diff --git a/docs/keycape-client-registration.md b/docs/keycape-client-registration.md index 95625bf..7f0902e 100644 --- a/docs/keycape-client-registration.md +++ b/docs/keycape-client-registration.md @@ -28,25 +28,34 @@ That component is this repository. These are the two strings. | Field | Value | | --- | --- | | `client_id` | `informed-decision-approver` | -| Redirect URI | `https:///auth/callback` | +| Redirect URI | `https://decisions.coulomb.social/auth/callback` | **`client_id` is fixed and stable.** It will not change. -**The origin is the one outstanding input.** Redirects match exactly at -`/authorize`, so a near-miss fails closed — which is precisely why -`approval-engine` refused to guess and why this document is not yet submitted. +**The origin is settled.** 2026-09-10: the operator assigned +`decisions.coulomb.social` to this surface. It is not the +`decide.coulomb.social` this document proposed — the assigned name is the one +that counts, and it is recorded here rather than the proposal, because +redirects match exactly at `/authorize` and a near-miss fails closed. That +exactness is why `approval-engine` refused to guess in the first place, and it +is the reason the proposed name is corrected here before submission rather +than reconciled afterwards. -- **Proposed:** `decide.coulomb.social`, giving - `https://decide.coulomb.social/auth/callback`. +- **Assigned:** `decisions.coulomb.social`, giving + `https://decisions.coulomb.social/auth/callback`. - **Consistent with** the estate's existing pattern (`forgejo.coulomb.social`, `hub.coulomb.social`, `kc.coulomb.social`), Traefik `ingressClassName`, TLS secret per host. -- **Requires, in `railiance-apps` rather than here:** a DNS A record for - `decide.coulomb.social`, an Ingress manifest, and a certificate. +- **DNS resolves** to the cluster address as of 2026-09-10. +- **Still requires, in `railiance-apps` rather than here:** an Ingress manifest + and an issued certificate. Manifest written 2026-09-10 + (`manifests/informed-decision-ingress.yaml`); not yet applied. -**This document is submitted to `key-cape` when that origin resolves — not -before.** The path component `/auth/callback` is fixed now so only the host -remains variable. +**This document is submitted to `key-cape` once the host answers over TLS — not +before.** DNS alone is not the origin; an origin that does not complete a TLS +handshake fails the same way a wrong hostname does, only later. The path +component `/auth/callback` was fixed ahead of the host, so nothing else in this +registration moves. --- @@ -163,6 +172,6 @@ while it stands. | # | Item | Owner | | --- | --- | --- | -| 1 | DNS A record + Ingress + TLS for the chosen origin | `railiance-apps` / deployment | +| 1 | ~~DNS A record~~ (done 2026-09-10) + Ingress + TLS for `decisions.coulomb.social` | `railiance-apps` / deployment | | 2 | Submit this document to `key-cape`, closing `KEY-WP-0013-T02` | this repo, once 1 lands | | 3 | Prove a token issued against the registration is accepted by `approval-engine` | `T08` | diff --git a/workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md b/workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md index aac8d68..88f1fb1 100644 --- a/workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md +++ b/workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md @@ -380,13 +380,26 @@ not be declared unless we are prepared to say so in the record. We are, and it is said there, along with the two consequences: the claim is stored with its provenance, and it is never used as the act-scope. -**Not submitted, and the task stays `progress`.** The origin -(`decide.coulomb.social` proposed, consistent with the estate's existing -Traefik/TLS-per-host pattern) needs a DNS A record, an Ingress manifest and a -certificate — work in `railiance-apps`, not here. Submitting a redirect for a -host that does not resolve is the exact failure `approval-engine` avoided by -refusing to invent these strings in the first place, and choosing a plausible -hostname is not the same as owning one. +2026-09-10 — **origin assigned.** The operator assigned +`decisions.coulomb.social`, not the `decide.coulomb.social` this workplan +proposed. `docs/keycape-client-registration.md` §2 is corrected to the assigned +name; the proposal is not preserved anywhere a reader could mistake it for the +registration, because a redirect URI that is one character off fails closed at +`/authorize` and presents as a rejected login rather than a registration +defect. DNS resolves to the cluster address. + +**Still not submitted, and the task stays `progress`.** What remains is the +Ingress manifest and an issued certificate — work in `railiance-apps`, not +here. The manifest is written there +(`manifests/informed-decision-ingress.yaml`, dry-run clean) but deliberately +not applied. DNS alone is not an origin: a host that resolves but does not +complete a TLS handshake fails the same way a wrong hostname does, only later +and less legibly. Submitting before the host actually answers would be the +same failure `approval-engine` avoided by refusing to invent these strings — +owning a name is not the same as the name working. + +Superseded context: the origin was previously the sole blocker in its +unowned form — choosing a plausible hostname is not the same as owning one. Superseded context: 2026-09-09: blocked on `INFD-IN-0002`. `key-cape` found that a human access token cannot carry `tenant:platform` today — the tenant claim resolves from a