coulomb/tenant-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
tenant-engine/.claude/rules/repo-boundary.md
tegwick 9370348d54 Bootstrap repo: State Hub registration, agent docs, TEN-WP-0001/0002 
statehub register + repo-seed template scaffold (CLAUDE.md, .claude/rules/,
registry/). INTENT.md and SCOPE.md rewritten from the generated stub to
match net-kingdom's ratified tenant-engine-boundary-contract_v0.1.md
(Purpose, Responsibility Boundary, Non-Goals). topic_slug corrected from
the auto-assigned custodian default to netkingdom, matching key-cape and
user-engine.

TEN-WP-0001 (bootstrap) complete: files reviewed/refined, stack decided
(Python 3.12 + FastAPI, matching qonto-assistant's convention), first real
workplan seeded.

TEN-WP-0002 drafted: service skeleton, domain model (tenant/grouping/
capability-role/plan-grant), storage layer, and the three boundary-contract
API surfaces (cache-read for key-cape, live-lookup for flex-auth with an
explicit fail-closed requirement, write API behind a WriteAuthorizer seam
since real flex-auth integration is a declared non-goal for this pass).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-23 21:56:07 +02:00

910 B
Raw Blame History

Repo boundary

This repo owns tenant-as-an-entity facts only: tenant existence, onboarding grouping, capability roles, plan/subscription assignment, and (reserved) guardrail/quota policy. It does not own:

  • Identity, authentication, MFA, token issuance → key-cape / Keycloak
  • Tenant identifier format and role vocabulary → NetKingdom canon (iam-profile_v0.3.md, ADR-0013, ADR-0014) — this repo consumes it, never redefines it
  • Users, profiles, memberships → user-engine (shared key: tenant_id only)
  • Authorization decisions → flex-auth (this repo is a data source it queries, never the decision maker)
  • Pricing-model / plan term definitions → adaptive-pricing
  • Payment processing → not yet identified as owned by any repo
  • Runtime secret custody → OpenBao / secrets-engine

Full contract: net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md.