# Tenant namespace contract v1

Canonical tenant IDs come from the live m2-gpt `tenants` table. Marketplace contracts must not
invent alternate sentinels or display-name aliases.

Live table read on 2026-07-02:

| tenant_id | display_name | status |
| --- | --- | --- |
| `erlengrund-m2o` | erlengrund-m2o | active |
| `gunnar-m2o` | gunnar-m2o | active |
| `m2` | m2 Operator | active |
| `m2bd-m2o` | m2bd-m2o | active |
| `matrix` | matrix | active |
| `parlobyg-m2o` | parlobyg-m2o | active |
| `smoke7623` | Smoke smoke7623 | active |
| `e2e-verify-0617` | E2E Verify delete me | archived |

Marketplace-reserved scopes:

- `*` in `listing.tenant_visibility` means public to all tenants.
- `m2-core` is the shared commons scope for reusable, scrubbed marketplace evidence and shared
  Solutions. It replaces `__fleet__` for marketplace contracts.

Rules:

- `tenant_visibility` is an allowlist of `*` or canonical active tenant IDs.
- Empty tenant filters fail closed.
- Readers must apply the S2 filter contract:
  `filters.tenant_visibility_any = ["*", "<caller_tenant>"]`, with client-side backstop that
  drops hits where `status != "published"` or caller tenant is not visible.
- Cross-tenant not-found and forbidden states are surfaced as `404` to avoid existence leaks.
- `m2-core` is allowed for `solution.tenant_scope` and evidence scope, but it is not a buyer
  tenant and is not a replacement for `tenant_visibility: ["*"]`.