26 lines
1.1 KiB
Markdown
26 lines
1.1 KiB
Markdown
|
## Architecture
|
||
|
|
|
||
|
|
Small headless service, modeled on `qonto-assistant`'s layout (same fleet
|
||
|
|
convention). Layers:
|
||
|
|
|
||
|
|
- `domain/` — tenant, grouping, capability-role, and plan-grant models; pure,
|
||
|
|
no framework dependency.
|
||
|
|
- `store/` — persistence for tenant records and the role/plan grant audit
|
||
|
|
trail. Starts in-memory/SQLite for early workplans; production backend TBD.
|
||
|
|
- `api/` — three surfaces per the boundary contract: a cache-read API
|
||
|
|
(`key-cape` calls at token issuance), a live-lookup API (`flex-auth` calls
|
||
|
|
synchronously for high-stakes decisions — must fail closed, never open),
|
||
|
|
and a write API (grant/revoke/plan mutations, authorization-gated by
|
||
|
|
`flex-auth`, not self-authorized).
|
||
|
|
- `guardrail/` — reserved namespace, not implemented yet (spend limits,
|
||
|
|
entity/action counts).
|
||
|
|
|
||
|
|
Full ownership boundary and API contract:
|
||
|
|
`net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md`.
|
||
|
|
Claim/carrying mechanism this service implements:
|
||
|
|
`net-kingdom/canon/standards/iam-profile_v0.3.md` ("Tenant Roles" section).
|
||
|
|
|
||
|
|
## Quick Reference
|
||
|
|
|
||
|
|
`~/state-hub/mcp_server/TOOLS.md` — MCP tool reference
|