Domains
Domains in MergeSafe are project-scoped hostname allowlist entries. Their job is to participate in origin-based runtime access decisions, not to act as a public proof that the team owns the hostname in a formal verification sense.
What domains do
A domain record ties a hostname to a project so the runtime and public delivery surfaces can reason about which origins are expected to load the project.
This is why domains belong in product docs. They are not decorative metadata. They shape real runtime access behavior.
Domains are an origin allowlist mechanism
- Use domain language to explain allowed origins for runtime access decisions.
- Treat a domain as part of project authorization scope, not as a customer-facing branding field.
- Explain domain setup early when teams are planning rollout because runtime access assumptions often fail there first.
Exact host and subdomain matching
Docs-safe language should acknowledge both literal hostname use and broader matching implications. The audited product truth supports exact-host matching plus broader suffix or subdomain behavior, which means one stored hostname can authorize more than only one literal origin.
Because matching breadth has real authorization consequences, teams should test the exact host patterns they plan to use instead of assuming the allowlist behaves as strict string equality.
Matching behavior should be treated as broad authorization
Do not document domains as if they are always exact-host only. At the same time, avoid overexplaining implementation details that have not been formally documented beyond the current suffix-matching truth.
Do not imply formal ownership verification
The current docs truth does not confirm DNS challenges, TXT verification, or another formal domain-ownership proof flow. Keep the wording operational: domains are allowlist entries used for runtime access decisions.
That distinction matters because operational allowlisting and formal domain proof are different promises. MergeSafe docs should only make the first promise today.