Relay: qualify one isolated relay instance per company

[100yenadmin]

Parent: #1

Classification

Relay/infrastructure qualification for Guarded Business Beta. Each company receives one customer VM containing that company's separate relay instance and Hermes gateway. Company members use separate Hermes profiles on that VM. This is not authorization to add a Hive collaboration, content, search, profile, DM, agent, or administration product.

Outcome

Qualify a repeatable, isolated Electric Sheep relay deployment per company while native Buzz event behavior remains unchanged inside each company community.

Preconditions

• The internal single-company canary has passed.
• Company/relay selection is server-owned and host-derived.
• Provisioning assigns one company identity, customer VM, hostname, database/cache/object namespace, Hermes gateway, and lifecycle to one relay instance.

Acceptance

• Unknown hosts and ambiguous company/community mappings fail closed.
• One relay instance resolves exactly one company and does not accept a client-selected tenant.
• One customer VM contains only that company's relay and Hermes gateway; company members use separate Hermes profiles.
• Database, cache, object storage, search, logs, secrets, backups, and restore targets are instance/company scoped.
• Native event, profile, file, search, DM, channel, and agent behavior remains unchanged inside the admitted company.
• Cross-company DNS, credential, network, backup, restore, and catalog probes fail.
• Revocation and durable revalidation work within the company relay.
• Provisioning, upgrade, health, backup, restore, rotation, incident response, and retirement are repeatable per company.
• Failure of one company relay does not grant access to or mutate another company.
• Capacity and cost fit the guarded-beta budget.
• Independent tenant/security review passes on the exact deployment contract and relay head.

Non-goals

• Replacing native Buzz collaboration with a managed broker.
• Adding new user-facing Hive capabilities.
• A Hive-owned memory, retrieval, profile, or VM system.
• Multiple unrelated companies sharing one relay instance during this stage.
• Multiple unrelated companies sharing one customer VM or Hermes gateway during this stage.

Stop conditions

Stop on shared company credentials/state, client-selected relay authority, ambiguous hostname ownership, cross-company backup/restore reachability, or any requirement for Hive to implement multi-tenant collaboration logic.

[100yenadmin]

Owner priority correction — 2026-07-28

Issue #12 remains open, but implementation is paused. The immediate owner priority is the internal Hive release candidate and the Benjamin/Andrew/ATRIS canary; Guarded Business Beta relay qualification resumes after that internal gate.

Read-only inspection found that the current relay already has host-derived, fail-closed community binding and existing single-node Compose/Helm deployment seams. It did not prove the live one-company VM, credential, backup/restore, isolation, capacity, or failure-domain acceptance in this issue. No #12 worktree, branch, source diff, PR, deployment, or runtime mutation was created.

This sequencing change does not alter the architecture: one company still receives one VM, relay, and Hermes gateway with separate employee profiles. The exact next product gate is an integrated internal Hive artifact containing the reviewed OAuth backup-code and company-agent stack, followed by Benjamin login and the two-human/one-agent canary.