Console/ Planning/ Tenant Runtime

Tenant Runtime 04 · ผู้เช่า / องค์กร · enterprise upload + hybrid intake + tenant registry

Planning · v0.2
เอกสาร planning · ไม่มี upload pipeline จริง · ไม่มี tenant provisioning. B shells at /kb/enterprise-upload + /kb/intake-workspace เป็น contract-only. Runtime ต้องผ่าน tenant-admin + platform-governance dual sign-off · founder sign-off สำหรับ first pilot.
Binding: live mock mapped-not-bound placeholder derived

Context

งานนี้มี 2 ส่วนที่รวมกันเป็น "Tenant": Enterprise Upload (SUB-3/SUB-4) = upload surface + 9-stage normalisation pipeline + conflict matrix + coverage score. Hybrid Intake Workspace = 8-panel workspace ผสม wizard + upload · shared state · multi-user · same approval gates. เหนือสองส่วนนี้คือ Tenant Registry ที่ provision per-tenant Nerve instance + data partitioning + cross-tenant marketplace listing.

docs/kb/data/enterprise_intake.json13 source_origins · 4 unit_modes · coverage_scoring · conflict_resolution · review_gates · tenant_ownership
docs/kb/data/hybrid_intake_workspace.json8 panels · state_model · collaboration · workspace_view_modes
docs/kb/data/multi_source_intake.jsonMulti-source ingest pipeline
docs/kb/data/source_mapping_engine.jsonSource → canonical mapping rules
docs/kb/data/tenant_scope.jsonTenant roles · scope transitions · app_registry_handoff · feature_flag_handoff
docs/kb/data/approval_matrix.jsonrow-tenant-instantiate-nerve gate
docs/kb/data/publish_workflow.jsonStages + rollback
docs/kb/data/living_city.jsontenant_replication template_checklist_hint

Scope

Field Mapping — Enterprise Intake upload surface + pipeline

Source: enterprise_intake root fields.

B Field B Type A Runtime Target A Owner Approval Gate Binding Notes
source_origins[] enum(13) Upload form radio group + origin tag on each asset Backend + FE none mapped-not-bound 13: founder · canonical · concept · system · legacy-wiki · partner-doc · regulator · press · chatgpt · claude · gemini · perplexity · mixed
unit_modes[] enum(4) Upload widget mode selector Frontend none mapped-not-bound single-file · folder · link · ai-bundle
coverage_scoring.dimensions array Coverage dashboard · per-dimension meter Backend + FE none mapped-not-bound —
coverage_scoring.thresholds object Thresholds → pass/warn/fail colour Backend none mapped-not-bound Block tenant go-live until green
conflict_resolution object Conflict matrix UI · resolution form Frontend gate-conflict-resolution mapped-not-bound Each conflict needs sign-off · T1 source wins by default per authority rules
review_gates array Step gating in publish workflow Backend gate-review mapped-not-bound Each gate = reviewer role + SLA
tenant_ownership object Tenant DB schema + RLS policies Backend + Infra gate-tenant-instantiate mapped-not-bound Founder sign-off for first pilot tenant
shareability_and_resellability object Marketplace listing rules Backend gate-marketplace mapped-not-bound Payment + contract brokering explicitly OUT of scope per handoff deferred list

Field Mapping — Hybrid Intake Workspace 8 panels + state

Source: hybrid_intake_workspace.workspace_panels.

Panel (B) A Runtime Component A Owner Binding Notes
panel-overviewWorkspace home · KPI + statusFrontendmapped-not-bound Always visible · sidebar nav
panel-wizardEmbedded Wizard (shared w/ Wizard Runtime)Frontendmapped-not-bound See Wizard Runtime page for details
panel-uploadUpload dropzone + progressFrontendmapped-not-bound 4 unit_modes
panel-normalise9-stage pipeline viewer · stage-by-stage logsBackend + FEmapped-not-bound Real-time SSE feed
panel-conflictConflict matrix · resolve formFrontendmapped-not-bound —
panel-review-queueReviewer queue · assignmentFrontendmapped-not-bound Shared w/ Cases queue pattern
panel-coverageCoverage dashboardFrontendmapped-not-bound Per dimension meter
panel-handoffDraft KB → live KB promote formBackend + FEmapped-not-bound Gated: tenant go-live approval

Shared state: state_model.persisted_fields → WebSocket + CRDT · state_merge_rules → conflict resolution per-field.

Field Mapping — Tenant Registry tenant_scope.app_registry_handoff

B Field A Runtime Target A Owner Binding Notes
tenant_idtenants.id PKBackendmapped-not-bound Embedded in every JWT · used in RLS
tenant_rolestenant_user_roles tableBackendmapped-not-bound Per-tenant role assignment
scope_transitionsState machine for tenant lifecycleBackendmapped-not-bound draft → review → pilot → live · rollback allowed
feature_flag_handoffPer-tenant flag override in flag registryBackendmapped-not-bound Depends on Feature Flag Registry runtime

A-owned Runtime Boundary ขอบเขต A vs B

B owns (read-only for A)

  • Contract JSON (all fields listed in "Context" block above)
  • Trilingual label parity
  • honest_note + requires_human_review flags
  • Contract evolution (schema-versioned)

A owns (this runtime)

  • All tables + indexes for entities in ER diagram below
  • API endpoints in API Sketch block
  • Frontend components + chart/form rendering
  • Cache + feature flag integration
  • Auth + sign-off capture
  • Audit trail

ER Diagram A-owned tables · Tenant · registry + partition + publish

Tenant · registry + partition + publish
tenants ● id (embed in JWT) name · domain tier · status db_schema_name k8s_namespace template_version pdpa_agreement_ref founder_signoff_ref created_at go_live_at tenant_sources ● id tenant_id origin (13 enum) unit_mode (4) filename/url ingest_stage coverage_score conflicts_count authority_rank publish_pipeline ● id tenant_id stage (enum) rollback_to approvals[] tenant_workspaces tenant_id · panel_state crdt_doc (shared) marketplace_listings tenant_id visibility share_scope resell_flag (no payments)

API Sketch FastAPI endpoints

POST/api/tenant/register
Create tenant · status=draft · founder sign-off required before go-live
POST/api/tenant/{id}/source/upload
Upload source · 13 origins × 4 unit modes
GET/api/tenant/{id}/coverage
Coverage score per dimension · pass/warn/fail
POST/api/tenant/{id}/publish
Move stage · gated by publish_workflow approvals
POST/api/tenant/{id}/rollback
Rollback stage · immutable history

Sequence Flow Tenant onboarding · first pilot

Tenant onboarding · first pilot
Tenant Admin Tenant API Intake pipeline Governance K8s · DB 1 register (name · PDPA agreement) 2 upload folder + AI bundle (4 sources) 3 9-stage normalise · coverage · conflicts 4 publish request · gate-tenant-instantiate dual + founder sign-off 5 provision K8s ns + DB schema · RLS verify go_live_at set · marketplace listing (read-only)

Dependencies

Upstream (must be done first)

  • Auth + JWT with tenant claim
  • Feature flag registry
  • Approval matrix integration
  • Publish workflow engine
  • K8s / infrastructure for per-tenant provisioning
  • Tenant billing (if commercial) — out of scope this phase

Blocks (this blocks)

  • Enterprise customer onboarding
  • Multi-tenant MICE scenarios
  • Cross-tenant dashboards (future phase)

Human Approval Gates

Risks

Tenant data bleed across partition boundary
High
Row-level security policies on every tenant-bound table · penetration test before pilot · CI check
AI bundle upload contains PII
High
PII scan at ingest · tenant must sign data handling agreement · SHA-256 for PII fields per CLAUDE.md
Cross-tenant conflict (same POI different data)
Med
Conflict matrix + authority rules (T1 wins) · per-tenant branch kept separate
Coverage threshold too strict → blocks small tenants
Med
B's thresholds have per-dimension override · A surfaces override UI to governance
Per-tenant Nerve provisioning cost explosion
Med
Shared infra with namespace isolation · cost monitoring per tenant
Template immutability violated during migration
High
Template versioned · immutable once published · semver enforced · deprecation grace window deferred per handoff

Definition of Done

  1. All 13 source_origins + 4 unit_modes functional in upload UI
  2. 9-stage normalisation pipeline produces auditable output + coverage score
  3. Conflict matrix renders + resolves + signs off
  4. Hybrid workspace 8 panels navigable + shared state persists across users
  5. Tenant registry CRUD with RLS verified via penetration test
  6. First pilot tenant provisioned end-to-end · founder sign-off captured
  7. Per-tenant Nerve instance boots + connects to scoped DB
  8. Feature flag override works per-tenant
  9. PDPA compliance audit passed for pilot tenant
  10. All 5 approval gates signed off · WORM audit log

Deferred

Tenant Runtime Planning · v0.2 · Session A · A-owned ← Planning hub · B contract ↗