Keycloak pins one issuer and each portal is configured with one authority; when
they drift the symptom lands three services away — a login that bounces back
logged out, or a 401 from the BFF (ADR-0010) — so assert they are the same
string. The same check states what publishing the stack has to mean: with
`public.domain` set the five hostnames are served and both halves become
`https://auth.<domain>`, and with it empty nothing of the edge renders, which is
what compose, CI and a laptop cluster depend on.
Red: the chart has no `public.domain`, so setting it changes nothing and no
hostname is published.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
notandClaude Opus 5
88fda30008