This is an internal working record, not an everyday instruction. It was written while the system was being rebuilt, for whoever maintains it. If you are here to do today's work, use the everyday documents instead: Procedures · Processes · Runbooks · The working day, step by step
Platform Tenant / Config — Current Resolution Matrix — 2026-08-10¶
- Status:
CURRENT SOURCE-RESOLUTION MATRIX / DOCUMENTATION ONLY - Task:
CTC-CDOC-005 - Source owner baseline:
8981a02f7b2a2fa256a7365d6921f3d7636f1fe2 - Final refs observed before integration:
qa@8981a02...,master@f82a91f...; the master delta is CTC-CDOC-006 documentation only - Source refresh:
PLATFORM_TENANT_CONFIG_CREDENTIAL_CURRENT_SOURCE_REFRESH_2026-08-10.md - Phase implementation:
USER HOLD - Runtime/DB/credential/provider effects:
NONE
1. Current Resolution Matrix¶
| Surface / caller | Current precedence | Missing / error behavior | Cache | Secret behavior | Effect | Classification |
|---|---|---|---|---|---|---|
tenant_config_get() plain |
tenant CONFIG_KEY |
null/empty/error -> caller default | DB object + tenant + key | n/a | read | legacy scalar config |
tenant_config_get() secret-classified |
prefer SECRET.<KEY> then legacy <KEY> |
null/empty/error -> caller default | DB object + tenant + key | trusted Runtime decrypt | read | secret compatibility reader; not reveal |
tenant_config_get_many() |
requested keys + managed companion keys | missing/error -> empty per key; caller fallback later | tenant + key only | trusted Runtime decrypt | read | multi-read compatibility |
tenant_config_get_env() |
tenant -> env -> caller default | env/default after missing/error/empty | single-read cache | source ownership separate | read | caller fallback |
tenant_provider_config() |
provider definitions -> multi-read -> env/default | empty -> env/default | multi-read cache | trusted Runtime aggregate may hold resolved secret | read | provider Runtime config |
| bool/int wrappers | scalar read -> normalization | missing/empty/invalid/error -> caller default | single-read cache | no reveal authority | read | provenance lost |
moduleGuardConfigDecision() |
config bool default false | missing/false -> deny; exception -> config error | config cache | no credential semantics | read | legacy page config gate |
moduleGuardModuleDecision() |
legacy isModuleEnabled() |
missing/error may compatibility-allow | legacy module cache | none | read | legacy module path |
moduleGuardStrictModuleDecision() |
strict tenant -> module observation -> registry -> resolver | compatibility fallback only when definition permits | source read + resolver | none | read | typed strict module path |
| typed process capability | explicit observation + registered default | keeps MISSING/INVALID/ERROR | resolver has no I/O cache | separate concern | read | typed capability |
| typed config | typed observation + allowed source | keeps MISSING/INVALID/ERROR; declared fallback visible | resolver has no I/O cache | safe serialization | read | typed config |
| typed secret availability | strict tenant + owner ref + allowed source | mismatch/missing/error -> unavailable | resolver has no I/O cache | safe result omits literal | read | availability, not reveal |
| effective diagnostics | rows -> definitions -> safe result | reports fallback/invalid/error | current request/source behavior | secret content replaced by presence marker | read | safe admin/support diagnostics |
| provider config/status list | logical metadata | configured/update metadata | request behavior | no secret value in ordinary response | read | safe status |
| managed credential reveal | explicit privileged POST | forbidden/not found/unavailable as applicable | no-store/private response | plaintext only through explicit reveal | privileged read | separate command |
| managed credential replace | explicit privileged POST + optional expected revision | empty invalid; stale revision conflict when metadata supports it | menu cache invalidated; config static caches not universally reset | encrypted SECRET.<KEY> write; metadata response |
write | source present; not executed |
| legacy plaintext retirement | part of managed replace | successful replace retires old logical row | replacement path | wipe + soft delete legacy row | write | source present; not executed |
| managed removal | no owner located | no accepted behavior | n/a | do not infer from blank/hide/cancel | none located | OPEN / NOT ESTABLISHED |
| operating profile | no canonical Runtime binding | UNBOUND |
n/a | none | none | open authority |
| entitlement | no canonical Runtime source | UNKNOWN |
n/a | none | none | open authority |
2. Resolution Graph¶
flowchart TD
I[Request / job input] --> T[Effective tenant]
T --> Q{Strict caller?}
Q -->|yes| C[Strict TenantExecutionContext]
Q -->|no| L[Legacy scalar CLIENT_ID]
C --> D[Registered definition]
D --> O[Current observation]
O --> R[CapabilityResolver]
R --> S[Safe typed result]
L --> H[Legacy module/config helper]
H --> V[Scalar result + caller fallback]
T --> G{Credential concern?}
G -->|Runtime read| RR[Config/provider helper]
G -->|Safe status| ST[Presence/update metadata]
G -->|Reveal| RV[Explicit privileged reveal]
G -->|Replace| RP[Explicit managed encrypted replacement]
ST -. does not authorize .-> P[Provider effect]
RV -. does not authorize .-> P
RR -. requires separate capability/access .-> P
S -. requires separate access/effect authority .-> P
3. Fallback Matrix¶
| Concern | Explicit | Missing | Source error | Invalid | Current meaning |
|---|---|---|---|---|---|
| legacy module | enabled/disabled authoritative | compatibility may allow | compatibility may allow | legacy boolean behavior | provenance mostly collapsed |
| strict registered module | typed enabled/disabled | fallback only if registered; otherwise disabled | fallback only if registered; otherwise unavailable | unavailable | provenance retained |
| legacy scalar config | non-empty value | caller default | caller default | wrapper default | provenance lost |
| strict registered config | typed value | missing or declared fallback | error or declared fallback | invalid or declared fallback | provenance retained |
| process capability | explicit enabled/disabled | registered default or disabled | unavailable | unavailable | module alone never grants capability |
| secret availability | valid owner/source/type | unavailable | unavailable | unavailable | no implicit credential fallback except allowed definition source |
| reveal | explicit privileged result | unavailable | unavailable | n/a | not substitutable with ordinary config read |
| replace | explicit encrypted write | n/a | failure | invalid/empty rejected | conflict protection depends on metadata support |
4. Cache / Freshness Matrix¶
| Current cache | Partition | Generic invalidation observed | Evidence gap |
|---|---|---|---|
| single config | DB object + tenant + key | none in inspected helper | same-process read-after-write |
| multi config | tenant + key | none | multi-DB/long-running isolation |
| module helper | DB host/database + tenant + module | process static | post-change freshness |
| metadata-support probe | one static boolean | none | heterogeneous schema targets |
| shared menu cache | separate shared cache | config upsert invalidates it | menu invalidation != config static-cache reset |
No Runtime incident is claimed from source structure alone.
5. Secret-Safe Evidence Contract¶
Allowed output:
logical credential key
provider/module key
configured boolean
active row count
managed companion presence
legacy-row presence
VALUE_TYPE / MODULE_ID / UPDATED_AT metadata
source / validity / fallback / reason
safe credential owner reference
Prohibited output:
CONFIG_VALUE
plaintext credential
ciphertext / enc:v1 payload
encryption key
Authorization header
OAuth token JSON
password/session/cookie/token material
hasValue=true proves stored presence only, not decryptability, provider validity, connectivity, authorization or provider success.
6. Strict / Legacy Coexistence¶
selected strict API principal + typed resolver
AND
legacy CLIENT_ID/module/config helpers for remaining PHP/API/page callers
Future migration order remains:
caller inventory
-> read-only parity
-> explicit policy decision
-> selected caller cutover
-> rollback
-> legacy caller-zero
This task performs none of those effects.
7. Evidence Ceiling¶
Resolution matrix: SOURCE-RECONCILED
Source-owner baseline: 8981a02...
Installed schema/config rows: NOT RUN
Target-role access: NOT RUN
Credential reveal/replace: NOT RUN
Provider effects: NOT RUN
Cache Runtime behavior: NOT RUN
Deployed identity: NOT RUN
Wiki current content: NOT RUN
Phase impact: NONE
External effects: NONE
---¶
Source:
docs/processes/PLATFORM_TENANT_CONFIG_CURRENT_RESOLUTION_MATRIX_2026-08-10.md— ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged.