@fabricorg/platform-host 7.1.1 → 7.2.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @fabricorg/platform-host
 
+## 7.2.0
+
+### Minor Changes
+
+- 715e920: `tenantIsolationChecks()` and `runTenantIsolationChecks(subject)`: six checks proving that scope is a key on every read, write, claim, and completion. An invocation cannot be read, executed, or completed by callback under another tenant's scope; the same idempotency key in two tenants is two invocations; a tenant's event stream carries no other tenant's events; a tenant-scoped worker claims nothing of another's; and, when the subject lends a governed read, a viewer in the other tenant sees none of ours. Each check carries a positive control, so a store or host that does nothing fails it, and each has a teeth test against the flaw it names. The claim check uses a probe space of its own and retires its probe row, so a backlog cannot hide a tenant-ignoring claim and a live worker never runs the probe. Rows a lent read returns must carry their `tenantId`.
+
+## 7.1.2
+
+### Patch Changes
+
+- 07e3c65: The external-completion lifecycle moves out of the host into its own internal module, with the helpers it shares with the host in another. No behaviour changes; the public surface is unchanged and every test passes as before.
+
 ## 7.1.1
 
 ### Patch Changes

package/README.md

@@ -300,6 +300,15 @@ migration 3 adds the `pending_completion`, `external_completion`, and `completio
 a partial index on the due instant the overdue sweep uses; the due instant is a real column because a
 cast in an index expression is not immutable and PostgreSQL refuses it.
 
+## Tenant isolation
+
+`tenantIsolationChecks()` and `runTenantIsolationChecks(subject)` prove that scope is a key on every
+read, write, claim, and completion: an invocation is invisible, inert, and uncompletable under another
+tenant's scope; the same idempotency key in two tenants is two invocations; event streams carry only
+their own tenant's events; a tenant-scoped worker claims nothing of another's; and a governed read
+the subject lends shows the other tenant none of ours. The subject supplies a host, a recoverable
+store, a registered action, and two scopes in different tenants.
+
 ## Runtime observability and health
 
 Platform Host exposes vendor-neutral lifecycle telemetry through the optional `telemetry` sink on