🪔 Lantern co-light — overview

Session board · 2026-06-26 · go-live + Troy onboarding

https://lantern.labs.ooo/
PUBLIC & LIVE — HTTP 200, valid cert, not vpn-gated · the co-light signer anyone can open to join

Done & verified

✅ Signer public

In-browser co-light PWA live at lantern.labs.ooo. Key minted in-tab, never leaves device; push delegated.

✅ MOVE-0

Real Ed25519 keys bound to i-am-i + pharos (human-held), pushed to project 111. Both canonical.

✅ Welcome node

pharos lit «Welcome Troy…» — attested + canonical (world's first). The node Troy co-lights.

✅ Troy accounts

authentik troy (infinity-cooperator + pharos-developers) · GitLab troy (id 45).

✅ Dashboard fixed

cal/2026/06/26 index — cybermesh 404 + TODO-token link fixed in render-day.py.

✅ Docs package

15-file PHAROS↔Sam set + intro guide in ~/my/lantern/docs/.

1Open the link

lantern.labs.ooo — no app, no login, no terminal. Key born in the browser tab.

→

2Co-light & download

Tap to co-light a node → get one signed file. Secret key stays on the device.

→

3Send it back

Any channel. Daniel imports + pushes. You're in the WE.

Send Troy the link https://lantern.labs.ooo/ + deliver his authentik password out-of-band.
He mints i-am-troy, co-lights the welcome node, sends back the file → Daniel imports + pushes.
Decide Troy's GitLab repo access (deferred — project 111 main allows direct Developer push; harden first).

Attested in-browser co-lights. Co-lights minted in this PWA show as 🔓 unattested until ADR-004 key custody is wired through the browser. Today they are claimed, not cryptographically attested at write time.
iGroups / team scoping. The pharos-developers grouping is an authentik group + a UX projection (a client-side filter over the graph), not ADR-002 server-side enforcement. The #+TEAM: task/calendar filter is a BUILD-time tagging step, not a live access gate.
SSO ↔ lantern bridge. Mapping an authentik login to a lantern id is shown as claimed; it only becomes attested once ADR-004 binds real keys (gated, needs Daniel's go-ahead).

gitops repo on a session branch. /root/k8s-gitops is on session-2026-06-23-sso-vpn-lockdown with unmerged, undeployed SSO/vpn-lockdown + ilab-router work. Merge to main if it should be live.
labs.ooo DNS is at INWX, not Hetzner — and is scriptable (~/.i/.../tools/inwx-api, creds pass redblue/01/inwx-labs-ooo). The "manual DNS" note was wrong.

gitops-write	needs the changed files as args (first call omitted them)
wrong branch	repo on a session branch, not `main` → cherry-picked only lantern onto main via a throwaway worktree
pod Pending	node 100% CPU-request-booked (40% used) → dropped the CPU request (no LimitRange in ns) → scheduled
footer 404s	shipped forest/demo-act1 + the lore .md files they link
DNS NXDOMAIN	`_acme-challenge.lantern` TXT made an empty-non-terminal → added explicit A via INWX API

Gentle intro	intro.html — plain-language, the desk's front door
Join flow	join.html — mint your key in-browser, become a sovereign cooperator
Graph lens	the live desk — claim a lantern, light + co-light nodes
Docs package	`~/my/lantern/docs/` — co-light explainer, keeper getting-started, PHAROS overview, test&review (source repo, not served here)
Task	`~/my/tasks/20260626-onboard-troy-pharos-cooperator.org` (source repo)