docs+defaults: 443 everywhere the agent dials; the attr the broker does not add yet; no jti state on the mount; release:gitea has not run

DD-0523 — !7 (31586c30, 0.1.5) moved install.sh and config.example.yaml to the
443 intercept after env-qa-02 hit "service not available". The ansible role
default (monky_deployd_tenancy_port) and TenancyCfg.port still said 8081, so
an ansible-installed box or a config that omits `port` still dialled the wrong
port; both now default to 443, the proxy-mapping and config tests follow, and
PROTOCOL.md §Where and how states the intercept port separately from the
in-pod 8081 and names openziti state/overlay/configs.json as the authority.

DD-0525 — PROTOCOL.md and README said "the broker adds the attr when the
identity is created at kit reveal". monky-ziti at b44c50a4 has no such code
(app/fabric.py host_identity_attrs carries the env template only) and openziti
docs/services.md says "Nothing carries the attr yet". Both now state the
dependency: an operator adds #monky-deploy-agent/#openbao-client on the
controller until the ADR-0028 addendum lands in monky-ziti.

DD-0527 — "the old kit's grant fails at login (unknown/used jti)". The
jwt-tenancy mount keeps no replay state (openbao terraform/jwt-tenancy.tf
see_env role: signature, aud, bound_claims, exp); a superseded grant logs in
until exp and the refusal is tenancy's 401 on the first bearer call. The
second-reveal paragraph, the grant-flow diagram and README §Security model say
so; FakeBao no longer pops a grant at login (the suite's superseded-token test
already goes through FakeTenancy.superseded_jtis, which is the real model).

DD-0528 — "Both locations keep being published": release:gitea has been a
never-run manual job on every tag pipeline (6999, 7044, 7066); README and
OPERATIONS.md now say when the Gitea mirror is published and that it has not
been yet.

Gates (local, py3.12): ruff format, ruff check, pytest 50 passed,
bash -n packaging/install.sh. `git grep 8081` afterwards hits only the in-pod
listener statements.

Doc-Drift: DD-0523 fixed
Doc-Drift: DD-0525 fixed
Doc-Drift: DD-0527 fixed
Doc-Drift: DD-0528 fixed
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AW3QqEpwLV69KHn24Re45Q

tests/fakes.py

@@ -190,9 +190,11 @@ class FakeBao:
                 return h._send(400, {"errors": ["error validating token: expired"]})
             if body.get("role") != self.role:
                 return h._send(400, {"errors": [f"role {body.get('role')!r} could not be found"]})
-            meta = self.grants.pop(body.get("jwt", ""), None)  # single-use grant
+            # the jwt mount keeps no jti/replay state: a known grant logs in until it expires;
+            # a SUPERSEDED grant is refused by tenancy (FakeTenancy.superseded_jtis), not here
+            meta = self.grants.get(body.get("jwt", ""))
             if meta is None:
-                return h._send(400, {"errors": ["error validating token: unknown or already used grant"]})
+                return h._send(400, {"errors": ["error validating token: unknown grant"]})
             m = json.loads(meta)
             tok = self.mint(m["env_id"])
             self.tokens[tok]["grant_jti"] = m["jti"]

tests/test_cli.py

@@ -93,7 +93,7 @@ def test_proxy_transport_refuses_unmapped_hosts():
 
     cfg = from_dict({"env_id": "env-dev-06", "site": "cbs", "transport": "proxy"})
     t = build(cfg)
-    assert t.mapping[("monky.tenancy.deploy", 8081)] == ("127.0.0.1", 18443)
+    assert t.mapping[("monky.tenancy.deploy", 443)] == ("127.0.0.1", 18443)
     assert t.mapping[("bao.cbs.tikali.net", 8200)] == ("127.0.0.1", 18200)
     try:
         t.connect("example.com", 443, 1)

tests/test_config.py

@@ -10,7 +10,7 @@ transport: sdk
 identity: /opt/openziti/etc/identities/monky-host.env-qa-02.json
 tenancy:
   service: monky.tenancy.deploy
-  base_url: http://monky.tenancy.deploy:8081
+  base_url: http://monky.tenancy.deploy:443
 bao:
   service: openbao
   addr: https://bao.cbs.tikali.net:8200   # intercept, not public DNS
@@ -27,7 +27,7 @@ volumes_on_absent: keep
 def test_yaml_subset_parses_nested_maps_and_types():
     d = c.parse_yaml_subset(KIT)
     assert d["env_id"] == "env-qa-02"
-    assert d["tenancy"]["base_url"] == "http://monky.tenancy.deploy:8081"
+    assert d["tenancy"]["base_url"] == "http://monky.tenancy.deploy:443"
     assert d["bao"]["addr"] == "https://bao.cbs.tikali.net:8200"
     assert d["interval_s"] == 60 and d["laptop_mode"] is False
 
@@ -46,7 +46,7 @@ def test_yaml_subset_refuses_flow_style_and_tabs():
 
 def test_config_defaults_and_derivations():
     cfg = c.from_dict(c.parse_yaml_subset(KIT))
-    assert cfg.tenancy.host == "monky.tenancy.deploy" and cfg.tenancy.port == 8081 and cfg.tenancy.scheme == "http"
+    assert cfg.tenancy.host == "monky.tenancy.deploy" and cfg.tenancy.port == 443 and cfg.tenancy.scheme == "http"
     assert cfg.bao_url == ("https", "bao.cbs.tikali.net", 8200)
     assert cfg.deploy_dir == "/var/lib/monky-deployd/env-qa-02"
     assert cfg.compose_project == "monky-env-qa-02"