The .network host was retired 2026-07-27 and no longer resolves at all, so every
reference to it named an address that cannot answer. The brand host is .cloud,
matching kms.zoo.cloud and the rest of the white-label convention.
Left alone deliberately, because rewriting them would invert what they say: the
LLM.md line that RECORDS the retirement, the e2e spec that ASSERTS
kms.lux.network must not resolve, and the recorded applies + cluster backups,
which are faithful accounts of what was applied and are not config.
Squash of the local main lineage onto the canonical origin/main. Net tree only
(62 files): stale docs pages removed, tenant config + tests updated, minor Go
fixes, refreshed opnet-watcher build. No third-party white-label branding in
code or history.
Co-authored-by: Hanzo Dev <[email protected]>
Adds internal/tenant.Config: a single YAML primitive that drives brand,
IAM endpoint, KMS endpoint, MPC cluster, PQ profile, supported-chains
allowlist, basket allowlist, fee receiver, domain, and per-family
release-pool sizing. Same pattern Lux already uses for IAM (hanzo.id /
lux.id / zoo.id / pars.id) and KMS.
- internal/tenant/config.go (462 LOC): Config + per-section structs
(Brand, Network, IAM, KMS, MPC, ReleasePool, FamilyPool); Load() +
Parse() + Validate(); IsChainSupported() + IsBasketAllowed() helpers.
Strict validation — daemon hard-fails on invalid config (no warn-
and-continue path).
- internal/tenant/config_test.go (491 LOC): round-trip yaml, defaults
applied, every required-field omission rejected, PQ profile must be
one of strict-pq|classical-compat, FeeReceiverAddr must be 0x-prefixed
20-byte hex, SupportedChains must be subset of the known family set,
slug must be lowercase-hyphenated, IAM/KMS endpoints must be https://,
MPC threshold can't exceed operators, basket allowlist validates.
26 tests, all pass.
- cmd/bridge/main.go: --tenant-config flag (BRIDGE_TENANT_CONFIG env).
When set, brand slug becomes the daemon log "service" tag + Fiber
AppName; tenant defaults fill flags the operator didn't pass.
Backwards-compatible: existing flag-driven deploys keep working.
- cmd/bridge/tenant_overrides.go: applyTenantOverrides — explicit
flag wins, tenant fills gaps. flag.Visit-based, so we never
clobber operator intent.
- cmd/bridge/main_test.go: TestTenantConfigFixture loads a complete
tenant.yaml from disk and asserts it validates; TestTenantExampleYAMLLoads
is a CI guardrail that the repo-root example file stays in sync
with the schema.
- tenant.example.yaml: canonical commented schema. All four white-label
shim repos (liquidity/bridge, hanzo/bridge-shim, zoo/bridge-shim,
pars/bridge-shim) consume this shape.
Tests: ./... PASS — internal/tenant 0.282s, cmd/bridge 2.86s, full
suite green across 12 packages.
zeekay
