Default to paranoid. Document every control.

// Tenant scoping contract (TS / Rust / Go — same semantics everywhere)
//
// (1) The authenticated operator DID is extracted at the edge, ONCE,
//     from a short-lived JWT signed by Wavestar's auth service. Never
//     from a header, query string, or request body.
//
// (2) Every DB query is wrapped. The wrapper refuses to execute if the
//     target table does not have a tenant_did column, or if the session
//     tenant has not been threaded through context.
//
// (3) Cross-tenant reads are possible, but only through a named helper
//     with a reason string. Every invocation is logged to an append-only
//     audit stream, alerted on, and visible to the tenants whose data
//     was touched (unless a regulator-confidential flag is set).

// normal read:
const balance = await withTenant(session.did, (tx) =>
  tx.sql`SELECT sum(amount) FROM ledger WHERE status='cleared'`
);

// cross-tenant (regulatory / settlement / support):
const view = await withCrossTenant(
  {
    reason: "CFTC 17 CFR 39.18 large-trade review · ticket RT-2026-04-18",
    requestor: session.did,
    approver:  "did:orbit:operator:wavestar:compliance-officer",
  },
  (tx) => tx.sql`SELECT ... FROM trades WHERE notional > $1 AND settled_at > $2`
);
// Emits:   audit.cross_tenant.read { requestor, approver, reason, tables[], row_count, ts }
// Logged:  append-only Trillian audit sub-log
// Alerted: Slack #sec-audit + PagerDuty for anomalous frequency

# Public endpoints (https://wavestar.space, https://resolver.wavestar.space)
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Security-Policy:   default-src 'self';
                           script-src 'self' 'nonce-<random>';
                           style-src 'self' 'nonce-<random>';
                           img-src 'self' data:;
                           connect-src 'self' https://api.wavestar.space;
                           frame-ancestors 'none';
                           base-uri 'self';
                           form-action 'self'
X-Frame-Options:           DENY
X-Content-Type-Options:    nosniff
Referrer-Policy:           strict-origin-when-cross-origin
Permissions-Policy:        geolocation=(), microphone=(), camera=()
Cross-Origin-Opener-Policy:   same-origin
Cross-Origin-Embedder-Policy: require-corp

# Authenticated APIs (https://api.wavestar.space)
# mTLS required for clearing member endpoints.
# JWT assertion profile: RFC 7521, signed by operator Ed25519 key,
# max exp 15min, replay-protected by nonce + jti tracking.