carlos / platform Public

Tito needs a second public registrable domain, tito.page, served by the platform edge the way *.go.tito.io already is — so that account-authored HTML, CSS and JS stops living inside the cookie scope of the domain we sign in on.

Filed from the titogo side. The design record is docs/superpowers/specs/2026-09-03-preview-origin-isolation-design.md in teamtito/titogo (merged in #2219).

Why

Tito's core invariant is an origin split: admin lives only on the root domain (go.tito.io), so credentials only ever exist on the root origin, and account-customizable pages render only on the account's own host. That split is what makes fully-custom pages safe.

Today the account's host is <slug>.go.tito.io — a subdomain of the domain we sign in on. It is a genuinely different origin, so it is safe against script. It is the same site, so account JS sits inside the root domain's cookie scope, alongside titogo_2fa, titogo_last_account, titogo_buyer, titogo_portal and titogo_preview.

Moving accounts to <slug>.tito.page is what removes account JS from that scope. Two further things follow from it:

• Licensed webfonts. A foundry licence is commonly tied to a domain and enforced as an Access-Control-Allow-Origin check at the font host. Font loads are CORS-mode by specification. An organizer's licensed face resolves on the address they licensed, and tito.page is the address we would tell them to license.
• The customer-facing address is better. techarena.tito.page reads as the customer's, where techarena.go.tito.io reads as ours.

What we are asking for

1. <slug>.tito.page hosts, routed to the account's instance exactly as <slug>.go.tito.io is today. Same routing, new apex.
2. *A certificate covering `.tito.page`** — a wildcard, or per-host issuance if that fits the edge's existing model better. See the note on quotas below.
3. *`.tito.page DNS pointed at the edge.** The zone does not have to move; a CNAME delegation for _acme-challenge` is enough if dns-01 is how issuance works today.
4. go.tito.page reserved as app-owned, so no account can ever claim it. Note this is not internal/carlos/router.go's reservedSlugs, which reserves path slugs on the root domain — whoever serves *.tito.page is what decides who may claim a host.

What we are not asking for

Nothing in titogo. We verified that the platform edge terminates TLS and routes account hosts with no titogo router involved: dig demo.go.tito.io returns CNAME edge.platform.tito.io., both it and go.tito.io answer with x-carlos-version, and that header appears nowhere in titogo's source. internal/wildcard in the titogo router is off by default everywhere (TITO_WILDCARD_DOMAINS unset). So this is entirely a platform change, and an earlier draft of our design record that said otherwise was wrong.

Two things worth knowing before scoping it

A wildcard certificate and a Public Suffix List entry are compatible. We had assumed these were a fork requiring a decision. They are not. Let's Encrypt refuses a wildcard only when the base domain is an ICANN suffix — Boulder's policy/pa.go checks iana.ExtractSuffix(baseDomain) and never consults the PSL's private section. Verified live: netlify.app, vercel.app and onrender.com all sit in the private section and all serve wildcard certificates today (CN=*.netlify.app from DigiCert, CN=*.vercel.app from Google Trust Services). So we intend to pursue both, and the PSL submission does not block issuance.

Per-host issuance has a quota shape worth checking against the edge's current limits. titogo's own deploy docs cap new tunnel hosts at 5/day (TITO_TUNNEL_MAX_NEW_HOSTS_PER_DAY) for Let's Encrypt quota reasons. If per-host is the preferred route, onboarding a batch of accounts to tito.page will need that thought through; a wildcard sidesteps it.

Timing — this is not blocking us

Worth saying plainly, because our own first plan got this wrong and parked six tasks behind it.

The security work this came out of ships on <slug>.go.tito.io, which already exists and is already foreign to the admin origin. tito.page buys fidelity and cookie isolation, not capability. So please scope this on its own merits rather than as an unblock — nothing of ours is stopped waiting for it.

The PSL submission is ours to start and has months of lead time, so we are starting it in parallel.

Contact

Paul, on the titogo side. Happy to take this to whatever shape suits — the four items above are the substance, not the form.