34 lines
1.4 KiB
Markdown
34 lines
1.4 KiB
Markdown
# Tenant namespace contract v1
|
|
|
|
Canonical tenant IDs come from the live m2-gpt `tenants` table. Marketplace contracts must not
|
|
invent alternate sentinels or display-name aliases.
|
|
|
|
Live table read on 2026-07-02:
|
|
|
|
| tenant_id | display_name | status |
|
|
| --- | --- | --- |
|
|
| `erlengrund-m2o` | erlengrund-m2o | active |
|
|
| `gunnar-m2o` | gunnar-m2o | active |
|
|
| `m2` | m2 Operator | active |
|
|
| `m2bd-m2o` | m2bd-m2o | active |
|
|
| `matrix` | matrix | active |
|
|
| `parlobyg-m2o` | parlobyg-m2o | active |
|
|
| `smoke7623` | Smoke smoke7623 | active |
|
|
| `e2e-verify-0617` | E2E Verify delete me | archived |
|
|
|
|
Marketplace-reserved scopes:
|
|
|
|
- `*` in `listing.tenant_visibility` means public to all tenants.
|
|
- `m2-core` is the shared commons scope for reusable, scrubbed marketplace evidence and shared
|
|
Solutions. It replaces `__fleet__` for marketplace contracts.
|
|
|
|
Rules:
|
|
|
|
- `tenant_visibility` is an allowlist of `*` or canonical active tenant IDs.
|
|
- Empty tenant filters fail closed.
|
|
- Readers must apply the S2 filter contract:
|
|
`filters.tenant_visibility_any = ["*", "<caller_tenant>"]`, with client-side backstop that
|
|
drops hits where `status != "published"` or caller tenant is not visible.
|
|
- Cross-tenant not-found and forbidden states are surfaced as `404` to avoid existence leaks.
|
|
- `m2-core` is allowed for `solution.tenant_scope` and evidence scope, but it is not a buyer
|
|
tenant and is not a replacement for `tenant_visibility: ["*"]`.
|