Operate tenant Sites

The Registrar will be the fleet control plane for provisioning and decommissioning tenant Sites, moving them through releases, and showing their health, resource use, errors, and running cost.

Each tenant is designed to receive a complete Site stack rather than a tenant key inside one shared application database. The Registrar keeps control-plane facts and vendor identifiers; it does not hold tenant project content or become a proxy for normal Site traffic.

Human-controlled operations

Phase 1 is display-first. The Registrar will report fleet health and cost without auto-remediating or auto-scaling. It will send email for a short list of binary failures: a Site going down, a failed decommission, a halted release, a halted model canary, or a configured ingestion channel going silent.

Provisioning and decommissioning are human-triggered workflows. Destructive steps are designed to be explicit, auditable, and resumable rather than hidden inside a dashboard action.

What exists today

The repository currently contains the first local Site substrate: Postgres in Docker Compose and a composite Site health endpoint that reports database connectivity. The Registrar itself is not implemented.

Capability covered

This page covers C13 in the Phase 1 design contract.