domain cutover: front doors + drone + per-run naming to ci.autonomic.zone

- acme-dns.nix: ONE dual-zone SAN cert (ci+*.ci.autonomic.zone AND ci+*.ci.commoninternet.net)
  via the same acmedns account — storage re-keyed by cc-ci-acme-storage-seed.service; handoff
  reads the new cert dir. Single secret pair => zero changes to the traefik reconciler.
- dashboard/bridge/reports: dual Host rules during the bake window (bridge gets explicit
  parentheses so && does not shadow the dashboard on the new host).
- drone abra app renamed to drone.ci.autonomic.zone (fresh DB supported: DRONE_USER_CREATE
  re-injects the sops bridge token); runner RPC + bootstrap-drone-oauth.sh follow.
- harness: app_domain() issues *.ci.autonomic.zone run domains; RUN_APP_RE / stack-name
  regexes / docker-prune accept BOTH zones during the bake. Warm stacks deliberately stay
  on the legacy zone (data-warm volumes; post-bake migration).
- URLs in bridge/dashboard defaults + recipe-report.py follow the new names.

runner/harness/generic.py

@@ -117,7 +117,10 @@ def assert_serving(domain: str, meta) -> None:
     # app is routed (Traefik serves the wildcard zone-wide). The serving proof is steps 1–2 above.
     verified, detail = served_cert(domain)
     assert verified, f"{domain}: served wildcard cert is not trusted/valid — {detail}"
-    assert "commoninternet.net" in detail.lower(), f"{domain}: served cert unexpected — {detail}"
+    # Dual-zone cert (2026-09 cutover): the SAN list covers both *.ci zones; a run
+    # domain in either zone must be covered by the one serving wildcard.
+    zone = "autonomic.zone" if domain.endswith(".autonomic.zone") else "commoninternet.net"
+    assert zone in detail.lower(), f"{domain}: served cert unexpected — {detail}"
 
 
 # ---- Op/assertion split (Phase 1e HC3) -------------------------------------------------------

runner/harness/lifecycle.py

@@ -25,7 +25,7 @@ from . import meta as meta_mod
 GATEWAY_IP = "143.244.213.108"  # *.ci.commoninternet.net -> gateway (TLS passthrough to cc-ci)
 # A run app domain is "<recipe[:4]>-<6hex>.ci.commoninternet.net" (see DECISIONS.md). Used by the
 # janitor to recognise orphaned run apps (infra apps like traefik/drone/backups don't match).
-RUN_APP_RE = re.compile(r"^[a-z0-9]{1,4}-[0-9a-f]{6}\.ci\.commoninternet\.net$")
+RUN_APP_RE = re.compile(r"^[a-z0-9]{1,4}-[0-9a-f]{6}\.ci\.(?:autonomic\.zone|commoninternet\.net)$")
 
 
 class TeardownError(RuntimeError):
@@ -1190,7 +1190,7 @@ def janitor() -> None:
     # also catch stacks whose .env was already deleted (abra ls won't list them)
     for svc in _docker_names("service", ""):
         # svc like cust-c95a69_ci_commoninternet_net_app -> reconstruct domain
-        m = re.match(r"^([a-z0-9]{1,4}-[0-9a-f]{6})_ci_commoninternet_net_", svc)
+        m = re.match(r"^([a-z0-9]{1,4}-[0-9a-f]{6})_ci_(?:autonomic_zone|commoninternet_net)_", svc)
         if m:
             seen.add(f"{m.group(1)}.ci.commoninternet.net")
 

runner/harness/naming.py

@@ -1,7 +1,9 @@
 """Shared run-app domain naming (used by the conftest fixtures and the orchestrator).
 
-Domain = "<recipe[:4]>-<6hex(recipe|pr|ref)>.ci.commoninternet.net" — short enough for Docker's
+Domain = "<recipe[:4]>-<6hex(recipe|pr|ref)>.ci.autonomic.zone" — short enough for Docker's
 64-char swarm config/secret name limit, unique per run, collision-safe across recipes (DECISIONS.md).
+(Migrated from *.ci.commoninternet.net 2026-09; the legacy zone remains valid until the bake
+window ends — lifecycle/warm name matching accepts both.)
 """
 
 from __future__ import annotations
@@ -18,4 +20,4 @@ def app_domain(recipe: str, pr: str = "0", ref: str | None = None) -> str:
     ref = ref or ("local" + str(int(time.time())))
     tag = _short(recipe, 4).lower()
     h = hashlib.sha1(f"{recipe}|{pr}|{ref}".encode()).hexdigest()[:6]
-    return f"{tag}-{h}.ci.commoninternet.net"
+    return f"{tag}-{h}.ci.autonomic.zone"

runner/harness/warm.py

@@ -25,6 +25,9 @@ import urllib.request
 # Recipes that, when declared as a dep, are served from a shared live-warm instance at a stable
 # domain instead of being co-deployed per run. Maps dep-recipe -> stable domain.
 WARM_DOMAINS = {
+    # Warm stacks stay on the legacy zone through the 2026-09 domain cutover (data-warm
+    # volumes + stack names are tied to the abra app name; renaming re-seeds the CI bases).
+    # They move to *.ci.autonomic.zone in a post-bake phase together with their stacks.
     "keycloak": "warm-keycloak.ci.commoninternet.net",
 }
 
@@ -38,11 +41,12 @@ _CTX.check_hostname = False
 _CTX.verify_mode = ssl.CERT_NONE
 
 # A cold per-run stack name looks like "<tag>-<6hex>_ci_commoninternet_net_<svc>"; extract the hex.
-_STACK_HEX_RE = re.compile(r"^[a-z0-9]{1,4}-([0-9a-f]{6})_ci_commoninternet_net_")
+_STACK_HEX_RE = re.compile(r"^[a-z0-9]{1,4}-([0-9a-f]{6})_ci_(?:autonomic_zone|commoninternet_net)_")
 
 
 def stable_domain(recipe: str) -> str:
     """The stable warm domain for a recipe: `warm-<recipe>.ci.commoninternet.net` — the canonical
+    base's hostname (legacy zone until the post-bake warm-stack migration; see WARM_DOMAINS note).
     scheme for BOTH the live-warm keycloak and the data-warm canonicals (WC2), distinct from cold
     per-run `<recipe[:4]>-<6hex>`. (WARM_DOMAINS['keycloak'] equals stable_domain('keycloak').)"""
     return f"warm-{recipe}.ci.commoninternet.net"