chore(viewer): the holon viewer becomes the xbrlkit viewer at xbrlkit.com

[jfrench9]

Summary

The holon viewer is becoming the xbrlkit viewer: the repository was renamed to xbrlkit-viewer on 2026-09-09 and its home moves from holon.robosystems.ai to xbrlkit.com. This PR is the platform's side of that move — the API origin allowlist, the deploy identity, and the SEC catalog's viewer links. The viewer's own repository carries the rest (brand, static site, its CloudFormation stack) in a separate PR.

holon.robosystems.ai is not going away. It keeps serving as an alias of the same deployment: every published xbrlkit view before 0.10 opens that host and names it as the only origin allowed to read the report it serves, so a redirect would break those installs. Both origins stay allowed.

Changes

CORS allowlist — robosystems/config/env.py, .env.example

• New VIEWER_URL (default https://xbrlkit.com; https://staging.xbrlkit.com on staging) joins the origins get_main_cors_origins() derives for deployed environments. Graph mode in the viewer is a browser-to-API call, so the new host needs this before it can talk to the API.
• HOLON_URL stays, re-described as the viewer's original host served as an alias. It is still an allowed origin.
• The allowlist order is ROBOLEDGER_URL, ROBOINVESTOR_URL, ROBOSYSTEMS_URL, VIEWER_URL, HOLON_URL; the dev list is untouched.

Deploy identity — cloudformation/bootstrap-oidc.yaml, bin/setup/bootstrap.sh

• The frontend role's trust policy names the renamed repository: parameter GitHubHolonViewerRepoName → GitHubViewerRepoName, default xbrlkit-viewer. GitHub mints the OIDC token's subject from the repository's current name, so without this the viewer's deploys fail at role assumption. bootstrap.sh passes only the org and backend-repo parameters, so the new default takes effect on the next just bootstrap-oidc.
• The same role's CloudFormation and S3 scoping follow the viewer's new resource names: stack/XbrlkitViewer* and xbrlkit-viewer-* buckets replace stack/RoboSystemsHolonViewer* and robosystems-holon-viewer-*. The viewer's stack is being recreated under those names rather than renamed in place. Reviewers: this is the one change that alters an IAM policy; the role's ceiling (FrontendRoleBoundary) is untouched.
• bootstrap.sh's frontend-repo discovery loop reads the renamed parameter.

SEC catalog — robosystems/adapters/sec/pipeline/configs.py

• viewer_url defaults to https://xbrlkit.com, so catalog files written from now on carry viewer links at the new host. Files already published keep their holon links, which keep working through the alias; a full_rebuild catalog run rewrites them when convenient.

Docs — SECURITY.md (OIDC repo list; the S3 scoping line now describes both roles accurately, which it did not before), bin/setup/README.md, cloudformation/README.md.

Tests — tests/config/test_env.py covers the new origin in the prod, staging and fork-domain derivations; tests/adapters/sec/pipeline/test_catalog.py uses the new host in its viewer-link fixtures.

Breaking Changes

None. No GraphQL, operations-envelope, or REST shape changes; nothing the SDKs generate from moves. VIEWER_URL is a new optional setting with a default, and HOLON_URL keeps its name and default.

Testing

• just test-code — ruff, format check, basedpyright and cf-lint all clean.
• uv run pytest tests/config/test_env.py tests/adapters/sec/pipeline/test_catalog.py — 53 passed.
• The full just test-all unit run was not executed for this PR; the change touches configuration defaults and a template, and the two affected modules were run directly.

Certification

• I have the right to submit this work under the Apache 2.0 license, and do so. Where any part of it is owned by my employer, I have their permission.

[github-actions]

Change classification: normal — platform or application code changed.

A normal change carries a documented automated review on this pull request before merge, in place of a second human approver. The change-classification job requests that review and passes once it has been posted. Recorded by the change-classification job.

[jfrench9]

@claude please review this PR

[claude]

Claude finished @jfrench9's task in 1m 17s —— View job

---

Review complete ✅

Todo list

• Gather context (diff, changed files)
• Review CORS allowlist changes (robosystems/config/env.py, .env.example)
• Review deploy identity changes (cloudformation/bootstrap-oidc.yaml, bin/setup/bootstrap.sh)
• Review SEC catalog change (robosystems/adapters/sec/pipeline/configs.py)
• Review docs updates (SECURITY.md, READMEs)
• Review test updates

Summary

This is a clean, well-scoped rename PR. I read through the full diff (git diff origin/main...HEAD) across all 10 files and didn't find any correctness issues or loose ends.

CORS allowlist (robosystems/config/env.py, .env.example)

• VIEWER_URL follows the exact same pattern as the existing HOLON_URL (staging vs. prod default, get_str_env override), and is correctly inserted into the get_main_cors_origins() tuple ahead of HOLON_URL (robosystems/config/env.py:1470-1480). The dev-only origin list is untouched, matching the PR description.
• I verified there's no leftover reference to HOLON_URL being removed or the ordering being wrong — both origins are appended, deduped by _url_origin, consistent with the PR's stated intent of keeping holon.robosystems.ai alive as an alias.

Deploy identity (cloudformation/bootstrap-oidc.yaml, bin/setup/bootstrap.sh)

• GitHubHolonViewerRepoName → GitHubViewerRepoName rename is applied consistently: the CFN parameter, the trust-policy !Sub statements, the CFN/S3 IAM resource ARNs (stack/XbrlkitViewer*, xbrlkit-viewer-*), and the bootstrap.sh discovery loop key all match.
• Confirmed the IAM statement CloudFormationWrite/S3 scoping changes are the only policy-affecting edits, as flagged in the PR body — nothing else in FrontendRoleBoundary moved.
• Grepped the repo for any remaining HolonViewer/robosystems-holon-viewer/RoboSystemsHolonViewer references outside the intentionally-preserved HOLON_URL origin — none found.
• bootstrap.sh's deploy_github_oidc only passes GitHubOrg/GitHubRepoName params (bin/setup/bootstrap.sh:461-462, :529-530), so the new xbrlkit-viewer default does take effect on next just bootstrap-oidc without needing an explicit override, as claimed.

SEC catalog (robosystems/adapters/sec/pipeline/configs.py)

• viewer_url default and docstring updated together; the "already-published catalogs keep their holon links, which keep working via the alias" reasoning checks out given HOLON_URL stays in the allowlist.

Docs & tests

• SECURITY.md's updated S3-scoping line is now accurate for both backend and frontend roles (previously understated the frontend role's own bucket scoping).
• Test diffs in tests/config/test_env.py and tests/adapters/sec/pipeline/test_catalog.py cover the new origin/URL correctly in all three CORS derivation paths (prod, staging, fork-domain) and the catalog viewer-link fixtures.

Not run: I wasn't able to execute uv run pytest / just test-code in this sandbox (command execution requires interactive approval not available in this context), so I relied on static review of the diff plus the PR's own reported results (53 passed, just test-code clean). Nothing in the diff looks like it would behave differently than what's described.

No blocking issues found. Nice, tight PR — the alias-preservation reasoning for HOLON_URL is well documented in both the code comment and PR body, which made this easy to verify.