Tenants and Runtimes

Model A: one runtime process per tenant (ADR 0016).

Enabling

VION_MULTI_TENANT=1 → POST /api/v1/tenants opens. When off: tenant.not_enabled.

Studio

• Tenant field at sign-in (slug)
• Tenant badge in the header
• Tenants — list, new tenant (name, slug, optional first admin)
• Runtimes — register (POST /api/v1/runtimes), bind target (PUT …/deployment-targets/{id}/runtime), delete (disabled if a target is bound)

Runtime protection

If VION_TENANT_ID is set, StageSnapshot rejects another tenant with tenant.mismatch. Unset → any tenant (single-tenant install).

Historian: separate DB/directory per process (configuration rule).

Each runtime sets its own OPC UA ApplicationUri with VION_OPCUA_SERVER_APPLICATION_URI (default urn:mikrodev:vion:opcua-server). Scheduled report history uses the project's bound runtime. Stage, activate, and operate spans carry vion.tenant_id when VION_TENANT_ID is set.

Not available yet

Per-tenant license limits are not implemented. Counters stay process-wide.