sweep the escaped domain spelling; seed-release in-cluster API (#258, #263) #264

Merged

plat merged 1 commit from immune-fixes into main

2026-09-02 08:56:17 +00:00

plat commented

2026-09-02 06:33:01 +00:00

Owner

Two immune-system findings, one cycle.

rehome apex (gauntlet run 880, issue #258): render_front_door writes the apex redirectRegex with the domain regex-escaped (dom\.tld). The identity sweep only rewrote the plain spelling — the redirect regex kept the old domain, never matched, and the apex fell through to www as 200 (gate wants 301→www). The escaped spelling is part of the identity: the sweep now rewrites it first (proven non-doubling; same already-correct shield), and file selection greps both spellings fixed-string. Unit-tested across disjoint / prefix-overlap / subdomain-shield / flat shapes + idempotence.

seed-release (#263): has never succeeded — steps 2–3 called the public API base from the isolated pool, whose egress is in-cluster only. All API calls now use $REGISTRY; the public URL is print-only. workflow_dispatch added — after merge, a dispatch must land on the 409 idempotent path for seed-r873, proving the lane.

Two immune-system findings, one cycle. **rehome apex (gauntlet run 880, issue #258):** `render_front_door` writes the apex redirectRegex with the domain regex-escaped (`dom\.tld`). The identity sweep only rewrote the plain spelling — the redirect regex kept the old domain, never matched, and the apex fell through to www as 200 (gate wants 301→www). The escaped spelling is part of the identity: the sweep now rewrites it first (proven non-doubling; same already-correct shield), and file selection greps both spellings fixed-string. Unit-tested across disjoint / prefix-overlap / subdomain-shield / flat shapes + idempotence. **seed-release (#263):** has never succeeded — steps 2–3 called the public API base from the `isolated` pool, whose egress is in-cluster only. All API calls now use `$REGISTRY`; the public URL is print-only. `workflow_dispatch` added — after merge, a dispatch must land on the 409 idempotent path for seed-r873, proving the lane.

plat added 1 commit

2026-09-02 06:33:01 +00:00

sweep the escaped spelling too; seed-release calls the forge in-cluster

guard-ppt / no-ppt (pull_request) Successful in 19s

Details

guard-ppt / no-ppt (push) Successful in 19s

Details

coldstart / coldstart (pull_request) Successful in 17m18s

Details

f12b6d2a7c

rewrite_identity_domain: the domain's regex-escaped spelling (apex
redirectRegex) is part of the identity — rewrite it first, same shield,
and select files carrying either spelling (gauntlet run 880: rehome left
the old domain in the redirect regex; apex served 200 instead of 301).

seed-release: every firing since birth failed because steps 2-3 called
the PUBLIC api base from the isolated pool, whose egress is in-cluster
only. API calls now go through $REGISTRY; the public URL is print-only.
workflow_dispatch added so the fix is provable without a reseed (#263).

plat merged commit ff52f2306c into main

2026-09-02 08:56:17 +00:00

plat deleted branch immune-fixes

2026-09-02 08:56:18 +00:00

plat referenced this pull request from a commit

2026-09-02 08:56:20 +00:00

sweep the escaped domain spelling; seed-release in-cluster API (#258, #263) (#264)