Tenant Link Schema

Display name for the connection list. Never sent over the wire.

local = another tenant of this installation (loopback, no secrets); remote = a foreign installation (signed HTTPS).

Remote only. HTTPS enforced and re-validated against assertSafeOutgoingUrl before every call (SSRF).

Opaque id of the counterpart installation, stamped during the handshake.

Counterpart tenant. Stamped on redemption only — never client-writable.

Server-generated invitation. Unique while pending, cleared on redemption. Redacted from every read.

After this instant the code no longer redeems.

Which side ended it. Both sides may revoke.

THE anchor — the customer party in the MSP CRM. Never leaves the installation.

Negotiated major version, min(local, peer).

What the PEER may do here. Server-enforced.

What we may do there. Display / pre-flight only — never an authorisation basis.

NON-SECRET selector (X-Codemeta-Peer-Key). Installation-wide unique — the ingress knows no tenant yet.

AES-256-GCM blob of the secret inbound signatures are verified with. Encrypted, NOT hashed — HMAC verification needs the plaintext.

The counterpart's selector — what we send in X-Codemeta-Peer-Key.

AES-256-GCM blob of the secret outbound signatures are created with.

TicketExchangeConfig (ADR 0363 §1b) — target, statusMap, priorityMap. Same type as the Jira side.