hanzo-inc resolves to the KMS org it actually seals to

The owner -> KMS-org relation knew hanzoai, luxfi and zooai. hanzo-inc — pay
and the other company surfaces — fell through to the default branch and
became the literal owner, which is not a KMS org.

That was survivable by accident: the read takes its org from the TOKEN, so
the flat route still returned the right secret. What was wrong was the
fallback URL and, more expensively, every error message this step can print
— they named org=hanzo-inc, which sends whoever reads them looking for a
missing tenant rather than a missing credential.

One line, in the one place the comment above it already says this relation
belongs.

Co-authored-by: Hanzo Dev <dev@hanzo.ai>

.github/workflows/build.yml

@@ -73,7 +73,7 @@ on:
           A string sidesteps it on both planes with identical meaning, and the
           comparison is against 'false' rather than a truthiness test so that the
           expression callers already write — hanzoai/cloud's
-          `tests: ${{ github.ref_type != 'tag' }}`, which renders the strings
+          `tests:` set from `github.ref_type != 'tag'`, which renders the strings
           "true"/"false" — keeps working unchanged.
         type: string
         default: 'true'
@@ -375,6 +375,15 @@ jobs:
           if [ -z "$ORG" ]; then
             case "${{ github.repository_owner }}" in
               hanzoai) ORG=hanzo ;;
+              # hanzo-inc is the same TENANT as hanzoai — pay, commerce and the
+              # rest of the company surfaces bill and seal to KMS org `hanzo`.
+              # Without this line ORG fell through to the literal owner,
+              # "hanzo-inc", which is not a KMS org. That still LOOKED fine,
+              # because the read below takes its org from the TOKEN, not the URL
+              # — so the only things that were wrong were the fallback URL and
+              # every error message, which named an org that does not exist and
+              # sent the reader looking for a tenant instead of a credential.
+              hanzo-inc) ORG=hanzo ;;
               luxfi)   ORG=lux ;;
               zooai)   ORG=zoo ;;
               *)       ORG="${{ github.repository_owner }}" ;;
@@ -839,16 +848,72 @@ jobs:
         # unset) — so `go vet` dies with `could not read Username for github.com`.
         # Reuse the SAME token here for the runner's git (GIT_TOKEN, set by the
         # KMS step above; GH_PAT fallback). No-op when neither is present.
+        #
+        # AND OUR OWN MODULES RESOLVE FROM OUR OWN FORGE. A module path is a NAME,
+        # not an address: `github.com/<owner>/x` is what the package is called, and
+        # which host git dials for it is a separate decision. On a forge runner
+        # that decision is the forge — the forge is where the code canonically
+        # lives, and github.com is fed by a mirror that trails it, sometimes by
+        # hours and sometimes not at all.
+        #
+        # Measured, on the first run in which this step's gate had ever actually
+        # executed: hanzoai/cloud's go.mod carries `github.com/hanzoai/dashscopego
+        # v0.6.0` as an indirect dependency. git.hanzo.ai serves it; github.com
+        # answers `Repository not found`. So `go vet` died before a single test
+        # ran, on a module that was never missing. Its own caller already knew the
+        # answer — cloud's `containment` and `reach` jobs each make this exact
+        # substitution, with a comment about the nine consecutive releases an
+        # ACL drift on ONE sibling module once blocked — but the gate that runs
+        # its tests reached the modules through a different door.
+        #
+        # go.sum is what makes this safe rather than merely convenient: the forge
+        # serves the same objects, so the fetched zip hashes to the h1: line
+        # already committed. A forge serving different bytes fails the build
+        # loudly instead of shipping them.
+        #
+        # Longest prefix wins in git, so the owner-scoped forge rule outranks the
+        # bare github.com rule beneath it and every OTHER module still resolves
+        # from github.com. Both rules are optional and independent: no FORGE_TOKEN
+        # (or a github.com-hosted run, where the server IS github.com) leaves the
+        # old behaviour exactly as it was.
+        #
+        # SPLIT THE SERVER, do not strip a scheme you assumed. GITHUB_SERVER_URL
+        # on this fleet's runners is `http://hanzo-git.hanzo.svc` — the forge's
+        # in-cluster address, plain http — and a `${SERVER#https://}` that only
+        # knows the https spelling passes it through whole, producing
+        # `https://http://hanzo-git.hanzo.svc/...` and a git that resolves the host
+        # `http`. Take the scheme and the host as the two values they are, and
+        # compare the HOST against github.com so the guard cannot be fooled by a
+        # spelling either.
         if: inputs.mode != 'delegate' && hashFiles('go.mod') != ''
         env:
           GH_PAT: ${{ secrets.GH_PAT }}
+          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
+          OWNER: ${{ github.repository_owner }}
         run: |
           set -uo pipefail
-          TOKEN="${GIT_TOKEN:-${GH_PAT:-}}"
-          if [ -z "$TOKEN" ]; then echo "no git token — public modules only"; exit 0; fi
           CFG="$RUNNER_TEMP/gitconfig-go-test"; : > "$CFG"
-          GIT_CONFIG_GLOBAL="$CFG" git config --global \
-            url."https://x-access-token:${TOKEN}@github.com/".insteadOf "https://github.com/"
+          SERVER="${GITHUB_SERVER_URL:-https://github.com}"
+          SCHEME="${SERVER%%://*}"; HOST="${SERVER#*://}"; HOST="${HOST%/}"
+          wrote=0
+
+          if [ -n "${FORGE_TOKEN:-}" ] && [ "$HOST" != "github.com" ]; then
+            GIT_CONFIG_GLOBAL="$CFG" git config --global \
+              url."${SCHEME}://x:${FORGE_TOKEN}@${HOST}/${OWNER}/".insteadOf \
+              "https://github.com/${OWNER}/"
+            echo "${OWNER}/* modules resolve from ${SCHEME}://${HOST}"
+            wrote=1
+          fi
+
+          TOKEN="${GIT_TOKEN:-${GH_PAT:-}}"
+          if [ -n "$TOKEN" ]; then
+            GIT_CONFIG_GLOBAL="$CFG" git config --global \
+              url."https://x-access-token:${TOKEN}@github.com/".insteadOf "https://github.com/"
+            echo "github.com modules authenticated"
+            wrote=1
+          fi
+
+          [ "$wrote" = 1 ] || { echo "no git credential — public modules only"; exit 0; }
           { echo "GIT_CONFIG_GLOBAL=$CFG"; echo "GIT_CONFIG_NOSYSTEM=1"; } >> "$GITHUB_ENV"
           echo "runner git authenticated for private Go modules"
 

.hanzo/workflows/build.yml

@@ -73,7 +73,7 @@ on:
           A string sidesteps it on both planes with identical meaning, and the
           comparison is against 'false' rather than a truthiness test so that the
           expression callers already write — hanzoai/cloud's
-          `tests: ${{ github.ref_type != 'tag' }}`, which renders the strings
+          `tests:` set from `github.ref_type != 'tag'`, which renders the strings
           "true"/"false" — keeps working unchanged.
         type: string
         default: 'true'
@@ -375,6 +375,15 @@ jobs:
           if [ -z "$ORG" ]; then
             case "${{ github.repository_owner }}" in
               hanzoai) ORG=hanzo ;;
+              # hanzo-inc is the same TENANT as hanzoai — pay, commerce and the
+              # rest of the company surfaces bill and seal to KMS org `hanzo`.
+              # Without this line ORG fell through to the literal owner,
+              # "hanzo-inc", which is not a KMS org. That still LOOKED fine,
+              # because the read below takes its org from the TOKEN, not the URL
+              # — so the only things that were wrong were the fallback URL and
+              # every error message, which named an org that does not exist and
+              # sent the reader looking for a tenant instead of a credential.
+              hanzo-inc) ORG=hanzo ;;
               luxfi)   ORG=lux ;;
               zooai)   ORG=zoo ;;
               *)       ORG="${{ github.repository_owner }}" ;;
@@ -839,16 +848,72 @@ jobs:
         # unset) — so `go vet` dies with `could not read Username for github.com`.
         # Reuse the SAME token here for the runner's git (GIT_TOKEN, set by the
         # KMS step above; GH_PAT fallback). No-op when neither is present.
+        #
+        # AND OUR OWN MODULES RESOLVE FROM OUR OWN FORGE. A module path is a NAME,
+        # not an address: `github.com/<owner>/x` is what the package is called, and
+        # which host git dials for it is a separate decision. On a forge runner
+        # that decision is the forge — the forge is where the code canonically
+        # lives, and github.com is fed by a mirror that trails it, sometimes by
+        # hours and sometimes not at all.
+        #
+        # Measured, on the first run in which this step's gate had ever actually
+        # executed: hanzoai/cloud's go.mod carries `github.com/hanzoai/dashscopego
+        # v0.6.0` as an indirect dependency. git.hanzo.ai serves it; github.com
+        # answers `Repository not found`. So `go vet` died before a single test
+        # ran, on a module that was never missing. Its own caller already knew the
+        # answer — cloud's `containment` and `reach` jobs each make this exact
+        # substitution, with a comment about the nine consecutive releases an
+        # ACL drift on ONE sibling module once blocked — but the gate that runs
+        # its tests reached the modules through a different door.
+        #
+        # go.sum is what makes this safe rather than merely convenient: the forge
+        # serves the same objects, so the fetched zip hashes to the h1: line
+        # already committed. A forge serving different bytes fails the build
+        # loudly instead of shipping them.
+        #
+        # Longest prefix wins in git, so the owner-scoped forge rule outranks the
+        # bare github.com rule beneath it and every OTHER module still resolves
+        # from github.com. Both rules are optional and independent: no FORGE_TOKEN
+        # (or a github.com-hosted run, where the server IS github.com) leaves the
+        # old behaviour exactly as it was.
+        #
+        # SPLIT THE SERVER, do not strip a scheme you assumed. GITHUB_SERVER_URL
+        # on this fleet's runners is `http://hanzo-git.hanzo.svc` — the forge's
+        # in-cluster address, plain http — and a `${SERVER#https://}` that only
+        # knows the https spelling passes it through whole, producing
+        # `https://http://hanzo-git.hanzo.svc/...` and a git that resolves the host
+        # `http`. Take the scheme and the host as the two values they are, and
+        # compare the HOST against github.com so the guard cannot be fooled by a
+        # spelling either.
         if: inputs.mode != 'delegate' && hashFiles('go.mod') != ''
         env:
           GH_PAT: ${{ secrets.GH_PAT }}
+          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
+          OWNER: ${{ github.repository_owner }}
         run: |
           set -uo pipefail
-          TOKEN="${GIT_TOKEN:-${GH_PAT:-}}"
-          if [ -z "$TOKEN" ]; then echo "no git token — public modules only"; exit 0; fi
           CFG="$RUNNER_TEMP/gitconfig-go-test"; : > "$CFG"
-          GIT_CONFIG_GLOBAL="$CFG" git config --global \
-            url."https://x-access-token:${TOKEN}@github.com/".insteadOf "https://github.com/"
+          SERVER="${GITHUB_SERVER_URL:-https://github.com}"
+          SCHEME="${SERVER%%://*}"; HOST="${SERVER#*://}"; HOST="${HOST%/}"
+          wrote=0
+
+          if [ -n "${FORGE_TOKEN:-}" ] && [ "$HOST" != "github.com" ]; then
+            GIT_CONFIG_GLOBAL="$CFG" git config --global \
+              url."${SCHEME}://x:${FORGE_TOKEN}@${HOST}/${OWNER}/".insteadOf \
+              "https://github.com/${OWNER}/"
+            echo "${OWNER}/* modules resolve from ${SCHEME}://${HOST}"
+            wrote=1
+          fi
+
+          TOKEN="${GIT_TOKEN:-${GH_PAT:-}}"
+          if [ -n "$TOKEN" ]; then
+            GIT_CONFIG_GLOBAL="$CFG" git config --global \
+              url."https://x-access-token:${TOKEN}@github.com/".insteadOf "https://github.com/"
+            echo "github.com modules authenticated"
+            wrote=1
+          fi
+
+          [ "$wrote" = 1 ] || { echo "no git credential — public modules only"; exit 0; }
           { echo "GIT_CONFIG_GLOBAL=$CFG"; echo "GIT_CONFIG_NOSYSTEM=1"; } >> "$GITHUB_ENV"
           echo "runner git authenticated for private Go modules"