railiance-platform/tenancy.yaml

# Canonical vector set for services owned or held in custody here.
# Human reasoning remains in docs/tenancy-posture.md.
schema_version: "0.1"
framework: netkingdom-tenancy-posture
services:
  - service: apps-pg
    role: relational-storage-provider
    tenancy:
      current: { I: 0, A: 0, E: 0, P: "n/a", R: 2, V: 1 }
      target:  { I: 0, A: 0, E: 0, P: "n/a", R: 2, V: 1 }
      reviewed: "2026-08-20"
      review_due: "2027-02-17"
      service_class: interactive
      permanent: [I, A, E, P]
      reason:
        I: "The storage provider receives credentials, not tenant claims."
        A: "No tenant context is bound at the database provider."
        E: "Tenant enforcement belongs to each consuming application."
        P: "apps-pg provides P1; a substrate is not itself at a P level."
        R: "Continuous WAL and a completed base backup use the governed
            30-day object-store path; a scratch restore recovered both
            consumer databases on 2026-08-20."
        V: "A separate scratch Cluster restored Ready in 56 seconds; this is
            single-node recovery evidence, not HA or failover."
    evidence:
      R2:
        - "docs/evidence/RPF-WP-0019-backup-restore-2026-08-20.md"
      V1:
        - "docs/evidence/RPF-WP-0019-backup-restore-2026-08-20.md"
    provider:
      capability: data.relational
      profile: s5-application-databases
      axes:
        E:
          available: 2
          maximum: 3
          conditions:
            - "E2 is entirely consumer-side."
            - "E3 requires adoption of the rapp-postgres GUC contract."
            - "E4 is unreachable on a shared cluster without per-tenant credentials."
        P:
          available: 1
          maximum: 2
          conditions:
            - "P2 requires a new dedicated cluster for the consumer."
          evidence:
            - "docs/evidence/RPF-WP-0019-isolation-2026-08-20.md"
        R:
          available: 2
          maximum: 2
          evidence:
            - "docs/evidence/RPF-WP-0019-backup-restore-2026-08-20.md"
        V:
          available: 1
          maximum: 1
          conditions:
            - "V1 is single-node recovery only; no HA or failover is claimed."
          evidence:
            - "docs/evidence/RPF-WP-0019-backup-restore-2026-08-20.md"

  - service: forgejo-db
    role: relational-storage-provider
    tenancy:
      current: { I: 0, A: 0, E: 0, P: "n/a", R: 0, V: 0 }
      target:  { I: 0, A: 0, E: 0, P: "n/a", R: 2, V: 1 }
      reviewed: "2026-08-17"
      review_due: "2027-02-17"
      service_class: interactive
      permanent: [I, A, E, P]
      reason:
        I: "The database receives a Forgejo credential, not tenant claims."
        A: "No NetKingdom tenant context is bound at this provider."
        E: "Tenant enforcement, if any, belongs to Forgejo."
        P: "forgejo-db provides P2 to Forgejo; it is not itself at P2."
        R: "A backup procedure exists, but no declared retention or erasure horizon does."
        V: "No exercised recovery objective or failover evidence exists."
      gap:
        R: "Declare the backup window and publish the effective erasure horizon."
        V: "Exercise recovery and record the interruption."
    provider:
      capability: data.relational
      profile: dedicated-forgejo-database
      axes:
        P:
          available: 2
          maximum: 2
        R:
          available: 0
          maximum: 2
          conditions:
            - "Declare and evidence retention on the existing backup path."
        V:
          available: 0
          maximum: 1
          conditions:
            - "Single-node recovery must be exercised."

  - service: openbao
    role: credential-provider
    tenancy:
      current: { I: 0, A: 0, E: 0, P: 0, R: 0, V: 0 }
      target:  { I: 0, A: 0, E: 0, P: 0, R: 1, V: 1 }
      reviewed: "2026-08-17"
      review_due: "2027-02-17"
      service_class: latency-critical
      permanent: [I, A, E, P]
      reason:
        I: "OpenBao authenticates workloads and does not resolve NetKingdom tenants."
        A: "No tenant context is carried or bound."
        E: "OpenBao holds workload secrets, not tenant-keyed records."
        P: "One instance is shared by every credential consumer."
        R: "No retention position covers audit output or KV version history."
        V: "Node recovery requires operator unseal; no recovery objective is evidenced."
      gap:
        R: "Declare the platform default for audit output and KV history."
        V: "Exercise the complete restart and unseal path against a recovery objective."
    provider:
      capability: credential.vending
      axes:
        E:
          available: 0
          maximum: 4
          conditions:
            - "Per-tenant paths, roles and credentials are required for tenant-level E4."
            - "Current evidence proves consumer-boundary scoping, not tenant-boundary scoping."
          evidence:
            - "scripts/openbao-verify-token-grants.py"
        V:
          available: 0
          maximum: 1
          conditions:
            - "Single-node restart and unseal recovery must be exercised."