[LIghtJUNction]

Fixes #216. Refs #221, #219, #80, #85.

A single instance can now serve explicitly allowlisted domain aliases while keeping its original signing authority, certificates, receipts, advertised links and client identity directory. Both ordinary HTTP and the PostgreSQL read-only hosting runtime validate exact Host/port syntax and the allowlist; browser platform Origin must match the selected ingress. Published static pages keep their existing CSP isolation.

Clients select the network destination with --endpoint, or SSH-style HostName plus ServiceURL, while signing for --server. All four operation transports, OAuth and signed previews use the selected endpoint, require the original discovery authority and refuse redirects. Secret-delivery checks use the actual endpoint. Backup/restore retains the alias policy and existing quarantine/configuration-proof behavior.

IdentityFile and primary identity keys share an owned, private, bounded, nonblocking no-follow reader. Unsafe modes, symlinks, FIFOs, directories and hardlinks are rejected; invocation keys are checked before client state/network initialization. Recovery CI now installs the sandbox required by doctor. Existing CLI, composition and homepage regressions use the current explicit service, OperationSpec and branding contracts while retaining their behavioral/security assertions.

Validation on head 8b4c2cd, test merge df21c18, tree 34a1e3dd310a58ee1e80bd023347867fe479733a:

• All 14 cloud workflows passed on this head.
• Complete eight-shard run: 2,960 tests plus 8 conformance cases; installable wheel/sdist built and checked. All eight ZIP digests were verified and scripts/ci_shards.py check 8 independently confirmed the exact non-overlapping node-ID union, with no failures, errors or skips.
• Focused alias/identity/configuration and regression contracts: 122 passed. Its source manifest records the head, test merge and tree above.
• Installed-package rehearsal: real daemon lifecycle and recovery, four transports, 42 official selftest checks, 7 real OpenSSH checks and minimal client installation passed; source/tree and artifact digest verified.
• Recovery, hosting, credential, storage, architecture, client, subject-view and integration workflows passed. Local Ruff check/format and diff checks passed; project runtime validation ran in cloud CI.

Server/client and TLS/proxy examples are in docs/SERVICE_ALIASES.md and docs/CLIENT_CONNECTIONS.md. DNS, TLS, proxy configuration and production rollout remain separate operator steps. Broader acceptance issues retain their existing evidence requirements.

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.