SkillPixel LMS — Multi-Tenant Roadmap

Storage and media, enrollments and certificates, submissions and grading, commerce, platform-admin APIs and UI, ops surfaces, frontend bootstrap.

Domain-aware URLs, tenant-scoped roles, branding and SEO in bootstrap, slug at provisioning, self-serve settings.

Config-backed entitlements plus the feature matrix UI. The backend and frontend gating code (SP-586, SP-587) is live in production as of v0.0.37 — what remains is beta verification of the gating behaviour itself, plus SP-585's rollout decisions.

Profile sync auto-creates a STUDENT membership in whatever tenant the client-sent header names (apps/backend/app/services/user.py), so any logged-in user can self-join any active tenant. The single biggest blocker.

create_tenant writes only the tenant row, so all 10 gated features 404 until an operator flips them by hand — this already bit HistoryClass. Needs a decided default set.

Notification crons bind only the default tenant, so other tenants get no deadline or live-class reminders (apps/backend/app/routers/v1/notification.py).

Domain activate and deactivate clear only the local process cache; other instances serve stale routing for up to 5 minutes.

Create and update only lowercase the value. Add IDNA/punycode canonicalization to match the read path, plus a reserved and platform-label blocklist (apps/backend/app/schemas/platform.py).

Courses, chapters, lessons and questions still carry a default-tenant server default. The metric that gates its later removal — zero fallback writes for 7 days — does not exist yet.

ENVIRONMENT=rsa resolves to DEV, giving wrong platform hostnames and dev-only behavior in production. Decide: real tenant, separate deployment, or a fourth Environment value.

Browser hostname pass-through, tenant activation gates, audit queries, monitoring. Default-tenant traffic must stay stable.

Default banner components hardcode SkillPixel imagery and copy on shared surfaces. Also add a uniqueness guard against duplicate seeded default banners.

A static index.html title and meta is served to every tenant; the hardcoded default-tenant snapshot and fallback hosts in resolution.ts must derive from config.

Landing strategy is a hardcoded build-time UUID map holding only the local seed UUID, and the shared template lacks hero copy, announcements and featured courses (frontend phase-3 WP3–WP6).

Memberships 404 unless the user already self-registered. Add invite tokens, a pending state and an invite email — or accept the manual workaround for launch and do this early in Phase 3.

One global SMTP identity (info@skillpixel.vn) and SkillPixel-branded templates and subjects everywhere. Add a per-tenant from-identity and branding, plus tenant_id on email templates.

Privacy, terms, refund and company address are shared i18n copy naming SkillPixel's legal entity. Decide: tenant data, per-tenant i18n, or external links.

Payment and cart routes cannot be feature-gated naively — webhooks resolve to the default tenant after the gateway already charged — and provider config is a hardcoded TODO. Decide: provider list entitlement, or per-tenant merchant credentials.

In progress. Per-tenant copy overrides fit naturally alongside the email and legal work.

TXT/CNAME challenge, with activation requiring a verified domain. Today ACTIVE can be set with no verification and no external side effects.

The spec assumes under 50 active custom domains, warns at 75 and blocks at 90. No counter or guardrail exists in code.

Registration on activate and deactivate, predictable canonical redirects, managed subdomain as the fallback.

The contest service and the admin chat WebSocket still authorize on global Firebase claims. Add wrong-tenant 403 tests per router family.

One is_platform_admin boolean controls every tenant's entitlements, with no append-only log of config writes.

Drop default-tenant stamping once the Phase-1 metric shows 7 clean days, add PostgreSQL RLS for prioritized tenant tables, and reduce global roles to platform-wide semantics.

Banner uploads missing a tenant prefix, the last direct-Postgres read in the platform-admin activity route, a CORS wildcard revisit, and cron tenant-binding as a dependency instead of a convention.