tenant

package
v0.8.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 28, 2026 License: MIT Imports: 16 Imported by: 0

Documentation

Overview

Package tenant manages isolated tenant profiles under ~/.multiversa/tenants/<slug>/. One tenant = one manifest (the brand DNA) + one vault (0700, never read by any Multiversa surface) + one memory/graph home. Switching tenants swaps the whole context safely: nothing from one tenant's dir is ever read while another is active.

Index

Constants

View Source 
const ProvidersFileName = "providers.json"
View Source 
const SecretsFileName = "secrets.env"

SecretsFileName is the env-style file inside a tenant's vault that holds its connection keys (ElevenLabs voice, its own backend, …). It lives inside the 0700 vault and is itself 0600. It is a real .env file so a local runtime can source it; it is never serialized into the manifest, synced, or shown to an agent — that is the vault invariant, enforced by the vault-leak test.

Variables

This section is empty.

Functions

func Active 

func Active() string

Active returns the currently active tenant slug, or "" if none.

func ConnectProvider added in v0.8.0 

func ConnectProvider(slug string, cfg ProviderConfig) error

ConnectProvider stores only routing metadata. API keys always remain in vault/secrets.env.

func Dir 

func Dir(slug string) (string, error)

Dir returns the directory for a slug after validating it.

func Load 

func Load(slug string) (*manifest.Manifest, string, error)

Load reads a tenant's manifest by slug.

func New 

func New(slug, name, kind string, pillars ...manifest.Pillar) (*manifest.Manifest, string, error)

New scaffolds a unique project OS from neutral technical defaults. It never overwrites: an existing tenant dir is an error, keeping profiles append-only.

Layout created: 

~/.multiversa/tenants/<slug>/
  multiversa.toml   the tenant's DNA (template pre-filled)
  vault/            0700 — secrets live here, never serialized
  graph/            knowledge graph home (anchored to identity)
  memory/           Engram home for this tenant

Pillars given here replace the template's defaults; passing none keeps them. It is variadic so every existing three-argument call still compiles — and so that the Tauri installer can delegate tenant creation here instead of writing its own multiversa.toml, which is how the two implementations drifted apart.

func ProviderNames added in v0.8.0 

func ProviderNames() []string

func ProviderSecretKey added in v0.8.0 

func ProviderSecretKey(name string) (string, error)

func Root 

func Root() (string, error)

Root returns ~/.multiversa/tenants.

func SecretsPath added in v0.8.0 

func SecretsPath(slug string) (string, error)

SecretsPath returns the path to a tenant's vault secrets file. It does not require the file to exist.

func SetSecret added in v0.8.0 

func SetSecret(slug, key, value string) (int, error)

SetSecret writes or updates one KEY=value entry in the tenant's vault secrets file, creating it 0600 inside the 0700 vault. Existing entries are preserved; a repeated key is updated in place. Returns the number of keys stored afterward.

The value is treated as opaque and is never logged by this package. Callers (the CLI command, the installer) must not print it either.

func Template 

func Template(kind string) *manifest.Manifest

Template returns neutral technical defaults for a unique project OS. The legacy kind argument is preserved for source compatibility but never selects a customer-shaped profile or changes the OS identity.

func Use 

func Use(slug string) error

Use marks slug as the active tenant. The tenant must exist.

Types

type BootstrapOptions added in v0.8.0 

type BootstrapOptions struct {
	Name        string
	Kind        string
	OSName      string
	Owner       string
	Brand       string
	Voice       string
	Language    string
	Taboos      []string
	Route       string
	Engagement  string
	Pillars     []manifest.Pillar
	Sources     []BootstrapSource
	Backend     string
	Model       string
	Mode        string
	NoCluster   bool
	Force       bool
	SkipExtract bool
	DryRun      bool
	Activate    bool
}

BootstrapOptions describes a resumable tenant bootstrap. Creation fields are used only when the tenant does not exist; an existing manifest is never overwritten.

type BootstrapResult added in v0.8.0 

type BootstrapResult struct {
	Slug             string            `json:"slug"`
	Dir              string            `json:"dir"`
	Created          bool              `json:"created"`
	Resumed          bool              `json:"resumed"`
	DryRun           bool              `json:"dry_run"`
	Activated        bool              `json:"activated"`
	Added            int               `json:"added"`
	Skipped          int               `json:"skipped"`
	GraphPath        string            `json:"graph_path,omitempty"`
	SourceFile       string            `json:"source_file"`
	Plan             []string          `json:"plan,omitempty"`
	ProviderAttempts []ProviderAttempt `json:"provider_attempts,omitempty"`
}

func Bootstrap added in v0.8.0 

func Bootstrap(ctx context.Context, slug string, opts BootstrapOptions, client ingest.Engine) (*BootstrapResult, error)

Bootstrap creates or resumes a tenant, materializes an identity-rooted corpus, ingests each new URL, extracts the graph, and optionally activates the tenant only after graph validation.

type BootstrapSource added in v0.8.0 

type BootstrapSource struct {
	URL         string `json:"url"`
	Author      string `json:"author,omitempty"`
	Contributor string `json:"contributor,omitempty"`
}

BootstrapSource is one public source approved for ingestion. Credentials do not belong here: Graphify receives API keys only through its process environment.

type Info 

type Info struct {
	Slug     string `json:"slug"`
	Name     string `json:"name,omitempty"`
	Kind     string `json:"kind,omitempty"`
	Owner    string `json:"owner,omitempty"`
	Dir      string `json:"dir"`
	Active   bool   `json:"active"`
	VaultOK  bool   `json:"vault_ok"` // vault dir exists with 0700
	Manifest bool   `json:"manifest"` // multiversa.toml present and parseable
}

Info is the JSON-safe view of a tenant profile. Vault contents are never included — only the path and whether the layout is intact.

func Inspect 

func Inspect(slug, active string) Info

Inspect builds the Info view for one slug. It reads the manifest but never enters the vault directory.

func List 

func List() ([]Info, error)

List returns every tenant profile found under Root.

type ProviderAttempt added in v0.8.0 

type ProviderAttempt struct {
	Provider  string `json:"provider"`
	Backend   string `json:"backend"`
	Model     string `json:"model"`
	Success   bool   `json:"success"`
	ErrorCode string `json:"error_code,omitempty"`
}

ProviderAttempt is deliberately redacted: it records routing and outcome, never environment variables, credentials, or provider response bodies.

type ProviderConfig added in v0.8.0 

type ProviderConfig struct {
	Provider string `json:"provider"`
	Model    string `json:"model,omitempty"`
	Priority int    `json:"priority,omitempty"`
	Enabled  bool   `json:"enabled"`
}

func LoadProviderConfigs added in v0.8.0 

func LoadProviderConfigs(slug string) ([]ProviderConfig, error)

type ProviderPlan added in v0.8.0 

type ProviderPlan struct {
	Provider string   `json:"provider"`
	Backend  string   `json:"backend"`
	Model    string   `json:"model"`
	Env      []string `json:"-"`
}

func BuildProviderFallback added in v0.8.0 

func BuildProviderFallback(slug string, preferred []string) ([]ProviderPlan, error)

BuildProviderFallback resolves enabled providers in requested/configured order and injects tenant-local keys only into the child process environment.

type ProviderSpec added in v0.8.0 

type ProviderSpec struct {
	Name         string
	SecretKey    string
	Backend      string
	DefaultModel string
	BaseURL      string
}

func LookupProvider added in v0.8.0 

func LookupProvider(name string) (ProviderSpec, bool)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.