feat(governance): per-tenant governance packages — GT-532 - #115
Merged
Conversation
The row's problem statement is that governance cannot be packaged per customer. A tenant configured it piece by piece - one GatePolicy per phase, one ArtifactFieldSchema per artifact type - with no way to take that configuration whole, version it, review it as a unit, or move it to another tenant. GET /governance-packages/export produces a named, versioned, portable document. POST /governance-packages/apply installs one. Four decisions worth arguing with: A package is a DOCUMENT, not a persisted aggregate. Storing it would add a third copy of data that already lives in two places, which is exactly the failure this repository has spent the week repairing. No table also means no migration and no drift. It carries NO tenant id anywhere, at any nesting level, and the destination is always the SESSION tenant. A package that dragged its source tenant into a target is precisely the isolation leak the product forbids. Enforced by reflection over the types rather than over a call, so adding the field breaks the test even if nobody writes a request that uses it - verified by adding it and watching it go red. Export is deterministically ordered, because two exports of the same state must produce the same document or nobody can diff two packages or review a governance change in a pull request. Apply refuses an invalid package ENTIRELY before touching anything, but once it starts it does not stop at the first failure: a partially applied package is a fact worth seeing whole, and stopping early leaves a state the report does not describe. The product ships the MECHANISM and no content. Per T-056 a canned "ISO 27001 package" would be engine code holding an opinion that belongs to the tenant, and a test asserts the repository contains no applicable package. The other half of criterion 1 was already met: TowerMd3 is the executive portfolio view. Credited rather than rebuilt - reimplementing it would have been the eighth instance this week of building something that already existed. 13 tests. The 10 failures in the local suite are the pre-existing DB-gated integration tests that fail by design without PostgreSQL.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The row says "governance cannot be packaged per customer". A tenant configured it piece by piece — one
GatePolicyper phase, oneArtifactFieldSchemaper artifact type — with no way to take that configuration whole: version it, review it as a unit, or move it to another tenant.GET /governance-packages/exportnow produces a named, versioned, portable document.POST /governance-packages/applyinstalls one.Four decisions worth arguing with
The mechanism, never the content
Per
T-056, a canned "ISO 27001 package" would be engine code holding an opinion that belongs to the tenant. A test asserts the repository contains no applicable package.The other half of the criterion was already met
TowerMd3is the executive portfolio view — "Control Tower", subtitled live SDLC governance across the portfolio, with a Portfolio flow section and counters over the session tenant's initiatives and executions.Credited rather than rebuilt. Reimplementing it would have been the eighth instance this week of building something that already existed.
Scope
The row's title also mentions marketplace adapters. The acceptance criteria never asked for them, and the row's own risk note warns about effort dispersion — so what landed is the packaging mechanism, and the row says so.
13 tests. The 10 failures in the local suite are the pre-existing DB-gated integration tests that fail by design without PostgreSQL; none is in this change.
🤖 Generated with Claude Code