SkillPixel LMS — Multi-Tenant Roadmap

Shipped to production in v0.0.37 on 2026-08-18, together with SP-595 and SP-596 moving platform-admin fully onto the /platform API behind a centralized guard, off direct DB access. Jira status still needs moving.

Profile sync auto-creates a STUDENT membership in whatever tenant the client-sent header names (apps/backend/app/services/user.py), so any logged-in user can self-join any active tenant. The single biggest blocker. Beta-verified 2026-08-20: a closed tenant no longer gains a membership from the header; an open-enrollment tenant still does.

Courses, chapters, lessons and questions still carry a default-tenant server default. The metric that gates its later removal — zero fallback writes for 7 days — is merged and beta-verified (2026-08-20) and feeds the SP-478 Gate C criterion, whose window is now running. Beta-verified 2026-08-20: tenant_default_fallback_write is wired and has logged zero events since deploy.

create_tenant writes only the tenant row, so all 10 gated features 404 until an operator flips them by hand — this already bit HistoryClass. Decided default (2026-08-20): new tenants start with certificates and DOCX import enabled, all other gated features disabled. Beta-verified 2026-08-20: a new tenant is seeded with all 10 feature rows (certificates and DOCX import on, the other eight off); deleting a tenant also removes its config rows. Tenants created via the platform API start PROVISIONED, so their domains only route once the tenant is set ACTIVE.

Notification crons bind only the default tenant, so other tenants get no deadline or live-class reminders (apps/backend/app/routers/v1/notification.py). Beta-verified 2026-08-20: a manual cron run completed with cron_fanout_completed tenant_count=3 and failed_count=0.

Create and update only lowercase the value. Add IDNA/punycode canonicalization to match the read path, plus a reserved and platform-label blocklist (apps/backend/app/schemas/platform.py). Beta-verified 2026-08-20: uppercase and whitespace are canonicalized, Unicode is stored as punycode, reserved labels (www/api/beta/apex/localhost) return 422, PLATFORM type returns 422, and duplicates return 409.

Domain activate and deactivate clear only the local process cache; other instances serve stale routing for up to 5 minutes. Beta-verified 2026-08-20: domain activate and disable flip routing instantly, and the Redis generation key bumps on every domain write.

Browser hostname pass-through, tenant activation gates, audit queries, monitoring. Default-tenant traffic must stay stable. SP-607 is merged and beta-verified (2026-08-20), so this work is unblocked. Merged 2026-08-23 together with the activation runbook (docs/tenant-activation-runbook.md). Beta-verified 2026-08-23: activating a tenant with no domain and no tenant admin returns 409 listing both missing prerequisites; HistoryClass stays healthy (tenant and primary managed subdomain ACTIVE and verified, served over HTTPS); zero default-tenant fallback writes and zero backend errors since the deploy. SP-477 (Phase 4) is now unblocked.

Default banner components hardcode SkillPixel imagery and copy on shared surfaces. Also add a uniqueness guard against duplicate seeded default banners. Beta-verified 2026-08-23: public and admin banner APIs return 200 and the /admin/marketing screen renders the banner list on the default host; the Banner menu entry also appears for HistoryClass tenant admins.

A static index.html title and meta is served to every tenant; the hardcoded default-tenant snapshot and fallback hosts in resolution.ts must derive from config. Beta-verified 2026-08-23: the served shell contains zero SkillPixel references; after bootstrap the HistoryClass page reports its own title, description and og:site_name with no SkillPixel body text.

Split in two. SP-610 (stack 3/7) — drive the landing strategy from tenant config instead of the hardcoded build-time UUID map, which holds only the local seed UUID. SP-611 (stack 4/7) — bring the shared template to launch quality: hero copy, announcement and featured courses (frontend phase-3 WP3–WP6). Beta-verified 2026-08-23: bootstrap exposes landing_strategy per tenant, and HistoryClass renders the shared template with its own hero, featured courses and branding on desktop and mobile. Open: beta has no landing.strategy config row for HistoryClass, so it renders the shared template via the deterministic non-default fallback — the bespoke-page-versus-template decision still needs an explicit config row either way.

Memberships 404 unless the user already self-registered. SP-612 (stack 6/7) — backend: invite tokens, a pending membership state, an accept endpoint and the invite email. SP-613 (stack 7/7) — UI: platform-admin invite screen, the tenant-admin menu entry and the accept page. Both merged 2026-08-23, so no manual membership workaround is needed at launch. Beta-verified 2026-08-23 end to end on HistoryClass: invite → pending → accept as the invitee → membership with the invited role; duplicate, revoked and bogus tokens are rejected with the right statuses; the tenant-admin screen, platform-admin tab and both accept-page states render correctly. Real email delivery stays blocked on SP-614.