---
title: "ADR 0013 — One deployment serves many orgs, superseding ADR 0001"
type: decision
tags: [signpost, adr, decision]
proposed_by: tok_bc09b340db294c709763789154d8113d
model: kmem-docs-publisher
extracted_at: "2026-10-08T22:39:37.580Z"
---
# ADR 0013 — One deployment serves many orgs, superseding ADR 0001

**Status** Accepted · **Date** 2026-08-18 · **Supersedes** [ADR 0001](./0001-single-project-per-instance.md) ·
**Relates to** ADR 0004 (`ProjectContext`), `PRD_PART2.md`, commit `174ef8a` (Wave 0),
`packages/db/migrations/0006_tenancy.sql`

## Decision

The hosted product serves many orgs from one deployment. An org lives at
`{org}.sarani.app` (`SIGNPOST_ROOT_DOMAIN`, one variable in `wrangler.jsonc`), and the request's
host resolves to a tenant. The pieces that exist as of Wave 0/1:

- `apps/worker/src/tenancy/domain.ts` — `rootDomain`, `hostFor`, `subdomainOf`, the reserved-name
  list.
- `apps/worker/src/tenancy/resolve.ts` and `store.ts` — the resolver and its store.
- `project` and `org_routing` tables — `packages/db/src/schema.ts`, applied by migration
  `0006_tenancy.sql`, with unique indexes on `subdomain` and `custom_domain`.

This reverses ADR 0001's decision ("a Signpost deployment holds exactly one project") for the
hosted product. ADR 0001's *bet* still paid: `ProjectContext` (ADR 0004) was the one concession it
made to this future, and it is exactly the seam the tenancy build now threads.

## What is true today, exactly

**The running data path is still single-project.** `resolveProjectContext`
(`apps/worker/src/context.ts`) still returns the one project; nothing calls the host-based
resolver yet, and `resolve.ts` says so in its own header. Wiring a request's host into
`resolveProjectContext` is Wave 2. Until Wave 2 lands, every operational statement in ADR 0001 —
unscoped queries, the instance as the permission boundary — remains a true description of the
running code. This ADR supersedes the *decision*, not the current behaviour.

## Alternative rejected

Deleting ADR 0001, or editing its body to describe the new world. An ADR is the record of a
decision that was made, with the reasoning it was made on; this repository's convention
(`docs/CONVENTIONS.md` §"A decision that will be questioned in six months") is that an ADR is
never edited afterwards — a change is a new ADR that supersedes it and says so. ADR 0001 keeps
its body; only its status line gains the forward pointer, so a reader landing there is not left
believing the decision is live.

## Consequences

- The self-hosted product keeps ADR 0001's shape: one instance, one project, no tenant column in
  its operator's mental model. Multi-tenancy is the hosted product's concern.
- Documents that describe a single project per instance are true until Wave 2 and must say what
  changes and when, rather than pre-writing the future.
- Billing attaches to the org. `apps/web/src/landing/numbers.ts` records the decided pricing and
  the Merchant-of-Record wiring — Kelviq first, Dodo Payments as the alternate, one adapter seam —
  for whoever builds it.