# Initial Production SaaS Readiness

Label: wayfinder:map

## Destination

The repository can be deployed from a clean checkout as the initial production
multi-tenant Curriculum Project Hub, operated safely on the ADR-0018/0020/0021
single-host Linux topology, with repeatable release evidence, rollback and
recovery procedures, and no known critical security or data-integrity gaps.

## Notes

- `spec/` remains the semantic source of truth; implementation drift must be
  surfaced rather than silently resolved.
- The initial product boundary follows the accepted ADRs: Organization is the
  tenant root, customer onboarding may be manual, and full billing, limits,
  tenant suspension, and self-service platform administration remain deferred
  unless a readiness investigation proves they are required for safe operation.
- Use the `diagnosing-bugs` loop for every reproduced defect. Prefer explicit
  failures and observable critical paths over fallback behavior.
- Work on `saas-production-readiness`; make small conventional commits after
  verified, independently reversible milestones. Do not push without explicit
  authorization.
- Local `lake build` currently requires a configured elan toolchain; CI remains
  the authoritative configured Lean build environment until that local toolchain
  is available.

## Decisions so far

- [Audit the clean-host deployment and rollback contract](issues/01-audit-clean-host-deployment.md) — keep the accepted single-host topology, but replace the incomplete in-place updater with a provisioned, immutable, readiness-gated and rollbackable release contract.
- [Audit tenant, authentication, and request security boundaries](issues/02-audit-tenant-auth-security.md) — retain the working org-admin/application authorization core, but production is blocked on agent/MCP isolation, execution-time object binding, org-scoped encrypted credentials, tenant status, browser sessions, and clean dependency audits.
- [Audit run lifecycle and data integrity under failure](issues/03-audit-run-lifecycle-integrity.md) — retain the database-enforced project-lock uniqueness and normal happy path, but replace receipt-before-success, process-local queues, independent run/session/lock effects, silent delivery/audit loss, and partial startup reset with durable, recoverable state machines; explicitly decide failed-run workspace semantics.
- [Define production observability and incident recovery](issues/04-define-observability-recovery.md) — keep the existing Fastify/Prisma/systemd signal fragments, but production requires dependency-aware readiness, typed and correlated errors, durable-work telemetry, an explicit SLO/retention/alerting control plane, and recovery runbooks proven by fault drills.

## Fog

- The production topology after the initial single-host pilot (HA, horizontal
  workers, multi-region, or managed container orchestration) depends on measured
  demand and failure experience.
- Commercial self-service concerns such as billing plans and automated tenant
  provisioning remain beyond the accepted ADR boundary; revisit after the
  initial safety and operability route is clear.
- Regulatory retention, residency, and customer-specific compliance controls
  require product/legal inputs that the repository does not currently contain.