Start or retry proving the brand's domain: the certificate row is ensured and a job issues it over ACME HTTP-01, retrying while the DNS propagates (about a day at most); on success the brand flips pending_domain to active. ASYNC: tell the reseller to point the domain's CNAME at the platform, then poll get_whitelabel with include ssl_certificate until status is active (or the certificate's last_error names the fault: domain_not_pointed, domain_validation_failed). Idempotent while pending; a no-op on an active brand; 404 on a deleted one.

Contract:

• MCP tool activate_whitelabel, registry package mcp.id/whitelabels, mount id.partner.
• Operation action, response envelope action_async.
• Flags: none.