feat(decisioning): create_tenant_store — opinionated multi-tenant AccountStore with fail-closed isolation

[bokelley]

Summary

Port of JS @adcp/sdk@6.7's createTenantStore — the headline 6.7 helper. Builds an opinionated multi-tenant AccountStore with the per-entry tenant gate baked into the framework so cross-tenant entries never reach adopter code.

from adcp.decisioning import create_tenant_store

store = create_tenant_store(
    resolve_by_ref=lambda ref, ctx: lookup_account_by_ref(ref),
    resolve_from_auth=lambda ctx: principal_to_tenant.get(
        ctx.auth_info.principal if ctx.auth_info else None
    ),
    tenant_id=lambda account: account.metadata["tenant_id"],
    tenant_to_account=lambda tid: tenants[tid].account,
    upsert_row=lambda ref, ctx: persist_account(ref),
    sync_governance_row=lambda entry, ctx: persist_governance(entry),
)

Security semantics

• Fail-closed: when resolve_from_auth(ctx) returns None (unauthenticated / unregistered principal), every upsert and sync_governance entry rejects with PERMISSION_DENIED. resolve returns None. list returns [].
• Per-entry gate: cross-tenant entries are rejected BEFORE reaching adopter upsert_row / sync_governance_row callbacks. Mixed batches partition cleanly into pass / PERMISSION_DENIED / ACCOUNT_NOT_FOUND.
• Immutability: gate methods are class-level and the store uses __slots__. Adopter code that tries store.upsert = custom_handler gets AttributeError instead of silently bypassing isolation. The Python equivalent of JS's Object.defineProperty(... writable: false).

Design decisions / divergences from JS

• Flattened Tenant to tenant_id: str. The JS API takes a generic TTenant value plus a tenantId(tenant): string projection. The Python adaptation collapses this to a single string identity since adopters typically denormalize the owning tenant onto the Account itself. tenant_id(account) projects from Account; tenant_to_account(tenant_id) is the inverse. Same security semantics, simpler shape.
• resolve() also enforces the gate. JS only gates upsert / syncGovernance; Python tightens this to gate resolve too (per the issue spec). Cross-tenant refs return None, hiding the existence of accounts the caller can't see.
• list() is generated. JS deliberately omits list from the helper because cursor pagination + multi-tenant filter shapes don't fit a one-liner. Python provides a single-tenant projection (returns [tenant_to_account(auth_tenant)]) since the prompt specified it; adopters needing pagination compose by wrapping the returned store.
• upsert_row / sync_governance_row are optional (matches JS). Without an adopter hook, authorized rows pass with action='unchanged' (no-op acknowledgment) rather than 501. Cross-tenant rejection still applies.

Tests cover

• resolve: same tenant, cross-tenant (returns None), unknown ref, unauthenticated, Path-2 (no ref → auth-derived account)
• upsert: in-tenant pass-through, cross-tenant rejected before adopter code runs, unknown ref → ACCOUNT_NOT_FOUND, fail-closed for unregistered + unauthenticated, mixed-batch partitioning, no-hook no-op behavior
• list: same-tenant only, unregistered → [], unauthenticated → []
• sync_governance: in-tenant, cross-tenant, fail-closed
• immutability: cannot reassign upsert / sync_governance / list / resolve (all raise AttributeError)

23 tests, all green. Full regression suite (3383 tests) stays green.

Closes #457. Part of #452.

🤖 Generated with Claude Code