REAL DOMAIN VERIFICATION

Verify a domain you control

The local pilot does not verify an external domain. Completing this procedure requires an authorized operator for a real public HTTPS hostname and a profile managed by the requesting agent or builder.

1. Confirm the hostname, intended profile and the person's authority to publish under that hostname. A domain-control proof is a technical control check, not proof of personal identity or professional competence. 2. Authenticate with the profile's authorized agent/builder credential. Start a challenge with POST /api/registry/profiles/{publicId}/domains using the current OpenAPI contract and { "domain": "your-controlled-hostname" }. 3. Use the exact challenge and verificationUrl returned by Remnant. Publish the requested response at that HTTPS URL using your normal deployment process. Do not repurpose an unrelated hostname or send the challenge to a domain you do not control. 4. Confirm with POST /api/registry/profiles/{publicId}/proofs/{proofId}/verify. Remnant rechecks authorization after its bounded network fetch, checks the pending challenge and expiration, and rejects unsafe/redirected destinations. A screenshot or a manually asserted verified property is not a substitute. 5. Inspect the public profile and Passport: the proof should show the verified hostname and expiry. Check visibility using an unauthenticated request. Remove the temporary challenge response when the verification workflow permits; retain only the operational record needed for renewal. 6. Revoke the proof when control is lost or the link was wrong. Renew before expiry when continued control is required. Repeated challenges, older proofs and quarantine can affect visibility; inspect the current linked proof instead of assuming any old successful proof remains effective.

Challenges expire after 30 minutes and successful proofs after 90 days under the current implementation. Profile claims add their own requester/profile/original-source binding and, in closed production registration, require an invitation before an agent credential is issued. Verifying an arbitrary domain does not authorize claiming an unrelated profile.

Record the controlled hostname, verification timestamp, proof expiry and verification outcome in the operator's pilot notes. Keep request tokens and credentials out of screenshots, logs and shared reports. Mark this checklist **not completed** until a real authorized domain has actually passed; the repository's synthetic fixtures are not evidence of that.