docs(02-architecture): hostname model, intent, and architecture updates

Made-with: Cursor

docs/02-architecture/ARCHITECTURAL_INTENT.md

@@ -1,7 +1,7 @@
 # Architectural Intent — Sankofa Phoenix
 
-**Last Updated:** 2026-01-31  
-**Document Version:** 1.0  
+**Last Updated:** 2026-03-25  
+**Document Version:** 1.1  
 **Status:** Active Documentation
 
 ---
@@ -43,6 +43,8 @@ This document describes **intended architectural roles and boundaries** for Sank
 - Future: May evolve to include public UI, delegated access, or other interfaces
 - No permanent restriction on access patterns
 
+**Public sector baseline:** Tenancy, **service catalog vs public marketing** (NON_GOALS §9), SMOA / Complete Credential repo registry: [PUBLIC_SECTOR_TENANCY_MARKETPLACE_AND_DEPLOYMENT_BASELINE.md](PUBLIC_SECTOR_TENANCY_MARKETPLACE_AND_DEPLOYMENT_BASELINE.md), [../../config/public-sector-program-manifest.json](../../config/public-sector-program-manifest.json).
+
 ---
 
 ### 2. Sankofa Brand & Access Layer
@@ -177,10 +179,12 @@ These are **possible futures**, not commitments:
 
 ### Possible Future Evolutions
 
-1. **Public Marketing Split**
-   - `www.sankofa.nexus` → Public marketing
-   - `portal.sankofa.nexus` → Authenticated portal
-   - Or maintain unified model
+1. **Sankofa / Phoenix hostname split (canonical intent)**
+   - `sankofa.nexus` → public **Sovereign Technologies** web
+   - `phoenix.sankofa.nexus` → public **Phoenix Cloud Services** division web
+   - `portal.sankofa.nexus` / `admin.sankofa.nexus` → **client SSO** (Keycloak IdP at `keycloak.sankofa.nexus`)
+   - `dash.sankofa.nexus` → **IP-gated** systems admin + **MFA**
+   - Detail: [EXPECTED_WEB_CONTENT.md](EXPECTED_WEB_CONTENT.md)
 
 2. **Phoenix UI Evolution**
    - May develop delegated UI interfaces