Authorization and scope
Tenant membership, roles, capabilities, Site grants, explicit record ownership, and subscription state are enforced server-side.
Trust & Deployment
Know what is implemented, what must pass before customer production, and which connected-property capabilities remain private preview.
PostgreSQL targetHosted records
Site-scoped writesExplicit ownership
Release gatedNo implied production claim
Implemented foundation
The application contract is tested before hosting claims are made.
The current pre-production system has synchronized SQLite/PostgreSQL schemas, backend authorization, tenant/Site scoping, revision-aware writes, activity and audit records, externalized jobs, and automated browser/mobile/API verification.
Operational history
Work-order aggregate saves, revisions, activity provenance, audit events, and user-applied assistant proposals.
Runtime separation
Web requests, scheduled work, agent execution, file cleanup, email, push, and reconciliation have explicit process boundaries.
Release gates
Customer production begins only after hosted operations pass.
The initial release still requires schema freeze and migrations, coordinated identity/client cutover, managed PostgreSQL restore evidence, production object storage, email/APNs/StoreKit operations, secrets and observability, load testing, and incident procedures.
Durability
Managed backups, point-in-time recovery policy, object lifecycle, restore drills, and retention.
Security operations
HTTPS, secure cookies, shared rate limiting, credential rotation, dependency scanning, logs, alerts, and incident ownership.
Capacity evidence
Staged load tests for APIs, database pools, workers, AI concurrency, files, and mobile synchronization.
Connected properties
Bridge enrollment, telemetry storage, monitoring evaluation, and delivery operations are not initial-release promises.
Public trust copy stays narrower than internal operations.
Public architecture stays logical. Credentials, private hostnames and endpoints, recovery commands, incident contacts, and operator runbooks remain private.