HTTPS DEPLOYMENT CHECKLIST

1. CloudFront distribution:
   [ ] Alternate domain name includes 8k.art
   [ ] Valid ACM certificate covers 8k.art
   [ ] Default behavior Viewer protocol policy = Redirect HTTP to HTTPS
   [ ] /beta/* Viewer protocol policy = Redirect HTTP to HTTPS
   [ ] /beta/_daily-builds/* Viewer protocol policy = Redirect HTTP to HTTPS
   [ ] Every directory-browser behavior uses Redirect HTTP to HTTPS

2. DNS:
   [ ] 8k.art points only to intended CloudFront distribution
   [ ] no public DNS points canonical traffic to S3 website endpoint

3. Source:
   [ ] directory browser emits no absolute http:// links
   [ ] same-host links are root-relative where possible
   [ ] index.mjs contains enforceHttpsCanonicalizationV097

4. Headers:
   [ ] response headers policy adds Strict-Transport-Security after HTTPS is verified
   [ ] do not enable HSTS preload until all subdomains are audited

5. Test:
   [ ] http://8k.art/beta/ returns 301 or 307/308 to https://8k.art/beta/
   [ ] http://8k.art/beta/_daily-builds/ returns HTTPS redirect
   [ ] copied directory links are https:// or root-relative
   [ ] Chrome does not show the insecure-site interstitial