Route Tenant Coverage

Source of truth: src/middleware/setup/routeManifest.ts (ROUTE_MANIFEST). This doc is a human-readable companion; the audit gate npm run audit-tenant-coverage enforces source ↔ manifest consistency.

PR-F0: each manifest prefix now also carries a typed RoutePolicy (auth/lifecycle/rateProfile) in src/middleware/setup/routePolicy.ts, audited by npm run audit-route-policy.

Classification semantics

PR 4B + PR 2C-Auth + F6 Stage 5 contract

• Strict production mode (today). The production central gate mounts tenantIsolation with strictMode: true, disableHeaderExtraction: true. A tenant_required route without verified tenant context returns 403 with code TENANT_REQUIRED before its handler runs. The middleware option default remains permissive only as an explicit compatibility seam for isolated harnesses; production must pass strict mode deliberately.
• disableHeaderExtraction: true is a permanent security invariant. It means the un-verified x-tenant-id header does NOT populate req.tenantContext, closing the header-impersonation surface against direct req.tenantContext consumers (mcpPolicies.ts) AND against the extractIdentityContext req.tenantContext bridge added in PR 2C-Auth. The flag is frozen by npm run audit-tenant-isolation-invariant: any tenantIsolation(...) callsite under src/ that omits or sets it false fails CI. The flag should not flip unless an upstream gateway verifies the header — Preston-Test does not have one.
• PR 2C-Auth wired the JWT path. optionalAuthMiddleware is mounted globally on /api/* ahead of the central gate, so a Bearer JWT against JWT_SECRET populates req.user.tenantId. Inside the gate, tenantIsolation's built-in JWT extraction populates req.tenantContext from the same JWT. extractIdentityContext reads req.auth → req.user → req.tenantContext in that order; the bridge (third source) was added in PR 2C-Auth and inherits the verified-source-only invariant above.
• Handler identity fallbacks. extractIdentityContext still supports SYSTEM_IDENTITY for non-request and explicitly permissive harness contexts, but production tenant_required requests can no longer reach that fallback anonymously. Existing handler-local 401 checks remain defense in depth and preserve their behavior on deferred or locally mounted paths that do not use the production central gate.
• Unknown-route safety default. classifyRoute() returns 'system' (NOT 'public') for unmatched paths and emits a one-time-per-path logger.error, capped at 1024 entries to bound memory/log volume under attacker-driven path enumeration. The CI audit gate is the primary safety net; the noisy runtime default is the backstop.

Identity & audit propagation matrix

Scope of this section. The classification table above answers "is this route tenant-scoped?" (isolation). This section answers a second, orthogonal SOC-2 question: "does the handler attribute the acting identity, and does that actor reach the audit trail?" (attribution). A route can be tenant-isolated at the middleware layer yet still fail to record who performed a write.

Baseline. Every /api/* route passes through optionalAuthMiddleware (global) + the central tenantIsolation gate, so a verified Bearer JWT makes req.user.tenantId available everywhere. Attribution is therefore about whether the handler/service consumes that identity (via extractIdentityContext(req)) and threads it into audit rows — not about whether auth ran.

States. ✅ propagates — handler calls extractIdentityContext and/or attributes the actor in audit. 🔶 tenant-scoped only — handler reads req.user.tenantId / requireTenantId for data scoping but does not attribute the actor per write. ⛔ gap — handler delegates to a service without passing tenant/actor; no extractIdentityContext, no audit actor (middleware still authenticates the caller, so this is an attribution gap, not an open door).

Methodology. Per-route-file scan (point-in-time, 2026-05-29) for extractIdentityContext, SYSTEM_IDENTITY, audit emission (auditService/AuditService/AuditLogRepository/safeAudit), and tenant reads (req.user?.tenantId/requireTenantId/tenantContext). Regenerate with: for f in src/routes/**/*.ts; do grep -cE 'extractIdentityContext|SYSTEM_IDENTITY' "$f"; done (see the grep block in the PR that introduced this section).

Genuine gaps (next increment)

The ⛔ rows are the live attribution gaps. They are tenant-authenticated (the central gate runs) but their handlers delegate to operator/sync services without passing extractIdentityContext(req) or writing an actor-bearing audit row — so a write through these surfaces is not attributable to a user. FinanceCentral and WorkflowCentral already closed this (PR §21 / Kerry C5); the remaining central-operator families should replicate that pattern (thread extractIdentityContext → service → audit row). This is deliberately not bundled here: each family touches a distinct operator service and is the same magnitude as the FC/WC work, so wiring them belongs in scoped per-family PRs, tracked against this matrix. Closing them is what lets a SOC-2 reviewer answer "is multi-tenant audit complete?" with yes.

Public

System

Demo

Tenant-required