Deployment Prerequisites
Audience: operators planning to add tenants to a Stella Ops deployment.
This runbook defines the operator prerequisites for adding tenants under a single operator trust boundary. It is anchored in ADR-005.
Trust Boundary
Run Stella Ops inside one operator trust boundary. All tenants in a deployment must share the same operator, security team, incident-response authority, and data-residency posture. Do not expose tenant self-service signup, and do not use one deployment as shared SaaS infrastructure for unrelated tenants.
Tenant Inventory Expectations
Tenants are expected to represent environments, business units, sub-organizations, or other logical scopes under the same operator. The canonical safe-addition fixture for QA planning is FIXTURE-T7-001; use it as the reference shape when proving both Authority and Platform tenant stores are populated consistently.
Resource Headroom
Operators must monitor shared deployment resources at the deployment level: PostgreSQL volume free space, RustFS or object-store capacity, and router QPS. Stella Ops does not currently enforce per-tenant storage quota, per-tenant object-store quota, or tenant-partitioned router rate limits.
Offboarding
Tenant offboarding is soft-suspend only today through POST /console/admin/tenants/{id}/suspend. Hard tenant-delete is manual and cross-database; there is no supported product endpoint that deletes all tenant data, validates every schema, and records a dry-run audit. For the non-runnable hard-delete test shape, see TOPO-124 approach 3b.
What This Deployment Is NOT
- Not shared-tenancy SaaS for unrelated customers.
- Not a deployment where tenants are expected to defend against each other.
- Not a tenant self-service signup system.
- Not a deployment with per-tenant storage headroom enforcement.
- Not an automated hard-delete/offboarding system for tenant-scoped erasure.