Track HiveGrid Cloud planning reference

hivegrid-cloud/docs/verification/tenant-auth-baseline-health.md

@@ -0,0 +1,53 @@
+# Tenant Auth Baseline Health Report
+
+## Scope
+
+The Tenant Auth baseline baseline health gate records the pre-feature health of tenant, authentication, OAuth, invite, and related access-control surfaces before downstream Tenant Auth feature slices begin. It is an operator-facing baseline: use it to distinguish pre-existing repository debt from regressions introduced by later tenant-model work.
+
+## Command
+
+Run the baseline with:
+
+```sh
+pnpm run verify:tenant-auth-baseline
+```
+
+The command attempts every configured non-E2E gate and writes a report even when one or more shell gates fail. Its process exit code is non-zero when any shell gate exits non-zero.
+
+## Generated Report Path
+
+The generated output is:
+
+```text
+.tc/baselines/tenant-auth/baseline-health.md
+```
+
+Treat this Markdown file as generated output, not as the source of truth. Re-run `pnpm run verify:tenant-auth-baseline` when you need a fresh baseline snapshot, and do not paste secrets or live environment values into interpretation notes.
+
+## Gate List
+
+The baseline covers these gate IDs:
+
+- `typecheck`: project typecheck command.
+- `lint`: project lint command.
+- `ci-baseline`: existing CI baseline verifier.
+- `vitest-tenantAuth-tenant-auth-smoke`: focused tenant/auth smoke tests for host-aware tenant routes, authentication settings, auth-boundary imports, database exports, and entitlement exports.
+- `tenantAuth-tenant-auth-inventory`: read-only source inventory for tenant/auth/OAuth/invite surfaces.
+
+For each automatic gate, the report records the command, exit code, failure count, duration, output fingerprint hash, and a capped fingerprint excerpt.
+
+## Inventory Meaning
+
+The inventory gate is read-only. It scans configured source roots for tenant/workspace, invite, expiry/revocation/acceptance, OAuth/Google/Apple, magic-link, callback/redirect/host-aware URL handling, context-switch, role/feature/plan revalidation, and SSO/SAML/OIDC terms.
+
+Inventory counts are discovery signals, not pass/fail assertions. A count indicates that the surface exists in scanned files and may need comparison or review during later Tenant Auth work; a missing optional scan root is reported as skipped metadata rather than a gate failure.
+
+## Failure-Count Comparison Rule
+
+Downstream slices should compare the gate ID, failure count, and fingerprint excerpt before treating a failure as new. A later failure is likely pre-existing when the same gate ID has the same failure count and a materially matching fingerprint excerpt. Treat it as a potential new regression when the failure count increases, a different gate fails, or the fingerprint excerpt points to changed tenant/auth/OAuth/invite behavior.
+
+When reporting a regression, include the later gate ID, later failure count, later fingerprint hash or excerpt, and the nearest baseline values from `.tc/baselines/tenant-auth/baseline-health.md`.
+
+## Non-E2E Boundary
+
+The Tenant Auth baseline health gate is intentionally non-E2E. It must not require Playwright, Cypress, browser automation, or live browser flows. Browser and E2E scenarios remain manual or slice-level verification unless explicitly approved for a separate run.