Story Index: tenant-admin (TENANT) — V0 Envelope¶
Module: tenant-admin
Total stories: 8 (V0 envelope only — v0.0.0 → v0.1.0)
Decomposed from: docs/architecture/tenant-admin-arch.md (§0 V0 deltas + §11 vertical slices)
PRD reference: docs/prd/tenant-admin-prd.md (V1 contract) + docs/prd/prd-v0.md §4 (ligne TENANT), §5, §8
Design reference: docs/design/tenant-admin-design.md
Date: 28/05/2026
PO decisions: (1) V0 envelope only — fine-grained re-numbering TENANT-001..008, each tagged [V0.0.x]; V1-only architecture (compliance docs, DPA-expiry, branding/settings edit, PII purge, full admin console) listed under "Hors Scope V0". (2) v0.0.0 ships the create/provision API + a minimal platform-admin create form; the rich tenant list/detail console + 5-step wizard are V1.
Stories are authored in simple English for the Claude DEVELOPER personality; they will be translated to French for human developers via the DeepL
/translatepipeline later.
⚠ Scope divergence flagged for the human PO¶
The design doc §11 groups cabinet-admin branding (TENANT-US-07) and tenant-settings editing (TENANT-US-09) into V0.0.2, alongside agencies. The authoritative PRD V0 envelope (prd-v0.md §4 ligne TENANT + §8, mirrored in tenant-admin-prd.md V0 table) scopes v0.0.2 TENANT to multi-agence only, and the sibling OP decomposition explicitly puts "Paramètres cabinet édition (PATCH)" in V1. This decomposition follows the PRD envelope → branding (US-07) and settings-edit (US-09 PATCH) are V1, out of V0. Only a read-only settings surface (TenantConfigService + GET) exists in V0.0.0. If the founder wants the cabinet-admin branding/settings editing inside V0.0.2, add TENANT-009/010 stories — flag raised, not silently decided.
V0 envelope → stories¶
| Sub-version | TENANT scope (per prd-v0 §8 + arch §0.1) | Stories |
|---|---|---|
[V0.0.0] |
Foundation infra + multi-datasource resolver + Flyway multi-profile; platform schema (tenant, country_profile seed CI, tenant_settings); tenant create (PENDING) + minimal form; provisioning pipeline (shared) + Keycloak Organization + TenantOnboarded. SHARED DB only. |
TENANT-001, TENANT-002, TENANT-003, TENANT-004 |
[V0.0.2] |
Multi-agence: agency table + CRUD + default PRINCIPAL agency + AgencyDisabled + agency_id binding; cabinet-admin agency management UI. |
TENANT-005, TENANT-006 |
[V0.0.4] |
BYO DB profile live (greenfield, NSIA go-live): resolver BYO branch + Flyway-on-BYO + credential envelope encryption. |
TENANT-007 |
[V0.1.0] |
Lifecycle hardening: suspend / reactivate + 90-day soft-delete job. Events emitted; PII purge deferred to V1. | TENANT-008 |
Dependency Graph¶
TENANT-001 [V0.0.0] Foundation (infra + resolver + Flyway)
│
TENANT-002 [V0.0.0] Platform schema + country_profile seed + tenant_settings + config service
│
TENANT-003 [V0.0.0] Tenant create (PENDING) — API + minimal form
│
TENANT-004 [V0.0.0] Provisioning (shared) + Keycloak Org + TenantOnboarded
├──────────────┬───────────────┐
▼ ▼ ▼
TENANT-005 TENANT-007 TENANT-008
[V0.0.2] [V0.0.4] [V0.1.0]
Agency backend BYO-DB prov. Lifecycle (suspend/reactivate/soft-delete)
│
▼
TENANT-006 [V0.0.2] Agency management UI (cabinet admin)
Story List¶
| # | Story ID | Title | Side | Sub-ver | Depends On | Concurrent With | Complexity | Status |
|---|---|---|---|---|---|---|---|---|
| 1 | TENANT-001 | Foundation — dev infra + datasource resolver + Flyway multi-profile | BACKEND | V0.0.0 | — | — | M | TODO |
| 2 | TENANT-002 | Platform schema (country_profile seed CI + tenant + tenant_settings) + config service | BACKEND | V0.0.0 | 001 | — | M | TODO |
| 3 | TENANT-003 | Tenant create (PENDING) — API + minimal form | ADMIN+BE | V0.0.0 | 002 | — | M | TODO |
| 4 | TENANT-004 | Provisioning (shared) + Keycloak Org + TenantOnboarded | ADMIN+BE | V0.0.0 | 002,003 | 005,007,008 | L | TODO |
| 5 | TENANT-005 | Agency backend + default PRINCIPAL + AgencyDisabled | BACKEND | V0.0.2 | 004 | 007,008 | M | TODO |
| 6 | TENANT-006 | Agency management UI (cabinet admin) | OPERATOR | V0.0.2 | 005 | 007,008 | M | TODO |
| 7 | TENANT-007 | BYO-DB provisioning (resolver branch + Flyway + creds encryption) | ADMIN+BE | V0.0.4 | 004 | 005,008 | L | TODO |
| 8 | TENANT-008 | Lifecycle: suspend/reactivate + 90-day soft-delete (events only) | ADMIN+BE | V0.1.0 | 004 | 005,007 | M | TODO |
Concurrency Tiers¶
| Tier | Stories | Can start after |
|---|---|---|
| T0 | TENANT-001 | — (serial; merge first) |
| T1 | TENANT-002 | TENANT-001 |
| T2 | TENANT-003 | TENANT-002 |
| T3 | TENANT-004 | TENANT-002 + TENANT-003 |
| T4 | TENANT-005, TENANT-007, TENANT-008 | TENANT-004 |
| T5 | TENANT-006 | TENANT-005 |
PRD Acceptance Criteria Coverage (V0 envelope)¶
| PRD User Story | ACs in V0 | Assigned to | Coverage |
|---|---|---|---|
| TENANT-US-01 (create) | AC-01.1 (V0 field set), AC-01.2, AC-01.3, AC-01.4 | TENANT-003 | ✅ |
| TENANT-US-02 (provision) | AC-02.2, AC-02.3 (v0.0.0); AC-02.1 (v0.0.2) | TENANT-004 + TENANT-005 | ✅ |
| TENANT-US-03 (BYO-DB) | AC-03.1, AC-03.2, AC-03.3 | TENANT-007 | ✅ |
| TENANT-US-04 (suspend/reactivate) | AC-04.1, AC-04.2, AC-04.3 | TENANT-008 | ✅ |
| TENANT-US-05 (soft-delete) | AC-05.1 only (AC-05.2/05.3 purge+retention → V1) | TENANT-008 | ✅ (partial by design) |
| TENANT-US-08 (agencies) | AC-08.1, AC-08.2, AC-08.3 | TENANT-005 (backend) + TENANT-006 (UI) | ✅ |
| TOTAL | 15 V0 ACs | All assigned ✅ | 100% of V0 envelope |
Hors Scope V0 (re-decomposed in the V1 PO pass)¶
These V1 architecture/PRD items are explicitly not in the V0 envelope and are listed in the "Out of Scope" section of the relevant stories:
- TENANT-US-06 — Compliance documents (DPA / agrément / FNE upload, versioning, immutable MinIO store, AC-06.1/06.2/06.3, DPA-expiry daily warning + banner). The V0 create form does not require a DPA (replaced by NOTIF sender-ID activation gate). → V1.
- TENANT-US-07 — Branding self-service (logo / primary_color / support_email edit, AC-07.x). → V1.
- TENANT-US-09 — Tenant settings editing (PATCH renewal window / channel / retention overrides, AC-09.x). GET/read service exists in V0.0.0; editing → V1.
- AC-05.2 / AC-05.3 — PII purge worker + fiscal/audit retention + "Cabinets supprimés" view (TR-006). Event emitted in V0.1.0; purge → V1.
- Identity edit (PATCH /identity), rich tenant list (tabs/search/DPA banner) + full tabbed detail page, 5-step creation wizard → V1.
- Group/holding (group_id FK), foreign-subsidiary tenants, SCHEMA/DATABASE profiles, SHARED→BYO migration, per-tenant realm, custom subdomain, data-subject-rights portal → V2/V3.
Implementation Order (recommended)¶
- TENANT-001 — Foundation; unblocks everything; merge before any other TENANT story.
- TENANT-002 — Platform schema + CI seed + config service.
- TENANT-003 — Tenant create (PENDING) + minimal form.
- TENANT-004 — Provisioning + Keycloak Org + TenantOnboarded (first demo-able v0.0.0 milestone).
- TENANT-005 + TENANT-007 + TENANT-008 (parallel after 004) — agencies backend / BYO-DB / lifecycle.
- TENANT-006 — agency management UI (after 005; closes the v0.0.2 milestone).
Bloquants to clear before dev-start¶
- AUDIT catalog (BLOCKS audited stories): the AUDIT
event_typecatalog (AUDIT §B.1) must admit the TENANT codes before any audited TENANT story merges —TENANT_CREATED,TENANT_PROVISIONED,TENANT_SUSPENDED,TENANT_REACTIVATED,TENANT_SOFT_DELETED,AGENCY_CREATED,AGENCY_EDITED,AGENCY_DISABLED,AGENCY_REACTIVATED,PLATFORM_ADMIN_QUERY. (AUDIT API rejects unknown event types — CLAUDE.md rule #3.) - AUTH ↔ TENANT (TenantOnboarded): AUTH consumes
TenantOnboardedto bootstrap the initial CABINET_ADMIN (async; brief gap window documented in AUTH-arch). TENANT only emits. - Keycloak ≥ 26.6 + Organizations (prd-v0 §5.8) available in the dev/test stack for TENANT-004.
- Scope confirmation (see divergence note above): confirm branding/settings-edit stay V1, or commission TENANT-009/010 for V0.0.2.
Compliance — synthesis¶
| Status | Items | Policy |
|---|---|---|
VÉRIFIÉ |
Platform sub-processor positioning; tenant isolation; audit trail | Implementable |
PRÉLIMINAIRE ([LEGAL-REVIEW]) |
TV-02 (FNE fields), TV-03 (retention floors), TV-04 (CIMA agrément positioning), TV-05 (soft-delete minimization) | Implementable with warning; surfaced at point of use |
INCERTAIN |
none in the V0 TENANT envelope | — |
Each story carries the explicit list of compliance rules it touches, with article/assumption reference and status.
Decomposition Quality Checks¶
- [x] Every story has 2–4 ACs (TENANT-001/002 are technical foundation stories with technical ACs; TENANT-004 has 2; others 3–4)
- [x] Vertical slices with 5+ behaviours split (S3 → provisioning shared/Keycloak in TENANT-004, BYO in TENANT-007; agency backend/UI split)
- [x] Every in-scope V0 PRD AC assigned to ≥ 1 story
- [x] Every V0 design-spec screen assigned (minimal create form, provisioning UI, agency UI, suspend/reactivate modals); rich list/detail/wizard marked V1
- [x] Self-containment: story + standards = full implementation context
- [x] No circular dependencies (DAG verified)
- [x] Story IDs sequential, zero-padded, uppercase prefix
- [x] French copy included for every UI state on UI-bearing stories
- [x] Compliance rules carry status +
[LEGAL-REVIEW]where needed - [x] Out-of-scope explicit per story; V1 items collected in "Hors Scope V0"
- [x] V0 envelope coverage: 100% (15 V0 ACs assigned)
- [x] Scope divergence (design §11 vs PRD envelope) flagged for human PO, not silently resolved
Decomposition completed 28/05/2026. V0 envelope only. Stories in simple English for Claude DEVELOPER; translate via /translate for human devs.
Merge onto main after founder review, then hand to developers.