chore(tangle-cloud): host inference bazaar on canonical blueprint domain

[drewstone]

Promote develop → master to ship the Inference Bazaar iframe host migration to production (cloud.tangle.tools).

Net change to production: apps/tangle-cloud/src/blueprintApps/registry.ts only (curated registry externalApp + iframe url/host/origin moved from the surplus-market.pages.dev alias to the canonical inference-bazaar.blueprint.tangle.tools). Verified via git merge-tree origin/master origin/develop: 1 file, 5/5 lines, no conflicts.

The new host is already serving 200 (CF Pages project + proxied CNAME on tangle.tools) and matches the *.blueprint.tangle.tools suffix allowlist, so embedding works via both the curated and metadata paths. The old .pages.dev alias only worked through the curated exception.

Companion to surplus#39 (app-side hosting move). After this lands on prod, the old surplus-market CF Pages project is deleted.

[netlify]

✅ Deploy Preview for tangle-dapp canceled.

Name	Link
🔨 Latest commit	8490935
🔍 Latest deploy log	https://app.netlify.com/projects/tangle-dapp/deploys/6a301631666c7900075bfc6d

[netlify]

✅ Deploy Preview for tangle-leaderboard canceled.

Name	Link
🔨 Latest commit	8490935
🔍 Latest deploy log	https://app.netlify.com/projects/tangle-leaderboard/deploys/6a30163146735f0008f93c95

[tangletools]

✅ Auto-approved PR — 8490935f

Blanket team auto-approval is enabled for this reviewer service.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-06-15T15:11:48Z}

[netlify]

✅ Deploy Preview for tangle-cloud canceled.

Name	Link
🔨 Latest commit	8490935
🔍 Latest deploy log	https://app.netlify.com/projects/tangle-cloud/deploys/6a301631ec45da0008d9eacc

[tangletools]

🟢 Value Audit — sound

Verdict	sound
Concerns	0 (none)
Heuristic	0.0s
Duplication	0.0s
Interrogation	79.1s (2 bridge agents)
Total	79.1s

💰 Value — sound

Repoints the Inference Bazaar curated registry entry from the surplus-market.pages.dev Cloudflare Pages alias to the canonical inference-bazaar.blueprint.tangle.tools domain; a minimal, consistent configuration change.

• What it does: In apps/tangle-cloud/src/blueprintApps/registry.ts (lines 295-311) it changes the Inference Bazaar externalApp.url/host and iframe.url/origin from https://surplus-market.pages.dev to https://inference-bazaar.blueprint.tangle.tools, plus updates the associated comment. No other files are modified.
• Goals it achieves: 1) Makes the new canonical domain the source of truth for the embedded Inference Bazaar app. 2) Brings the host in line with the *.blueprint.tangle.tools suffix allowlist in apps/tangle-cloud/src/blueprintApps/policy.ts:33-36 and the CSP frame-src in apps/tangle-cloud/netlify.toml:71, so embedding now works through the metadata-driven path as well as the curated path. 3) Allows decommissioning
• Assessment: Good. The change is tiny, targeted, and follows the exact same pattern already used for the other three first-party iframe apps (trading, sandbox, llm-inference) in the same registry file. It correctly updates both the user-facing externalApp handoff and the runtime iframe policy, keeping them in sync. The new host matches the codebase's existing iframe host-suffix allowlist, so the security m
• Better / existing approach: none — this is the right approach. I checked the surrounding code: apps/tangle-cloud/src/blueprintApps/registry.ts is the established curated-registry location, apps/tangle-cloud/src/blueprintApps/policy.ts defines the wildcard allowlist, and other first-party apps hardcode their *.blueprint.tangle.tools URLs in the same way. No existing env-driven or shared config for per-app iframe URLs was fo

🎯 Usefulness — sound

Canonical-domain migration for an already-wired curated iframe app; fits the established *.blueprint.tangle.tools allowlist pattern and has active callers.

• Integration: Wired correctly and reachable. The registry entry is consumed by getBlueprintAppBySlug/getBlueprintAppForMetadata (registry.ts:431-479), which are called from route pages ([id]/page.tsx:57, [slug]/[serviceId]/page.tsx:27,40, [publisher]/[slug]/page.tsx:18) and useResolvedBlueprintView.ts:45,60. The bazaar entry matches metadata identity publisherNamespace: 'tangle', `requestedSlug:
• Fit with existing patterns: Fits the codebase's established pattern. All other curated iframe apps (trading, sandbox, llm-inference) already use *.blueprint.tangle.tools hosts (registry.ts:95, 171, 365). The new host matches the suffix allowlist in policy.ts:33-36, so the metadata-driven path can now embed it too; the old .pages.dev alias only worked through the curated exception.
• Real-world viability: Holds up. This is a pure URL swap in an existing entry; no new concurrency, error-handling, or input-validation surface is introduced. The sandbox policy, origin validation (iframe/origin.ts), and manifest gating (manifest.ts:220-271) continue to apply unchanged. The PR body notes the canonical host is already serving 200.

No concerns — sound change, no better or existing approach found. ✅

---

What this audit checks

It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.

Pass	What it asks
Heuristic	Vague title? Whitespace-only or cruft-bearing diff? (content signals only)
Duplication	Do added function/class names already exist elsewhere in the repo?
Value Audit	What does it do? What goal does it achieve? Is it good? Better architecture or already-exists?
Usefulness Audit	Does it integrate and fit? Will it hold up in real use and actually get used?

Findings are concerns, not blocks — the human reviewer decides what to do with them.

_{value-audit · 20260615T151711Z}