docs+defaults: 443 everywhere the agent dials; the attr the broker does not add yet; no jti state on the mount; release:gitea has not run

DD-0523 — !7 (31586c30, 0.1.5) moved install.sh and config.example.yaml to the
443 intercept after env-qa-02 hit "service not available". The ansible role
default (monky_deployd_tenancy_port) and TenancyCfg.port still said 8081, so
an ansible-installed box or a config that omits `port` still dialled the wrong
port; both now default to 443, the proxy-mapping and config tests follow, and
PROTOCOL.md §Where and how states the intercept port separately from the
in-pod 8081 and names openziti state/overlay/configs.json as the authority.

DD-0525 — PROTOCOL.md and README said "the broker adds the attr when the
identity is created at kit reveal". monky-ziti at b44c50a4 has no such code
(app/fabric.py host_identity_attrs carries the env template only) and openziti
docs/services.md says "Nothing carries the attr yet". Both now state the
dependency: an operator adds #monky-deploy-agent/#openbao-client on the
controller until the ADR-0028 addendum lands in monky-ziti.

DD-0527 — "the old kit's grant fails at login (unknown/used jti)". The
jwt-tenancy mount keeps no replay state (openbao terraform/jwt-tenancy.tf
see_env role: signature, aud, bound_claims, exp); a superseded grant logs in
until exp and the refusal is tenancy's 401 on the first bearer call. The
second-reveal paragraph, the grant-flow diagram and README §Security model say
so; FakeBao no longer pops a grant at login (the suite's superseded-token test
already goes through FakeTenancy.superseded_jtis, which is the real model).

DD-0528 — "Both locations keep being published": release:gitea has been a
never-run manual job on every tag pipeline (6999, 7044, 7066); README and
OPERATIONS.md now say when the Gitea mirror is published and that it has not
been yet.

Gates (local, py3.12): ruff format, ruff check, pytest 50 passed,
bash -n packaging/install.sh. `git grep 8081` afterwards hits only the in-pod
listener statements.

Doc-Drift: DD-0523 fixed
Doc-Drift: DD-0525 fixed
Doc-Drift: DD-0527 fixed
Doc-Drift: DD-0528 fixed
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AW3QqEpwLV69KHn24Re45Q

docs/PROTOCOL.md

@@ -10,8 +10,16 @@ The agent side of the backend lifecycle agent protocol — [MONKY-ADR-0028](http
 
 - **Where:** tenancy's **agent entrypoint** — a second container (`app.agent_main`,
   `127.0.0.1:8081`) bound to the ziti service **`monky.tenancy.deploy`** by a `ziti-edge-tunnel
-  run-host` sidecar. Unreachable from the public ingress. Only host identities carrying
-  `#monky-deploy-agent` may dial (the broker adds the attr when the identity is created at kit reveal).
+  run-host` sidecar. Unreachable from the public ingress. **The agent dials the service's
+  INTERCEPT port, `tcp/443`** (`monky.tenancy.deploy.intercept.v1` in openziti
+  `state/overlay/configs.json` — the authority for the port); the sidecar's `host.v1` forwards to
+  `127.0.0.1:8081` inside the pod. `tenancy.port` in the config, `install.sh` and the ansible role all
+  default to 443 (0.1.5). Only host identities carrying `#monky-deploy-agent` may dial
+  (`monky.tenancy.deploy.dial`, openziti). Adding that attr (and `#openbao-client`) to
+  `monky-host.<env>` at kit reveal is the ADR-0028 addendum and is **not implemented in monky-ziti
+  yet** (its host template `app/fabric.py` `host_identity_attrs` does not carry it; openziti
+  `docs/services.md` §Platform services records when it does) — until then an operator adds both
+  attrs on the controller by hand after enrolment.
 - **Transport:** plain HTTP inside the mesh (`transport: sdk` dials by service name;
   `proxy` → `127.0.0.1:18443`). OpenBao is the existing `openbao` ziti service (`#openbao-client`),
   dialled as `https://bao.cbs.tikali.net:8200` (an intercept name), TLS validated against the
@@ -29,7 +37,7 @@ The agent side of the backend lifecycle agent protocol — [MONKY-ADR-0028](http
 ```
 kit reveal (admin, once)     tenancy signs a bootstrap DEPLOY GRANT: ES256 JWT
                               iss <tenancy issuer>, aud openbao-see-env, sub agent:<env_id>,
-                              env_id, kind deploy-grant, jti (single-use, recorded), exp now+1h
+                              env_id, kind deploy-grant, jti (→ token meta grant_jti; tenancy records it), exp now+1h
 install.sh                   stages it at /etc/monky-deployd/bootstrap.jwt (0600)
 first tick                   POST https://bao…/v1/auth/jwt-tenancy/login {"role":"see-env","jwt":<grant>}
                               → auth.client_token (ttl 24 h, max 30 d, policy see-env,
@@ -49,10 +57,13 @@ OpenBao side (Terraform, `tikali/services/security/openbao`): mount `jwt-tenancy
 `monky/data/{{identity.entity.aliases.<accessor>.metadata.env_id}}/see/*` read + metadata list +
 `auth/token/{renew-self,lookup-self}`. **Gate 1 v2 passed 2026-09-05 07:40Z** (distinct entity per env).
 
-**Second-reveal semantics.** A kit re-reveal (or a retire) supersedes every earlier grant of the
-backend and revokes the token accessors tenancy knows. The old kit's grant fails at login
-(unknown/used `jti`), and a token already minted from it is refused at the next call with
-`401 AGENT_UNAUTHENTICATED` (its `meta.grant_jti` is superseded) — **not** `AGENT_ENV_MISMATCH`.
+**Second-reveal semantics.** A kit re-reveal (or a retire) supersedes every earlier bootstrap grant
+of the backend (tenancy marks their `backend_leases` rows revoked) and revokes the token accessors
+tenancy knows. The `jwt-tenancy` mount keeps **no** replay state — it validates signature, `aud`,
+`bound_claims` and `exp` only (openbao `terraform/jwt-tenancy.tf`, the `see_env` role) — so a
+superseded grant still logs in until its 1 h `exp`; the token it yields, like a token already minted
+from it, is refused by tenancy at the first bearer call with `401 AGENT_UNAUTHENTICATED` (its
+`meta.grant_jti` is superseded) — **not** `AGENT_ENV_MISMATCH`.
 The agent then deletes its token; if a fresh `bootstrap.jwt` is on disk it bootstraps again in the
 same tick, otherwise it exits 1 and says "re-run the install kit".