- Shipped
- August 24, 2026 at 8:42 PM UTC
- Author
- Kamo
- Commit
- 7a2e548
Org identity comes from the hostname today: OrgHostResolver.resolveByFqdn turns <alias>.<domain> into (orgId, providerId), and its SQL requires od.is_dns_verified = TRUE. That one predicate is why a newly created org cannot be signed in to until its owner configures DNS -- DNS is a prerequisite for access, not just for white-label delivery. The session already carries the tenant (KToken SID/OID, the Redis *** blob), and every authenticated read path already takes orgId from it. So the host is load-bearing at only four seams: session minting, the DNS gate, theming, and durable outbound URLs. Records the target model (session > host > hint, with the hint never granting access), the auth split that separates user-level credentials from org-level authorization, and a six-phase rollout in which every phase is independently shippable -- pushing deploys, so the host path keeps working until nothing calls it.