tegwick da7bc31d45 Document tenant claim ownership and prove registration binding ... Answers the GLAS-WP-0015 tenant-alignment request. The JWT tenant is tenant:coulomb for all four reviewed service registrations; the approval store tenant and the policy tenant belong to other owners and KeyCape does no normalization between them. No mapping is invented and no live registration changes. Adds regression tests proving the tenant claim is bound at registration and is not influenced by request parameters, that distinct registrations never carry each other's tenant, and that human tokens fall back to the platform tenant rather than an empty claim. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6		2026-09-06 20:33:06 +02:00
..
adr	feat: implement T01-T04 — Go module, canonical model, LDAP validator, error taxonomy	2026-03-13 01:27:54 +01:00
approval-engine-auth-contract.md	Add bounded resource audiences and enforce browser scope grants	2026-09-05 00:41:17 +02:00
approval-engine-provisioning-request.yaml	Add native verified login and service-token commands	2026-09-05 01:08:58 +02:00
native-authentication.md	Add native verified login and service-token commands	2026-09-05 01:08:58 +02:00
openbao-service-auth-contract.md	Implement KeyCape provider and service identity contracts	2026-08-23 13:10:13 +02:00
qonto-runtime-identity-contract.md	Define Qonto runtime identity contract	2026-07-26 13:34:56 +02:00
tenant-claim-contract.md	Document tenant claim ownership and prove registration binding	2026-09-06 20:33:06 +02:00