Hub's boundary with LearnStack core is governed by two invariants — the Hub stores no tenant content, and every crossing goes through a named adapter (ADR-0034). This file is pointer-only: every load-bearing rule (endpoint list, auth chain, what Hub MUST NOT do) lives in LearnStack-side documents. Read those — do not duplicate their content here.
Each link below is the single source of truth for the topic. If you find anything in this Hub repo that contradicts the linked source, fix the Hub repo — never mirror or "extend" the source-side rule here.
| Topic | Source |
|---|---|
| The endpoint set — the authoritative enumeration | ADR-0034 § The endpoint set. Mirrored in Standards 20 § The endpoint set; the two are kept identical. |
| The two invariants + the ADR gate on adding an endpoint | ADR-0034 § Decision, restated in Standards 20 § Hub HTTPS Contract Surface |
| Auth chain (mTLS + RS256 JWT + HMAC body signature), both directions, and the separate-repository decision | ADR-0034 § One auth chain, both directions and ADR-0019 § Inter-system contracts — ADR-0034 replaces ADR-0019's "closed at four endpoints" rule and its per-instance API key on the LearnStack → Hub direction; both directions now carry the same three layers |
| Architecture deep dive (Hub data model, sequence diagrams) | Architecture 24 LearnStack Hub |
Triple deployment model + license (IEntitlementProvider impls) |
ADR-0020 Triple Deployment + Hybrid License |
| Feature-based entitlement projection shape | ADR-0021 Feature-Based Entitlement |
| Custom-domain + TLS lifecycle (Hub never writes LearnStack K8s state) | ADR-0022 Custom Domain + TLS, as amended by ADR-0034 — the lifecycle stands; Amendment 1's step-3 delivery mechanism is superseded |
Two-realm Keycloak boundary (learnstack-hub realm rejected on tenant routes; learnstack realm rejected on /api/internal/*) |
ADR-0004 Authentication Strategy (Amendment 1) |
Architecture tests that enforce the boundary (LearnStack_Modules_DoNotReference_Hub, Hub_Modules_DoNotReference_LearnStack_Internals, Internal_API_Endpoints_AreNot_Public, Hub_NeverStores_TenantData, Hub_Operator_JWT_NeverAccepted_On_LearnStack_Routes, Hub_Client_Referenced_Only_By_Named_Adapters, plus the Stripe / Iyzico SDK isolation tests once Phase 09b lands) |
Architecture 24 § 10 Architecture tests (authoritative list of the 7 Hub-side tests), ADR-0019 § Architecture tests (Accepted decision; lists 4 of them, and predates ADR-0034's seventh), Standards 21 Architecture Tests Catalogue (canonical identifier registry — the Hub-side tests now carry full entries there, owned and run by this repository) |
| Packet | Endpoint work (cross-references the authoritative spec above) |
|---|---|
| P02c-2 | Hub-side handlers for every LearnStack → Hub path in ADR-0034's set. Outbound LearnStackApiClient for every Hub → LearnStack path (mTLS + JWT + HMAC chain, both directions). |
| P02c-3 | LearnStack-side handlers for every Hub → LearnStack path (paired PR into the LearnStack core repo). HubEntitlementProvider + IUsageReporter adapters on the LearnStack side. |
| P02c-5 | LearnStack-side host-mapping handler behind IHubTenantSync for PUT /api/internal/tenants/{id}/host-mappings — the push endpoint is the authority for platform_host_to_tenant; the learnstack.hub.custom-domain.activated/.deactivated/.renewed Dapr events are the cache-invalidation signal, not the mapping channel. Certificate material moves by secret-store replication and is referenced by path, never by value (ADR-0034, superseding ADR-0022 Amendment 1 step 3). |
- Not a quick-reference cheat sheet. Duplicating the endpoint table here breaks single-source-of-truth: if the LearnStack-side spec evolves, the cheat sheet ages out silently. Use the links above.
- Not a place to add Hub-internal rules. Hub-internal-only decisions live in docs/decisions/ under the
HUB-NNNNseries.