app.stormtrust.net

app.stormtrust.net is the authenticated StormTrust command center. It combines tenant-scoped storm evidence, a map-led operating view, collaborative workspaces, and accountable agents behind the existing StormTrust sign-in.

User journey

Sign in with StormTrust
          ↓
Select an authorized tenant
          ↓
Explore the map, evidence, or a workspace
          ↓
Ask an agent to research or prepare work
          ↓
Review every proposed external action

StormTrust Auth remains the only login. The gateway establishes a host-only session and injects verified identity headers. App Core resolves the user to a tenantId:principalId key and an active tenant membership. Email addresses are never identity keys or authorization boundaries.

Agent documentation context

Every signed-in member's ambient StormTrust connection can search and read the published StormTrust documentation. The corpus is generated deterministically from rendered pages during the Developers application build, so agents receive the same reviewed content that people read at developers.stormtrust.net.

Tool	Result
`searchDocumentation(query, limit?)`	Ranked matching sections with source links
`getDocumentationPage(path)`	One full published page and its digest
`listDocumentationSections()`	Available sections and page counts

Each call records a Gatekeeper observation. The ambient connection has no documentation write capability.

Documentation authoring

StormTrust platform administrators may connect the separate StormTrust documentation author. It can read MDX only under org/apps/developers/src/content/docs/stormtrust/, prepare replacement content against an exact main commit, and return the full unified diff.

Opening a draft pull request is a separate human-confirmed action. The review shows the exact diff, base commit, and branch before the Gatekeeper obtains a short-lived GitHub App installation token. If main changed after preparation, the action stops and asks for a fresh preview.

The author cannot delete or rename files, edit another repository path, label a pull request, mark it ready, merge it, or deploy it. GitHub review and the label-driven CI/CD workflow remain the release authority.

Local development uses an ignored source corpus and ends at a preview. It does not require GitHub credentials and cannot write to GitHub.

Runtime

The command center uses eight private Workers:

Worker	Responsibility
`stormtrust-app-router`	SPA assets and private request routing
`stormtrust-app-workshop`	Workspaces, agents, Gadgets, and approvals
`stormtrust-app-context`	Tenant-scoped Context collections
`stormtrust-app-scheduler`	Scheduled and recurring work
`stormtrust-app-gatekeeper`	Read-only StormTrust evidence and published documentation
`stormtrust-app-docs-author`	Administrator-only MDX previews and draft pull requests
`stormtrust-app-core`	Tenants, memberships, invitations, sessions, and audit
`stormtrust-app-error-reporter`	Structured application error events

The gateway is the only public ingress. It reaches the router through a service binding. Every application Worker has workers.dev and preview URLs disabled and has no custom domain or public route.

Ownership and deployment

Terraform owns Worker identities, D1, KV, R2, AI Gateway, ordinary DNS, and the production environment policy. Wrangler owns application code, assets, service bindings, Durable Object migrations, and deploy-time observability. The public, stable GitHub App ID is committed in the app deployment configuration. The protected GitHub environment gates deployment, and an organization secret selected only for infrastructure holds the private key. Terraform owns that allow-list, never the private-key value.

An organization owner retains the GitHub App registration and its selected-repository list. The provider resource for that relationship requires a broad classic personal access token, which conflicts with the Terraform credential boundary. Terraform still rejects all-repository installations, unexpected permissions, webhooks, suspension, and duplicate installations. The Worker also requests each short-lived token for only StormTrust/infrastructure.

Production releases run only in the trusted pull-request and main workflows. Run the local contract from the repository root:

make app-verify APP=app

Operational guides

Use the shared validation and deployment guides and health evidence by app. For a failed release, follow recovery procedures with this application's state and access boundaries.