Skip to content

Platform Tenant, Operating Profile, Capability And Configuration — Capability Rebuild Packet

  • Packet status: DETAILED SOURCE-RECONCILED PLATFORM INPUT / NO IMPLEMENTATION ACTIVATION
  • Source authority: PLATFORM_TENANT_PROFILE_CAPABILITY_CONFIGURATION_SOURCE_AUTHORITY.md
  • Current source baseline: qa@4f6165bc4c53a7d98b0c246392dd9ed5bd75c21c
  • Related current tasks: P4-001 COMPLETE, P4-002 bounded typed-context input, P4-003 PLANNED, P2-007 active live-tenant Gate
  • Target stack: Next.js tenant/admin adapters over framework-independent TypeScript identity/profile/capability/configuration contracts; MySQL applied state first; Control Tower remains the target release control plane
  • Effect boundary: documentation only
  • Important: this packet does not authorize fail-closed conversion, new schema, module/config writes, secret reads, Control Tower calls, deployment or P4-003 activation.

1. Required Platform Outcome

A future implementation must answer every consequential request with explicit, independently reviewable results:

Which tenant is executing?
Which actor and subject are involved?
Which operating profile applies?
Is the owning module explicitly available?
Is the named process capability enabled?
Which typed config value and provenance apply?
Is the required credential available and correctly owned?
May this actor invoke this action on this record?
Which published/applied version produced the effective result?

The platform must not answer these questions with one generic enabled boolean.

1.1 User-visible administrator result

An authorized platform administrator can:

  1. identify one tenant by portable and local identity;
  2. inspect the current applied operating profile, modules, named capabilities and config without exposing secrets;
  3. distinguish explicit enablement, compatibility fallback, missing data, invalid data and source error;
  4. prepare or review a versioned configuration release;
  5. preview affected pages/APIs/processes and Client 1/Client 2 parity before apply;
  6. apply one approved release to one deployment target;
  7. reread the exact applied rows and effective resolutions;
  8. observe drift, partial apply and stale caches;
  9. rollback or supersede a release without rewriting unrelated tenant state;
  10. preserve an immutable audit/correlation trail.

1.2 User-visible support result

An authorized support operator can inspect, without changing state:

  • effective tenant and impersonation provenance;
  • operating profile and version;
  • module decision and reason;
  • named capability decision and reason;
  • config value presence/type/source/validity without secret value;
  • credential availability and owner match without secret value;
  • menu/page/API/action/record decision chain;
  • published version, applied version and drift;
  • current source release SHA and deployment identity;
  • exact owner for correction or escalation.

1.3 Explicit non-goals

Do not build:

  • one universal isEnabled() result for all concerns;
  • a customer-specific profile fork;
  • a request-time Control Tower dependency;
  • broad fail-closed behavior before current callers are known;
  • a second tenant/config table merely to mirror existing applied state;
  • a generic workflow engine;
  • a secret-value diagnostic API;
  • a package-tier denial policy without accepted entitlement semantics;
  • automatic module/menu/role changes from a profile assignment;
  • React/Next.js Runtime migration inside this documentation wave;
  • PostgreSQL before MySQL target stabilization.

2. Concern Model

2.1 Independent concerns

Concern Question Current compatibility owner Target owner/result
Tenant execution context Which single tenant/actor/subject/request is executing? session, impersonation, scalar context and selected typed adapters TenantExecutionContext
Portable tenant mapping Which global tenant corresponds to local CLIENT_ID? optional injected mapping; often absent trusted published mapping result
Operating profile Which Product/value-stream policy applies? inferred from tenant, modules, config, pages and record classes versioned OperatingProfileResolution
Module enablement Is a catalog module available for this tenant? isModuleEnabled() / module guard typed ModuleResolution
Named process capability Is one specific workflow behavior enabled? module/config/numeric branch/route-specific code typed ProcessCapabilityResolution
Entitlement/package Which commercial package/tier permits what? current catalog/admin metadata; no accepted universal authority explicit entitlement result if Product accepts it
Config What typed value/provenance applies? tenant_config_get*() plus caller fallbacks typed ConfigResolution
Credential Is a non-exposed credential available and owned correctly? caller/provider-specific config/env lookup typed CredentialResolution
Menu/page/API access Can this user enter/call the routed surface? menu/page/module/role helpers explicit access decision
Action/record access Can this actor run this command on this record? route/handler-specific guards semantic capability + record predicate
Release/apply Which approved config version is applied to this deployment? direct admin writes and partial Control Tower contracts versioned publish/apply result

2.2 Mandatory non-implications

Tenant resolved
!= profile assigned

Profile assigned
!= module enabled

Module enabled
!= process capability enabled

Capability enabled
!= config valid

Config valid
!= credential available

Credential available
!= provider call authorized

Menu visible
!= API authorized

API authorized
!= record eligible

Admin write succeeded
!= all Runtime consumers observe the value

Published
!= applied

Applied
!= stable

3. Actors And Responsibilities

Actor Required responsibilities Prohibited shortcuts
Product/Profile owner define ctc-execution, mk-order and future profile meaning encode customer number as profile
Platform tenant owner tenant identity/context/mapping contract infer tenant from arbitrary payload
Configuration release owner draft/review/publish/apply/rollback direct Production edits without release/readback
Module owner catalog ownership and explicit enablement treat missing row as intentional target enablement
Process capability owner named behavior prerequisites/defaults enable every module behavior from module alone
Provider owner credential definition, owner and provider prerequisites expose or log secret values
Access owner menu/page/API/action/record authorization infer authorization from module/config result
Tenant administrator current allowed tenant settings under bounded policy change another tenant or platform-global state
Super administrator cross-tenant control-plane actions with explicit target implicit tenant target or hidden impersonation
Support operator read-only diagnostics and evidence collection modify state during diagnosis
Deployment operator apply approved release to named deployment reinterpret config during deploy
Runtime caller consume typed result and stable reason parse display text or tenant number
Migration owner cohort cutover, rollback and caller-zero dual-write old/new resolver outcomes

4. Identity And Execution Context Contract

4.1 Required target context

The existing tenant-execution-context/v1 is the current reference contract.

interface TenantExecutionContextV1 {
  schemaVersion: 'tenant-execution-context/v1';
  scopeMode: 'SINGLE_TENANT';
  localTenantId: number;
  globalTenantId: string | null;
  identityState: 'MAPPED' | 'LEGACY_LOCAL_ONLY';
  tenantProvenance:
    | 'SESSION'
    | 'IMPERSONATION_TARGET'
    | 'ADMIN_ROUTE_OVERRIDE'
    | 'EXPLICIT_JOB'
    | 'INTEGRATION_BINDING'
    | 'LEGACY_DEFAULT';
  entrypoint: 'WEB' | 'API' | 'CLI' | 'INTEGRATION';
  sourceName: string;
  requestId: string;
  accessMode: 'DIRECT' | 'IMPERSONATION' | 'ADMIN_TENANT_OVERRIDE' | 'SYSTEM';
  actor: PrincipalRef;
  subject: PrincipalRef | null;
  credentialOwnerRef: CredentialOwnerRef | null;
  authorizationRef: string | null;
  policyState: 'STRICT' | 'COMPATIBILITY_ONLY';
}

4.2 Required construction rules

  • WEB/API requests are single-tenant.
  • Super-admin tenant-scoped API calls require explicit target and allowlisted route.
  • Impersonation preserves original actor and target subject separately.
  • CLI/integration writes require explicit single-tenant binding.
  • LEGACY_DEFAULT is compatibility-only and cannot authorize a new write.
  • Global mapping mismatch rejects the context.
  • Scalar clientId and typed context must agree during additive migration.
  • Safe serialization excludes session, cookie, token, body, config values and secret values.

4.3 Multi-tenant job rule

all-tenant scheduler
-> enumerate target tenants under its own platform authorization
-> create one strict child context per tenant
-> resolve that tenant's capability/config/credential
-> execute one tenant child
-> persist per-tenant result

An all-tenant control object must not be passed as a business command context.

5. Operating Profile Contract

5.1 Profile definition

interface OperatingProfileDefinitionV1 {
  schemaVersion: 'operating-profile-definition/v1';
  profileKey: string;
  version: number;
  status: 'DRAFT' | 'REVIEWED' | 'ACTIVE' | 'DEPRECATED';
  displayName: string;
  productModel: string;
  valueStreams: string[];
  processFamilies: string[];
  requiredModuleKeys: string[];
  optionalModuleKeys: string[];
  defaultCapabilityKeys: string[];
  terminologySetKey: string;
  configDefinitionSetKey: string;
  documentTemplateSetKey: string | null;
  adapterSetKey: string | null;
  compatibilityPolicy: 'STRICT' | 'MIGRATION_COMPATIBILITY';
  supersedesVersion: number | null;
}

Initial documented profile candidates:

ctc-execution
mk-order

5.2 Tenant profile assignment

Logical result:

interface TenantProfileAssignmentV1 {
  localTenantId: number;
  globalTenantId: string | null;
  profileKey: string;
  profileVersion: number;
  assignmentSource: 'PUBLISHED_SNAPSHOT' | 'TENANT_CONFIG_COMPATIBILITY' | 'LEGACY_INFERENCE';
  validity: 'VALID' | 'MISSING' | 'INVALID' | 'ERROR';
  compatibilityFallback: boolean;
  reason: string;
}

The persistence owner remains an open P4/Control Tower decision. Do not add a Runtime table until publish/apply ownership and profile composition are accepted.

5.3 Profile resolution

strict tenant context
-> trusted applied profile assignment
-> profile definition/version
-> applicability validation
-> required module diagnostics
-> named capability defaults as definitions, not direct grants
-> result

5.4 Profile result

interface OperatingProfileResolutionV1 {
  profileKey: string | null;
  profileVersion: number | null;
  decision: 'ASSIGNED' | 'UNAVAILABLE';
  source: 'PUBLISHED_SNAPSHOT' | 'TENANT_CONFIG' | 'LEGACY_INFERENCE' | 'NONE';
  validity: 'VALID' | 'MISSING' | 'INVALID' | 'ERROR';
  policyState: 'STRICT' | 'COMPATIBILITY';
  compatibilityFallback: boolean;
  reason: string;
}

6. Module Resolution Contract

6.1 Current parity inputs

T_MODULE catalog row
T_TENANT_MODULE applied row
current compatibility policy

6.2 Target result

Reuse the existing CapabilityResolution shape for MODULE_ENABLEMENT.

explicit enabled row -> ENABLED / VALID / TENANT_MODULE
explicit disabled row -> DISABLED / VALID / TENANT_MODULE
missing strict -> DISABLED / MISSING
missing compatibility -> ENABLED / MISSING / fallback only when definition allows
source error strict -> UNAVAILABLE / ERROR
source error compatibility -> fallback only when definition explicitly permits
invalid row -> UNAVAILABLE / INVALID

6.3 Module definition

interface ModuleDefinitionV1 {
  moduleKey: string;
  displayName: string;
  ownerDomain: string;
  moduleType: 'PLATFORM' | 'SYSTEM' | 'ADDON' | 'PORTAL';
  dependencies: string[];
  required: boolean;
  compatibilityPolicy: 'STRICT' | 'ALLOW_UNCONFIGURED' | 'ALLOW_SOURCE_ERROR';
  deprecatedBy: string | null;
}

Target policy must not globally change existing missing-row behavior. Each module/caller cohort migrates after explicit parity seed.

7. Process Capability Contract

7.1 Definition

interface ProcessCapabilityDefinitionV1 {
  schemaVersion: 'process-capability-definition/v1';
  capabilityKey: string;
  ownerModuleKey: string;
  ownerProcessId: string | null;
  applicableProfiles: string[];
  prerequisiteModules: string[];
  prerequisiteCapabilities: string[];
  requiredConfigKeys: string[];
  requiredCredentialKey: string | null;
  policyState: 'STRICT' | 'COMPATIBILITY';
  defaultDecision: 'ENABLED' | 'DISABLED';
  allowedSources: Array<'PUBLISHED_SNAPSHOT' | 'TENANT_CONFIG'>;
  safeDiagnosticLabel: string;
  deprecatedBy: string | null;
}

7.2 Example capability families

mk.documents.render
mk.export-brokerage.create
mk.allocation.apply
mk.scale.check-in
mk.scale.reverse
ctc.loader.assignment-work.create
ctc.billing.qbo.deliver

These examples are semantic naming inputs, not an automatically accepted registry.

7.3 Resolution order

strict tenant context
-> operating profile applicability
-> module prerequisites
-> explicit capability applied state/default
-> required typed config
-> credential availability when applicable
-> ENABLED / DISABLED / UNAVAILABLE

Menu/role/record access follows separately.

8. Typed Config Definition And Resolution

8.1 Definition

interface ConfigDefinitionV1 {
  schemaVersion: 'config-definition/v1';
  configKey: string;
  valueType: 'string' | 'bool' | 'int' | 'decimal' | 'url' | 'uuid' | 'datetime' | 'json' | 'file_id' | 'secret';
  jsonShape: 'OBJECT' | 'LIST' | null;
  ownerModuleKey: string | null;
  applicableProfiles: string[];
  allowedSources: Array<'PUBLISHED_SNAPSHOT' | 'TENANT_CONFIG' | 'DEPLOYMENT_ENV' | 'EXTERNAL_SECRET_REF'>;
  emptySemantics: 'MISSING' | 'VALID_EMPTY' | 'DISABLED';
  defaultValue: unknown | null;
  defaultSource: 'LEGACY_DEFAULT' | 'CALLER_DEFAULT' | null;
  validation: ConfigValidationRule;
  redaction: 'NONE' | 'MASKED' | 'SECRET';
  cachePolicy: 'REQUEST' | 'SHORT_TTL' | 'RELEASE_VERSIONED' | 'NO_CACHE';
  deprecatedBy: string | null;
}

8.2 Resolution result

Use CapabilityResolution concern CONFIG_VALUE or SECRET.

Required diagnostics:

value only for trusted Runtime caller
safe result for UI/logs
source
validity
fallback flag
stable reason
applied release version when available

8.3 No scalar ambiguity in target callers

Target callers must distinguish:

MISSING
INVALID
ERROR
VALID explicit value
VALID compatibility default
VALID deployment fallback

8.4 Cache/freshness contract

Each definition declares cache behavior. A configuration write/apply must:

  1. commit applied state;
  2. increment or assign an applied release/version marker;
  3. invalidate relevant process-local/shared caches or route callers by version;
  4. reread persisted applied rows;
  5. reread effective resolution through the same production resolver;
  6. record observed version and source.

A success response without effective reread is incomplete.

9. Credential Resolution Contract

9.1 Owner reference

interface CredentialOwnerRefV1 {
  scope: 'TENANT' | 'DEPLOYMENT_FALLBACK' | 'NONE';
  sourceType?: 'TENANT_CONFIG' | 'ENV' | 'EXTERNAL_SECRET_REF';
  moduleKey?: string;
  referenceKey?: string;
  ownerLocalTenantId?: number;
  ownerGlobalTenantId?: string | null;
}

9.2 Safe result

interface CredentialAvailabilityV1 {
  credentialKey: string;
  moduleKey: string;
  decision: 'AVAILABLE' | 'UNAVAILABLE';
  source: 'TENANT_CONFIG' | 'PUBLISHED_SNAPSHOT' | 'DEPLOYMENT_ENV' | 'EXTERNAL_SECRET_REF' | 'NONE';
  validity: 'VALID' | 'MISSING' | 'INVALID' | 'ERROR';
  ownerMatched: boolean;
  hasValue: boolean;
  reason: string;
}

The value itself is never serialized to browser, diagnostics, audit metadata or logs.

10. Access Decision Composition

Target action access is conjunctive.

authenticated / authorized system actor
AND strict tenant context
AND page/API route available
AND module resolution permits
AND named process capability permits
AND menu/page action policy permits
AND actor role/capability permits
AND record belongs to tenant
AND record state permits command
AND required config/credential permits effect

A denial returns a stable safe reason owned by the failing concern.

Suggested access result:

interface AccessDecisionV1 {
  decision: 'ALLOW' | 'DENY' | 'UNKNOWN';
  actionKey: string;
  recordRef: { type: string; id: string } | null;
  tenantId: number;
  actorRef: { type: string; id: string | number };
  failedConcern: string | null;
  reason: string;
  authorizationRef: string | null;
  policyVersion: string | null;
}

UNKNOWN cannot authorize a consequential write.

11. Current Applied-State Administration

11.1 Current admin queries

GetTenants
GetTenantModules
GetTenantConfigs
GetProviderConfigDefinitions
GetFeatureFlags

11.2 Current admin commands

UpdateTenant
OnboardTenant
ToggleTenantModule
UpdateTenantConfig
UpdateProviderConfig

Current completion is local applied-state commit plus local reread.

11.3 Target control-plane queries

GetTenantIdentity
GetTenantOperatingProfile
GetEffectiveTenantState
GetTenantModuleResolutions
GetTenantCapabilityResolutions
GetTenantConfigResolutions
GetCredentialAvailability
GetTenantPublishedRelease
GetTenantAppliedRelease
GetTenantConfigurationDrift
GetTenantAffectedSurfacePreview

11.4 Target control-plane commands

CreateTenantConfigurationDraft
UpdateTenantConfigurationDraft
SubmitTenantConfigurationForReview
ApproveTenantConfigurationRelease
PublishTenantConfigurationRelease
ApplyTenantConfigurationRelease
RollbackTenantConfigurationRelease
ReconcileTenantAppliedState
RotateTenantCredentialReference
RetireCompatibilityFallback

These are control-plane semantics. Exact service/storage implementation belongs to P3/P4 and must not be inferred as current functionality.

12. Publish / Apply / Rollback Model

12.1 Target states

DRAFT
REVIEWED
APPROVED
PUBLISHED
APPLYING
APPLIED
PARTIAL
DRIFTED
ROLLED_BACK
SUPERSEDED
FAILED
UNKNOWN

These are semantic lifecycle states, not automatic columns in current Runtime tables.

12.2 Publish package

A release must contain:

releaseId
portable tenant ID
profile assignment/version
module overrides
capability overrides
config entries and typed definitions
credential references only, never values
expected current applied version
impact summary
role/process/page/API consumers
rollback predecessor
reviewer/approver
created/published timestamps
source revision

12.3 Apply sequence

Control Tower Release
-> Deployment Apply Agent
-> resolve local tenant mapping
-> compare expected applied version
-> validate definitions and references
-> transactionally apply bounded local state where possible
-> commit
-> invalidate/version caches
-> reread local rows
-> resolve effective state
-> return per-item apply result
-> observe selected pages/APIs/processes

12.4 Partial apply

If module/config/profile operations cannot share one transaction, the apply result must expose each child:

SUCCEEDED
FAILED
SKIPPED
UNKNOWN
ROLLBACK_REQUIRED

Do not return one generic success after mixed effects.

12.5 Rollback

Rollback means applying a reviewed predecessor/superseding release to the same target, followed by exact reread.

Rollback does not mean:

  • deleting audit history;
  • restoring secret plaintext;
  • reusing another tenant's config;
  • setting all missing modules to enabled;
  • bypassing current Client 1 callers;
  • changing Runtime source version implicitly.

13. Semantic Queries

GetTenantExecutionContext

Returns safe typed context for support/diagnostics under explicit authorization.

Must not return session token, cookie, raw impersonation payload or credential value.

GetTenantIdentity

Returns local ID, global ID/mapping state, display identity and mapping provenance.

GetOperatingProfile

Returns profile assignment, definition version, source, validity and compatibility fallback.

GetModuleResolution

Input:

tenant
moduleKey
policy definition

Output: typed resolution and reason.

GetProcessCapabilityResolution

Returns capability decision plus profile/module/config/credential prerequisite dispositions.

GetEffectiveConfig

Returns typed Runtime value only to trusted server caller; returns safe presence/provenance/validity to diagnostics.

GetCredentialAvailability

Returns safe availability and owner-match result only.

GetTenantConfigurationDiagnostics

Returns one read model:

tenant context
profile
modules
capabilities
configs
credentials
published/applied versions
drift
source release SHA
selected page/API consumers
compatibility fallbacks
unknowns

GetAffectedSurfacePreview

Before publish/apply, lists:

  • page/menu routes;
  • APIs/actions;
  • process capabilities;
  • jobs/integrations;
  • roles/accounts requiring parity tests;
  • caches/restarts;
  • rollback owner.

14. Stable Error Catalog

Existing context errors

TENANT_CONTEXT_REQUIRED
TENANT_TARGET_REQUIRED
TENANT_CONTEXT_FORBIDDEN
IMPERSONATION_CONTEXT_INVALID
TENANT_MAPPING_MISMATCH
CREDENTIAL_OWNER_MISMATCH
TENANT_CONTEXT_COMPATIBILITY_ONLY
TENANT_CONTEXT_INVALID

Current route/module errors

UNAUTHENTICATED
FORBIDDEN
MODULE_DISABLED

Target profile/capability/config errors

PROFILE_NOT_ASSIGNED
PROFILE_NOT_APPLICABLE
PROFILE_DEFINITION_INVALID
MODULE_CONFIGURATION_UNKNOWN
CAPABILITY_DISABLED
CAPABILITY_UNAVAILABLE
CAPABILITY_DEFINITION_MISSING
CAPABILITY_PREREQUISITE_FAILED
CONFIG_MISSING
CONFIG_INVALID
CONFIG_SOURCE_ERROR
CONFIG_STALE
CONFIG_DEFINITION_MISSING
CREDENTIAL_UNAVAILABLE
CREDENTIAL_OWNER_MISMATCH
PUBLISHED_SNAPSHOT_MISSING
APPLIED_STATE_VERSION_MISMATCH
TENANT_CONFIG_CONFLICT
TENANT_CONFIG_RESULT_UNKNOWN
TENANT_CONFIG_PARTIAL_APPLY
ACCESS_DECISION_REQUIRED

New target codes must not be presented as current API behavior before implementation.

15. Exception And Recovery Matrix

Exception ID Detection Required reread Safe action Must not repeat/do
TPC-EXC-010 tenant target missing/ambiguous session, impersonation, route target stop and require explicit tenant use Config::CLIENT_ID for new write
TPC-EXC-020 global/local mapping mismatch trusted mapping + local tenant stop; mapping owner corrects choose either ID arbitrarily
TPC-EXC-030 module row missing module catalog + tenant row + compatibility definition preserve compatibility for current caller or seed explicitly global fail-closed switch
TPC-EXC-040 module source error source error + current caller policy return UNAVAILABLE or declared compatibility fallback report as explicit enabled
TPC-EXC-050 profile missing applied assignment + definition return unavailable/compatibility evidence infer customer profile silently
TPC-EXC-060 config missing definition + tenant row + allowed fallback apply explicit typed default or unavailable treat blank/missing/error as same without reason
TPC-EXC-070 config invalid stored metadata/value shape + definition reject or declared typed fallback silently cast into trusted value
TPC-EXC-080 secret owner mismatch credential ref + tenant context + module/key stop before loading/calling provider use another tenant/deployment secret
TPC-EXC-090 admin update response lost exact target rows + effective resolution + audit determine committed/not committed before repeat resend whole config/module batch
TPC-EXC-100 partial apply release child results + applied rows + effective state resume/rollback only failed child under owner mark release applied globally
TPC-EXC-110 stale cache after apply applied version + effective resolver in each consumer class invalidate/version/restart selected consumer edit row repeatedly
TPC-EXC-120 page visible but API denied menu/page/module/API/role/action matrix correct owning access contract give Administrator globally
TPC-EXC-130 API callable but page hidden same matrix and logs correct bounded parity infer no caller exists
TPC-EXC-140 profile/module/capability disagree each typed resolution route to definition/assignment owner merge concerns into one override
TPC-EXC-150 published/applied version drift release, target mapping, local rows, source SHA reconcile or supersede release edit local state without recording drift

16. Current And Target UI

16.1 Current Admin Console

Current sections:

  • tenant list and identity fields;
  • module toggles and tiers;
  • provider settings;
  • generic config rows;
  • onboarding defaults;
  • dedicated deployment read-only presentation.

Current limitations to make visible:

  • applied-state direct edit;
  • no single effective-resolution panel;
  • no profile assignment/definition display;
  • no compatibility-fallback reason per consumer;
  • no published/applied version comparison;
  • no complete page/API/action/record impact preview;
  • no universal cache/drift readback;
  • package/tier semantics are not proven entitlement authority.

16.2 Target administration workspace

Suggested sections:

Tenant Identity
Operating Profile
Modules
Named Capabilities
Configuration
Credentials
Affected Surfaces
Draft / Review / Release
Applied State / Drift
Diagnostics
Audit / Rollback

Required UI states:

LOADING
NO_TENANT_TARGET
MAPPING_MISSING
MAPPING_CONFLICT
PROFILE_MISSING
COMPATIBILITY_FALLBACK
EXPLICIT_ENABLED
EXPLICIT_DISABLED
CONFIG_MISSING
CONFIG_INVALID
CREDENTIAL_UNAVAILABLE
DRAFT_DIRTY
REVIEW_REQUIRED
APPLYING
PARTIAL_APPLY
APPLIED
DRIFTED
ROLLBACK_REQUIRED
READ_ONLY_DEDICATED
ACCESS_DENIED

No secret value is rendered after save.

17. Target Component Map

flowchart TD
    UI[React Tenant Configuration Workspace]
    NX[Next.js Server Components / Route Handlers]
    CTX[Tenant Context Application]
    PROF[Operating Profile Application]
    CAP[Capability And Config Application]
    ACCESS[Access Decision Application]
    APPLY[Configuration Release Apply Application]
    REPO[Typed MySQL Applied-State Repositories]
    CT[Control Tower Release Source]
    CACHE[Versioned Effective-State Cache]
    AUDIT[Audit / Correlation]

    UI --> NX
    NX --> CTX
    NX --> PROF
    NX --> CAP
    NX --> ACCESS
    NX --> APPLY
    CT --> APPLY
    CTX --> REPO
    PROF --> REPO
    CAP --> REPO
    APPLY --> REPO
    APPLY --> CACHE
    CTX --> AUDIT
    CAP --> AUDIT
    APPLY --> AUDIT

Responsibility rules

React:

  • presents safe diagnostics/draft/review/apply state;
  • never resolves secrets;
  • never decides module/capability policy;
  • never infers profile from Client ID.

Next.js:

  • adapts authenticated actor/tenant request;
  • validates DTO;
  • calls framework-independent application contracts;
  • maps stable safe errors;
  • never owns SQL or config precedence.

TypeScript applications:

  • tenant context construction/validation;
  • profile/module/capability/config resolution;
  • release preview/apply/rollback orchestration;
  • access decision composition;
  • cache version and audit intent.

Repositories:

  • current MySQL applied state;
  • Control Tower release content through an explicit adapter, not request-time cross-DB query;
  • optimistic version and exact readback.

Worker:

  • only for durable multi-target apply/retry/observation if accepted;
  • never required for ordinary synchronous resolution.

18. Migration And Coexistence

TPC-W0 Current caller and effective-state characterization

  • pin source/deployment/schema/config identity;
  • inventory scalar/strict contexts;
  • inventory module/config/numeric branches;
  • inventory Admin direct writes and caches;
  • capture Client 1/2 parity.

TPC-W1 Read-only diagnostics

  • TypeScript read model over current MySQL;
  • compare current helpers and typed resolution;
  • no caller behavior change.

TPC-W2 Operating profile definitions and read-only assignment

  • accept profile composition/storage;
  • publish explicit parity assignments;
  • expose read-only resolution;
  • no behavior selection yet.

TPC-W3 Module explicit parity seed

  • seed current enabled/missing compatibility intent per tenant/module;
  • preserve existing behavior;
  • expose provenance.

TPC-W4 Named capability definitions

  • select low-risk read-only capabilities first;
  • add typed resolution without changing menu/role/record access;
  • compare old/new result.

TPC-W5 Typed config definitions and diagnostics

  • replace heuristic only for opted definitions/callers;
  • preserve current fallback under declared compatibility;
  • add versioned source/validity/readback.

TPC-W6 Current Admin Console read-only effective-state view

  • show profile/module/capability/config/credential diagnostics;
  • retain existing write path initially.

TPC-W7 Versioned draft/review/publish/apply for one bounded config family

  • one tenant/config family;
  • no provider effect initially;
  • exact rollback and cache readback.

TPC-W8 Caller-by-caller capability/config cutover

  • one owner/caller cohort;
  • no dual policy authority;
  • Client 1 non-regression and Client 2 expected result.

TPC-W9 Secret/provider binding

  • credential references and safe diagnostics;
  • one provider cohort at a time.

TPC-W10 Applied-state direct-write retirement

  • after publish/apply replacement accepted;
  • preserve emergency bounded procedure;
  • caller-zero for old control-plane write.

TPC-W11 Numeric tenant compatibility retirement

  • only after explicit profile/capability/config parity;
  • remove one branch at a time.

TPC-W12 Shared/Dedicated and multi-deployment parity

  • mapping/apply/readback/rollback across deployment types;
  • no request-time Control Tower dependency.

TPC-W13 PostgreSQL later

  • preserve typed definitions, release identity, applied version, audit and tenant mapping.

19. Rollback Rules

Rollback unit is the selected caller/config release/cohort.

Allowed rollback:

  • route caller back to current helper;
  • apply predecessor configuration release;
  • restore explicit module/config rows from reviewed before state;
  • invalidate/version caches;
  • preserve release/audit history;
  • mark drift/partial results.

Prohibited rollback:

  • enable all missing modules;
  • erase published/apply history;
  • copy another tenant's rows;
  • expose secret values;
  • fall back silently to deployment tenant for a write;
  • dual-authorize current and target resolver with conflicting outputs;
  • globally disable current pages/APIs without caller evidence.

20. Stable Verification Scenarios

Tenant context

TPC-SCN-010 direct authenticated tenant
TPC-SCN-020 user impersonation actor/subject separation
TPC-SCN-030 tenant-only impersonation
TPC-SCN-040 allowlisted super-admin tenant override
TPC-SCN-050 missing tenant target
TPC-SCN-060 mapping mismatch
TPC-SCN-070 explicit CLI child tenant
TPC-SCN-080 legacy default rejected for new write

Profile

TPC-SCN-110 explicit ctc-execution assignment
TPC-SCN-120 explicit mk-order assignment
TPC-SCN-130 missing profile
TPC-SCN-140 invalid/deprecated profile version
TPC-SCN-150 profile/module prerequisite mismatch
TPC-SCN-160 legacy inferred profile diagnostic

Module

TPC-SCN-210 explicit enabled
TPC-SCN-220 explicit disabled
TPC-SCN-230 missing row current compatibility
TPC-SCN-240 source error current compatibility
TPC-SCN-250 strict missing row
TPC-SCN-260 page any/all module combination
TPC-SCN-270 inactive module-page registry row
TPC-SCN-280 unmapped page

Capability/config

TPC-SCN-310 capability enabled with prerequisites
TPC-SCN-320 module enabled / capability disabled
TPC-SCN-330 config missing with explicit default
TPC-SCN-340 config missing without default
TPC-SCN-350 invalid typed value
TPC-SCN-360 JSON shape mismatch
TPC-SCN-370 numeric Client compatibility fallback
TPC-SCN-380 current scalar versus target typed parity
TPC-SCN-390 stale cache after apply

Credential

TPC-SCN-410 tenant secret available and owner matched
TPC-SCN-420 tenant owner mismatch
TPC-SCN-430 deployment fallback explicit
TPC-SCN-440 missing secret
TPC-SCN-450 module/capability disabled despite valid secret
TPC-SCN-460 safe diagnostics contain no value

Admin/release

TPC-SCN-510 current direct module update and exact reread
TPC-SCN-520 current direct config update and exact reread
TPC-SCN-530 response loss before reread
TPC-SCN-540 version conflict
TPC-SCN-550 publish/apply success
TPC-SCN-560 partial apply
TPC-SCN-570 drift detected
TPC-SCN-580 predecessor rollback
TPC-SCN-590 Dedicated read-only behavior
TPC-SCN-600 Client 1 non-regression
TPC-SCN-610 Client 2 expected profile/capability result

Migration

TPC-MIG-SCN-010 scalar/typed context parity
TPC-MIG-SCN-020 current/typed module parity
TPC-MIG-SCN-030 config provenance parity
TPC-MIG-SCN-040 one caller cutover
TPC-MIG-SCN-050 rollback without access outage
TPC-MIG-SCN-060 old caller-zero
TPC-MIG-SCN-070 no numeric tenant selector
TPC-MIG-SCN-080 Shared/Dedicated apply parity
TPC-MIG-SCN-090 PostgreSQL result parity

21. Evidence Template

For every scenario record:

source/deployed SHA
deployment type and environment
database/schema identity
tenant local/global identity
actor/subject/access mode
profile assignment/version
module/capability/config definition version
before rows and safe diagnostics
command/query and request/correlation ID
expected result
actual local rows
effective resolution reread
menu/page/API/action/record result
cache/restart result
provider result if applicable
rollback/cleanup
residual risk

Never record secret values.

22. Definition Of Ready For Implementation

  • [ ] current qa, deployed SHA and environment pinned;
  • [ ] P4/P2/P5/P6/P8/P12 writer ownership agreed;
  • [ ] profile composition and assignment owner accepted;
  • [ ] target definition storage/publish boundary accepted;
  • [ ] selected module/capability/config caller cohort inventoried;
  • [ ] Client 1 and Client 2 parity/negative expectations approved;
  • [ ] missing/error fallback policy accepted for selected cohort;
  • [ ] cache/version/readback contract accepted;
  • [ ] Admin current direct-write and target publish/apply coexistence defined;
  • [ ] rollback and observation owner defined;
  • [ ] no broad held work accidentally activated.

23. Definition Of Complete For One Migrated Cohort

  • [ ] strict tenant context used by every selected caller;
  • [ ] explicit operating profile result available;
  • [ ] module/capability/config/credential results are typed and separately visible;
  • [ ] menu/page/API/action/record authorization parity proven;
  • [ ] no numeric tenant/customer behavior selector remains in the cohort;
  • [ ] current helper and target resolution parity/intentional delta accepted;
  • [ ] versioned publish/apply/readback/rollback proven where applicable;
  • [ ] secrets remain redacted and owner-matched;
  • [ ] Client 1 normal and negative paths pass;
  • [ ] Client 2 target paths pass;
  • [ ] current and target Wiki/admin Runbook updated and accepted;
  • [ ] old caller-zero proven;
  • [ ] stabilization window complete;
  • [ ] Process/capability coverage and Roadmap owners update their own status.

24. Current Readiness Disposition

Source authority: DETAILED
Typed tenant context foundation: PRESENT / PARTIAL CALLER ADOPTION
Typed capability resolver foundation: PRESENT / NO BROAD ACTIVE ADOPTION PROVEN
Operating profile binding: NOT ESTABLISHED
Current Admin applied-state UI/API: PRESENT
Versioned Control Tower publish/apply integration: NOT ESTABLISHED IN RUNTIME
Role/page/API/action/record matrix: INCOMPLETE
Fresh DB/browser/provider evidence: NOT RUN IN THIS WAVE
Wiki current content/publication: NOT READ / NOT AUTHORIZED
P4-003 activation: NO
M4: NOT ESTABLISHED

---

Source: docs/reconstruction/PLATFORM_TENANT_PROFILE_CAPABILITY_CONFIGURATION_REBUILD_PACKET.md — ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged.