What problem does it solve? Multi-tenant systems can silently leak one tenant's data to another when a read path or storage key builder drops the tenant prefix, and such regressions can ship green if no test covers them. This Skill enforces REQ-025 by requiring a proven isolation test case for every route and R2/D1 key builder that touches tenant-scoped storage. ## Core Features & Use Cases - Read-path registry: Maintains a registry of every tenant-scoped read path (routes, key builders, D1 loaders) with its required test cases, updated in the same PR as the code. - Attack-shape matrix: Defines the adversarial cases every route must pass — client tenant header, query param injection, forged tokens, unsigned tokens, and cross-tenant IDs under a valid session. - Key-builder unit assertions: Adds literal string assertions that R2 key builders embed the tenant prefix, catching regressions route tests cannot see. - Use Case: When adding a new API route that reads session.tenant or a new R2 key template like evidence/${tenant}/..., use this Skill to add the matching isolation tests and registry row before merging. ## Quick Start Ask the AI to prove tenant isolation for the new route you just added by generating the attack-shape test cases and updating the read-path registry.
