- Shipped
- November 15, 2026 at 5:11 AM UTC
- Author
- Kamo
- Commit
- db05373
Owner decision 2026-11-14: a sign-in redirect follows the email rule — the org's own domain only when ownership-verified AND its certificate is live, else the platform's. - WorkspaceHostResolver (enter-as, impersonation, card-checkout returns) is now the host of **************** it checked the certificate but not ownership, so a domain an org merely typed in could receive a one-time key. Never null now. - **************** (register auto-login deep link) mints only when OrgLinkHosts.liveRootDomain is set; otherwise the manual login redirect, as before. - Both are off OrgDomainRuleGuardTest's ALLOWED list, with a test that they stay off. Live data checked read-only: no org has ssl_confirmed without ownership_verified, so no current redirect moves; the platform org still resolves to internal.kamouniverse.com and verified orgs (chinilaw.com, tech-life.com, ...) to their own internal host.