MC #105767 — Bilko Demo CORS/DNS Fix (OCD-11 Resolved)

MC #105767 — Bilko Demo Env CORS/API-host + DNS Retirement (OCD-11 closed) 
 Date: 2026-07-15 | Agent: CodeCraft | Status: RESOLVED 
 Root cause 
 The original UAT finding (MC #105765) conflated two separate, non-overlapping facts as one "CORS bug": 
 
 The Ktor API's CORS_ORIGINS allowlist ( azure-pipelines.yml:889 ) is deliberately scoped to
the customer brand domains only ( app.bilko.cloud , app.bilko.io , app.bilko.company ,
 localhost ). It correctly rejects unrecognized origins — the raw ACA FQDN and
 bilko-demo.alai.no — with a 403 BILKO-AUTH-003 . This is intended access control, not a
defect. 
 bilko-demo.alai.no and bilko-demo-api.alai.no were dead Cloudflare CNAME records pointing
at ghs.googlehosted.com (GCP era, dead since the 2026-06-15 Azure cutover). This was already
tracked as DEPLOY-MAP.md OCD-11 and already declared "dead/retired for customer handoff" in
the canonical docs/operations/DEMO-ACCESS.md (verified 2026-07-12). 
 
 The canonical customer/sales demo entry point, https://app.bilko.cloud/demo?country=HR , was
 never broken . Confirmed live before and after this change: HTTP 200, correct
 access-control-allow-origin header, zero console errors, zero network errors (Playwright
chromium, screenshot in evidence). 
 Action taken 
 
 Deleted 2 dead DNS records from the alai.no Cloudflare zone: bilko-demo.alai.no and
 bilko-demo-api.alai.no (both CNAME → ghs.googlehosted.com ). 
 No code, pipeline, ACA container app, revision, or CORS_ORIGINS config was changed. 
 No production traffic was touched — app.bilko.cloud/.io/.company and
 api.bilko.cloud/.io/.company all confirmed 200 before and after. 
 Updated DEPLOY-MAP.md : OCD-11 marked RESOLVED; 2 stale references to the retired hostnames
corrected to point at the canonical demo URL. 
 
 Why repoint-through-Worker was rejected 
 Both DNS records were proxied=false (grey-clouded), so they could never reach the
 bilko-edge-proxy Cloudflare Worker's Host/SNI rewrite mechanism. The Worker's wrangler.toml 
routes are scoped to the bilko.io / bilko.cloud / bilko.company zones only — not alai.no .
Extending that would require a code change, an azdo pipeline deploy, and a Workers-scoped
Cloudflare API token (only a DNS/zone-scoped token was available at triage time). Disproportionate
for a dead legacy alias already declared retired in canonical docs. 
 Verification 
 
 P2P pre-verifier (Company Mesh): thread mesh-thr-f05cd82e-5678-4178-bc2d-b5a678686c76 ,
Proveo peer end-state PASS. 
 Live Playwright browser check on https://app.bilko.cloud/demo?country=HR : HTTP 200, 0
console errors, 0 network errors, screenshot captured. 
 DNS retirement confirmed via Cloudflare API (record count 0) and authoritative nameserver
 dig (empty answer) for both retired hostnames. 
 Prod safety confirmed: all 6 brand domain + health-check endpoints returned 200
post-change. 
 
 Evidence 
 ~/system/evidence/105767/ — DNS before/after snapshots, Playwright result JSON + screenshot,
direct-probe log, sha256-verified evidence manifest ( evidence-105767.json ). 
 References 
 
 MC #105765 (UAT synthesis that surfaced this) · MC #105767 (this task) 
 Bilko/DEPLOY-MAP.md OCD-11 · Bilko/docs/operations/DEMO-ACCESS.md