chore: tornar core tenant-agnóstico com contrato e guardrails

[LucasSantana-Dev]

Resumo

Implementa o baseline de desacoplamento multi-tenant no core, removendo hardcodes de owner/paths, adicionando contrato de tenant e guardrail de CI para bloquear regressões.

Mudanças principais

• adiciona contrato de tenant em src/tenant/contract.ts (campos obrigatórios e validação runtime)
• exporta contrato no barrel principal (src/index.ts)
• adiciona check tenant-decoupling:
  • script scripts/security/validate-tenant-decoupling.sh
  • script npm check:tenant-decoupling
  • job de CI tenant-decoupling
• atualiza test-autogen phase 0 para contexto explícito de tenant (hooks + CI)
• sanitiza referências pessoais em scripts/integrações/documentação ativa
• remove paths absolutos locais de scripts de release e torna dependentes configuráveis por FORGE_DEPENDENT_PROJECTS

Validação

• npm run validate ✅
• npm run build ✅
• npm test -- --runInBand ✅
• npm run check:tenant-decoupling ✅

Observações

• Existem warnings legados de lint no repositório; nenhum erro novo foi introduzido.

[coderabbitai]

Warning

Rate limit exceeded

@LucasSantana-Dev has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 8 minutes and 10 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 26f4d6cf-2992-4562-a552-56326d15849a

📥 Commits

Reviewing files that changed from the base of the PR and between a15fabd and e694e3b.

📒 Files selected for processing (31)

• .github/CODEOWNERS
• .github/dependabot.yml
• .github/workflows/ci.yml
• .husky/pre-commit
• .husky/pre-push
• CHANGELOG.md
• README.md
• docs/SHARED_DOCUMENTATION.md
• docs/architecture-decisions/ADR-003-mcp-server-design.md
• docs/ecosystem/INTEGRATION_GUIDE.md
• docs/guides/reusable-workflows-reference.md
• package.json
• patterns/ai/README.md
• scripts/bootstrap/project.sh
• scripts/integrate-mcp-gateway.sh
• scripts/integrate-uiforge-mcp.sh
• scripts/integrate-uiforge-webapp.sh
• scripts/integrate.js
• scripts/release-core.sh
• scripts/rollback-release.sh
• scripts/security/scan-for-secrets.sh
• scripts/security/validate-no-secrets.sh
• scripts/security/validate-tenant-decoupling.sh
• scripts/update-dependencies.sh
• scripts/validate-release.sh
• src/index.ts
• src/mcp-context-server/context-store/forge-patterns.md
• src/mcp-context-server/context-store/mcp-gateway.md
• src/mcp-context-server/context-store/uiforge-webapp.md
• src/tenant/contract.ts
• test/security-validators.test.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch chore/tenant-decoupling

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Project Scorecard

Scorecard: 84/100 (B)
────────────────────────────────────────
  security: 100/100 (A)
  quality: 80/100 (B) — 1 violations
  performance: 67/100 (D) — 1 violations
  compliance: 75/100 (C) — 1 violations
  dependency: 100/100 (A)

Recommendations:
  - Increase test coverage to meet the 80% threshold
  - Extend log retention to at least 90 days for compliance

[sonarqubecloud]

Quality Gate passed

Issues
7 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud