# 2026-05-15 — Universe Onboarding PR1

Resumed `/plans/universe-onboarding.md` at PR1 (Broker config foundations: `WorldConfig.PublicURL`).

## Changes

- `tools/demarkus-broker/internal/broker/config.go` — added `WorldConfig.PublicURL string` with a doc comment explaining the field belongs on the broker (single source of truth for the client-facing address), is optional, and that a blank value means "skip in /me/install."
- `deploy/helm/demarkus-broker/values.yaml` — documented `publicURL` in the commented worlds[] example with the rationale for setting it.
- `deploy/helm/demarkus-broker/templates/secret-config.yaml` — render `publicURL: "<value-or-empty>"` for every world. Always emitted so the YAML shape is stable across set/unset, and operators can grep for the field.
- `tools/demarkus-broker/internal/broker/config_test.go` — two new subtests: empty default round-trip + explicit `mark://` value round-trip.
- `deploy/helm/demarkus-broker/tests/secret-config_test.yaml` — two new cases: blank renders as `publicURL: ""`, operator-supplied value renders verbatim.

## Verification

- `go test ./internal/broker/ -run TestLoadConfig` → 29/29 pass (2 new).
- `helm unittest -f tests/secret-config_test.yaml .` → 13/13 pass (2 new).
- `bash pre-commit.sh` → format, vet, lint clean across protocol/server/client/tools.

## Scope discipline

No validation in PR1 — plan calls for "optional; validation only requires it when used." Shape validation (`mark://` URL, port present, etc.) lives with the `/me/install` consumer in PR5.

`KnownFields(true)` means older broker binaries would reject the new chart's rendered config because of the unknown `publicURL` line. Chart appVersion gates broker upgrade as usual; not new for this PR.

## Next

PR2 — broker discovery doc (`GET /.well-known/openid-configuration` proxying the IdP discovery with device-endpoint overrides). Resume at `tools/demarkus-broker/internal/broker/discovery.go` (new file) + route registration in `server.go`.

Pending review: should PR1 ship as a standalone PR or be folded into PR2? Plan calls for independent reviewability per PR, so default is standalone.