This is an internal working record, not an everyday instruction. It was written while the system was being rebuilt, for whoever maintains it. If you are here to do today's work, use the everyday documents instead: Procedures · Processes · Runbooks · The working day, step by step
Platform Tenant, Operating Profile, Capability And Configuration — Parity And Cutover Matrix¶
- Status:
MIGRATION INPUT / NO WAVE ACTIVATED - Source baseline:
qa@4f6165bc4c53a7d98b0c246392dd9ed5bd75c21c - Rebuild packet:
PLATFORM_TENANT_PROFILE_CAPABILITY_CONFIGURATION_REBUILD_PACKET.md - Policy:
PLATFORM_TENANT_PROFILE_CAPABILITY_CONFIGURATION_POLICY_DECISION_MATRIX.md - Related activation owners: P4-003/P4-004, P2-007, P5, P7, P8, P12, Control Tower
- Important: this matrix does not activate P4 or change current missing-row/fallback behavior.
1. Migration Invariant¶
one selected caller/cohort
= one authoritative tenant/profile/module/capability/config decision owner
Read shadow is allowed. Dual authorization is not.
current helper authorizes write
+ target resolver authorizes write independently
= prohibited
2. Parity Dimensions¶
| Dimension | Current evidence | Target parity requirement | Intentional target improvement |
|---|---|---|---|
| effective tenant | session/impersonation/scalar fallback | same tenant/actor/subject for selected normal path | explicit provenance; no fallback for new write |
| portable identity | often local-only | preserve local query key and add trusted global mapping | mapping mismatch rejects |
| profile | inferred from compatibility | same Product/process behavior for CTC/MK selected paths | explicit profile/version/source |
| module | missing/error may allow | no access loss during parity seed | typed explicit/missing/error result |
| process capability | caller-specific | same selected behavior availability | named capability and prerequisites |
| config value | scalar/default | same effective value for selected caller | source/validity/fallback visible |
| secret | tenant/env caller-specific | same provider credential for selected tenant | owner match and safe diagnostics |
| menu/page/API | independent current guards | exact allow/deny parity per role/action | semantic action result and reason |
| record | handler-specific predicate | same tenant/state eligibility | typed record decision |
| admin write | direct applied state | preserve current result during coexistence | versioned draft/publish/apply/readback |
| cache | request/process-specific | selected caller observes committed value | applied version and invalidation |
| Shared/Dedicated | partially known | same accepted effective result | per-target apply/drift evidence |
3. Current Versus Target Read Parity¶
3.1 Tenant context¶
| Scenario | Current expected | Target expected | Cutover block |
|---|---|---|---|
| normal session | session tenant/user | same + strict provenance | scalar/typed mismatch |
| impersonation | target tenant/user effective | same + original actor preserved | actor/subject mismatch |
| super-admin target API | selected allowlisted override | same + authorization ref | implicit target |
| CLI explicit job | caller-specific | strict explicit child context | no explicit tenant |
| legacy CLI | deployment fallback | compatibility diagnostic only | any new write |
3.2 Module¶
| Scenario | Current | Shadow target | Accepted target |
|---|---|---|---|
| explicit enabled | allow | ENABLED/VALID | allow |
| explicit disabled | deny | DISABLED/VALID | deny |
| missing row | allow | ENABLED/MISSING compatibility for existing caller | explicit seed or accepted compatibility |
| source error | allow | ENABLED/ERROR compatibility for existing caller | strict unavailable after accepted migration |
| invalid row | caller-specific cast | UNAVAILABLE/INVALID | owner correction |
3.3 Config¶
| Scenario | Current | Shadow target | Accepted target |
|---|---|---|---|
| valid tenant value | scalar | VALUE/VALID/TENANT_CONFIG | same value |
| missing with default | default | VALUE/MISSING/fallback | same value + provenance |
| invalid with default | often default | VALUE/INVALID/fallback when declared | accepted definition behavior |
| source error with default | often default | VALUE/ERROR/fallback when declared | accepted definition behavior |
| missing without default | empty/false/caller behavior | UNAVAILABLE/MISSING | explicit UI/error |
| deployment env fallback | caller-specific | VALUE/VALID/DEPLOYMENT_ENV | same value + deployment label |
4. Role And Access Parity Matrix¶
For each selected page/API/action populate:
| Tenant/Profile | Role | Menu | Page | API method/path | Module | Capability | Config/Credential | Record predicate | Current | Target | Evidence |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Client 1 / ctc-execution | target role | ALLOW/DENY/UNKNOWN | |||||||||
| Client 2 / mk-order | target role | ALLOW/DENY/UNKNOWN |
Rules:
- Administrator evidence is not field-role acceptance.
- Menu visibility is not API evidence.
- API 200 is not record authorization evidence.
- Unknown current caller blocks a proposed denial.
- Current Client 1 normal paths must remain available throughout migration.
5. Admin Applied-State Parity¶
| Current operation | Required target equivalent | Coexistence rule | Retirement evidence |
|---|---|---|---|
| update tenant identity | versioned tenant identity release or accepted direct owner | current API remains until replacement | no active UI/API caller |
| toggle module | release module override and apply | direct and release writes cannot race; one selected authority | current API disabled/removed after acceptance |
| set tier | accepted entitlement/onboarding policy | no enforcement before Product decision | explicit disposition |
| update config | typed release entry and apply | exact key-family authority | direct write caller-zero |
| provider config | typed config/credential reference release | secret never copied into draft/audit | provider parity and rotation rollback |
| onboarding | versioned seed package or bounded current command | resulting rows reread and versioned | accepted replacement or retained compatibility |
6. Cutover Waves¶
TPC-W0 Freeze And Characterize¶
Deliverables:
- exact source/deployed SHA;
- schema/config/module/menu/role snapshots without secret values;
- current caller map;
- current Admin write map;
- caches and deployment topology;
- Client 1/2 expected behavior.
Exit:
No proposed strict change can deny an UNKNOWN caller.
TPC-W1 Typed Read Shadow¶
- construct strict context where safe;
- load observations without changing current result;
- resolve profile/module/capability/config in shadow;
- compare and log safe reason differences;
- no access/write change.
Exit:
- no tenant mismatch;
- reason/validity coverage understood;
- no secret values logged.
TPC-W2 Operating Profile Read Model¶
- accept profile composition and assignment source;
- publish explicit CTC/MK parity assignments;
- show read-only diagnostics;
- do not select behavior yet.
Exit:
- profile resolution matches accepted tenant behavior;
- no numeric branch removed yet.
TPC-W3 Module Parity Seed¶
- explicit rows/intent for selected modules and tenants;
- compare current missing/error behavior;
- retain current caller authority.
Exit:
- selected cohort no longer depends on unknown missing-row intent.
TPC-W4 Named Capability Read Shadow¶
- register selected low-risk capability definition;
- resolve prerequisites;
- compare with current ad hoc logic;
- display safe diagnostics.
Exit:
- capability result explainable for Client 1/2.
TPC-W5 Typed Config Definition Read Shadow¶
- register selected config definitions;
- compare current scalar value and target typed resolution;
- verify defaults, invalid/error cases and cache behavior.
Exit:
- accepted parity or intentional delta.
TPC-W6 Admin Effective-State Diagnostics¶
- add read-only profile/module/capability/config/credential/version/drift panel;
- no control-plane write change;
- verify super-admin and tenant-admin safe scope.
Exit:
- support can explain effective state without reading secret values or code.
TPC-W7 Versioned Release For One Non-Secret Config Family¶
- draft/review/approve/publish;
- apply to one target deployment;
- expected-version guard;
- local row and effective reread;
- rollback predecessor.
Exit:
- publish/apply/rollback evidence complete;
- Client 1 unaffected.
TPC-W8 One Caller Authoritative Cutover¶
- choose one low-risk read or bounded command;
- current helper remains rollback path;
- target resolver becomes sole authority for cohort;
- role/action/record parity tested.
Exit:
- target accepted and observed;
- no dual decision.
TPC-W9 Secret/Provider Cohort¶
- credential reference and owner match;
- selected provider caller;
- safe diagnostics;
- provider negative/unknown recovery;
- rollback.
TPC-W10 Direct Admin Write Retirement¶
- target release UI accepted;
- emergency policy accepted;
- old write route/UI caller-zero;
- retain read-only history/diagnostics as needed.
TPC-W11 Numeric Branch Retirement¶
- explicit profile/capability/config equivalent accepted;
- remove one branch/caller;
- Client 1/2 parity;
- rollback by routing, not reintroducing customer fork.
TPC-W12 Shared/Dedicated Multi-Target Apply¶
- same release to named targets;
- local mapping and applied-version result per target;
- drift/partial/rollback.
TPC-W13 PostgreSQL Later¶
- migrate typed definitions/applied release/audit/mapping after application stabilization.
7. Cutover Stop Conditions¶
Stop before write/authorization cutover when:
- tenant target or actor/subject is ambiguous;
- profile composition/assignment is unresolved;
- selected current caller depends on missing-row/module-error fail-open and has no parity seed;
- config definition/default/empty/error semantics are unresolved;
- credential owner cannot be proven;
- menu/page/API/action/record parity is incomplete;
- Client 1 target-role normal path is unknown;
- Admin direct write and release apply can race;
- cache/effective reread is not defined;
- rollback cannot restore accepted applied state;
- Control Tower/local mapping is unavailable for the selected portable operation;
- the change would activate held broad P4/security work.
8. Rollback Matrix¶
| Cutover | Rollback trigger | Rollback action | Preserve |
|---|---|---|---|
| typed context caller | tenant/actor mismatch | route caller back to scalar context | request/audit evidence |
| profile read | incorrect assignment | apply corrected predecessor/assignment | version history |
| module strict | current access lost | restore compatibility definition/row | explicit parity evidence |
| capability | unexpected deny/allow | route selected caller to old policy | definition and diagnostics |
| typed config | wrong value/fallback/cache | route caller to current helper and apply predecessor row | source/validity evidence |
| provider credential | owner/provider failure | disable selected capability or restore prior reference | provider result/audit, no secret value |
| control-plane apply | partial/drift | predecessor/superseding release | child results and applied rows |
| numeric branch removal | CTC/MK behavior regression | restore routing to accepted previous caller, not customer copy | explicit profile/capability state |
9. Caller-Zero Requirements¶
A legacy owner is retired only after:
- static caller search;
- route/page/job/integration inventory;
- runtime/log observation where approved;
- selected field-role paths use target;
- no hidden/direct URL or provider callback remains;
- Wiki/current admin links point to successor;
- rollback no longer requires the old caller;
- code/config/deployment cleanup is reviewed separately.
Caller-zero targets include:
getClientId deployment fallback on selected writes
numeric Client behavior branch
direct scalar config helper in selected caller
old module boolean decision in selected caller
current direct Admin write route after replacement
10. Stable Migration Scenarios¶
TPC-MIG-SCN-010 direct session scalar/typed parity
TPC-MIG-SCN-020 impersonation actor/subject parity
TPC-MIG-SCN-030 explicit job tenant parity
TPC-MIG-SCN-040 module missing/error shadow
TPC-MIG-SCN-050 explicit module parity seed
TPC-MIG-SCN-060 profile assignment shadow
TPC-MIG-SCN-070 named capability shadow
TPC-MIG-SCN-080 typed config missing/invalid/error/default parity
TPC-MIG-SCN-090 credential owner negative
TPC-MIG-SCN-100 current Admin write/effective reread
TPC-MIG-SCN-110 one non-secret release apply
TPC-MIG-SCN-120 partial apply and predecessor rollback
TPC-MIG-SCN-130 one caller authoritative cutover
TPC-MIG-SCN-140 Client 1 non-regression
TPC-MIG-SCN-150 Client 2 expected profile/capability behavior
TPC-MIG-SCN-160 numeric branch caller-zero
TPC-MIG-SCN-170 direct Admin write caller-zero
TPC-MIG-SCN-180 Shared/Dedicated parity
TPC-MIG-SCN-190 PostgreSQL parity
11. Current Status¶
Parity matrix: DOCUMENTED
Current caller inventory: PARTIAL / PRIOR P4 INPUT
Current DB/browser/role/provider evidence: NOT RUN IN THIS WAVE
Selected cutover cohort: NONE
P4-003 activation: NO
Control Tower apply lifecycle: NOT ACTIVE
One-writer cutover: NOT STARTED
Caller-zero: NOT STARTED
---¶
Source:
docs/processes/PLATFORM_TENANT_PROFILE_CAPABILITY_CONFIGURATION_PARITY_AND_CUTOVER_MATRIX.md— ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged.