# Canonical Tenant Context Resolution

## Canonical Rule

- Tenant-panel and tenant-scoped flows keep panel-native tenant semantics through `Filament::getTenant()` / `Tenant::current()`.
- Workspace-admin and monitoring flows under `/admin/...` resolve the active tenant only through `App\Support\OperateHub\OperateHubShell::activeEntitledTenant(Request)`.
- When both admin sources exist and disagree, the entitled Filament tenant wins for the full request and remembered workspace tenant state remains fallback-only.
- Tenant-owned Entra groups remain tenant-panel-primary navigation. The admin-panel route may stay available for direct links or global search, but it must not appear as a regular workspace-admin sidebar entry.

## Explicit No-Context Outcomes

| Surface | No-context outcome |
| --- | --- |
| `/admin/operations` | Render the workspace-scoped `All tenants` state, clear tenant-default filters, and hide tenant-only KPI cards. |
| `/admin/operations/{run}` | Render only when workspace membership and run-tenant entitlement still pass; otherwise return `404`. |
| Admin Entra group list and view | Return `404` instead of widening scope. |
| Admin Entra group global search | Return no tenant-owned results. |

## Approved Exceptions

- `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Pages/ChooseTenant.php`
  Tenant chooser remains panel-native because it is the explicit tenant-selection surface.
- `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Http/Controllers/SelectTenantController.php`
  Explicit tenant selection persists remembered tenant state after a user choice.
- `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Support/Middleware/EnsureFilamentTenantSelected.php`
  Middleware is allowed to read and set `Filament::getTenant()` because it owns panel bootstrapping and route/query synchronization.
- `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Resources/EntraGroupResource.php`
  Mixed-surface resource keeps one tenant-panel-native branch through `Tenant::current()` while admin panel logic delegates to `OperateHubShell`.

## Residual Inventory

- Compliant admin call sites:
  `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Pages/Monitoring/Operations.php`
  `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Widgets/Operations/OperationsKpiHeader.php`
  `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Pages/Operations/TenantlessOperationRunViewer.php`
  `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Resources/OperationRunResource.php`
  `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Resources/AlertDeliveryResource.php`
  `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Pages/Monitoring/AuditLog.php`
  `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Resources/EntraGroupResource.php`
- Tenant-panel-native call sites intentionally outside the admin guard:
  `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Pages/InventoryCoverage.php`
  `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Pages/BaselineCompareLanding.php`
  tenant-owned resources under `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/app/Filament/Resources/` that are routed only through tenant context.
- Deferred admin remediation:
  none in the Spec 135 operations, OperationRun, alert-delivery reference, or Entra-group admin surfaces after this iteration.