How it holds
Conventions get forgotten. These are structural.
Every tenant — including each reseller's own customers — is provisioned
into a dedicated Postgres schema. Isolation sits at the schema boundary,
so a forgotten WHERE clause cannot spill one customer into
another. Routes resolve their database handle through a helper that throws
rather than quietly falling back to the shared schema.
Schematenant_<slug>
All autonomous execution funnels through a single gate. That isn't a convention people have to remember — a guard walks the require graph at build time and fails if any path from autonomous code reaches the executor without passing through it. Authority lives in each tenant's own schema too, so no admin can widen another tenant's limits.
GateassertAutonomyAllowed()
The browser never talks to a provider. It posts an intent, and the server
builds the request, decrypts and injects the right credentials, follows
redirects under SSRF checks, and returns what actually came back. Token
endpoints are the interesting exception — inject a stale bearer into
/oauth/token and the provider rejects it, so those receive
nothing.
RoutePOST /api/execute
Testing
Tests are mutation-checked rather than trusted: a tool flips one token at a time in the source and reports anything the suite failed to notice. It exists because a vacuous test — one that passes whatever the code does — reviews exactly like a good one.