user
Account identity: the per-tier user collections, profile fields, the global system role, OAuth link bookkeeping, and the avatar pipeline. A leaf module with no dependencies — everything else reaches it through iface.UserProvider rather than importing it.
notification
All outbound email, behind one narrow interface. Any module delivers mail through iface.NotificationSender without knowing anything about transport, rendering, preferences, or suppressions. The primary consumer today is auth — verification and password-reset messages.
tenant
Organizations, per-user memberships, the tenant hierarchy, plan-based entitlements, and the invite lifecycle — the substrate under the two-tier tenancy model. Implements iface.TenantProvider, so auth can embed memberships in JWTs and middleware can resolve the acting tenant.
authz
The permission catalog, the seeded roles, org-scoped custom roles, role bindings, and the evaluator that middleware calls on every protected request. Implements iface.AuthzProvider — the HasPermission primitive every other module's RBAC gate leans on.
auth
Every way a caller proves who it is: email/password (argon2id), OAuth 2.1, MFA, passkeys, machine-to-machine service accounts, plus the RS256 JWT, session, and RBAC middleware the rest of the platform leans on. This page is the module's contract; for the narrative of how a request becomes an identity, read Authentication flow.
navigation
Collects NavItems() from every registered module at boot, filters the result per request, and returns one JSON tree to the frontend. Adding a menu entry means editing the owning module, never this one — if you find yourself adding items here, the entry belongs somewhere else.
logging
Runtime logging operations for the slog pipeline (ADR-0005 Phase F). Tier-1 operators use /admin/modules/logging to apply permanent thresholds, run expiring per-module diagnostics, and preview a bounded set of recent Loki events. The workspace keeps its active overview, levels, diagnostics, or logs section in the URL; /admin/observability/log-levels is a redirect retained for old bookmarks.
compliance
Platform audit trail + GDPR data-subject rights. Re-homed from a removed addon back into the always-loaded core by ADR-0009 — the personal data it acts on (user, auth, tenant) is core-owned, so the compliance plane ships on day one.