Multi-Tenant Same-Key Service Impact Ledger

Audience: implementers and reviewers delivering the same-key multi-tenant contract across Authority, Router/Gateway, Platform, Scanner, Graph, and the Web Console. Companion: the behavioral sequences are in Multi-Tenant Same-Key End-to-End Flow Sequences; the design decision is ADR-002 — Multi-tenant same-API-key selection.

Purpose

Change Ledger

ServiceSprintFile-level touchpoint categoriesOwner roleDepends onVerification evidence
Authority20260222.054Console/Admin endpoints, OpenIddict handlers, Client metadata stores, Auth abstractions, Authority testsDeveloper + Test AutomationADR-002Targeted Authority test project pass logs for client credentials/password grant tenant selection, token validation mismatch, /console/tenants, and admin client CRUD tenant assignments.
Router + Gateway20260222.055Identity header policy middleware, tenant override gating, route passthrough policy, middleware parity testsDeveloper + Security architect20260222.054Targeted Router and Gateway tests proving spoof stripping, no authenticated default fallback, mismatch rejection, and feature-flagged override behavior.
Platform20260222.056Request context resolver, tenant-required endpoint groups, topology/read-model store callers, context preferences, platform integration testsDeveloper + Test Automation20260222.055Platform test project outputs validating endpoint classification, tenant parity checks, topology isolation, and tenant-scoped preference behavior.
Scanner20260222.057Scanner request resolver, scan submission/coordinator, triage query contracts, webhook tenant lookup, unknowns endpoints, scanner testsDeveloper + Test Automation20260222.055Scanner tenant isolation test outputs for scan ownership, triage isolation, webhook source collision routing, unknowns isolation, and middleware partitioning.
Graph20260222.058Graph request resolver, endpoint auth policies, scope handling, rate-limit/audit tenant keys, graph API testsDeveloper + Test Automation20260222.055Graph API test outputs covering missing tenant, cross-tenant denial, missing-scope denial, and export ownership checks.
Web Console20260222.059Topbar tenant selector, console/auth/platform context stores, tenant interceptor, authority console client, component/unit testsDeveloper + Test Automation20260222.054, 20260222.055Web unit/component test outputs for selector UX, state synchronization, interceptor canonical+legacy headers, switch rollback, and URL context sync.
QA / Playwright matrix20260222.060Playwright fixtures, tenant-switch specs, Tier 2a API verification docs, Tier 2c artifact bundleQA + Test Automation20260222.054…20260222.059Playwright run output, traces/screenshots, and module-level API isolation evidence with explicit go/no-go decision.

Ownership and Dependency Notes

Completion Mapping