m2/m2-market
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
m2-market/contracts/tenants.md

1.4 KiB
Raw Permalink Blame History

Tenant namespace contract v1

Canonical tenant IDs come from the live m2-gpt tenants table. Marketplace contracts must not invent alternate sentinels or display-name aliases.

Live table read on 2026-07-02:

tenant_id display_name status
erlengrund-m2o erlengrund-m2o active
gunnar-m2o gunnar-m2o active
m2 m2 Operator active
m2bd-m2o m2bd-m2o active
matrix matrix active
parlobyg-m2o parlobyg-m2o active
smoke7623 Smoke smoke7623 active
e2e-verify-0617 E2E Verify delete me archived

Marketplace-reserved scopes:

  • * in listing.tenant_visibility means public to all tenants.
  • m2-core is the shared commons scope for reusable, scrubbed marketplace evidence and shared Solutions. It replaces __fleet__ for marketplace contracts.

Rules:

  • tenant_visibility is an allowlist of * or canonical active tenant IDs.
  • Empty tenant filters fail closed.
  • Readers must apply the S2 filter contract: filters.tenant_visibility_any = ["*", "<caller_tenant>"], with client-side backstop that drops hits where status != "published" or caller tenant is not visible.
  • Cross-tenant not-found and forbidden states are surfaced as 404 to avoid existence leaks.
  • m2-core is allowed for solution.tenant_scope and evidence scope, but it is not a buyer tenant and is not a replacement for tenant_visibility: ["*"].