Parent: #173

P9a-5b: the legal pages go live from the platform

Caller: #173, slice row P9a-5: "The tunnel line and hal's apex move, his sentence stands, hal's exit is named, the live body equals built/, and an item on marketplace's board drops the legal-texts skill's sentence that hal still assembles and serves the pages (marketplace#561's follow-up)." After P9a-5a, which makes platform's copy hold every sentence hal serves and the ruled 30-day sentence, and the sections' owner.

Ruled

• The operator, 08.11.2026 (P9: legal pages, person export and erasure, AI keys and expiry checks move from hal #173's body): "P9a: the legal pages move as soon as the platform builds them, before the big cutover." It replaces Platform on k3s and Flux: from an empty PC to every app live, with hal archived #1's card line 1 (A, 06.11.2026: the live pages stay on hal until the cutover) for the legal pages.
• P9: legal pages, person export and erasure, AI keys and expiry checks move from hal #173 card line 2, ruled „other“ on 09.11.2026 („…wir global und die apps halten sich dran!“), read by the head in P9: legal pages, person export and erasure, AI keys and expiry checks move from hal #173's comment of 09.11.2026 09:19Z as option A's sentence: "his sentence stands" at the go, since P9a-5a puts it into the general part.
• P9: legal pages, person export and erasure, AI keys and expiry checks move from hal #173 invariant 2: "hal's copy of a tool leaves with hal (P11), and until then only one of the two serves a given address."
• hal#110 (ruled shape, 18.10.2026): the three addresses never change and are never redirected. Its live checks C1-C5: the public body hash equals the origin's; no injected script; legal@hallucinai.de literally in the HTML; no nel, report-to or reporting-endpoints header and no CSP reporting; a browser at 390 and 1440 px requests hallucinai.de only, with no CSP violation.
• Owners: tunnel lines change only in a pull request.

How the go works (hal at origin/main e9cfd360)

• The edge stays hal's. Cloudflare's redirect ruleset (external/cloudflare.tf:278-342, fleet.yaml:3-8) answers every request to hallucinai.de and www at the edge, before any tunnel: the four pages and /_rechtliches/… pass to the origin, every other form of a page goes 302 to its exact path, and everything else, / included, goes 302 to https://auth.hallucinai.de/. Moving the record changes none of that. So no path hal serves at the apex stops answering: hal's nginx (legal/nginx/default.conf) answers exactly the five paths platform's Ingress routes, try_files $uri.html for the pages and /favicon.ico (404, as platform's), and alias for /_rechtliches/. One unverified difference: a file in hal's git-ignored legal/assets/ on the PC beyond platform's assets/ (an older appkit-<version>/) stops answering; the committed pages link only appkit-0.15.0 and legal-2.css, and Cache-Control: no-cache makes a cached page ask again.
• The record moves by one catalog key. tunnel: platform on the legal entry's "@" host (fleet.yaml:43): catalog.py's _tunnel accepts it (only target and the wildcard are refused), external/cloudflare.tf:17-22 points the apex's proxied CNAME at the tunnel platform, external/tunnel.tf drops the apex's line from hal's ingress, the publish phase skips ready for a host on another tunnel, and www keeps hal's tunnel record (a redirect-only name), which never reaches an origin. cloudflare.redirect.serve needs the apex as an enabled host, so the legal entry stays enabled: hal's legal unit keeps running and serving nothing, the rollback target until P11. This is hal#1100's and hal#1148's mechanism; hal's freeze admits it.

What it builds

1. The tunnel line. infrastructure/cloudflared/cloudflared.yaml gains - hostname: hallucinai.de to http://traefik.traefik.svc.cluster.local:80, before the final http_status:404, without a path: the edge and the Ingress each already admit only the five paths. checksum/config follows, computed as tests/cloudflared/ingress_from_pods_built_from_its_template.sh does.
2. The cloudflared cell. For a line without a path, the cell today asks / and, for a host an Ingress routes, fails on 404 (:92, :115, :123-126); the apex's Ingress routes no /. The cell asks such a host on the first path of its Ingress rule instead of /; hopin and skat route / and stay as they are.
3. The comment at infrastructure/legal/legal.yaml:104-106 drops "and no tunnel line sends the host here yet".
4. The hal script's end. tests/legal/legal_sections_assets_and_headers_equal_hals_at_commit.sh loses the stylesheet and header comparisons, hal_commit and hal's fetch, since hal serves nothing after the go and platform's copies are the owners. The appkit check stays with its own pin: the wheel's URL and sha256 (today hal's pin, v0.15.0, 710bed31…) move into the script, renamed tests/legal/appkit_assets_equal_their_release_wheel.sh; it still fails when assets/appkit-<version>/ differs from the wheel's appkit/static/ or assets/ holds anything else. Weighed: deleting it, which drops the only proof that ten vendored files equal a release, or keeping hal's pin, which keeps a predecessor as a source of truth.
5. AGENTS.md is not changed (the operator, 09.11.2026, platform carries the fleet document set: AGENTS.md within its budget, an architecture overview and runbooks #134 comment 6738858275: no lane changes it). The head names on platform carries the fleet document set: AGENTS.md within its budget, an architecture overview and runbooks #134 the sentences this makes false: "No tunnel line names the host, so hal keeps the public address." (P0 class R, destination item: Platform on k3s and Flux: from an empty PC to every app live, with hal archived #1 card line 1, which the 08.11.2026 ruling replaces for these pages; the ruling stands in P9: legal pages, person export and erasure, AI keys and expiry checks move from hal #173's body), and the assets/ sentence ending "until hal no longer serves the apex" (class D); the hal script's clause if P9a-5a left one.
6. docs/personal-data.md: the "The promise:" lists gain allgemein#server-protokolle, so a lane changing retention finds the one general promise (the gate of The speech section takes hal's last ruled sentence; platform owns the legal sections #324, F3).

Size: three production files (cloudflared.yaml, legal.yaml's comment, ci.yml's step), about 6 changed lines, plus the two test scripts and docs/personal-data.md.

The live go, in order

The operator's block (he answers yes at the plan, which shows the apex record moving to the tunnel platform and hal's apex line leaving hal's ingress):

cd ~/srv/hal && hal update && hal apply

Rollback: hal's head reverts step 2; the operator runs the same block. The record returns to hal's tunnel and hal's still-running legal unit answers, with the text of hal's last apply. platform's tunnel line stays and serves nothing. hal's frozen legal/sections/allgemein has no server-logs section, so after a rollback the public page lacks the ruled 30-day log sentence until the record returns to the platform (the gate of overnightworks/hal#1199).

Proof

CI. cluster, part core: the cloudflared cell finds the apex's line pointing at Traefik's web and a client Pod in cloudflared reaching the route with nginx's answer, checksum/config matches, hopin's and skat's lines unchanged; the five-paths cell unchanged (three pages and every asset with the committed checksums, nginx's headers, Traefik's 404 for /). checks: the appkit script with its own pin.

Live, after step 3, from outside, by a delegated agent with curl, at the landed main:

• curl -fsS https://hallucinai.de/<page> | sha256sum equals sha256sum infrastructure/legal/built/<page>.html for impressum, datenschutz and nutzungsbedingungen;
• the outside ETag of /datenschutz (a W/ prefix ignored) equals the in-cluster one of step 1, so the platform served it, not hal;
• every /_rechtliches/… the pages reference answers 200 with the committed file's sha256;
• each answer carries default.conf's four headers, no nel, report-to or reporting-endpoints header; no body holds /cdn-cgi/, __cf_email__, data-cfemail, email-decode or challenge-platform, and legal@hallucinai.de stands literally (hal#110 C2-C4);
• the edge is unchanged: / and /foo give 302 to https://auth.hallucinai.de/, /impressum/ and https://www.hallucinai.de/impressum give 302 to https://hallucinai.de/impressum, /favicon.ico gives 404;
• each page's answer carries strict-transport-security exactly once: Cloudflare's zone adds it and neither nginx's default.conf nor Traefik adds a second (required by hal's docs/external.md; asked by hal's head for The platform serves the legal pages at the apex hal#1199);
• a browser at 390 and 1440 px opens /datenschutz, requests hallucinai.de only and reports no CSP violation (hal#110 C5);
• hal check hosts exits 0 (hal's head).

Trace (main 0bf0c46; hal origin/main e9cfd360)

• infrastructure/cloudflared/cloudflared.yaml:10-15 (lines), :37 (checksum/config).
• tests/cloudflared/ingress_from_pods_built_from_its_template.sh:85-131.
• infrastructure/legal/legal.yaml:104-106 (comment), :108-150 (Ingress, five paths).
• tests/legal/legal_sections_assets_and_headers_equal_hals_at_commit.sh:23-31 (stylesheet, headers), :33-56 (wheel); .github/workflows/ci.yml:72-73, :336-338, :496-503.
• AGENTS.md:692-696 (D), :703 (R row of P0 part c, base line 700).
• hal: fleet.yaml:3-8,39-43; src/hal/stack/catalog.py:501-513 (_tunnel), :583-598 (_check_serve); external/cloudflare.tf:17-22,153-162,278-342; external/tunnel.tf:7-10; legal/nginx/default.conf; hal#1148's trace (the publish phase skips ready on another tunnel).

Risk

Material: a public legal page and a public route. Opus review at high and a cross-provider final gate. The first review drives:

Deliberately untouched

• hal's cloudflare.redirect and the zone: hal's catalog until platform's OpenTofu takes over the zone hallucinai.de from hal at the cutover #48 takes the zone over at the cutover.
• hal's legal unit, legal and appkit steps, hal legal and legal/: the predecessor; hal's exit item below names its exit, P11.
• The strict rule carried over from hal#110 (no public app without a privacy section) and the blessed look: P9: legal pages, person export and erasure, AI keys and expiry checks move from hal #173's, not this slice's; hal's apply keeps the rule only for hal's own pages, which serve nothing after the go.
• built/impressum.html is hal's frame byte for byte (AGENTS.md:684) stays true.

Cross-repository items, opened at step 5

• hal, owner hal's head (hal-af): "hal's apex host names tunnel: platform, hal's legal/ takes no further change (a change of a shared section goes to platform, hal#1154 moves to platform's board), and hal's legal unit, legal and appkit steps and hal legal leave with hal's archive in P11, the unit staying the rollback target until then." Step 2's commit is its first part; hal#110 names platform for what remains. The item also moves the pointer in hal's docs/keycloak.md that calls hal's legal/sections/allgemein/nutzungsbedingungen.html "the central terms page" (the gate of The platform serves the legal pages at the apex hal#1199).
• songmaker, owner songmaker's head: "songmaker's privacy part refers to the general part's 30-day period for its server logs instead of stating size rotation and no fixed maximum, and the vendored ACE-Step fork writes no log file that outlives 30 days." It is songmaker#1714 finding 6 with a pointer to this item; the wording is the operator's yes in songmaker's repository. Its Audit-Log: wird derzeit ohne feste Frist gespeichert beside the general part's 30-day sentence needs the same owner's decision (the gate of The speech section takes hal's last ruled sentence; platform owns the legal sections #324, F2).
• presentator, owner presentator's head: "presentator's privacy part refers to the general part's 30-day period for its server logs instead of „Eine Aufbewahrungsdauer ist nicht festgelegt“." Its wording is the operator's yes in presentator's repository.
• marketplace, owner marketplace's head: "The legal-texts skill names platform as the owner that assembles and serves the pages and holds the shared sections, and drops the sentence that hal still does until platform's assembler lands." (plugins/atelier/skills/legal-texts/SKILL.md:21-24, marketplace#561's follow-up.)

Done when

hallucinai.de's three pages are served through platform's tunnel line, with each live body equal to built/ at main and the platform's ETag; the edge's redirects are unchanged; the hal script no longer reads hal; the head has named on #134 the sentences of AGENTS.md this makes false; and the four cross-repository items are open with their owners, hal's naming its exit in P11.

version = 1
now = "Cut from #173 on 09.11.2026 as the second half of P9a-5; hal's catalog mechanism for another tunnel (hal#1100, hal#1148) carries the apex unchanged."
next = "The tunnel line, the cell and the script's end have landed (#333, ab4d602) and step 1 of the live go passed at 7ba3a15: hal's head's commit (overnightworks/hal#1199), then the operator's hal update && hal apply, the live check and the four items."
done_when = "hallucinai.de's three pages are served through platform's tunnel line, each live body equal to built/ at main with the platform's ETag; the edge's redirects are unchanged; the hal script no longer reads hal; the head has named on #134 the sentences of AGENTS.md this makes false; the hal, songmaker, presentator and marketplace items are open, hal's naming its exit in P11."

scope = [".github/workflows/ci.yml", "docs/personal-data.md", "infrastructure/cloudflared/cloudflared.yaml", "infrastructure/legal/legal.yaml", "tests/cloudflared/ingress_from_pods_built_from_its_template.sh", "tests/legal/appkit_assets_equal_their_release_wheel.sh", "tests/legal/legal_sections_assets_and_headers_equal_hals_at_commit.sh"]

whole = "One public route: the tunnel line, the cell that judges it, and the end of the hal comparison land together, and the live go after them is one hal commit and one apply."

size = "S"