decisions.coulomb.social answers 200 over an issued Let's Encrypt certificate as
of 2026-09-10 14:32 UTC. The condition this document set for its own submission
— a real origin rather than a plausible one — is met.
T07 stays progress: the remaining acceptance criteria are that the contract
actually reaches key-cape and that a token issued against the registration is
accepted by approval-engine's verifier, which cannot be shown until
approval-engine is deployed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EJbh7o7UWF4tQ5jxygnNGu
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2072522@bnt-lap001
Assistant-Session: 46173adf-7302-4ede-99d6-963b61359928
The operator assigned decisions.coulomb.social, not the decide.coulomb.social
this workplan proposed. Redirect URIs match byte-exactly at /authorize, so the
proposal is corrected in place rather than reconciled after submission — a
one-character miss presents as a rejected approval, not as a registration
defect.
DNS resolves. The Ingress and certificate are written in railiance-apps
(manifests/informed-decision-ingress.yaml, dry-run clean) but not applied, so
T07 stays progress: DNS alone is not an origin, and a host that does not answer
over TLS fails the same way a wrong hostname does, only later.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EJbh7o7UWF4tQ5jxygnNGu
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2072522@bnt-lap001
Assistant-Session: 46173adf-7302-4ede-99d6-963b61359928
Everything except the host is now fixed: client_id informed-decision-approver,
callback path /auth/callback, authorization-code + S256 PKCE public client,
scopes [openid, approval:read, approval:approve], the expected token shape, and
the assurance shape cited from key-cape's contract rather than restated so it
cannot drift.
Section 5 declares the tenant provenance rather than assuming it. Nothing
populates domain.User.Tenant for approver users, so declaring tenant:platform
reaches the token by the gap route by construction rather than by accident.
GH-DEC-2026-013 was explicit that a tenant the directory does not carry must not
be declared unless we are prepared to say so in the record — so it is said,
with the two consequences: the claim is stored with its provenance, and it is
never used as the act-scope.
Deliberately NOT submitted. The origin needs a DNS A record, an Ingress manifest
and a certificate, which is work in railiance-apps rather than here.
decide.coulomb.social is proposed and consistent with the estate's existing
Traefik/TLS-per-host pattern, but proposing a plausible hostname is not the same
as owning one, and submitting a redirect for a host that does not resolve is the
exact failure approval-engine avoided by refusing to invent these strings.
T07 stays progress with the deployment dependency named and owned elsewhere.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3W1dQG7GFFM9d94jFx7iR
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1565372@bnt-lap001
Assistant-Session: 16bb2f25-b34c-49ef-8e94-5fec3567a568
