From 37b6104ede07786a0d630d50d919cfda3b4dea74 Mon Sep 17 00:00:00 2001 From: Jeff Gonzalez Date: Tue, 8 Sep 2026 10:26:49 -0400 Subject: [PATCH] a fifth listener, and the one-for-one claim now holds of four loom.hypertheory-labs.dev serves a documentation site that exists only here, so the Gateway no longer matches production listener for listener. A route pinned to loom will not apply against production and it is the only one of which that is true. Recorded as a divergence with an explicit end state, like the last plain Ingress, rather than silently weakening the invariant the page opens with. Co-Authored-By: Claude Opus 5 (1M context) --- .loom/published/public-access.md | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/.loom/published/public-access.md b/.loom/published/public-access.md index 40a28d6..e2ecdec 100644 --- a/.loom/published/public-access.md +++ b/.loom/published/public-access.md @@ -17,10 +17,20 @@ exists rather than a use it happens to have. what makes them portable — a route that carries its own `hostnames:` stops inheriting and stops working in the other environment.* -**Four listeners**, matching production one for one: `web` (plain HTTP), and +**Four listeners match production one for one:** `web` (plain HTTP), and `websecure`, `theoria` and `notes` over HTTPS. **Pin to the one whose hostname you want.** +**A fifth, `loom`, has no production counterpart.** *It serves a documentation +site that exists only here.* **So the one-for-one claim now holds of four +listeners and not of the Gateway** — *a route pinned to `loom` will not apply +against production, and that is the only listener of which that is true.* + +> **A divergence with an explicit end state**, like the plain `Ingress` below: +> *either production grows a `loom` listener, or this stays staging-only and +> production keeps four.* **Written down so it cannot become permanent by nobody +> remembering it was a choice.** + **One route is the exception and keeps its hostname:** the HTTP-to-HTTPS redirect, because the `web` listener declares no hostname at all — *dropping it there would widen the redirect from one host to every host.* @@ -76,11 +86,12 @@ state, so it cannot quietly become permanent.** ## Checking this is still true -**Verified 2026-09-03.** +**Verified 2026-09-08.** ```sh kubectl get gatewayclass # ACCEPTED=True kubectl get gateway -n traefik # PROGRAMMED=True, with an address +curl -sS -o /dev/null -w "%{http_code}\n" https://loom.hypertheory-labs.dev/ curl -sS -o /dev/null -w "%{http_code}\n" https://class.hypertheory-labs.dev/ # A hostname with no listener MUST 404. A 200 means a route was widened.