Claim Step 3: tenant label + canonical namespace search UI and CommandLayer namespace guardrails

[GsCommand]

Motivation

• Provide a safer, clearer Claim Step 3 experience so users can activate under CommandLayer canonical parents or use their own ENS while preventing illegitimate CommandLayer namespace claims.
• Surface wallet-detected ENS names without pretending verification and keep user-owned ENS activations gated until ownership/control verification exists.
• Enforce server-side guardrails so the commandlayer-namespace endpoint only accepts CommandLayer-mode requests mapped to supported canonical parents.

Description

• UI: Replace the single ENS input on Step 3 with a Tenant label input, a Search CommandLayer capability namespaces autocomplete, and a separate ENS namespace field for user-owned mode, plus contextual safety copy and tenant validation hints in public/claim.html.
• UX: Add client-side state and helpers for tenant label validation (validTenantLabel), canonical parent selection (limited to the 10 Trust Verification parents), rendering of selected canonical parents, and explicit wallet-ENS detection messaging with controlStatus: not_checked (no fake verification).
• Backend: Tighten api/claim/commandlayer-namespace.js validation to require activationMode === 'cl', reject tenants containing .eth, require that each capability maps to a supported Trust Verification canonical parent, ensure agents entries match tenant + '.' + canonicalParent, and verify declared capabilities include each agent's capability.
• Tests: Add tests to tests/api-claim-commandlayer-namespace.test.js covering rejection of activationMode: 'own', invalid agent ENS parent, unsupported canonical parent mapping, and tenant values containing .eth.
• Non-changes: No payment flow, ENS provisioning, fake ENS ownership verification, fake ERC-8004 behavior, token balance display, or unauthorized activation was added.

Testing

• Ran npm test; all tests passed (47/47) after the changes, including the new backend guardrail tests.
• Ran example checks in examples/webhook-auto-verify with npm install and npm run check; the example check succeeded.
• npm run build is not present in this repo (no build script) and therefore was not executed.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
commandlayer-commandlayer-org	Building	Preview	May 22, 2026 8:41pm
commandlayer-org	Building	Preview	May 22, 2026 8:41pm
commandlayer-org111	Building	Preview	May 22, 2026 8:41pm