Tenant isolation, modelled in TLA+.
The difference between marketing-language multi-tenant and actually-multi-tenant is a formal proof. CoreLink keeps a TLA+ specification of cross-tenant byte non-leakage and runs it in CI on every change. If the safety property regresses, the build fails. We don't trust ourselves to get this right by code review alone.
- BLAKE3 + SHA-256 content addressing
- Per-tenant CAS namespace, isolation-by-construction
- Tenant boundary verified in CI on every commit