docs(T07): settle the approver origin as decisions.coulomb.social

The operator assigned decisions.coulomb.social, not the decide.coulomb.social
this workplan proposed. Redirect URIs match byte-exactly at /authorize, so the
proposal is corrected in place rather than reconciled after submission — a
one-character miss presents as a rejected approval, not as a registration
defect.

DNS resolves. The Ingress and certificate are written in railiance-apps
(manifests/informed-decision-ingress.yaml, dry-run clean) but not applied, so
T07 stays progress: DNS alone is not an origin, and a host that does not answer
over TLS fails the same way a wrong hostname does, only later.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EJbh7o7UWF4tQ5jxygnNGu

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2072522@bnt-lap001
Assistant-Session: 46173adf-7302-4ede-99d6-963b61359928

docs/keycape-client-registration.md

@@ -28,25 +28,34 @@ That component is this repository. These are the two strings.
 | Field | Value |
 | --- | --- |
 | `client_id` | `informed-decision-approver` |
-| Redirect URI | `https://<origin>/auth/callback` |
+| Redirect URI | `https://decisions.coulomb.social/auth/callback` |
 
 **`client_id` is fixed and stable.** It will not change.
 
-**The origin is the one outstanding input.** Redirects match exactly at
+**The origin is settled.** 2026-09-10: the operator assigned
-`/authorize`, so a near-miss fails closed — which is precisely why
+`decisions.coulomb.social` to this surface. It is not the
-`approval-engine` refused to guess and why this document is not yet submitted.
+`decide.coulomb.social` this document proposed — the assigned name is the one
+that counts, and it is recorded here rather than the proposal, because
+redirects match exactly at `/authorize` and a near-miss fails closed. That
+exactness is why `approval-engine` refused to guess in the first place, and it
+is the reason the proposed name is corrected here before submission rather
+than reconciled afterwards.
 
-- **Proposed:** `decide.coulomb.social`, giving
+- **Assigned:** `decisions.coulomb.social`, giving
-  `https://decide.coulomb.social/auth/callback`.
+  `https://decisions.coulomb.social/auth/callback`.
 - **Consistent with** the estate's existing pattern (`forgejo.coulomb.social`,
   `hub.coulomb.social`, `kc.coulomb.social`), Traefik `ingressClassName`, TLS
   secret per host.
-- **Requires, in `railiance-apps` rather than here:** a DNS A record for
+- **DNS resolves** to the cluster address as of 2026-09-10.
-  `decide.coulomb.social`, an Ingress manifest, and a certificate.
+- **Still requires, in `railiance-apps` rather than here:** an Ingress manifest
+  and an issued certificate. Manifest written 2026-09-10
+  (`manifests/informed-decision-ingress.yaml`); not yet applied.
 
-**This document is submitted to `key-cape` when that origin resolves — not
+**This document is submitted to `key-cape` once the host answers over TLS — not
-before.** The path component `/auth/callback` is fixed now so only the host
+before.** DNS alone is not the origin; an origin that does not complete a TLS
-remains variable.
+handshake fails the same way a wrong hostname does, only later. The path
+component `/auth/callback` was fixed ahead of the host, so nothing else in this
+registration moves.
 
 ---
 
@@ -163,6 +172,6 @@ while it stands.
 
 | # | Item | Owner |
 | --- | --- | --- |
-| 1 | DNS A record + Ingress + TLS for the chosen origin | `railiance-apps` / deployment |
+| 1 | ~~DNS A record~~ (done 2026-09-10) + Ingress + TLS for `decisions.coulomb.social` | `railiance-apps` / deployment |
 | 2 | Submit this document to `key-cape`, closing `KEY-WP-0013-T02` | this repo, once 1 lands |
 | 3 | Prove a token issued against the registration is accepted by `approval-engine` | `T08` |

workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md

@@ -380,13 +380,26 @@ not be declared unless we are prepared to say so in the record. We are, and it
 is said there, along with the two consequences: the claim is stored with its
 provenance, and it is never used as the act-scope.
 
-**Not submitted, and the task stays `progress`.** The origin
+2026-09-10 — **origin assigned.** The operator assigned
-(`decide.coulomb.social` proposed, consistent with the estate's existing
+`decisions.coulomb.social`, not the `decide.coulomb.social` this workplan
-Traefik/TLS-per-host pattern) needs a DNS A record, an Ingress manifest and a
+proposed. `docs/keycape-client-registration.md` §2 is corrected to the assigned
-certificate — work in `railiance-apps`, not here. Submitting a redirect for a
+name; the proposal is not preserved anywhere a reader could mistake it for the
-host that does not resolve is the exact failure `approval-engine` avoided by
+registration, because a redirect URI that is one character off fails closed at
-refusing to invent these strings in the first place, and choosing a plausible
+`/authorize` and presents as a rejected login rather than a registration
-hostname is not the same as owning one.
+defect. DNS resolves to the cluster address.
+
+**Still not submitted, and the task stays `progress`.** What remains is the
+Ingress manifest and an issued certificate — work in `railiance-apps`, not
+here. The manifest is written there
+(`manifests/informed-decision-ingress.yaml`, dry-run clean) but deliberately
+not applied. DNS alone is not an origin: a host that resolves but does not
+complete a TLS handshake fails the same way a wrong hostname does, only later
+and less legibly. Submitting before the host actually answers would be the
+same failure `approval-engine` avoided by refusing to invent these strings —
+owning a name is not the same as the name working.
+
+Superseded context: the origin was previously the sole blocker in its
+unowned form — choosing a plausible hostname is not the same as owning one.
 
 Superseded context: 2026-09-09: blocked on `INFD-IN-0002`. `key-cape` found that a human access
 token cannot carry `tenant:platform` today — the tenant claim resolves from a