Both fired on a healthy production cutover and told the operator to roll
back, which is worse than not checking at all.
- The DNS check looked for a CNAME on www. Once the custom domain is
attached the record is PROXIED, so it answers with Cloudflare anycast A
records and exposes no CNAME — the empty result was the correct state
being reported as "unexpected target". Now it asserts what actually
matters: the host resolves, and it does not still CNAME to Vercel. The
authoritative on-Cloudflare signal was already the cf-ray/x-vercel-id
pair right below it.
- HSTS absence was a hard FAIL. It is an independent one-toggle choice with
no bearing on whether the migration worked, so it is a WARN unless
EXPECT_HSTS=1. Set that once the zone toggle is on and it becomes a hard
assertion again.
Verified against the real cutover: 21 probes, 20 pass, 1 warn (HSTS), 0 fail.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LAmkjM7okPdScp9XLW1JVr
c61ec8aa0c