Active Storage + activerecord-tenanted

Blobs live in the tenant database (tenanted_rails_records = true). Default Active Storage controllers look in the global connection, so uploads succeed and saved images 404. Direct-upload must create the blob inside with_tenant, and the signed_id must include the tenant key.

Single-database apps: use the active-storage skill only. This skill is the Herald overlay.

Philosophy

1. Never create a blob without a current tenant. The storage key is {tenant_key}/{token}.
2. Sign blob id + tenant together. A tenant-local numeric/UUID id is not globally unique. Serving "the first match" is a cross-tenant leak.
3. Redirect URLs go through your controllers, not a public S3 URL, so tenant checks run.
4. Fail closed on ambiguous legacy IDs. One match is ok; two matches are 404.

Config (required)