kms.lux.cloud is the brand host; kms.lux.network is retired

The .network host was retired 2026-07-27 and no longer resolves at all, so every
reference to it named an address that cannot answer. The brand host is .cloud,
matching kms.zoo.cloud and the rest of the white-label convention.

Left alone deliberately, because rewriting them would invert what they say: the
LLM.md line that RECORDS the retirement, the e2e spec that ASSERTS
kms.lux.network must not resolve, and the recorded applies + cluster backups,
which are faithful accounts of what was applied and are not config.

app/server/src/clients/__tests__/kms.test.ts

@@ -5,7 +5,7 @@ import { KMSError, KMSSecretClient } from "../kms"
 import { IAMClient } from "../iam"
 
 const ISSUER = "https://iam.lux.network"
-const KMS_URL = "https://kms.lux.network"
+const KMS_URL = "https://kms.lux.cloud"
 
 function jsonResponse(body: object, status = 200): Response {
   return new Response(JSON.stringify(body), {

app/server/src/clients/kms.ts

@@ -27,7 +27,7 @@ const _fetch = (...args: Parameters<typeof globalThis.fetch>) =>
   globalThis.fetch(...args)
 
 export interface KMSConfig {
-  /** Lux KMS endpoint, e.g. `https://kms.lux.network`. */
+  /** Lux KMS endpoint, e.g. `https://kms.lux.cloud`. */
   url: string
   /** Org slug whose secret namespace we're reading from. */
   org: string

app/server/src/domain/__tests__/cosigners-kms-secret-fetch.test.ts

@@ -60,7 +60,7 @@ function textResponse(body: string, status = 200): Response {
 
 describe("fetchCosignerSecret — KMS-backed", () => {
   it("reads utila PEM from bridge/cosigners/utila/{org}/sa_pem when KMS is configured", async () => {
-    process.env.BRIDGE_KMS_URL = "https://kms.lux.network"
+    process.env.BRIDGE_KMS_URL = "https://kms.lux.cloud"
     process.env.BRIDGE_KMS_ORG = "lux"
     process.env.BRIDGE_IAM_ISSUER = "https://iam.lux.network"
     process.env.BRIDGE_IAM_CLIENT_ID = "lux-bridge"
@@ -81,12 +81,12 @@ describe("fetchCosignerSecret — KMS-backed", () => {
     expect(pem).toBe("UTILA-PEM-BYTES")
     const url = fetchSpy.mock.calls[1]?.[0] as string
     expect(url).toBe(
-      "https://kms.lux.network/v1/kms/orgs/lux/secrets/bridge/cosigners/utila/ORG_A/sa_pem",
+      "https://kms.lux.cloud/v1/kms/orgs/lux/secrets/bridge/cosigners/utila/ORG_A/sa_pem",
     )
   })
 
   it("reads fireblocks PEM from bridge/cosigners/fireblocks/{api_key}/secret_pem", async () => {
-    process.env.BRIDGE_KMS_URL = "https://kms.lux.network"
+    process.env.BRIDGE_KMS_URL = "https://kms.lux.cloud"
     process.env.BRIDGE_KMS_ORG = "lux"
     process.env.BRIDGE_IAM_ISSUER = "https://iam.lux.network"
     process.env.BRIDGE_IAM_CLIENT_ID = "lux-bridge"
@@ -106,12 +106,12 @@ describe("fetchCosignerSecret — KMS-backed", () => {
     expect(pem).toBe("FB-PEM")
     const url = fetchSpy.mock.calls[1]?.[0] as string
     expect(url).toBe(
-      "https://kms.lux.network/v1/kms/orgs/lux/secrets/bridge/cosigners/fireblocks/PUB_KEY/secret_pem",
+      "https://kms.lux.cloud/v1/kms/orgs/lux/secrets/bridge/cosigners/fireblocks/PUB_KEY/secret_pem",
     )
   })
 
   it("falls back to env var when KMS returns 404", async () => {
-    process.env.BRIDGE_KMS_URL = "https://kms.lux.network"
+    process.env.BRIDGE_KMS_URL = "https://kms.lux.cloud"
     process.env.BRIDGE_KMS_ORG = "lux"
     process.env.BRIDGE_IAM_ISSUER = "https://iam.lux.network"
     process.env.BRIDGE_IAM_CLIENT_ID = "lux-bridge"
@@ -156,7 +156,7 @@ describe("fetchCosignerSecret — KMS-backed", () => {
   })
 
   it("non-404 KMS error propagates (retryable on the caller side)", async () => {
-    process.env.BRIDGE_KMS_URL = "https://kms.lux.network"
+    process.env.BRIDGE_KMS_URL = "https://kms.lux.cloud"
     process.env.BRIDGE_KMS_ORG = "lux"
     process.env.BRIDGE_IAM_ISSUER = "https://iam.lux.network"
     process.env.BRIDGE_IAM_CLIENT_ID = "lux-bridge"

cmd/bridge/main_test.go

@@ -115,7 +115,7 @@ iam:
   clientID: lux-bridge
   organization: lux
 kms:
-  endpoint: https://kms.lux.network
+  endpoint: https://kms.lux.cloud
   projectID: lux-bridge
   environment: prod
 mpc:

compose.standalone.yml

@@ -59,7 +59,7 @@ services:
       LOG_LEVEL: info
       # All external integrations are OPTIONAL — uncomment to enable.
       # BRIDGE_IAM_ISSUER: https://iam.lux.network
-      # BRIDGE_KMS_URL: https://kms.lux.network
+      # BRIDGE_KMS_URL: https://kms.lux.cloud
       # BRIDGE_KMS_ORG: lux
       # BRIDGE_IAM_CLIENT_ID: lux-bridge
       # BRIDGE_IAM_CLIENT_SECRET: <fetch from your secret store>

config.kms.yaml

@@ -7,7 +7,7 @@ kms:
   site_url: "http://localhost:8080"
   
   # For production Lux KMS
-  # site_url: "https://kms.lux.network"
+  # site_url: "https://kms.lux.cloud"
   
   # Project settings (required)
   project_id: "your-project-id"  # Or set KMS_PROJECT_ID env var

pkg/bridge/README.md

@@ -65,7 +65,7 @@ mountBridge({
     },
 
     // KMS endpoint — same shape as <Exchange kms={…} />.
-    kms: { url: 'https://kms.lux.network' },
+    kms: { url: 'https://kms.lux.cloud' },
 
     // Wallet connector defaults (WalletConnect v2 + EVM chain set).
     wallet: {

pkg/bridge/src/types.ts

@@ -60,7 +60,7 @@ export interface BridgeAuthConfig {
  * runtime secrets via JWT-gated requests.
  */
 export interface BridgeKMSConfig {
-  /** KMS endpoint URL (e.g. `https://kms.lux.network`). */
+  /** KMS endpoint URL (e.g. `https://kms.lux.cloud`). */
   url: string
 }
 

pkg/tenant/config.go

@@ -48,7 +48,7 @@ type Config struct {
 	IAM IAMConfig `yaml:"iam"`
 
 	// KMS points the bridge at the tenant's KMS (kms.hanzo.ai,
-	// kms.lux.network, ...). All secrets (mpc tokens, coingecko keys,
+	// kms.lux.cloud, ...). All secrets (mpc tokens, coingecko keys,
 	// release-wallet seeds) come from KMS via Universal Auth, NEVER
 	// from environment variables in production.
 	KMS KMSConfig `yaml:"kms"`

pkg/tenant/config_test.go

@@ -354,7 +354,7 @@ iam:
   clientID: lux-bridge
   organization: lux
 kms:
-  endpoint: https://kms.lux.network
+  endpoint: https://kms.lux.cloud
   projectID: lux-bridge
   environment: prod
 mpc:

tenant.example.yaml

@@ -54,7 +54,7 @@ iam:
 # material) MUST come from KMS via Universal Auth. NEVER from env vars
 # in production.
 kms:
-  endpoint:    "https://kms.lux.network"
+  endpoint:    "https://kms.lux.cloud"
   projectID:   "lux-bridge"
   environment: "prod"                       # prod | staging | dev