P06 — Custom Domains

[Techshrr]

P06 — Custom Domains

Parent tracker: #1
Base integration commit: ed82747f9f7ddb7696534cdda110f2f7f594b46a (merged P05)

Status

IN PROGRESS — ENTRY CONDITIONS SATISFIED

Goal

Implement the GoJet V10 Custom Domains authority model: CAP-DOMAIN-ENTITLEMENT, ownership verification, DNS/HTTPS/domain-risk axes, periodic revalidation and fail-closed custom-host routing enforcement.

Entry conditions

• P05 destination-risk parity and custom-host checkpoint are proven in the current repository
• P00 entitlement schema / permission contract is approved
• P01 migration, API and concurrency-test harness is available
• P05 signed and merged at ed82747f9f7ddb7696534cdda110f2f7f594b46a
• P06 does not depend on unexecuted P13/P14/P17 deliverables

Specification authority

• Master Plan GJ-V10-MP-GREENFIELD-2026-08-20 — P06
• Page-Level IA GJ-V10-IA-GREENFIELD-2026-08-20 — APP-DOMAINS, APP-DOMAIN-NEW, APP-DOMAIN-DETAIL, §§9 and 11
• Design System GJ-V10-DS-GREENFIELD-2026-08-20 — domain/trust state semantics and all exact visual values

In scope

• structured custom-domain entitlement store and resolver
• entitlement source none | plan | manual_approval
• entitlement status requested | active | suspended | expired | revoked, with derived seven-calendar-day grace_period where applicable
• active business plan automatic entitlement from structured server data
• manual_approval core API with required reason, validity window and existing support-ticket reference
• coexistence of valid plan and manual-approval sources without weakening security state
• atomic domain_limit enforcement under concurrency
• server-authoritative direct-API and crafted-client denial
• hostname normalization and cross-Workspace ownership/conflict policy without tenant disclosure
• DNS TXT ownership secret/hash lifecycle and rotation
• ingress DNS target validation
• HTTPS readiness / active state
• independent domain-risk decision axis
• periodic revalidation and history
• immediate suspension for abuse/fraud/ownership loss/security conditions; no grace for these cases
• normal plan downgrade seven-calendar-day grace for existing active domains only
• entitlement enforcement for create/verify/activate/restore/rotate/new-link-assignment checkpoints
• redirect-time enforcement for custom hosts
• no silent fallback from an unavailable custom host to an official GoJet short host
• official/custom hostname destination-risk parity for primary, routing and A/B reachable targets
• Workspace /app/domains, /app/domains/new, /app/domains/{domainId} flows and applicable states
• Add Domain wizard axes:
  1. Entitlement preflight
  2. Hostname normalization/conflict check
  3. DNS TXT ownership
  4. DNS ingress target
  5. HTTPS readiness
  6. Domain risk decision
  7. Ready for links

Authority / correctness invariants

• support ticket creation is a request only; it MUST NOT create or imply active entitlement
• public plan feature text / feature JSON / frontend controls are never entitlement authority
• only a valid structured plan source or recorded manual approval can resolve active entitlement
• inactive entitlement rejects POST /api/workspaces/{id}/domains before any domain row or ownership token is created
• domain_limit is enforced atomically; concurrent calls cannot over-allocate
• deep-link /app/domains/new requires Workspace manage permission + active entitlement + remaining limit and MUST NOT mount/prefill the wizard when denied
• verification/activation/restoration/rotation require current entitlement and ownership; denial cannot advance an axis
• custom-domain link assignment requires current entitlement/authorization + ownership verified + ingress DNS valid + HTTPS active + domain risk allow
• redirect resolution requires current entitlement/grace policy + domain trust + current target-fingerprint allow
• ownership, DNS, HTTPS, risk and entitlement remain separate authoritative axes; no single collapsed verified boolean may substitute for them
• cross-tenant hostname conflicts must not reveal the other Workspace or provider evidence
• all denial responses use allowlisted codes, correlation IDs and safe remediation

Workspace state contract

APP-DOMAINS must represent at least: locked, requested, active-empty, active-list, verification, grace_period, suspended, expired, revoked, partial-axis.

APP-DOMAIN-NEW must represent at least: entitlement-denied, input, conflict, ownership-pending, DNS-invalid, HTTPS-error, risk-review, ready, error.

APP-DOMAIN-DETAIL must represent at least: loading, verification, ready, ownership-failed, DNS-invalid, HTTPS-error, risk-review, grace_period, suspended, revoked.

Persistent domain/security failures must remain visible in-page/Attention surfaces; Toast is not the sole carrier of persistent state.

Excluded / later-owned work

• P14 owns the full custom-domain request UX/mail workflow; P06 only establishes the core authority/API contract and may bind an existing support-ticket reference
• P17 owns the administrator entitlement queue/UI; it must consume, not redefine, the P06 authority model
• P13 owns the full billing/subscription product; P06 may use the already-approved structured entitlement seam and test fixtures but must not implement P13
• P16 owns the full destination/domain risk provider and abuse administration product; P06 implements the domain-risk axis interface/state/enforcement required for this node, without pre-implementing the provider/admin product
• no support reply, frontend button or feature JSON may directly authorize custom domains
• no production Docker/Node runtime

Deliverables

• frozen P06 test-plan.json before implementation proceeds beyond contracts
• entitlement data model/store/resolver and source/status precedence
• manual-approval core API contract
• atomic domain-limit enforcement
• domain DB/migration/state machine
• ownership TXT secret/hash and rotation contract
• ingress DNS verification contract
• HTTPS readiness contract
• domain-risk axis contract
• periodic revalidation/history contract
• API create/detail/verify/revalidate/restore/rotate/remove lifecycle
• redirectengine custom-host enforcement
• Link assignment guard against non-ready custom domains
• Workspace Domains list/new/detail route-backed flows
• entitlement/grace/suspended/revoked/partial-axis UI states
• real API/MySQL/DNS/TLS/browser/audit evidence
• P06 validator / CI
• G3/G4/G5/G6 P06-owned evidence
• P00-P05 regression matrix on final exact head

Required tests

• no-entitlement direct API and crafted-client create is rejected without creating domain/token state
• requested support ticket without independent approval remains denied
• active business plan resolves plan entitlement and positive enforced domain limit
• manual approval resolves independently with required reason/start/expiry/ticket reference
• plan/manual valid-source coexistence follows authority rules
• concurrent domain creation cannot exceed domain_limit
• cross-tenant hostname conflict is enforced without tenant disclosure
• TXT ownership success/failure/rotation behavior
• ingress DNS valid/invalid/drift behavior
• HTTPS pending/error/active behavior
• domain-risk allow/review/block/stale/missing behavior as applicable
• normal downgrade denies new mutations immediately while preserving exactly seven calendar days for existing active domains
• grace deadline transitions to expired absent another valid source
• abuse/fraud/ownership loss/security suspension is immediate with no grace
• entitlement suspension/revocation cannot be bypassed by UI, crafted API, restore/rotate or new link assignment
• custom-domain link assignment requires all authoritative axes ready
• custom-host redirect fails closed when entitlement/trust/risk is not current and never falls back to an official host
• official/custom primary/routing/A-B destination-risk parity remains intact
• Workspace locked/requested/active/grace/suspended/expired/revoked/partial-axis browser states
• mobile flow has no root overflow/clipped required text and applicable keyboard/name-role-value contracts pass
• audit/revalidation correlation is reviewable

Evidence

P06 root: artifacts/v10/P06/

Required evidence includes request/response records, MySQL state, entitlement resolution, audit records, DNS/TLS observations, redirect records and browser captures. Unit tests or mocked DNS/TLS alone cannot satisfy the P06 Exit Conditions where a real integration harness can provide deterministic local authoritative evidence.

Exit conditions

P06 exits only when all custom-domain entitlement/ownership/DNS/HTTPS/risk checkpoints are server-enforced, redirect-time behavior is fail closed, official/custom destination-risk parity remains proven, required tests pass with reviewable current-repository evidence, accountable technical review is signed, P0/P1 defects are zero, DECISION REQUIRED is zero, and the signed exact head passes P00-P06 plus all affected Gate regressions.

[Techshrr]

P06 completed and integrated.

• PR: P06: implement Custom Domains authority model #19 — squash merged
• Signed source revision: 4079d1ee7c4876cab3e6bccccc3e4ac62cf97f23
• Main integration SHA: 3aa80b566d144963130b8f61fa63a4ee677ebc99
• Signed-head P00/P01/P02/P03/P04/P05 Domain/P05 Integration/P05 Browser/P05 Closure/P06 Contract/P06 Integration/P06 Browser/P06 Closure: all SUCCESS
• P06-T001..P06-T024: PASS on the signed exact head; T024 bound 23/23 evidence inputs and 12/12 required regression workflows to the signed SHA
• Final P06 Closure run: 32519298309
• Closure artifact: 9460016077 — sha256:21e2fe5898a047e166aac520870070e8072f00885a3c89aaf86736f6ac22a2c8
• Accountable technical review: Backend Lead / QA Lead / Frontend Lead / Accessibility Reviewer / Security Reviewer — APPROVED
• P0 defects: 0; P1 defects: 0; DECISION REQUIRED: 0
• Final review record: artifacts/v10/P06/review.md

P06 is now integrated into main. The next active development node is P07 — Analytics, based on main integration commit 3aa80b566d144963130b8f61fa63a4ee677ebc99.