feat: add tenant provisioning and key lifecycle (#5)

Closes #5
2026-07-16 05:13:35 +02:00
parent 69c8b2d2bc
commit 47382ddadc
21 changed files with 2294 additions and 6 deletions
@@ -81,6 +81,8 @@ The ratified v1 boundaries, trust decisions, privacy rules, safety budgets, and
 threat model are indexed in [the architecture documentation](docs/architecture/README.md).
 The frozen v1 wire surface is documented in the
 [HTTP, UDP, and generated OpenAPI contracts](docs/contracts/README.md).
+Tenant policy, publisher/operator principals, and production key custody are
+defined in [game provisioning and signing-key lifecycle](docs/security/provisioning.md).

 ## Development

@@ -97,5 +99,9 @@ dotnet test Rendezvous.slnx --configuration Release --no-build
 Run the bootstrap server with
 `dotnet run --project src/FinalFactory.Rendezvous.Server`. It serves HTTP health endpoints and binds
 the configured UDP mediator port; both stop through normal host cancellation.
+The launch profile uses an ephemeral development-only signing key. Production
+startup fails closed until externally supplied game policies and `env:` signing
+key references resolve to valid key material; no reusable game secret is stored
+in this repository or the public Client package.
 The project dependency rules and supported runtime choices are documented in
 [project and dependency boundaries](docs/architecture/project-boundaries.md).