deploy: bind demo company to published tenant-path release

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/vergabe-demo-company-binding.md

@@ -1,22 +1,22 @@
 # Vergabe demo-company deployment binding
 
 Prepared 2026-09-11 under RAPPS-WP-0014-T02 and VERGABE-WP-0019-T03/T04.
-This is an execution packet; native tenant creation and deployment are pending.
+Native tenant creation is verified; application placement and onboarding remain pending.
 
 | Item | Binding / execution status |
 | --- | --- |
-| Tenant | `tenant:trial:demo-company`; display `demo-company`; native creation pending |
+| Tenant | `tenant:trial:demo-company`; display `demo-company`; active, version 1; native operator create/readback verified |
 | Purpose / data | New demo workspace; synthetic data only; no existing data import |
 | Initial accounts | `demo-user1`, `demo-user2`, ordinary members; creation and private credential setup pending |
 | Operator / acceptance | Bernd Worsch via authenticated existing operator path |
 | Cluster | Railiance01, kube-system UID `a553c742-0115-43d4-99a4-a5ca56fe0786` |
 | Proposed namespace | `vergabe-demo-company`; create separately from historical installations |
 | Helm release | `vergabe-teilnahme` within that namespace |
-| Image source | `ccb6d1f8c7abd50f2ef654491bb1aa5861e795cb`; live CI 29 / publication 31 passed |
+| Image source | Tenant-path source `9345a1bb1a92ac0ee3b2dc6443a3d299e6754e70`; CI smoke 43 / publication 44 passed |
-| Image digest | `forgejo.coulomb.social/coulomb/vergabe-teilnahme@sha256:963240ef4180a01e5b8af7fbeb88be27e56203a45da8ecd633326b4c6d262005` |
+| Image digest | `forgejo.coulomb.social/coulomb/vergabe-teilnahme@sha256:cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68` |
 | Chart baseline | 0.2.0 at railiance-apps `9491744e5adab4464070c164d7172a7392ae1e15` |
 | Resources | One Recreate replica, CPU request 60m / limit 1000m, memory request 256Mi / limit 1Gi |
-| Proposed URL | `https://demo-vergabe.coulomb.social`; user preference pending |
+| Selected URL | `https://vergabe-teilnahme.coulomb.social/demo-company/`; one product host, exact tenant path |
 | Public edge | DNS, TLS and login abuse-control configuration pending; expected target 92.205.62.239 |
 | Proposed database / role | Fresh `vergabe_demo_company` / `vergabe_demo_company` on `databases/apps-pg`; platform provisioning/custody pending |
 | Runtime Secret | `vergabe-demo-env` in the dedicated namespace; platform delivery pending, no secret values in this packet |
@@ -34,7 +34,11 @@ Its `/login` uses KeyCape and the registered native callback. The authenticated
 platform form creates `tenant:trial:demo-company` through Tenant Engine. Record
 the response and read back the exact tenant before creating memberships. Do not
 substitute a service actor, fabricate verified claims, or bypass policy on denial.
-An operator browser has been opened; native login/creation is not yet confirmed.
+Native login and operator creation succeeded at 19:03:18 UTC. Tenant Engine
+confirms demo-company active/version 1; User Engine contains the first
+administrator with invited status. A subsequent Create login fails with an
+LLDAP service-login 401. NK-WP-0036-T04 owns the attended credential-reference
+repair; no directory identity is inferred from the user-domain record.
 
 Create two ordinary memberships through User Engine. Confirm how the identity
 provisioner assigns login names before provisioning the requested demo names;
@@ -45,14 +49,18 @@ This establishes a platform tenant and a bounded app pilot, not completed SSO.
 
 ## Hostname and deployment execution
 
-`helm/vergabe-demo-company-values.proposed.yaml` pins the published image and
+`helm/vergabe-demo-company-values.proposed.yaml` retains 60m resources and the
-60m resources, and consistently uses the proposed host for Django and probes.
+selected product host, APP_BASE_PATH=/demo-company and published immutable
-The chart does not itself create public ingress or DNS. Confirm the preferred
+digest. The chart does not create ingress or DNS.
-hostname, point its DNS to Railiance01 through the DNS owner, configure the
+The edge must match exactly /demo-company or /demo-company/, canonicalize the
-HTTPS route and abuse control through the existing edge lane, and verify TLS.
+bare path and strip the prefix. It must keep private media on the app route and
-On 2026-09-11 the proposed hostname resolved to 80.158.43.29; the legacy
+apply TLS and the admitted abuse-control policy. Do not route neighboring paths
-`vergabe-teilnahme.whywhynot.de` resolved to 92.205.130.254. Neither was the
+to this instance. Company/data separation remains the dedicated database and
-intended Railiance01 address. No DNS changes have been made.
+volumes, not a forwarded header or browser path.
+
+On 2026-09-11 the selected product hostname resolves to 80.158.43.29; Railiance01
+is 92.205.62.239. No DNS changes have been made. A single product DNS/certificate
+serves this arrangement; tenants do not need their own subdomains.
 
 Complete platform database/Secret provisioning and the source-backed namespace,
 network and public edge manifests before deployment. Then migrate the fresh

docs/vergabe-teilnahme-pilot.md

@@ -140,3 +140,13 @@ database/backup metadata; no customer data was read, selected for reuse or
 modified. The user subsequently selected a new demo-company workspace; the
 prepared binding explicitly uses a fresh database and leaves historical data
 untouched.
+
+
+2026-09-11 update: the selected customer URL is
+https://vergabe-teilnahme.coulomb.social/demo-company/. Native demo-company
+creation and first-administrator registration are verified. Identity login
+provisioning currently fails its LLDAP service authentication, tracked by
+NK-WP-0036-T04. Tenant-path application source 9345a1b passes 98 tests and seven
+local browser checks; image publication 44 passed with digest
+sha256:cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68.
+Live edge/data admission remains open. See the updated demo-company binding for execution status.

helm/vergabe-demo-company-values.proposed.yaml

@@ -1,10 +1,10 @@
 # Proposed binding only; see docs/vergabe-demo-company-binding.md.
-# Native tenant, database/Secret, DNS/TLS and edge admission are still pending.
+# Tenant and published image are verified; database/Secret and DNS/TLS admission are pending.
 # Release vergabe-teilnahme; namespace vergabe-demo-company.
 pilot:
   enabled: true
 image:
-  digest: sha256:963240ef4180a01e5b8af7fbeb88be27e56203a45da8ecd633326b4c6d262005
+  digest: sha256:cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68
 replicaCount: 1
 resources:
   requests:
@@ -15,11 +15,12 @@ resources:
     memory: 1Gi
 envSecretName: vergabe-demo-env
 env:
+  APP_BASE_PATH: /demo-company
   DJANGO_SETTINGS_MODULE: vergabe_teilnahme.settings.prod
-  ALLOWED_HOSTS: demo-vergabe.coulomb.social,localhost
+  ALLOWED_HOSTS: vergabe-teilnahme.coulomb.social,localhost
-  CSRF_TRUSTED_ORIGINS: https://demo-vergabe.coulomb.social
+  CSRF_TRUSTED_ORIGINS: https://vergabe-teilnahme.coulomb.social
 probes:
-  hostHeader: demo-vergabe.coulomb.social
+  hostHeader: vergabe-teilnahme.coulomb.social
 persistence:
   media:
     enabled: true

workplans/RAPPS-WP-0014-vergabe-invited-pilot.md

@@ -39,7 +39,7 @@ values template prepare the deployment; no live resources were changed.
 id: RAPPS-WP-0014-T02
 status: progress
 needs_human: true
-intervention_note: "Company and fresh data are selected. Await native User Engine operator login for demo-company creation; proposed hostname preference and DNS/TLS setup remain open. No new approval for the accepted 60m prototype is needed."
+intervention_note: "Native demo-company exists; product host/path is selected. Identity-provisioner LLDAP login returns 401 after credential reload; NK-WP-0036-T04 holds attended consumer credential reconciliation. DNS/TLS, new database/Secret, app deployment and ordinary demo accounts remain. No new approval for the 60m prototype is needed."
 priority: high
 assignee: the-custodian
 state_hub_task_id: "b00958c8-1401-5ebf-bc22-c0252618d897"
@@ -80,18 +80,31 @@ limiter. Keep `/media/` behind the app gate.
 The user requests a new `demo-company` tenant with `demo-user1`, etc. Apply
 NetKingdom ADR-0013 as `tenant:trial:demo-company` and start with two ordinary
 demo users. Fresh data is selected; no historical customer import is authorized.
-The exact prepared namespace/database/release and proposed hostname are in
+The prepared namespace/database/release and current execution status are in
 `docs/vergabe-demo-company-binding.md` and
-`helm/vergabe-demo-company-values.proposed.yaml`. The suggested hostname is
+`helm/vergabe-demo-company-values.proposed.yaml`. The user chose
-`demo-vergabe.coulomb.social`; user preference is pending. Its observed DNS
+`https://vergabe-teilnahme.coulomb.social/demo-company`. DNS/TLS is per product
-target is not Railiance01 and must be corrected through the edge owner.
+host; the exact company prefix selects its isolated application instance.
+The chosen hostname currently resolves to 80.158.43.29 and needs the admitted
+Railiance01 route (92.205.62.239) through the edge owner.
 
-Tenant Engine creation must use the authenticated User Engine operator portal.
+Native operator authentication as platform-root succeeded. At 19:03:18 UTC the
-An isolated native KeyCape login window has been opened; operator login,
+operator created demo-company through the native User Engine form; Tenant
-tenant creation/readback, memberships and app account provisioning are not yet
+Engine readback confirms active, version 1. The chosen first administrator is
-confirmed. Do not substitute a trusted service actor to bypass a denial.
+present with invited status. A subsequent user was created, but Create login
-Platform registration does not add SSO to the Django pilot. Continue execution
+fails in identity-provisioner at the LLDAP admin authentication step, before
-on T02; company/data choice is no longer missing input.
+directory mutation. Reloading the existing credential reference preserves this
+401. NK-WP-0036-T04 owns the prepared attended consumer-only reconciliation;
+T05 retains the functional dependency preflight/error-reporting improvement.
+No provider password has been changed, and no failed login create was replayed.
+
+Vergabe source 9345a1b supports APP_BASE_PATH=/demo-company, prefix-aware URL
+reversing and cookie scope. All 98 application tests, Vite build and seven
+local Chromium path/edge checks pass. CI smoke 43 and publication 44 passed; the proposed values now pin
+sha256:cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68
+and APP_BASE_PATH=/demo-company. The previous root-path image is superseded. Ordinary demo memberships and
+Django accounts remain separate from platform tenant existence. No product SSO
+is claimed. The selected URL and successful tenant creation are resolved inputs.
 
 ## Demonstrate restart, isolated restore, rollback and operating ownership