Tenancy

The tenant.* family (11 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.

Backuptenant.backup

Record a consistent-snapshot backup request. { note? }. Idempotent. The off-box encrypted capture is the flagged follow-on (STUB_OFFBOX).

Call POST /v/tenant.backup with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool tenant.backup.

Configuretenant.backup.configure

The DR-WRITER: set backup cadence/retention/destination/ residency. { cadence?, retentionDays?, destination?, residencyOnBox? }. UPSERTS the one dr_policy row.

Call POST /v/tenant.backup.configure with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool tenant.backup.configure.

Statustenant.backup.status

The standing backup read (last/next set, age vs RPO). {}. Computed against ops_event + dr_policy (INV-6 - never a stored “last backup” duplicate).

Call POST /v/tenant.backup.status with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Deploytenant.deploy

Record an immutable-image roll. { imageRef, canary?, dryRun? }.

Call POST /v/tenant.deploy with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool tenant.deploy.

Deprovisiontenant.deprovision

Record the only state-destroying transition (archive or --purge). { purge?, reason? }. The actual teardown is the operator-script edge; this is the seam.

Call POST /v/tenant.deprovision with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Exporttenant.export

The SAR/full-domain portable serialisation request (matter/party/ equity/doc/bill/audit). { note? }. Idempotent. One human-attributed audit event (the dispatch append). The per-domain serialiser fan-out is the reuse-not-rebuild follow-on (equity.ocf.export + the G6 pipe).

Call POST /v/tenant.export with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Restoretenant.restore

Record a point-in-time restore request. { targetTimestamp? }. The guarded reload: data-first then reconcile-from-PG (ADR-0011); a restore that breaks the audit chain FAILS (NFR-SEC-9). The actual reload is the flagged follow-on (STUB_OFFBOX).

Call POST /v/tenant.restore with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Resumetenant.resume

A reversible start. { reason? }. Idempotent (re-resume). PROMOTED ([2026] VJS-CC-OPBOX 33 holding C): ENFORCING - it clears the authoritative workspace.status back to ‘ACTIVE’ (lifting the admission-gate block) AND records the ops_event. It is EXEMPT from the admission gate (the one write verb an overseer can call on a SUSPENDED workspace).

Call POST /v/tenant.resume with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool tenant.resume.

Statustenant.status

This box’s runtime/health/image/front-door. {}. SINGLE-BOX (no fleet index, D6). ([2026] VJS-CC-OPBOX 33 condition C8): the runtime posture is read from the AUTHORITATIVE workspace.status column (the same column the admission gate keys off + tenant.suspend/ resume maintain), NOT derived from an ops_event scan; the ledger stays the audit record (surfaced as lastLifecycle). A DEPROVISION has no status column value (it is the off-box teardown record), so the ops_event scan still backstops the DEPROVISIONED runtime. Computes nothing authoritative (INV-14).

Call POST /v/tenant.status with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Suspendtenant.suspend

A reversible stop (state preserved). { reason? }. PROMOTED ([2026] VJS-CC-OPBOX 33 holding C): it is now ENFORCING - it sets the AUTHORITATIVE workspace.status='SUSPENDED' (the column the dispatch admission gate keys off) AND records the ops_event ledger (the AUDIT record, unchanged). HUMAN-only (mirror org.membership.set): suspending a tenant is a human operator act, never an agent one.

Call POST /v/tenant.suspend with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.

Upgradetenant.upgrade

Record an immutable-image upgrade roll. { imageRef, canary? }.

Call POST /v/tenant.upgrade with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.