Public Suffix List submission

Status: prepared, not yet submitted (blocked on the production apex being live).

Listing imaginook.app as a private entry on the Public Suffix List makes every user subdomain (*.imaginook.app) its own registrable site. That upgrades the isolation described in origin-model.md from same-site to cross-site: browsers stop treating a user subdomain as same-site with the Console, so SameSite cookies are never sent between them and one user subdomain can't be treated as same-site with another.

This is a long-lead external process (a PR to the publicsuffix/list repo, reviewed by volunteers, then propagated into browser releases over weeks to months), so it is filed early and does not gate the launch — the __Host- cookie and header isolation protect users in the meantime.

The entry to submit

Add under the // Submitted by... PRIVATE DOMAINS section of public_suffix_list.dat, alphabetically:

// Imaginook : https://imaginook.app
// Submitted by <ops contact> <security@imaginook.app>
imaginook.app

Submission checklist (per publicsuffix.org guidelines)

1. The production apex imaginook.app is live and serves the Console.
2. A _psl DNS TXT record (or the required verification the guidelines specify at submission time) points to the pull request, proving control of the domain.
3. Open a PR against publicsuffix/list adding the entry above, using the current PR template and rationale ("multi-tenant host: each *.imaginook.app is an independent user site; listing isolates them for cookie/same-site boundaries").
4. Respond to reviewer questions; the entry ships to end users only after browser vendors pull the updated list.

After it lands

• Re-test the same-site boundary: a user subdomain should no longer be able to set a SameSite=Lax cookie the Console will send, nor be treated as same-site with the Console.
• Update origin-model.md to note the boundary is now cross-site.
• Consider whether any first-party behaviour relied on the old same-site treatment (none is expected — the Console is single-host and its cookies are already __Host-/host-only).