ADR-0006: Control plane holds the map, not client content

• Status: Accepted
• Date: 2026-07-25
• Deciders: El

Context

The registry is the one shared thing in a multi-tenant system; if it holds client data, isolation and residency break.

Decision

The registry stores tenant records, resolved config, connector manifests (references to credentials, not the credentials), and operational metadata only — never client data. A thin API sits in front (a service, not a raw shared DB everyone queries). Two writers only: Ansible creates the tenant record at provisioning (bootstrap); the BOS Console edits config. The brain is read-only against the registry. Config applies to new work items only; each run pins to the config version it started under.

Consequences

Isolation and residency preserved; a single gate for validation and the no-client-data rule; the failure modes to guard are drift and leakage (hence reconciliation), not load.

Alternatives considered

• Raw shared DB everyone queries — rejected: multiple corruption paths, no single enforcement point.
• Brain writes to the registry — rejected: runtime reasoning must not mutate the source of truth.