Skip to content

Tenant Isolation Negative-Test Baseline — 2026-07-15

  • Classification: OBSERVED-FACT
  • Does not own: current tenant contract, P4 status or Production readiness

Selected context/relation/job/capability/telemetry and YMS/Dock no-I/O fixtures passed; unauthenticated Local page/API checks returned 302/401/404 as expected. This does not prove platform-wide isolation.

Dated source findings: missing/error module rows can fail open; page role and domain API role checks differ; partial session can fall back to tenant 1; foreign direct-ID results can be 200 empty/no-op; parent/file/log/browser state/job/provider/AI isolation has incomplete active-caller evidence; and local static media/log paths need separate Production exposure verification.

---

Source: docs/research/tenant/2026-07-15/TENANT_ISOLATION_NEGATIVE_TEST_BASELINE.md — ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged.