tegwick
749461b97b
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 41s
Add the PostgreSQL backend, migration and stopped-write transfer tools, lease-aware deployment manifests, tenancy declarations, and shared conformance coverage. Persist grouping mutations in durable stores and separate process liveness from database readiness.
78 lines
2.9 KiB
YAML
78 lines
2.9 KiB
YAML
# Canonical declaration: NetKingdom Tenancy Posture v0.1 draft-8.
|
|
schema_version: "0.1"
|
|
framework: netkingdom-tenancy-posture
|
|
service: tenant-engine
|
|
role: tenant-registry
|
|
|
|
tenancy:
|
|
current: { I: 1, A: 0, E: 1, P: "n/a", R: 0, V: 0 }
|
|
implemented: { A: 3, E: 2, P: 1 }
|
|
target: { I: 2, A: 3, E: 3, P: 1, R: 2, V: 1 }
|
|
reviewed: "2026-08-18"
|
|
review_due: "2027-02-17"
|
|
service_class: latency-critical
|
|
reason:
|
|
I: >-
|
|
Acting identity is supplied in request bodies; tenant-engine verifies no
|
|
inbound token. Canonical ownership of tenant records does not raise its
|
|
own inbound identity level.
|
|
A: >-
|
|
The running digest leaves GET tenant and role routes unprotected, so the
|
|
live minimum remains A0. Source now delegates every tenant/role read and
|
|
mutation to flex-auth before store access, implementing A3 without an
|
|
existence oracle; promotion and live endpoint evidence remain gated.
|
|
P: >-
|
|
Production still uses a dedicated SQLite PVC. It is a datastore, but it
|
|
is neither a shared database nor a PostgreSQL cluster described by P0-P4;
|
|
P1 is the accepted TEN-WP-0009 target.
|
|
R: >-
|
|
Tenant retirement is reversible and no hard-delete path exists; personal
|
|
fields therefore have no erasure position.
|
|
V: >-
|
|
The deployment has no exercised recovery objective or failover evidence.
|
|
gap:
|
|
I: "Bind actor and tenant to a verified inbound token."
|
|
A: "Authenticate and authorize every read path; then evidence endpoint denial."
|
|
E: >-
|
|
Child records are tenant-keyed, but E2 requires binding an authenticated
|
|
identity and adversarial evidence. Registry tables remain a named E3
|
|
exception because cross-tenant enumeration is their function.
|
|
P: "Complete TEN-WP-0009 and publish the P1 isolation evidence."
|
|
R: >-
|
|
docs/data-retention-policy.md now declares indefinite primary-record
|
|
retention and a 30-day copy horizon honestly. R2 still requires an
|
|
implemented and evidenced personal-field erasure/expiry workflow.
|
|
V: "Exercise restart recovery for tenant-engine and its critical path."
|
|
paths:
|
|
A:
|
|
mutations: 3
|
|
tenant_reads: 0
|
|
live_role_reads: 0
|
|
E:
|
|
tenant_keyed_children: 2
|
|
tenant_registry: 1
|
|
placement_exceptions: []
|
|
|
|
provider:
|
|
capability: tenant.registry
|
|
axes:
|
|
I:
|
|
available: 2
|
|
maximum: 3
|
|
conditions:
|
|
- "Consumers verify canonical tenant identifiers on their own inbound calls."
|
|
- "I3 consumers wire the live role lookup on high-stakes paths."
|
|
evidence:
|
|
- "net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md"
|
|
|
|
evidence:
|
|
E1:
|
|
- "src/tenant_engine/domain.py"
|
|
- "tests/test_store.py"
|
|
implemented_A3:
|
|
- "src/tenant_engine/app.py"
|
|
- "tests/test_api_reads.py"
|
|
implemented_P1:
|
|
- "src/tenant_engine/postgres_store.py"
|
|
- "tests/postgres_backend.py"
|
|
- "src/tenant_engine/transfer.py"
|