Published on AWS · 12 August 2026

From handoff
to AWS.

A public, sanitized dialogue about turning a publishing handoff into a durable AWS path — then using that path to publish the dialogue itself.

Anonymous HTTPS Restricted publisher Rollback-ready release

The dialogue

A precise request, completed in public.

The exchange below preserves the intent and sequence of the visible user–assistant conversation. Sensitive infrastructure identifiers and internal execution details are deliberately omitted.

User handoff

“This is everything you need to learn how to publish on AWS. Finish it and make sure you can publish automatically on AWS and the credentials are long lived.”

User constraint

“Read this file and do exactly what this file does. Nothing else. Do not improvise.” The user allowed only desktop-specific path corrections and automatic retrieval of missing dependencies.

Codex inspection

The handoff was audited, its single installer entrypoint was identified, and its completion contract was preserved: verify the intended AWS identity, verify restricted SSH publishing, install the plugin, and finish only when the installer reports readiness.

User authorization

“The page is opening in Chrome with AWS root logged in. We can do it. Try it.”

Codex secure setup

A dedicated long-lived IAM credential was created and routed through Windows Credential Manager rather than plaintext files. A distinct machine-specific SSH key was generated with restricted local permissions, and only its public half was registered on the existing AWS host.

User status

“Almost done. How many steps left?”

Codex completion

The remaining path was made explicit: register the public key, prove non-interactive SSH, rerun the original installer to its exact readiness state, and start a new Codex task so the plugin could load.

Codex verified result

The AWS identity check passed, restricted SSH accepted the deploy key, the plugin validated, and a fresh task confirmed that both publishing and provisioning skills were available. No secret was displayed or stored in plaintext.

User recursive request

“Publish this dialogue on falconshire.com using AWS and explain your path.”

Publication note. This page excludes system prompts, internal tool logs, access keys, private keys, account identifiers, local file paths, source network addresses, and console-session links. The omissions protect the publishing path without changing the substance of the dialogue.

The AWS path

A narrow route from local file to public HTTPS.

The site is a static bundle. It moves through a restricted publisher into an immutable release on the existing AWS host, then becomes live through an atomic switch.

  1. Build locally

    One self-contained HTML document, no external scripts, fonts, trackers, or credential-bearing files.

  2. Preflight the bundle

    Validate the project contract, file types, required paths, origins, and deploy-safe archive contents.

  3. Publish narrowly

    Upload over pinned-host SSH using the restricted deploy account and invoke only the root-owned publisher.

  4. Switch atomically

    Create an immutable release, validate the web-server configuration, switch the live pointer, and retain rollback history.

Acceptance contract

  • DNS resolves directly to the configured AWS static IPv4.
  • The certificate matches the final falconshire.com hostname.
  • The root page and all critical same-origin assets return successful responses.
  • A fresh signed-out browser renders the page at desktop and mobile widths.
  • An independent external fetch reaches the same public HTTPS page.
  • A failed acceptance check triggers immediate rollback.

Readiness gate

Automation became a verified capability.

READY: long-lived AWS static-site publishing is available to new Codex tasks.