The host's own record, over corpus_host. It answers three questions and holds nothing else:
- what is connected — the databases and services this installation reaches,
and for a database belonging to one organization, whose it is and which product it carries;
- who may have an account — the organizations: us, our customers, and the
fixtures;
- what they may open — which consoles and modules each organization reaches.
What it deliberately does not hold
Authorization inside an organization. Their users, their roles and their grants live in their own database, governed by them, because their users are their business and their data is where those users act. What the host decides is the outer boundary: whether an organization exists at all, and what it may reach.
It also holds no content — no parties, no tickets, no pages. A row here is a grant or a pointer, never a record of work.
Why it exists
forge_cms_test was doing two jobs: the installation's tenants, users, roles and 83 permissions, and every module's data, because each module is handed the host's one pool when it is mounted. That is also why eleven parties sit in it carrying a tenant_id. A product database that is also the master cannot be handed to a customer, and cannot be replaced without replacing the installation.
Operator ruling, 2026-09-10: God Mode gets its own database.
The tables
| table | what it says |
|---|---|
organizations | who may have an account, and what they are to us (in_house, customer, test, prospect) |
connections | what is reachable, whose it is, which product's schema it carries |
consoles | the surfaces this installation offers — the switcher's contents |
console_modules | which modules a console carries |
organization_modules | what an organization may reach, and where it was provisioned |
organization_consoles | which consoles an organization may open |
A console marked audience = 'ours' is never grantable, and the database refuses the row rather than trusting every caller to remember: a customer holding God Mode would control the host that serves them.
Applying it
The schema is carried as data in HOST_CONTROL_MIGRATIONS, the same shape operations-control-plane uses, so the owning tool applies it and this crate depends on no runner.