This is an internal working record, not an everyday instruction.
It was written while the system was being rebuilt, for whoever maintains it. If you are here to do
today's work, use the everyday documents instead:
Procedures · Processes · Runbooks
· The working day, step by step
- Status:
CURRENT DUAL-REF PROCESS/PLATFORM MATRIX
- Release source:
master@baff406d964b9f785bf98d2ae84cfb262e26f4b2
- QA integration source:
qa@1dfed7d5c827f992e763c63bfca95324a60af387
- Source authority:
PLATFORM_TENANT_CAPABILITY_DUAL_REF_CURRENT_AUTHORITY_2026-08-09.md
- Phase implementation:
USER HOLD
1. Interpretation Rule
This matrix separates:
released behavior
QA integration-candidate behavior
target architecture
current evidence
A row marked QA ONLY is not a released procedure. A row marked SOURCE PRESENT is not environment acceptance.
2. Capability And Configuration Delta
| Concern |
Release master |
QA integration |
Current disposition |
Required evidence |
Typed CapabilityResolution |
present |
present |
shared foundation |
source identity and selected caller evidence |
CapabilityResolver |
present |
present |
shared foundation |
prove active callers separately |
CapabilityDefinitionRegistry |
absent |
present |
QA ONLY |
branch/deployed SHA |
| Module typed definition |
absent |
present |
QA adapter |
enabled/disabled/missing/error parity |
| Process capability typed definition |
absent |
registered subset |
QA diagnostic input |
explicit row versus legacy default |
| Config typed definition |
legacy inference/provider metadata |
registry adapter + legacy inference |
hybrid |
stored type and caller result |
| Secret typed definition |
credential/config helper only |
registry safe observation + credential owner |
QA diagnostics only |
no-secret response evidence |
| Effective diagnostics service |
absent |
present |
QA ONLY |
GET/readback/no-mutation |
| Effective diagnostics API |
absent |
present |
QA ONLY |
admin/same-tenant/denied-tenant matrix |
| Admin Effective view |
absent |
present |
QA ONLY |
rendered output and redaction |
| Profile binding |
absent |
absent |
UNBOUND |
product/source decision |
| Entitlement binding |
absent |
absent |
UNKNOWN |
commercial/platform owner decision |
| Package authority |
not established |
legacy tier inference only |
not entitlement |
tier consistency and catalog evidence |
| Terminology binding |
absent |
absent |
UNBOUND |
product/profile decision |
| Document template binding |
absent |
absent |
UNBOUND |
document owner decision |
| Hardware adapter binding |
absent |
absent |
UNBOUND |
provider/device owner decision |
3. Module Resolution Delta
| Path |
Release |
QA |
Meaning |
| Non-strict page module decision |
legacy |
legacy |
same current compatibility owner |
| Non-strict API module decision |
legacy |
legacy unless route opts into strict principal |
no universal cutover |
| Strict API module decision |
legacy strict-principal gate without registered resolution |
typed registry/resolver result |
QA-only provenance improvement |
| Explicit enabled row |
allow |
allow / ENABLED |
parity expected |
| Explicit disabled row |
deny |
deny / DISABLED |
parity expected |
| Missing row |
compatibility allow |
compatibility allow with fallback metadata on strict path |
not explicit policy |
| Source error |
compatibility allow on current module path |
compatibility allow with error provenance on strict path |
not strict fail-closed |
| Role/Menu/Record access |
external authority |
external authority |
not granted by capability result |
Stable discrepancy:
CAPABILITY-DISCREPANCY-002
Strict and non-strict callers use different resolution surfaces on QA.
4. Registered Process Capability Delta
| Capability key |
Release behavior |
QA diagnostic behavior |
Current policy state |
MK_DOCUMENT_WORKFLOW_ENABLED |
legacy helper and numeric Client 2 default |
registered PROCESS_CAPABILITY, explicit row or LEGACY_DEFAULT |
compatibility, not entitlement |
EXPORT_BROKERAGE_WORKFLOW_ENABLED |
legacy helper, default false |
registered PROCESS_CAPABILITY, explicit row or false legacy default |
compatibility |
| Other business workflows |
caller-specific |
generally not registered |
no universal registry coverage |
Required interpretation:
registered
!= explicitly configured
!= module enabled
!= actor authorized
!= command eligible
5. Effective Relationship Projection
| Relationship |
Release |
QA projection |
Correct interpretation |
| Tenant |
scalar/local context |
LEGACY_LOCAL_ONLY |
not portable global identity |
| Profile |
no binding |
UNBOUND |
diagnostics does not invent profile |
| Package |
no accepted owner |
one tier can be LEGACY_DERIVED |
not entitlement |
| Module |
legacy current decision |
resolved per module |
principal access still separate |
| Capability |
caller-specific |
REGISTERED_SUBSET |
incomplete coverage |
| Entitlement |
no source |
UNKNOWN |
never inferred |
| Role/Menu |
existing guards |
EXTERNAL_AUTHORITY |
diagnostics is not access decision |
| Provider |
config helper |
registered config subset |
effect authority unknown |
| Hardware |
no binding |
UNBOUND |
no device authorization |
6. Configuration Cache Delta
| Reader |
Release key |
QA key |
Disposition |
tenant_config_get() |
clientId:configKey |
spl_object_id(db):clientId:configKey |
QA single-key isolation improved |
tenant_config_get_many() |
clientId:configKey |
clientId:configKey |
unchanged; multi-DB collision remains possible |
tenant_provider_config() |
uses multi-key reader |
uses multi-key reader |
inherits multi-key cache scope |
| Module-ID lookup |
process-static module key |
process-static module key |
DB identity evidence required for multi-DB process |
| Metadata-support lookup |
process-static support result |
process-static support result |
multi-DB process evidence required |
Stable discrepancy:
CAPABILITY-DISCREPANCY-003
QA cache isolation is partial, not universal.
7. Secret And Provider Boundary
| Question |
Release |
QA |
Required rule |
| Secret literals in ordinary config list |
masked/omitted |
masked/omitted |
never expose in diagnostics |
| Secret diagnostics |
no typed effective endpoint |
safe hasValue/owner metadata |
no runtime value in safe array |
| Provider configured |
config presence |
config/secret resolution |
not connectivity |
| Provider authorized |
caller-specific |
caller-specific |
not inferred by registry |
| Provider effect |
separate command |
separate command |
no diagnostic-side effect |
| Credential owner |
config helper rules |
strict context metadata in typed secret result |
verify tenant ownership |
8. Admin And Access Delta
| Surface |
Release |
QA |
Evidence required |
| Tenant list/config/module tabs |
present |
present |
current role and tenant scope |
| Provider settings |
present |
present |
restricted role and secret handling |
| Effective diagnostics tab |
absent |
present |
QA-only findability and safe rendering |
| Effective diagnostics API |
absent |
present |
super-admin and tenant-admin boundary |
| Module/config writes |
current Admin APIs |
current Admin APIs |
diagnostics does not authorize writes |
| Control Tower release lifecycle |
target only |
target only |
not current Runtime |
9. Current Decision Matrix
| Observation |
Release classification |
QA classification |
Operator action |
| Effective endpoint not found |
expected |
unexpected if QA source is deployed |
verify source identity |
Effective endpoint returns profile UNBOUND |
not applicable |
expected |
do not invent profile assignment |
Capability uses LEGACY_DEFAULT |
legacy helper behavior |
compatibility fallback |
do not report explicit enablement |
| Module missing row resolves enabled |
compatibility |
compatibility with provenance on strict path |
do not globally change during diagnosis |
| Module explicit disabled |
deny |
deny |
verify page/API parity |
| Config invalid type |
caller-dependent |
diagnostic INVALID/UNAVAILABLE |
correct only through approved owner |
| Secret hasValue true |
configured metadata |
configured metadata |
do not infer provider connectivity |
| Multiple tier keys |
current data ambiguity; no accepted package result |
package INVALID |
investigate; do not pick a tier automatically |
| Role can see Effective tab but cross-tenant GET denied |
possible UI/API mismatch |
expected server-side protection |
fix bounded UI parity, not tenant guard |
10. Migration Matrix
| Wave |
Release action |
QA action |
Exit evidence |
| Read inventory |
record legacy callers |
record typed and legacy callers |
complete caller map |
| Read shadow |
no change |
compare typed result to legacy decision |
exact parity by tenant/scenario |
| Cache evidence |
current baseline |
single/multi DB-object synthetic evidence |
no cross-connection leakage |
| Explicit parity seed |
separate DB authorization |
same |
exact rows and rollback |
| Selected caller cutover |
later bounded release |
candidate first |
one authority for cohort |
| Rollback |
legacy caller remains |
switch selected caller back |
behavior/readback restored |
| Caller-zero |
no legacy retirement yet |
count old caller use |
zero for selected cohort |
| Promotion |
separate source decision |
QA candidate reviewed |
release impact/rollback accepted |
11. Evidence Scenario Matrix
| Scenario |
Release expected |
QA expected |
| Explicit enabled module |
page/API legacy allow |
strict and legacy allow |
| Explicit disabled module |
page/API deny |
strict and legacy deny |
| Missing module assignment |
compatibility allow |
strict typed fallback + legacy allow |
| Module read error |
compatibility behavior |
strict typed error fallback + legacy behavior |
| Explicit MK document capability true |
helper true |
diagnostic explicit enabled |
| Missing Client 2 MK document row |
helper legacy true |
diagnostic legacy-default enabled |
| Missing Client 1 MK document row |
helper legacy false |
diagnostic disabled/missing fallback result |
| Export Brokerage missing row |
helper false |
diagnostic disabled from legacy default |
| Secret companion present |
configured metadata |
safe configured metadata |
| Secret direct legacy row only |
legacy read possible |
safe logical-key observation; migration evidence required |
| Conflicting module tiers |
no accepted package result |
package invalid |
| Effective endpoint GET |
route absent |
route present for authorized admin |
| Cross-tenant tenant-admin GET |
route absent |
denied |
12. Stop Conditions
Stop documentation-to-implementation transition when any of the following remains:
- exact deployed branch is unknown;
- Client 1/2 explicit/missing/error parity is not recorded;
- strict/non-strict caller inventory is incomplete;
- role/menu/action ownership is being inferred from capability state;
- cache isolation across DB objects is unverified;
- secret literals can enter diagnostics/logs;
- profile or entitlement is being inferred from module tier;
- a QA-only endpoint is described as released;
- rollback and caller-zero are missing;
- Phase hold has not been explicitly lifted for a named bounded task.
13. Current Completion
Release/QA source matrix:
COMPLETE
Typed/legacy boundary:
DOCUMENTED
Cache discrepancy:
DOCUMENTED
Read-only evidence:
DEFINED / NOT RUN
Policy acceptance:
OPEN / PARTIAL
M3/M4:
NO CHANGE
---
Source: docs/processes/PLATFORM_TENANT_CAPABILITY_RELEASE_QA_DELTA_MATRIX_2026-08-09.md — ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged.