[C] #514 slice 9: Farm contract, with tenant identity staying in Platform

[mforce]

Important

Track C is unscheduled. These slices move production code, and the 2026-08 design's own status
line still governs: "proposed architecture; no production refactor is authorized by this
document." Filed so the analysis is tracked work rather than a comment, not as a commitment to
run it.

The 2026-09-14 re-plan
recommends gating Track C on evidence from Tracks A and B: if the #842 ratchet fires repeatedly in
real pull requests, these become worth their cost; if it stays quiet, they do not. Track C is
57–95 focused engineering days and produces no user-visible change.

Read the re-plan before picking any of these up. Several assumptions in the 2026-08 plan are
corrected there.

Farm settings, logo, banner, currency, units and timezone behind a contract, while tenant identity
stays in Platform.

The one rule that must not bend

Tenant identity resolution stays claim-only in Platform. TenantResolutionMiddleware keeps populating
TenantContext directly from the JWT account_id claim, before any module contract runs. It must
not route through a Farm contract to establish tenant identity — that would either execute
tenant-filtered reads before TenantContext exists, or require bypassing the filters mid-request.
Either weakens the fail-closed tenant boundary (#530, #562, #673).

Farm contracts are called only after TenantContext is resolved, to read settings. Never to
resolve identity.

Scope

• IFarmModule for settings, logo and banner; a small context reader returning an immutable
  currency/unit/timezone snapshot.
• The lock-aware currency port the Finance pilot introduced becomes Farm's own.
• Account and logo endpoints and the farm clock call the contract.

Carries a known cross-module edge

UpdateFarmSettingsHandler.cs:12 injects IEggUnitConversionRepository and :149 calls
DiscountCeiling.TryParsePercent (#727) — a real Farm → Commerce read the 2026-08 matrix marks —.
This slice decides whether it becomes a declared contract call or stays a declared edge. It is
legitimate either way; it must stop being accidental.

Done when

• Settings, logo and banner HTTP contracts unchanged; SPA tests pass unedited.

• Invalid timezone still fails closed (Deploy: farm timezone provisioning — seeded UTC + undocumented tzdata/ICU image dependency #264, provision-account: optional --timezone at creation (assumed by #537, never built) #603).

• The currency-bound-row probe still compiles across every module it spans.

• Tenant query-filter and stamping tests pass unedited; EF model digest identical.

• Change map in the PR (owner, 2026-10-01). The PR carries a before/after diagram of who calls whom, in the shape of the refactor(finance): put Finance behind an IFinanceModule contract #1010 and refactor(insights): read reports, exports and audit provenance through an Insights facade #1012 change maps: the adapters and module types before and after, any ledger edges added or removed, and the end state of any file another open slice also changes. Put it in the PR body or a PR comment as a fenced text block.

Explicitly not in this slice

TenantResolutionMiddleware, TenantContext, the stamp interceptor and middleware order — all
Platform, all unchanged.

[mforce]

Audit 2026-09-26, against main at e47288c

Body left as written.

The load-bearing premise holds. TenantResolutionMiddleware still reads the account_id claim directly and calls tenant.Resolve before the rest of the pipeline. The file imports only Infrastructure Identity and Persistence; nothing Farm-owned sits on that path.

Correction: the contract is under-scoped for its six consumers. Farm has six incoming edges. What each one actually needs:

Consumer	Needs from Farm
Access (19 symbols)	account lifecycle writes, locked account reads, role vocabulary, UserRoleAssignment
Commerce (4)	locked currency snapshot, discount ceiling, worker sale-allocation policy
General Inventory (3)	locked currency snapshot
Finance (2)	locked currency snapshot, SeedDefaults.FarmId
Egg Operations (1)	SeedDefaults.FarmId
Flock Management (1)	SeedDefaults.HouseId

The minimum surface is therefore a lock-aware currency snapshot preserving the exact FOR SHARE semantics of #162, a plain settings read, role vocabulary plus assignment read and write, account lifecycle writes, and a default-farm-id accessor. The issue's scope covers the settings read and part of the accessor. It does not cover the locked snapshot, the role vocabulary or the lifecycle writes, and three modules share that locked-snapshot pattern.

Correction: one sentence is missing and it is load-bearing. The issue never says whether IAccountRepository and Domain.Accounts remain a permanent cross-module seam or eventually fold into the Farm contract. If it is the latter, Access at slice 15 reopens this slice's finished contract. Add an explicit line. The recommendation from the audit is that they stay the stable seam every consumer calls directly and are never routed through the Farm contract.

Context on the Access edge. Of its 19 symbols, 8 are provisioning or break-glass (AccountProvisioner, FirstRunAdminService, AdminRecoveryService and their result types) and 11 are ongoing runtime coupling, chiefly IdentityProvider taking an account-wide lock on every user-admin write, plus the rename and suspension services and the assignment validators. Ongoing or not, it all flows through the existing account seam, so it does not block writing a narrow Farm contract first. It does mean this slice will not retire that edge.