forked from EduCraft/curriculum-project-hub
46 lines
3.2 KiB
Markdown
46 lines
3.2 KiB
Markdown
# Initial Production SaaS Readiness
|
|
|
|
Label: wayfinder:map
|
|
|
|
## Destination
|
|
|
|
The repository can be deployed from a clean checkout as the initial production
|
|
multi-tenant Curriculum Project Hub, operated safely on the ADR-0018/0020/0021
|
|
single-host Linux topology, with repeatable release evidence, rollback and
|
|
recovery procedures, and no known critical security or data-integrity gaps.
|
|
|
|
## Notes
|
|
|
|
- `spec/` remains the semantic source of truth; implementation drift must be
|
|
surfaced rather than silently resolved.
|
|
- The initial product boundary follows the accepted ADRs: Organization is the
|
|
tenant root, customer onboarding may be manual, and full billing, limits,
|
|
tenant suspension, and self-service platform administration remain deferred
|
|
unless a readiness investigation proves they are required for safe operation.
|
|
- Use the `diagnosing-bugs` loop for every reproduced defect. Prefer explicit
|
|
failures and observable critical paths over fallback behavior.
|
|
- Work on `saas-production-readiness`; make small conventional commits after
|
|
verified, independently reversible milestones. Do not push without explicit
|
|
authorization.
|
|
- Local `lake build` currently requires a configured elan toolchain; CI remains
|
|
the authoritative configured Lean build environment until that local toolchain
|
|
is available.
|
|
|
|
## Decisions so far
|
|
|
|
- [Audit the clean-host deployment and rollback contract](issues/01-audit-clean-host-deployment.md) — keep the accepted single-host topology, but replace the incomplete in-place updater with a provisioned, immutable, readiness-gated and rollbackable release contract.
|
|
- [Audit tenant, authentication, and request security boundaries](issues/02-audit-tenant-auth-security.md) — retain the working org-admin/application authorization core, but production is blocked on agent/MCP isolation, execution-time object binding, org-scoped encrypted credentials, tenant status, browser sessions, and clean dependency audits.
|
|
- [Audit run lifecycle and data integrity under failure](issues/03-audit-run-lifecycle-integrity.md) — retain the database-enforced project-lock uniqueness and normal happy path, but replace receipt-before-success, process-local queues, independent run/session/lock effects, silent delivery/audit loss, and partial startup reset with durable, recoverable state machines; explicitly decide failed-run workspace semantics.
|
|
- [Define production observability and incident recovery](issues/04-define-observability-recovery.md) — keep the existing Fastify/Prisma/systemd signal fragments, but production requires dependency-aware readiness, typed and correlated errors, durable-work telemetry, an explicit SLO/retention/alerting control plane, and recovery runbooks proven by fault drills.
|
|
|
|
## Fog
|
|
|
|
- The production topology after the initial single-host pilot (HA, horizontal
|
|
workers, multi-region, or managed container orchestration) depends on measured
|
|
demand and failure experience.
|
|
- Commercial self-service concerns such as billing plans and automated tenant
|
|
provisioning remain beyond the accepted ADR boundary; revisit after the
|
|
initial safety and operability route is clear.
|
|
- Regulatory retention, residency, and customer-specific compliance controls
|
|
require product/legal inputs that the repository does not currently contain.
|