# REPORT — v0.312.0: every public name answers only over https (R-1033, P1, 2026-10-14 night)

Baseline `9b95e8e` (0.311.0). Design: felhom.eu `09` §3 decision 244 + the unattended decision recorded there (traefik on
the box, because the box keys cannot change Cloudflare zone settings). Evidence: felhom.eu
`documentation/audits/https-only-2026-10-14/`.

- `forwarded.yml`: `felhom-forwarded` = chain [`felhom-https-only` (redirectScheme https, 301), `felhom-forwarded-headers`
  (clean-up + HSTS 86400)]; catch-all router for unknown names over http. traefik.yml unchanged, no traefik restart.
- Tests red-proofed (three mutations, each seen failing). Green gate: build, vet, test all OK.
- Delivered by hand to Tester 1, demo-hp 9201 and demo-felhom 9201 for the proof (Tier 0). **Not vouched, floor not
  moved** — the operator's morning step.