ADR-010: Public fixed-realm product boundary and independent lightweight Veltro

Source of truth: docs/adr/010-public-fixed-realm-product-boundary.md (synced at build time — edit the original, not this copy). Status: Accepted (2026-07-30)

Amended by ADR-016: identity owns the team directory, replacing §2’s product-owned teams.

Decision owner: Danny

Issues: #202, #204, #212

Context

The shipped suite proved cross-product identity, product-native role propagation, and immutable cross-product ownership identifiers. Its current realization also made VectorFlow’s Organization the public suite customer boundary and deployed Veltro’s identity role from the complete VectorFlow application, schema, database, image, version, and release.

That realization is coherent historical evidence, but it is not the approved forward public product. Maintaining public Organization/MSSP capability and a synchronized public/private application would obscure the open-source boundary, keep Veltro physically coupled to VectorFlow, and repeat an architecture already shown to be operationally expensive.

The approved active program is therefore open-source-only. Organization/MSSP is deferred product scope, not a control plane to design during the extraction.

Decision

1. Public Veltro is one fixed realm

Public Veltro has exactly one immutable internal realm whose literal identifier is default. The realm is not caller-selectable and has no public lifecycle. Veltro may serve multiple users and owns:

• authentication and account security;
• fixed-realm IdP/SSO/SCIM configuration;
• launcher and single-origin gateway behavior;
• application access grants;
• suite status and audit aggregation;
• MCP authority and principal attribution.

Supported UI, API, configuration, documentation, and artifacts do not present an Organization noun or Organization/MSSP product behavior.

2. Public standalone products are independent single-tenant applications

Superseded on acceptance of ADR-014 (proposed 2026-09-26): products will always run behind Veltro identity, and a standalone product becomes the Veltro core plus that one product. Local identity and the absence of a runtime dependency on Veltro stop being requirements. The hidden ownership boundary, product-native teams and roles, and the fail-closed rules below stand.

VectorFlow, CHAD, and Warden each support standalone deployment with local identity and one immutable hidden ownership boundary. They have no runtime, network, DNS, database, gateway, or release dependency on Veltro.

The hidden tenant remains fail-closed authorization state, not customer-facing product capability. Caller input—including Host, domain, cookie, request field, slug, environment variable, or feature flag—cannot select another tenant.

VectorFlow retains ownership of Teams, Environments, pipelines, fleet, agents, and product resources. CHAD and Warden retain their product-native teams, roles, resources, and authorization. A Team is not an Organization projection.

3. Integrated public suite mode uses the same fixed realm

Veltro authenticates users and grants application access. Products verify Veltro authority and enforce their own native roles and resource scopes. Integrated mode uses suite_org_id = "default" as an authenticated internal projection where needed; it has no customer provisioning saga, Organization switching, billing, operator control plane, or MSSP portfolio.

Products may verify authority but may not share mint authority. The current shared symmetric signing mechanism is historical runtime compatibility. Issuer- only verification (#130) is a hard prerequisite to identity cutover, not part of this architecture-contract PR.

4. Internal ownership keys are retained by rationale, not by product noun

Fields or rows such as organization_id, org_id, and suite_org_id may remain when they are required for:

• foreign-key integrity;
• RLS or equivalent ownership predicates;
• authorization and fail-closed cross-scope checks;
• audit attribution;
• encryption/AAD binding;
• migration, upgrade, restore, or compatibility readers;
• legacy export and historical evidence.

Their presence does not make Organization a supported product. New public code may not use retained keys to introduce customer-selectable tenancy.

5. Existing non-default authority is unsupported and must fail closed

Fresh public installations create only default. Existing installations with non-default or ambiguous Organization authority must not be silently merged, renamed, reassigned, or deleted. Upgrade and extraction work must detect that state and stop with an explicit export or later migration path.

Schema contraction follows expand/migrate/cutover/contract. It occurs only after reconciliation, independent restore evidence, a defined rollback window, and a recorded point of no return. Post-write rollback is not called lossless unless reverse synchronization exists or writes are frozen and reconciled.

6. Veltro becomes physically independent

The target Veltro application owns its source boundary, dependency graph, schema, migrations, PostgreSQL database, Redis workloads, backup/restore, image, version, release, and resource budget. It does not contain VectorFlow product routers, UI, jobs, schema ownership, or bytes.

Component workflows publish independent artifacts. release-suite.yml may coordinate an immutable integrated promotion/deployment tuple but does not own component publication.

7. Public capability has a negative composition boundary

No supported public route, package export, image, source map, SBOM, Compose profile, feature flag, fixture, or combination of public artifacts may provide:

• Organization CRUD or lifecycle;
• Organization selection or switching;
• invitations or membership administration;
• tenant-domain/Host authority;
• multi-realm SSO/SCIM policy;
• hosted signup/provisioning;
• billing, dunning, or entitlements;
• operator/break-glass product surfaces;
• MSSP/customer portfolio APIs;
• non-default realm minting;
• a flag/profile that enables any prohibited capability.

The manifest in conformance/public-product-boundary-v1.json freezes this no-growth contract. It does not claim that current artifacts already conform. Issue #204 owns inventory, capability retirement, and final composition proof.

8. Organization/MSSP remains deferred

No private repository, billing system, provisioning saga, operator workflow, or commercial control-plane owner is selected by this ADR. Issue #57 records the deferred concept and is not an implementation dependency for #202 or #204. vectorflow-cloud is historical/provenance evidence under #203, not a source tree or synchronized superset to revive.

Previously published AGPL grants and license history remain valid.

Supersession map

Supersession is section-level. Historical decisions, migrations, release evidence, and ADR-008 identifiers remain intact.

Authority	Superseded forward target	Preserved authority/evidence
ADR-002 Decision 2 §4	A shared symmetric delegated-auth secret as the target module contract	Standalone boot, local identity, single-origin integration requirements, and shipped compatibility behavior
ADR-003 Decision 3 and consequences	Shared VectorFlow source/schema/database/image/version as Veltro’s target realization	Veltro as suite identity authority, host-only single-origin session intent, and the historical identity-role implementation
ADR-008 Amendment 8	Public non-default Organization production, selection, lifecycle, and future MSSP seam	D1–D11 meanings, rollout aliases, strict product-native roles, default deny, opaque authenticated scope, and shipped #144–#149 evidence
CONTEXT.md terminology/current state	Active Organization membership and a suite-wide customer/MSSP boundary as forward product design	Exact historical release/conformance records and current compatibility seams
Historical open-core/cloud material	A synchronized public/private superset or active commercial-design prerequisite	Provenance, threat-model, legal, security, migration, and archival evidence under #203

Consequences

• #212 can land without pretending current runtime already conforms.
• #202 extraction children implement the independent Veltro target.
• #204 independently removes or quarantines public Organization/MSSP capability.
• #130 must complete before identity cutover.
• Some internal tenant-shaped schema remains temporarily or permanently for security and integrity; unsupported product capability does not.
• Historical non-default conformance remains testable evidence until follow-up issues deliberately retire or quarantine it.
• Publication is blocked by exact leakage and resource-budget gates in later children rather than by aspirational documentation.

Rejected alternatives

1. Keep VELTRO_ROLE=identity as the product boundary. Rejected: behavior gating does not remove VectorFlow source, dependencies, schema, image bytes, release coupling, or eager router imports.
2. Delete every Organization-shaped key immediately. Rejected: it can break FK/RLS/audit/encryption invariants and make upgrades or restores unsafe.
3. Design the deferred commercial control plane during extraction. Rejected: it adds speculative dependencies and does not improve the public boundary.
4. Revive vectorflow-cloud as a synchronized superset. Rejected: it repeats the ownership and synchronization failure this program is removing.
5. Treat the all-public composition gate as documentation. Rejected: the boundary must inspect publishable artifacts and fail mechanically.