feat(store): tenant schema + identity plumbing (RIG-2861 T1) - #715
Open
rigel-mintaka wants to merge 2 commits into
Open
feat(store): tenant schema + identity plumbing (RIG-2861 T1)#715rigel-mintaka wants to merge 2 commits into
rigel-mintaka wants to merge 2 commits into
Conversation
The tenant-identity foundation for Compass managed multi-tenancy, per the frozen RIG-2861 design record (docs/designs/infra/runtime/compass-managed-multitenancy/design.md, §T1). This is T1 only: schema + context plumbing, no RLS (that is T2, gated on RIG-2877). - New `tenants` table (id, slug, display_name, created_at_unix_ms), folded into 0001_init.sql per the repo's pre-dogfood collapse convention (no new NNNN file). `accounts` gains a NOT NULL `tenant_id` FK + a lookup index. - `store.TenantID` newtype; `WithTenant`/`TenantFromContext` context seam mirroring the comms actor seam (context.go). - `(*Store).BootstrapTenant` — idempotent single-tenant seed mirroring BootstrapAdmin; `Open` seeds it and caches the id. `resolveTenant` stamps the context tenant when set, else the bootstrap tenant — OSS single-tenant stays degenerate with no `if multiTenant` fork. - All four account inserts stamp `tenant_id` via `resolveTenant(ctx)`. Tests (pgtest): idempotent seed, migration on fresh + existing DBs, CreateUser stamps the context tenant and falls back to the bootstrap tenant. Existing account/agent/system suites pass unchanged under the new NOT NULL column. Refs RIG-2918.
|
Compass engineering docs preview: https://compass-managed-rig-2918-t1.compass-eng-docs.pages.dev Deployed from |
…1 review) Review finding (low): only CreateUser tenant-stamping was directly asserted. CreateAgent inserts through a different transactional path, so a wrong-tenant stamp there would escape both the CreateUser test and the NOT NULL column. Add TestCreateAgentStampsTenant reading back the persisted agent tenant_id. Refs RIG-2918.
rigel-mintaka
marked this pull request as ready for review
August 28, 2026 05:42
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The tenant-identity foundation for Compass managed multi-tenancy, per the
frozen RIG-2861 design record
(docs/designs/infra/runtime/compass-managed-multitenancy/design.md, §T1). This
is T1 only: schema + context plumbing, no RLS (that is T2, gated on RIG-2877).
tenantstable (id, slug, display_name, created_at_unix_ms), folded into0001_init.sql per the repo's pre-dogfood collapse convention (no new NNNN
file).
accountsgains a NOT NULLtenant_idFK + a lookup index.store.TenantIDnewtype;WithTenant/TenantFromContextcontext seammirroring the comms actor seam (context.go).
(*Store).BootstrapTenant— idempotent single-tenant seed mirroringBootstrapAdmin;
Openseeds it and caches the id.resolveTenantstamps thecontext tenant when set, else the bootstrap tenant — OSS single-tenant stays
degenerate with no
if multiTenantfork.tenant_idviaresolveTenant(ctx).Tests (pgtest): idempotent seed, migration on fresh + existing DBs, CreateUser
stamps the context tenant and falls back to the bootstrap tenant. Existing
account/agent/system suites pass unchanged under the new NOT NULL column.
Refs RIG-2918.