feat: add registrable BrandRef domain validation

[bokelley]

Summary

• add a public validateBrandDomain helper backed by tldts
• require ICANN or PRIVATE PSL registrability in production
• support explicit .localhost, .test, .example, and .invalid development names while excluding .local

Tests

• npm run build
• node --test test/lib/brand-domain.test.js test/lib/brand-public-export.test.js
• npm run typecheck
• pre-push validation

[aao-secretariat]

Ladon verdict: Approve

Approve — clean additive PR, no blocking or medium findings.

Reviewed PR #2857 (147 additions, 0 deletions): new src/lib/brand/domain.ts validateBrandDomain helper + canonicalizeHost delegate, public-export wiring in src/lib/brand/index.ts and src/lib/index.ts, tests, and a minor changeset.

What I checked:

• Control flow is fail-closed: dev-name early return is gated on explicit allowDevelopmentDomains; special-use and registrability checks reject IPs, bare public suffixes, and non-dev special-use names even with the flag on.
• tldts is a proper runtime dependency.
• Changeset (minor) correctly matches the purely additive export surface — no understated impact, no hand-edited version line.
• No witness-not-translator concerns; no protocol/transport reimplementation.

Decision trace: no critical/high findings (row 1 n/a); gated_paths false (row 2 n/a); high_risk false (rows 3/5 n/a); no medium findings (rows 4/8 n/a); no prior escalation (row 6 n/a); no no-auto-approve team match (row 7 n/a). Falls through to row 9 → approve. Note review_decision is REVIEW_REQUIRED, but that only gates approval when gated_paths is true, which it is not here.

[aao-secretariat]

Ladon verdict: Approve

Approve

Clean delta pass on subsequent review. This change hardens BrandRef PSL validation: adds IANA special-use suffix rejection in brand/domain.ts, tightens eTldPlusOne to reject non-ICANN/non-private and special-use hosts, and gates a narrow dev-only allowPrivateIp operator-match path (fail-closed in production, NODE_ENV-gated). Changeset present with correct minor type, no import cycle, and new branches are covered by tests.

No Critical/High/Medium findings. No author team gate, gated_paths is false, high_risk is false, and the prior decision was also approve with no findings. None of decision rows 1–8 fire, so this falls through to row 9 → approve.

Blocking findings: none.
Medium findings: none.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean delta pass, no blocking or medium findings.

This PR narrows the allowPrivateIp eTLD+1 fallback in resolve-agent.ts so bare-hostname equality only applies when both agent and brand hosts are explicit development hosts (localhost, dev-suffix domains, IP literals); otherwise it fails closed with request_signature_brand_origin_mismatch. This is a fail-closed security tightening scoped to the dev-only path, covered by new reject/preserve tests, and shipped with an appropriate minor changeset (.changeset/strict-brand-domains.md).

Checked: changeset present and correctly typed for the src/lib/** change; no witness/translator violations; no transport-client reimplementation. No critical/high/medium findings.

Decision-table trace: no critical/high (rows 1 skip); gated_paths false (row 2 skip); high_risk false (rows 3/5 skip); no medium findings (rows 4/6/8 skip); no no-auto-approve team match (row 7 skip). Falls through to row 9 → approve. Prior decision was also approve with no findings; this remains clean.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean delta pass, no findings.

This subsequent push (prior decision: approve) is a delta pass over one test file, test/agent-resolver-primitives.test.js, swapping RFC 2606 reserved example domains for real domains (adcontextprotocol.org, acme.co.uk, Bücher.de) in the eTLD+1 primitive tests. All assertions preserve original semantics — ICANN suffix computation, case-folding, IDN/Punycode handling, and shared eTLD+1 relationships remain correct.

Checked:

• No critical/high findings (row 1 clear).
• gated_paths is false (row 2 N/A) — REVIEW_REQUIRED does not gate here since no gated paths are touched.
• high_risk is false; no deletions or modified high-risk files (rows 3, 5 clear).
• No medium findings in any escalation category (row 4 clear).
• Prior decision was approve, not escalate (row 6 N/A).
• No no-auto-approve team match (row 7 clear).
• Zero medium findings (row 8 clear).

Falls through to row 9: approve.