diff --git a/backend/security/src/routes/security.ts b/backend/security/src/routes/security.ts
index 577bcfdc0..ad8a3e1ec 100644
--- a/backend/security/src/routes/security.ts
+++ b/backend/security/src/routes/security.ts
@@ -144,6 +144,53 @@ function sendError(res: Response, err: unknown): void {
     // Retry-After marks it explicitly retryable; both errors are transient
     // from the caller's point of view (an unavailable provider recovers, and
     // an undriveable flow stage is retryable via the SSO button).
+    //
+    // THE RESPONSE DELIBERATELY DOES NOT SAY WHICH OF THE TWO IT IS, so the
+    // SERVER LOG MUST. `PROVIDER_UNAVAILABLE` covers two conditions that call
+    // for opposite responses from whoever is paged:
+    //
+    //   AuthentikUnavailableError  the identity provider is unreachable or too
+    //                              slow -> a platform incident, everyone is
+    //                              affected, go look at the provider.
+    //   UnsupportedFlowStageError  THIS account's login flow presented a stage
+    //                              a server cannot drive (MFA, consent, a
+    //                              prompt) -> nothing is down, browser/SSO
+    //                              sign-in still works, and only callers using
+    //                              the programmatic password grant are
+    //                              affected. `err.message` carries the
+    //                              offending stage component.
+    //
+    // Until 2026-08-26 this branch logged NOTHING and both rendered as one
+    // opaque 503. That cost real time: a monitoring account whose flow gained
+    // an undriveable stage was escalated as "production authentication is
+    // down" while browser sign-in was working the whole time. The stage name
+    // was in the thrown error and was being discarded one line from here.
+    //
+    // The BODY stays generic on purpose and is not what changed. The provider's
+    // raw message can name internal hosts and flow slugs, and this endpoint is
+    // unauthenticated -- `security-routes.test.ts` pins that the message is
+    // never echoed. Diagnosis belongs in the log, which is already trusted with
+    // it; the sibling legacy route (routes/auth.ts) has logged exactly this
+    // split since it was written, so this brings the two into line rather than
+    // inventing a scheme.
+    //
+    // Newlines are stripped before logging: `err.message` is provider-derived
+    // and must not be able to forge extra log lines.
+    const detail = String((err as Error)?.message ?? '').replace(/[\r\n]+/g, ' ')
+    if (name === 'UnsupportedFlowStageError') {
+      console.warn(
+        '[security] createSession 503 PROVIDER_UNAVAILABLE: undriveable Authentik flow stage ' +
+          '(NOT an outage -- browser/SSO sign-in is unaffected; this account needs it). ' +
+          JSON.stringify({ stage: detail })
+      )
+    } else {
+      console.error(
+        '[security] createSession 503 PROVIDER_UNAVAILABLE: Authentik unreachable or too slow ' +
+          '(platform incident -- all password sign-ins affected). ' +
+          JSON.stringify({ detail })
+      )
+    }
+
     res.setHeader('Retry-After', '5')
     res.status(503).json({ error: 'Authentication unavailable', code: 'PROVIDER_UNAVAILABLE' })
     return
diff --git a/backend/security/tests/security-routes.test.ts b/backend/security/tests/security-routes.test.ts
index 290ee46b8..0e3bc681e 100644
--- a/backend/security/tests/security-routes.test.ts
+++ b/backend/security/tests/security-routes.test.ts
@@ -336,6 +336,68 @@ describe('POST /session (password login)', () => {
       expect(JSON.stringify(res.body)).not.toContain('bad day')
     })
   }
+
+  // The body is deliberately identical for both errors (above), so the LOG is
+  // the only thing that tells an operator which one happened -- and they call
+  // for opposite responses: a provider outage pages everyone, an undriveable
+  // flow stage affects one account and nothing is down. Before 2026-08-26 this
+  // branch logged nothing at all, and the ambiguity turned a broken monitoring
+  // credential into a reported production outage. These pin the split.
+  describe('server-side diagnosis (the body cannot carry it, so the log must)', () => {
+    const rejectWith = (name: string, message: string) => {
+      const err = new Error(message)
+      err.name = name
+      return fakeProvider({ passwordLogin: jest.fn().mockRejectedValue(err) })
+    }
+
+    it('names the undriveable stage, and says it is NOT an outage', async () => {
+      // @fuzequality api createSession
+      const warn = jest.spyOn(console, 'warn').mockImplementation(() => {})
+      try {
+        await request(makeApp(rejectWith('UnsupportedFlowStageError', 'ak-stage-authenticator-validate')))
+          .post('/api/v1/security/session')
+          .send({ email: 'x', password: 'y' })
+
+        const logged = warn.mock.calls.map(c => c.join(' ')).join('\n')
+        expect(logged).toContain('ak-stage-authenticator-validate')
+        expect(logged).toContain('NOT an outage')
+      } finally {
+        warn.mockRestore()
+      }
+    })
+
+    it('reports a provider outage distinctly, at error level', async () => {
+      // @fuzequality api createSession
+      const error = jest.spyOn(console, 'error').mockImplementation(() => {})
+      try {
+        await request(makeApp(rejectWith('AuthentikUnavailableError', 'connect ETIMEDOUT')))
+          .post('/api/v1/security/session')
+          .send({ email: 'x', password: 'y' })
+
+        const logged = error.mock.calls.map(c => c.join(' ')).join('\n')
+        expect(logged).toContain('platform incident')
+        expect(logged).not.toContain('NOT an outage')
+      } finally {
+        error.mockRestore()
+      }
+    })
+
+    it('strips newlines so a provider message cannot forge log lines', async () => {
+      // @fuzequality api createSession
+      const warn = jest.spyOn(console, 'warn').mockImplementation(() => {})
+      try {
+        await request(makeApp(rejectWith('UnsupportedFlowStageError', 'ak-stage-x\n[security] FORGED')))
+          .post('/api/v1/security/session')
+          .send({ email: 'x', password: 'y' })
+
+        const logged = warn.mock.calls.map(c => c.join(' ')).join('\n')
+        expect(logged).toContain('FORGED')       // still recorded, not dropped
+        expect(logged).not.toMatch(/\n\[security\] FORGED/)  // but not on its own line
+      } finally {
+        warn.mockRestore()
+      }
+    })
+  })
 })
 
 describe('GET /session (me) — bearer enforcement', () => {
diff --git a/backend/src/index.ts b/backend/src/index.ts
index fa9d9f501..6efdedc52 100644
--- a/backend/src/index.ts
+++ b/backend/src/index.ts
@@ -16,6 +16,7 @@ import internalRoutes from './routes/internal'
 import billingRoutes, { billingWebhookRouter } from './routes/billing'
 import appRegistryRoutes from './routes/appRegistry'
 import appRegistryProxyRoutes from './routes/app-registry'
+import federatedProxyRoutes from './routes/federatedProxy'
 import flagsRoutes from './routes/flags'
 import portalRoutes from './routes/portal'
 import adminPortalRoutes from './routes/adminPortals'
@@ -343,6 +344,14 @@ app.use('/api/v1/app-registry', appRegistryRoutes)
 // federated app (e.g. the built-in Clock) can mount. Forwards the platform JWT
 // verbatim; the applications-service does its own authn/authz.
 app.use('/api/v1/app-registry', appRegistryProxyRoutes)
+// Same-origin federated asset proxy: /apps/<slug>/* -> the remote's in-cluster
+// Service. Without this the path falls through the ingress `/` rule to the
+// frontend, whose SPA fallback answers with 200 + index.html — a remoteEntry
+// that is HTML, which is precisely what the portal census reports. Operator
+// allowlist only (FEDERATED_PROXY_UPSTREAMS); see routes/federatedProxy.ts for
+// why it is not derived from the registry.
+app.use('/apps', federatedProxyRoutes)
+
 // Internal, secret-guarded provisioning endpoint (NOT exposed via public ingress).
 app.use('/internal', internalRoutes)
 
diff --git a/backend/src/routes/federatedProxy.ts b/backend/src/routes/federatedProxy.ts
new file mode 100644
index 000000000..954eaa936
--- /dev/null
+++ b/backend/src/routes/federatedProxy.ts
@@ -0,0 +1,429 @@
+// Same-origin reverse proxy for federated remotes: `/apps/<slug>/*`.
+//
+// WHY THIS EXISTS. `frontend/src/utils/loadFederatedApp.ts:71` resolves every
+// remote against the portal's own origin —
+//
+//     const resolved = new URL(remoteEntry, origin)
+//
+// — so a registered `integration.remoteEntry` of `/apps/finance/remoteEntry.js`
+// is fetched from `https://app.fuzefront.com/apps/finance/remoteEntry.js`.
+// Nothing served that path. It fell through the ingress `/` rule to the
+// frontend, whose SPA fallback answers ANY unmatched path with 200 + index.html
+// — which is exactly why the census scores `fuzequality` as "remoteEntry
+// returned 200 but is HTML". A green healthcheck in front of a blank panel.
+//
+// WHY NOT AN INGRESS PER REMOTE, which is what `.Values.federatedApps` builds.
+// A Kubernetes Ingress may only name a Service in its OWN namespace, and every
+// family product deploys to its own (`fuzemarket`, `fuzequality`, …). The
+// documented escape hatch — an ExternalName Service — is refused by Traefik
+// unless `allowExternalNameServices` is set, and it is false by default. So
+// that mechanism cannot route a single out-of-namespace remote, which is why it
+// has sat as `[]` in every values file since it was written and why only
+// `clock` (same namespace, hand-written block) was ever reachable.
+//
+// A reverse proxy has no such restriction: cross-namespace Service DNS
+// (`http://<svc>.<ns>.svc.cluster.local`) is an ordinary HTTP call. It also puts
+// every remote on the portal's own origin for free, which is what the
+// same-origin/no-mixed-content rule wants anyway.
+//
+// TRUST MODEL — read before adding a "convenient" lookup here.
+// The upstream map is operator configuration ONLY. It is deliberately NOT
+// derived from the app registry, even though the registry knows every remote's
+// URL: any authenticated product can self-register and edit its own manifest
+// (`PUT /apps/{slug}`), so deriving the proxy target from registry data would
+// let a registered app point this proxy at an arbitrary in-cluster address and
+// read the response — a textbook SSRF, unauthenticated at that, since a
+// `<script src>` carries no credentials. An explicit allowlist keeps the set of
+// reachable upstreams equal to the set an operator wrote down.
+//
+// Consequences of that, all intentional:
+//   - GET/HEAD only. These are static asset servers; nothing here should accept
+//     a write, and refusing them shrinks what the proxy can be aimed at.
+//   - Inbound `Authorization` and `Cookie` are NOT forwarded. The portal session
+//     must never reach a remote's static file server.
+//   - Outbound `Set-Cookie` is dropped. A remote cannot set a cookie on the
+//     portal origin through this proxy.
+import express, { Request, Response } from 'express'
+import rateLimit from 'express-rate-limit'
+import axios, { AxiosError, AxiosRequestConfig } from 'axios'
+
+const router = express.Router()
+
+// Upstream request timeout (ms). Asset fetches are fast in-cluster; a remote
+// that is down should fail quickly rather than hold a portal connection open.
+const UPSTREAM_TIMEOUT_MS = parseInt(
+  process.env.FEDERATED_PROXY_TIMEOUT_MS || '10000',
+  10
+)
+
+// Ceiling on a single proxied asset. Module-Federation chunks are usually well
+// under a megabyte; this is a runaway guard, not a tuning knob.
+const MAX_ASSET_BYTES = parseInt(
+  process.env.FEDERATED_PROXY_MAX_BYTES || String(32 * 1024 * 1024),
+  10
+)
+
+// Slugs are lowercase alphanumeric + hyphen. This is a shape check on the map's
+// KEYS, not a naming rule — CLAUDE.md is explicit that a slug's prefix is free
+// and immutable, and nothing here derives, edits or validates a product's slug.
+const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/
+
+// One path segment of an asset URL: unreserved characters plus the few sub-delims
+// that appear in real bundler output, and percent-escapes. Everything else — '/',
+// '\\', ':', '@', '?', '#', control characters — is refused rather than escaped,
+// because those are exactly the bytes that can change which host a URL addresses.
+const SEGMENT_RE = /^(?:[A-Za-z0-9._~!$'()*+,;=-]|%[0-9A-Fa-f]{2})+$/
+// A query string, leading '?' included. Same principle: an explicit set, no
+// control characters, no whitespace.
+const QUERY_RE = /^\?(?:[A-Za-z0-9._~!$&'()*+,;=:@/?-]|%[0-9A-Fa-f]{2})*$/
+
+/**
+ * Make a value safe to appear in a log line.
+ *
+ * Two distinct problems, both real here because slug/method/path all originate
+ * in the request:
+ *   - Log forging: a CR or LF lets a caller write what looks like a second,
+ *     fabricated log entry. Control characters are collapsed to a space.
+ *   - Format-string injection: a '%s' in caller data, if that data is used as
+ *     console's FORMAT argument, silently consumes the next argument. The
+ *     callers below never pass caller data as the format string; this is the
+ *     second layer.
+ */
+export function logSafe(value: unknown): string {
+  // Scanned by code point rather than matched with a character-class regex.
+  // A regex spelling of this trips eslint's `no-control-regex`, and the honest
+  // options there are to suppress the rule or to not need it — this is the
+  // second. A run of control characters collapses to a single space, so a
+  // CR+LF pair cannot become two.
+  let out = ''
+  let lastWasControl = false
+  for (const ch of String(value)) {
+    const code = ch.codePointAt(0) ?? 0
+    const isControl = code < 0x20 || code === 0x7f
+    if (isControl) {
+      if (!lastWasControl) out += ' '
+    } else {
+      out += ch
+    }
+    lastWasControl = isControl
+    if (out.length >= 200) break
+  }
+  return out.slice(0, 200)
+}
+
+export interface UpstreamMap {
+  [slug: string]: string
+}
+
+/**
+ * Parse `FEDERATED_PROXY_UPSTREAMS` — a JSON object of `slug -> base URL`, e.g.
+ *
+ *     {"finance":"http://fuzefinance.fuzefinance.svc.cluster.local:80"}
+ *
+ * Malformed entries are dropped rather than thrown, because this router shares a
+ * process with authentication, the app registry and billing: one bad URL in a
+ * values file must not take the whole portal down. Every rejection is logged at
+ * error level and names the visible consequence, so a dropped entry cannot pass
+ * for a working one.
+ */
+export function parseUpstreams(raw: string | undefined): UpstreamMap {
+  if (!raw || !raw.trim()) return {}
+
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(raw)
+  } catch (err) {
+    console.error(
+      '[federated-proxy] FEDERATED_PROXY_UPSTREAMS is not valid JSON — NO remote ' +
+        'will be proxied and every /apps/<slug>/* request will 404. %s',
+      JSON.stringify({ error: logSafe((err as Error).message) })
+    )
+    return {}
+  }
+
+  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+    console.error(
+      '[federated-proxy] FEDERATED_PROXY_UPSTREAMS must be a JSON object of ' +
+        'slug -> base URL — NO remote will be proxied.'
+    )
+    return {}
+  }
+
+  const out: UpstreamMap = {}
+  for (const [slug, value] of Object.entries(parsed as Record<string, unknown>)) {
+    if (!SLUG_RE.test(slug)) {
+      console.error(
+        '[federated-proxy] ignoring upstream key: not a valid slug shape — that ' +
+          'remote will 404. %s',
+        JSON.stringify({ key: logSafe(slug) })
+      )
+      continue
+    }
+    if (typeof value !== 'string' || !value.trim()) {
+      console.error(
+        '[federated-proxy] ignoring upstream: value is not a non-empty string — ' +
+          'that remote will 404. %s',
+        JSON.stringify({ slug: logSafe(slug) })
+      )
+      continue
+    }
+    let url: URL
+    try {
+      url = new URL(value)
+    } catch {
+      console.error(
+        '[federated-proxy] ignoring upstream: not an absolute URL — that remote ' +
+          'will 404. %s',
+        JSON.stringify({ slug: logSafe(slug), value: logSafe(value) })
+      )
+      continue
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+      console.error(
+        '[federated-proxy] ignoring upstream: protocol is not http/https — that ' +
+          'remote will 404. %s',
+        JSON.stringify({ slug: logSafe(slug), protocol: logSafe(url.protocol) })
+      )
+      continue
+    }
+    // Keep the operator's string verbatim apart from a trailing slash, so what
+    // is logged and what is in the values file read the same. Deliberately NOT
+    // `url.origin + url.pathname`: that drops a default port, turning a
+    // configured `http://svc:80` into `http://svc` in every log line and making
+    // config and diagnostics disagree for no benefit.
+    void url
+    out[slug] = value.trim().replace(/\/+$/, '')
+  }
+  return out
+}
+
+const UPSTREAMS: UpstreamMap = parseUpstreams(
+  process.env.FEDERATED_PROXY_UPSTREAMS
+)
+
+if (Object.keys(UPSTREAMS).length === 0) {
+  console.warn(
+    '[federated-proxy] no upstreams configured (FEDERATED_PROXY_UPSTREAMS is ' +
+      'empty) — /apps/<slug>/* will 404 for every remote. This is the default; ' +
+      'populate federatedProxy.upstreams in the Helm values to enable remotes.'
+  )
+} else {
+  console.log(
+    '[federated-proxy] proxying %d remote(s): %s',
+    Object.keys(UPSTREAMS).length,
+    Object.keys(UPSTREAMS).sort().map(logSafe).join(', ')
+  )
+}
+
+/**
+ * Split the router-relative URL into slug, subpath and query.
+ *
+ * Mounted at `/apps`, so `req.url` looks like `/finance/remoteEntry.js?v=2`.
+ * Returns null when the shape is unusable — including any `..` segment, which is
+ * rejected outright rather than normalised, so no request can climb above the
+ * upstream's base path.
+ */
+export function splitRequest(
+  rawUrl: string
+): { slug: string; subpath: string; query: string } | null {
+  const qIndex = rawUrl.indexOf('?')
+  const path = qIndex === -1 ? rawUrl : rawUrl.slice(0, qIndex)
+  const query = qIndex === -1 ? '' : rawUrl.slice(qIndex)
+
+  const segments = path.split('/').filter(Boolean)
+  if (segments.length === 0) return null
+
+  const [slug, ...rest] = segments
+  if (!SLUG_RE.test(slug)) return null
+  // Reject traversal and encoded traversal before it can reach the upstream.
+  if (rest.some(s => s === '..' || s === '.' || /%2e%2e/i.test(s))) return null
+  // Whitelist, not blacklist: every remaining segment must look like an asset
+  // filename. This is what keeps caller-controlled bytes out of the upstream
+  // URL's authority — a backslash, a colon, a control character or a stray '@'
+  // can all change how a URL parses, so none of them are allowed through.
+  if (!rest.every(s => SEGMENT_RE.test(s))) return null
+  if (query && !QUERY_RE.test(query)) return null
+
+  return { slug, subpath: rest.join('/'), query }
+}
+
+/**
+ * Build the upstream URL from an ALLOWLISTED base plus caller-supplied path and
+ * query.
+ *
+ * Deliberately not string concatenation. The path and query are attached through
+ * the WHATWG URL API, which cannot alter the authority, and the result's origin
+ * is then compared byte-for-byte against the base's. Two independent controls
+ * therefore have to fail before a request could leave for a host an operator did
+ * not configure — the allowlist lookup, and this assertion.
+ *
+ * Returns null rather than a best-effort URL if anything does not line up; the
+ * caller refuses the request.
+ */
+export function buildUpstreamUrl(
+  base: string,
+  subpath: string,
+  query: string
+): string | null {
+  let baseUrl: URL
+  try {
+    baseUrl = new URL(base)
+  } catch {
+    return null
+  }
+
+  const target = new URL(baseUrl.href)
+  const basePath = baseUrl.pathname.replace(/\/+$/, '')
+  // Assigning .pathname cannot change protocol, host or port — that is the point
+  // of using the setter instead of building a string.
+  target.pathname = subpath ? `${basePath}/${subpath}` : `${basePath}/`
+  target.search = query
+  target.hash = ''
+
+  // Belt and braces: if anything above somehow moved the origin, refuse.
+  if (target.origin !== baseUrl.origin) return null
+  if (target.protocol !== baseUrl.protocol) return null
+  if (target.host !== baseUrl.host) return null
+
+  return target.href
+}
+
+async function proxy(req: Request, res: Response): Promise<void> {
+  // Static assets only. Anything else would widen what an allowlisted upstream
+  // can be asked to do; see the trust model at the top of this file.
+  if (req.method !== 'GET' && req.method !== 'HEAD') {
+    res.setHeader('Allow', 'GET, HEAD')
+    res.status(405).json({
+      error: 'method_not_allowed',
+      detail: 'The federated asset proxy serves GET and HEAD only.',
+    })
+    return
+  }
+
+  const parts = splitRequest(req.url)
+  if (!parts) {
+    res.status(400).json({ error: 'bad_request', detail: 'Malformed asset path.' })
+    return
+  }
+
+  const base = UPSTREAMS[parts.slug]
+  if (!base) {
+    // Deliberately the same answer whether the slug is unknown or merely
+    // unconfigured: this endpoint is unauthenticated, and it should not report
+    // which products exist.
+    res.status(404).json({
+      error: 'remote_not_configured',
+      detail: `No federated upstream is configured for "${parts.slug}".`,
+    })
+    return
+  }
+
+  const url = buildUpstreamUrl(base, parts.subpath, parts.query)
+  if (!url) {
+    // Unreachable given the allowlist and the segment whitelist above; if it
+    // ever fires, the request is refused rather than sent somewhere unintended.
+    console.error(
+      '[federated-proxy] refusing request: could not be resolved inside the ' +
+        'configured upstream origin. %s',
+      JSON.stringify({ slug: logSafe(parts.slug) })
+    )
+    res.status(400).json({ error: 'bad_request', detail: 'Malformed asset path.' })
+    return
+  }
+
+  const config: AxiosRequestConfig = {
+    method: req.method as 'GET' | 'HEAD',
+    url,
+    // NOTE the omissions: no Authorization, no Cookie. The portal session must
+    // not reach a remote's file server.
+    headers: {
+      // Pass conditional-request headers so the browser cache keeps working.
+      ...(req.headers['if-none-match']
+        ? { 'If-None-Match': req.headers['if-none-match'] as string }
+        : {}),
+      ...(req.headers['if-modified-since']
+        ? { 'If-Modified-Since': req.headers['if-modified-since'] as string }
+        : {}),
+      ...(req.headers['accept']
+        ? { Accept: req.headers['accept'] as string }
+        : {}),
+    },
+    timeout: UPSTREAM_TIMEOUT_MS,
+    // Relay the upstream's status verbatim — a remote's own 404 is a real
+    // answer and must not be laundered into a 200.
+    validateStatus: () => true,
+    responseType: 'arraybuffer',
+    maxContentLength: MAX_ASSET_BYTES,
+    maxRedirects: 0,
+  }
+
+  try {
+    const upstream = await axios.request(config)
+
+    // Content-Type is the whole ballgame for Module Federation: the browser
+    // refuses a module served as text/html, which is the failure the census
+    // reports today. Relay it exactly as the upstream sent it.
+    const passthrough = [
+      'content-type',
+      'cache-control',
+      'etag',
+      'last-modified',
+   ]
+    for (const h of passthrough) {
+      const v = upstream.headers[h]
+      if (v) res.setHeader(h, v as string)
+    }
+    // Content-Encoding and Content-Length are deliberately NOT relayed: axios
+    // has already decompressed the body, so echoing `gzip` would hand the
+    // browser plaintext labelled as compressed and break every chunk.
+    // Set-Cookie is dropped — a remote cannot set cookies on the portal origin.
+
+    res.status(upstream.status).send(Buffer.from(upstream.data))
+  } catch (err) {
+    const ax = err as AxiosError
+    // Constant format string; every caller-derived value goes through logSafe
+    // and is passed as an ARGUMENT, never as the format.
+    console.error(
+      '[federated-proxy] upstream error: %s',
+      JSON.stringify({
+        slug: logSafe(parts.slug),
+        method: logSafe(req.method),
+        url: logSafe(url),
+        code: logSafe(ax.code || ax.message),
+      })
+    )
+    res.status(502).json({
+      error: 'remote_unavailable',
+      slug: parts.slug,
+      code: ax.code || 'EUPSTREAM',
+    })
+  }
+}
+
+// Rate limit. This endpoint is unauthenticated by necessity — a `<script src>`
+// carries no credentials — and each request costs an outbound in-cluster fetch,
+// so without a ceiling one client can turn the portal into a load generator
+// pointed at another team's service. The window is deliberately generous:
+// mounting a remote fetches remoteEntry plus every chunk it imports, so a normal
+// page load is a burst of dozens of requests, and a limit tuned for an API would
+// break legitimate use.
+const limiter = rateLimit({
+  windowMs: parseInt(process.env.FEDERATED_PROXY_RATE_WINDOW_MS || '60000', 10),
+  limit: parseInt(process.env.FEDERATED_PROXY_RATE_MAX || '600', 10),
+  standardHeaders: 'draft-7',
+  legacyHeaders: false,
+  message: { error: 'rate_limited' },
+})
+
+router.use(limiter, (req, res) => {
+  void proxy(req, res)
+})
+
+export default router
+
+// Exported for tests / introspection.
+export const __federatedProxyConfig = {
+  UPSTREAMS,
+  UPSTREAM_TIMEOUT_MS,
+  MAX_ASSET_BYTES,
+}
diff --git a/backend/tests/federated-proxy.test.ts b/backend/tests/federated-proxy.test.ts
new file mode 100644
index 000000000..c882c99bb
--- /dev/null
+++ b/backend/tests/federated-proxy.test.ts
@@ -0,0 +1,360 @@
+// Unit tests for the same-origin federated asset proxy
+// (backend/src/routes/federatedProxy.ts).
+//
+// Pure unit tests: the upstream HTTP client is mocked, so this runs with no
+// database and no live remote. What matters here is the wiring and the
+// security-relevant decisions the proxy makes on its own — that it serves only
+// an operator-configured allowlist, never forwards the portal session upstream,
+// never lets a remote set a cookie on the portal origin, and never launders a
+// remote's HTML 404 into a working-looking module.
+
+jest.mock('axios')
+import axios from 'axios'
+const mockedAxios = axios as jest.Mocked<typeof axios>
+
+import request from 'supertest'
+import express from 'express'
+
+process.env.FEDERATED_PROXY_UPSTREAMS = JSON.stringify({
+  finance: 'http://fuzefinance.fuzefinance.svc.cluster.local:80',
+  market: 'https://fuzemarket.fuzemarket.svc.cluster.local:8080/base',
+})
+
+import federatedProxyRoutes, {
+  parseUpstreams,
+  splitRequest,
+  buildUpstreamUrl,
+  logSafe,
+  __federatedProxyConfig,
+} from '../src/routes/federatedProxy'
+
+function buildApp(): express.Application {
+  const app = express()
+  app.use(express.json())
+  app.use('/apps', federatedProxyRoutes)
+  return app
+}
+
+function upstreamReplies(
+  body: string,
+  headers: Record<string, string> = { 'content-type': 'application/javascript' },
+  status = 200
+) {
+  mockedAxios.request.mockResolvedValueOnce({
+    status,
+    headers,
+    data: Buffer.from(body),
+  } as any)
+}
+
+describe('federated asset proxy', () => {
+  let app: express.Application
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+    app = buildApp()
+  })
+
+  describe('routing', () => {
+    it('proxies a remoteEntry to the configured upstream and relays the JS content-type', async () => {
+      upstreamReplies('export default 1')
+      const res = await request(app).get('/apps/finance/remoteEntry.js')
+
+      expect(res.status).toBe(200)
+      expect(res.headers['content-type']).toContain('application/javascript')
+      expect(res.text).toBe('export default 1')
+      expect(mockedAxios.request).toHaveBeenCalledWith(
+        expect.objectContaining({
+          // :80 is normalised away by the URL API — http://h:80 and http://h are
+          // the same URL. The stored allowlist value keeps the operator's :80; only
+          // the derived request URL is normalised.
+          url: 'http://fuzefinance.fuzefinance.svc.cluster.local/remoteEntry.js',
+          method: 'GET',
+        })
+      )
+    })
+
+    it('preserves nested chunk paths and the query string', async () => {
+      upstreamReplies('chunk')
+      await request(app).get('/apps/finance/assets/chunk-abc123.js?v=2')
+
+      expect(mockedAxios.request).toHaveBeenCalledWith(
+        expect.objectContaining({
+          url: 'http://fuzefinance.fuzefinance.svc.cluster.local/assets/chunk-abc123.js?v=2',
+        })
+      )
+    })
+
+    it("keeps a base path the operator wrote into the upstream URL", async () => {
+      upstreamReplies('chunk')
+      await request(app).get('/apps/market/remoteEntry.js')
+
+      expect(mockedAxios.request).toHaveBeenCalledWith(
+        expect.objectContaining({
+          url: 'https://fuzemarket.fuzemarket.svc.cluster.local:8080/base/remoteEntry.js',
+        })
+      )
+    })
+
+    it('404s an unconfigured slug without contacting anything', async () => {
+      const res = await request(app).get('/apps/fuzeagent/remoteEntry.js')
+
+      expect(res.status).toBe(404)
+      expect(res.body.error).toBe('remote_not_configured')
+      expect(mockedAxios.request).not.toHaveBeenCalled()
+    })
+  })
+
+  describe('the failure this proxy exists to end', () => {
+    // The census signature: remoteEntry returns 200 but is HTML, because an SPA
+    // fallback answered a 404 with index.html. The proxy must relay a remote's
+    // real status and real content-type, never improve on them.
+    it("relays a remote's own 404 rather than turning it into a 200", async () => {
+      upstreamReplies('<!doctype html>', { 'content-type': 'text/html' }, 404)
+      const res = await request(app).get('/apps/finance/remoteEntry.js')
+
+      expect(res.status).toBe(404)
+      expect(res.headers['content-type']).toContain('text/html')
+    })
+
+    it('does not relay content-encoding, which would mislabel the decompressed body', async () => {
+      upstreamReplies('plain', {
+        'content-type': 'application/javascript',
+        'content-encoding': 'gzip',
+      })
+      const res = await request(app).get('/apps/finance/remoteEntry.js')
+
+      expect(res.headers['content-encoding']).toBeUndefined()
+      expect(res.text).toBe('plain')
+    })
+  })
+
+  describe('trust model', () => {
+    it('never forwards the portal session upstream', async () => {
+      upstreamReplies('js')
+      await request(app)
+        .get('/apps/finance/remoteEntry.js')
+        .set('Authorization', 'Bearer super-secret')
+        .set('Cookie', 'session=super-secret')
+
+      const sent = mockedAxios.request.mock.calls[0][0] as any
+      const headerNames = Object.keys(sent.headers || {}).map(h => h.toLowerCase())
+      expect(headerNames).not.toContain('authorization')
+      expect(headerNames).not.toContain('cookie')
+      expect(JSON.stringify(sent.headers)).not.toContain('super-secret')
+    })
+
+    it('does not let a remote set a cookie on the portal origin', async () => {
+      upstreamReplies('js', {
+        'content-type': 'application/javascript',
+        'set-cookie': 'evil=1; Path=/; HttpOnly',
+      })
+      const res = await request(app).get('/apps/finance/remoteEntry.js')
+
+      expect(res.headers['set-cookie']).toBeUndefined()
+    })
+
+    it('refuses non-GET/HEAD methods', async () => {
+      const res = await request(app).post('/apps/finance/remoteEntry.js').send({})
+
+      expect(res.status).toBe(405)
+      expect(res.headers['allow']).toBe('GET, HEAD')
+      expect(mockedAxios.request).not.toHaveBeenCalled()
+    })
+
+    it('does not follow redirects, so an upstream cannot bounce the proxy elsewhere', () => {
+      upstreamReplies('js')
+      return request(app)
+        .get('/apps/finance/remoteEntry.js')
+        .then(() => {
+          const sent = mockedAxios.request.mock.calls[0][0] as any
+          expect(sent.maxRedirects).toBe(0)
+        })
+    })
+
+    it('answers 502, not 500, when the remote is unreachable', async () => {
+      mockedAxios.request.mockRejectedValueOnce(
+        Object.assign(new Error('connect ECONNREFUSED'), { code: 'ECONNREFUSED' })
+      )
+      const res = await request(app).get('/apps/finance/remoteEntry.js')
+
+      expect(res.status).toBe(502)
+      expect(res.body).toMatchObject({ error: 'remote_unavailable', slug: 'finance' })
+    })
+  })
+
+  describe('upstream URL construction', () => {
+    it('cannot be moved off the allowlisted origin by the request path', () => {
+      const base = 'http://svc.ns.svc.cluster.local'
+      expect(buildUpstreamUrl(base, 'a/b.js', '')).toBe(
+        'http://svc.ns.svc.cluster.local/a/b.js'
+      )
+      // A segment that looks like a host stays a PATH segment.
+      expect(buildUpstreamUrl(base, 'evil.com/x.js', '')).toBe(
+        'http://svc.ns.svc.cluster.local/evil.com/x.js'
+      )
+    })
+
+    it('keeps the operator base path underneath the subpath', () => {
+      expect(buildUpstreamUrl('https://svc.local/base', 'remoteEntry.js', '')).toBe(
+        'https://svc.local/base/remoteEntry.js'
+      )
+    })
+
+    it('carries the query and drops any fragment', () => {
+      expect(buildUpstreamUrl('http://svc.local', 'a.js', '?x=1')).toBe(
+        'http://svc.local/a.js?x=1'
+      )
+    })
+  })
+
+  describe('request charset whitelist', () => {
+    it.each([
+      ['a colon', '/apps/finance/a:b.js'],
+      ['an at-sign', '/apps/finance/a@evil.com'],
+    ])('refuses a segment carrying %s', async (_label, path) => {
+      const res = await request(app).get(path)
+      expect(res.status).toBe(400)
+      expect(mockedAxios.request).not.toHaveBeenCalled()
+    })
+
+    it('refuses a RAW backslash, asserted at the unit level', () => {
+      // Not exercised over HTTP: superagent percent-encodes a literal backslash
+      // before it leaves the client, so a request test would be checking the
+      // client's encoder rather than this guard.
+      expect(splitRequest('/finance/a\\b.js')).toBeNull()
+    })
+
+    it('ALLOWS a percent-escaped byte — it stays escaped and cannot re-point a URL', () => {
+      // %5C is an encoded backslash. Rejecting it would break legitimate asset
+      // names for no security gain: a percent-escape is inert in the path and
+      // can never alter the authority. The literal character is refused above.
+      expect(splitRequest('/finance/a%5Cb.js')).toEqual({
+        slug: 'finance',
+        subpath: 'a%5Cb.js',
+        query: '',
+      })
+    })
+
+    it('allows the characters real bundler output actually uses', () => {
+      expect(splitRequest('/finance/assets/chunk-abc_123.min.js')).not.toBeNull()
+      expect(splitRequest('/finance/assets/a~b!c$d.js')).not.toBeNull()
+      expect(splitRequest('/finance/assets/a%20b.js')).not.toBeNull()
+    })
+  })
+
+  describe('logging cannot be forged or used as a format string', () => {
+    it('logSafe collapses the control characters that would forge a log line', () => {
+      expect(logSafe('a\nb')).toBe('a b')
+      expect(logSafe('a\r\n[federated-proxy] FORGED')).toBe(
+        'a [federated-proxy] FORGED'
+      )
+      expect(logSafe('a\u0000b')).toBe('a b')
+    })
+
+    it('logSafe bounds the length so one value cannot flood the log', () => {
+      expect(logSafe('x'.repeat(5000)).length).toBe(200)
+    })
+
+    it('passes caller-derived values as ARGUMENTS, never as the format string', async () => {
+      const spy = jest.spyOn(console, 'error').mockImplementation(() => undefined)
+      mockedAxios.request.mockRejectedValueOnce(
+        Object.assign(new Error('boom'), { code: 'ECONNREFUSED' })
+      )
+
+      await request(app).get('/apps/finance/remoteEntry.js')
+
+      const [format, ...args] = spy.mock.calls[0]
+      // The format is a fixed literal: no slug, no method, no URL in it. If a
+      // caller-controlled '%s' ever reached this position it would consume the
+      // next argument and rewrite the line.
+      expect(format).toBe('[federated-proxy] upstream error: %s')
+      expect(format).not.toContain('finance')
+      expect(args).toHaveLength(1)
+      expect(JSON.parse(args[0] as string)).toMatchObject({
+        slug: 'finance',
+        method: 'GET',
+      })
+      spy.mockRestore()
+    })
+  })
+
+  describe('splitRequest', () => {
+    it('rejects traversal so nothing can climb above the upstream base', () => {
+      expect(splitRequest('/finance/../../etc/passwd')).toBeNull()
+      expect(splitRequest('/finance/%2e%2e/secret')).toBeNull()
+    })
+
+    it('rejects a slug that is not slug-shaped', () => {
+      expect(splitRequest('/Finance/remoteEntry.js')).toBeNull()
+      expect(splitRequest('/../remoteEntry.js')).toBeNull()
+    })
+
+    it('parses slug, subpath and query', () => {
+      expect(splitRequest('/finance/assets/a.js?v=1')).toEqual({
+        slug: 'finance',
+        subpath: 'assets/a.js',
+        query: '?v=1',
+      })
+    })
+  })
+
+  describe('parseUpstreams', () => {
+    // A dropped entry must never be able to pass for a working one, so each of
+    // these logs at error level; the assertion here is only that it is dropped.
+    beforeEach(() => {
+      jest.spyOn(console, 'error').mockImplementation(() => undefined)
+    })
+    afterEach(() => {
+      ;(console.error as jest.Mock).mockRestore()
+    })
+
+    it('returns an empty map for absent or blank config', () => {
+      expect(parseUpstreams(undefined)).toEqual({})
+      expect(parseUpstreams('   ')).toEqual({})
+    })
+
+    it('drops the whole map on malformed JSON rather than throwing', () => {
+      expect(parseUpstreams('{not json')).toEqual({})
+      expect(console.error).toHaveBeenCalled()
+    })
+
+    it('rejects a JSON array or scalar — the contract is an object', () => {
+      expect(parseUpstreams('["a"]')).toEqual({})
+      expect(parseUpstreams('"a"')).toEqual({})
+    })
+
+    it('drops entries that are not absolute http/https URLs', () => {
+      expect(
+        parseUpstreams(
+          JSON.stringify({
+            good: 'http://svc.ns.svc.cluster.local',
+            relative: '/apps/thing',
+            scheme: 'file:///etc/passwd',
+            empty: '',
+            notString: 5,
+          })
+        )
+      ).toEqual({ good: 'http://svc.ns.svc.cluster.local' })
+    })
+
+    it('drops keys that are not slug-shaped', () => {
+      expect(
+        parseUpstreams(JSON.stringify({ 'Bad Slug': 'http://x.local' }))
+      ).toEqual({})
+    })
+
+    it('strips a trailing slash so joining never doubles it', () => {
+      expect(parseUpstreams(JSON.stringify({ a: 'http://x.local/base/' }))).toEqual(
+        { a: 'http://x.local/base' }
+      )
+    })
+  })
+
+  it('exposes the parsed allowlist for introspection', () => {
+    expect(Object.keys(__federatedProxyConfig.UPSTREAMS).sort()).toEqual([
+      'finance',
+      'market',
+    ])
+  })
+})
diff --git a/deploy/helm/fuzefront/templates/_helpers.tpl b/deploy/helm/fuzefront/templates/_helpers.tpl
index b0f51d7a8..a4d31bf64 100644
--- a/deploy/helm/fuzefront/templates/_helpers.tpl
+++ b/deploy/helm/fuzefront/templates/_helpers.tpl
@@ -168,3 +168,32 @@ login needs is an outage.
 - /static/dist/
 - /static/authentik/
 {{- end -}}
+
+{{/*
+Render .Values.federatedProxy.upstreams as the JSON object the backend's
+federated asset proxy expects: {"<slug>":"<base url>"}.
+
+Returns "{}" when the feature is disabled or the list is empty, so the env var
+is always present and always parses — a backend that finds no upstreams answers
+404 for every remote, which is the intended default.
+
+Entries missing `slug` or `url` FAIL THE RENDER rather than being skipped. A
+silently dropped remote is indistinguishable from a working one until someone
+opens the portal and finds a blank panel; `helm template` is the last place that
+mistake is cheap to catch.
+*/}}
+{{- define "fuzefront.federatedProxyUpstreams" -}}
+{{- $out := dict -}}
+{{- if .Values.federatedProxy.enabled -}}
+{{- range $i, $u := .Values.federatedProxy.upstreams -}}
+{{- if not $u.slug -}}
+{{- fail (printf "federatedProxy.upstreams[%d] has no `slug` — the browser requests /apps/<slug>/..., so this entry could never be matched." $i) -}}
+{{- end -}}
+{{- if not $u.url -}}
+{{- fail (printf "federatedProxy.upstreams[%d] (slug %q) has no `url` — there is nothing to proxy to." $i $u.slug) -}}
+{{- end -}}
+{{- $_ := set $out $u.slug $u.url -}}
+{{- end -}}
+{{- end -}}
+{{- $out | toJson -}}
+{{- end -}}
diff --git a/deploy/helm/fuzefront/templates/backend.yaml b/deploy/helm/fuzefront/templates/backend.yaml
index 5b32a1dd5..84e0e1f86 100644
--- a/deploy/helm/fuzefront/templates/backend.yaml
+++ b/deploy/helm/fuzefront/templates/backend.yaml
@@ -77,6 +77,13 @@ spec:
                   key: SESSION_SECRET
             - name: FRONTEND_URL
               value: "{{ ternary "https" "http" .Values.ingress.tls.enabled }}://{{ .Values.ingress.host }}"
+            # Federated asset proxy allowlist: slug -> in-cluster base URL,
+            # rendered as JSON from .Values.federatedProxy.upstreams. Absent or
+            # empty means every /apps/<slug>/* answers 404, which is the default
+            # and is a truthful answer rather than the SPA fallback's
+            # 200-that-is-HTML. See backend/src/routes/federatedProxy.ts.
+            - name: FEDERATED_PROXY_UPSTREAMS
+              value: {{ include "fuzefront.federatedProxyUpstreams" . | quote }}
             # Permit.io deferred in the minimal cut; placeholder lets the backend
             # boot (SDK uses throwOnError:false). PDP is intentionally absent.
             - name: PERMIT_API_KEY
diff --git a/deploy/helm/fuzefront/templates/ingress.yaml b/deploy/helm/fuzefront/templates/ingress.yaml
index 02fa4d341..8f97da88f 100644
--- a/deploy/helm/fuzefront/templates/ingress.yaml
+++ b/deploy/helm/fuzefront/templates/ingress.yaml
@@ -84,6 +84,34 @@
       port:
         number: {{ .Values.backend.port }}
 {{- end }}
+{{- if .Values.federatedProxy.enabled }}
+# Federated remotes: /apps/<slug>/* -> the thin backend's same-origin asset
+# proxy (backend/src/routes/federatedProxy.ts), which forwards to each remote's
+# in-cluster Service.
+#
+# This MUST sit above the `/` catch-all. Without it these paths fall through to
+# the frontend, whose SPA fallback answers any unmatched path with 200 +
+# index.html -- so remoteEntry.js resolves, returns 200, and is HTML. The
+# browser refuses it as a module and the panel is blank behind a green
+# healthcheck. That is the exact failure the portal census reports.
+#
+# Why the backend and not an Ingress per remote: an Ingress may only name a
+# Service in its OWN namespace, and the family products each deploy to their
+# own. `.Values.federatedApps` below builds those per-remote Ingresses and is
+# therefore limited to same-namespace apps -- which is why it has been `[]`
+# everywhere. A reverse proxy has no namespace restriction.
+#
+# The dedicated clock-app Ingress further down keeps working: both nginx
+# longest-prefix-match and Traefik rule-length priority rank `/apps/clock`
+# above `/apps`.
+- path: /apps
+  pathType: Prefix
+  backend:
+    service:
+      name: fuzefront-backend
+      port:
+        number: {{ .Values.backend.port }}
+{{- end }}
 # Frontend catch-all. The frontend nginx also fans /api and /socket.io
 # to the per-service backends for in-pod / port-forward scenarios.
 - path: /
diff --git a/deploy/helm/fuzefront/values.yaml b/deploy/helm/fuzefront/values.yaml
index 5df9a1a36..497742a6b 100644
--- a/deploy/helm/fuzefront/values.yaml
+++ b/deploy/helm/fuzefront/values.yaml
@@ -446,6 +446,46 @@ a2aDeploy:
 # Each entry: { slug, serviceName, port, enabled }.
 federatedApps: []
 
+# Same-origin federated asset proxy — the mechanism that actually works
+# cross-namespace, and the one to use for a remote that is NOT in this release's
+# namespace.
+#
+# When enabled, templates/ingress.yaml routes /apps/* to the thin backend, and
+# backend/src/routes/federatedProxy.ts forwards /apps/<slug>/* to the upstream
+# named here. Because that is an ordinary HTTP call rather than an Ingress
+# backend reference, it is not bound by the same-namespace rule that has kept
+# `federatedApps` above empty since it was written, and it needs no
+# ExternalName Service (which Traefik refuses by default:
+# allowExternalNameServices=false).
+#
+# `url` is the remote's in-cluster base — the origin the remote's own assets are
+# served from, NOT including the /apps/<slug> prefix, which the proxy strips.
+# Cross-namespace Service DNS is the normal form:
+#
+#   federatedProxy:
+#     enabled: true
+#     upstreams:
+#       - slug: market
+#         url: http://fuzemarket.fuzemarket.svc.cluster.local:80
+#
+# The list is an ALLOWLIST and is deliberately the only source of upstreams.
+# It is not derived from the app registry: any product can edit its own
+# registered manifest, so deriving the target from registry data would let a
+# registered app aim this proxy at an arbitrary in-cluster address — an SSRF on
+# an unauthenticated endpoint. See the trust model in
+# backend/src/routes/federatedProxy.ts.
+#
+# `slug` must be the slug the remote is REGISTERED under, because that is what
+# the browser requests. It is read here, never written — CLAUDE.md's
+# immutable-slug rule is untouched by this.
+#
+# Empty and disabled by default: with no upstreams every /apps/<slug>/* answers
+# 404, which is a truthful "not configured" rather than the 200-that-is-HTML the
+# SPA fallback produces today.
+federatedProxy:
+  enabled: false
+  upstreams: []
+
 clockApp:
   enabled: false
   image:
diff --git a/frontend/nginx.conf b/frontend/nginx.conf
index 05be4468a..29116c10f 100644
--- a/frontend/nginx.conf
+++ b/frontend/nginx.conf
@@ -198,6 +198,36 @@ http {
             proxy_read_timeout 86400;
         }
 
+        # Federated remotes: /apps/<slug>/* -> the backend's same-origin asset
+        # proxy. MUST be declared, and must sit above `location /`: nginx picks
+        # the longest matching prefix, so without this block these requests fall
+        # into the SPA fallback and remoteEntry.js comes back as 200 + index.html.
+        # A module served as text/html is refused by the browser, which is the
+        # blank-panel-behind-a-green-healthcheck failure the portal census
+        # reports. No Upgrade forwarding — these are static asset fetches.
+        #
+        # All four security headers are repeated here on purpose. `add_header` in
+        # a location block REPLACES the server-level set rather than adding to
+        # it, so an incomplete list here silently drops whatever it omits — this
+        # block originally left out X-XSS-Protection and would have served these
+        # assets without it.
+        #
+        # Host is deliberately NOT forwarded. nginx then sends the upstream's own
+        # name (`$proxy_host`), so a client-supplied Host header cannot reach the
+        # backend. The backend routes these by path only, so it needs nothing
+        # from the original Host.
+        location /apps/ {
+            add_header X-Frame-Options "SAMEORIGIN" always;
+            add_header X-Content-Type-Options "nosniff" always;
+            add_header X-XSS-Protection "1; mode=block" always;
+            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+            proxy_pass http://fuzefront-backend:3001;
+            proxy_http_version 1.1;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
         # Chat-service: AI chat + RAG. SSE streaming, so buffering MUST be off and
         # the read timeout long. baseUrl on the client is `${origin}/chat-api`, so
         # /chat-api/chat/stream maps to the service's /chat/stream.