curriculum-project-hub/.scratch/saas-production-readiness/map.md

Initial Production SaaS Readiness

Label: wayfinder:map

Destination

The repository can be deployed from a clean checkout as the initial production multi-tenant Curriculum Project Hub, operated safely on the ADR-0018/0020/0021 single-host Linux topology, with repeatable release evidence, rollback and recovery procedures, and no known critical security or data-integrity gaps.

Notes

• spec/ remains the semantic source of truth; implementation drift must be surfaced rather than silently resolved.
• The initial product boundary follows the accepted ADRs: Organization is the tenant root, customer onboarding may be manual, and full billing, limits, tenant suspension, and self-service platform administration remain deferred unless a readiness investigation proves they are required for safe operation.
• Use the diagnosing-bugs loop for every reproduced defect. Prefer explicit failures and observable critical paths over fallback behavior.
• Work on saas-production-readiness; make small conventional commits after verified, independently reversible milestones. Do not push without explicit authorization.
• Local lake build currently requires a configured elan toolchain; CI remains the authoritative configured Lean build environment until that local toolchain is available.

Decisions so far

• Audit the clean-host deployment and rollback contract — keep the accepted single-host topology, but replace the incomplete in-place updater with a provisioned, immutable, readiness-gated and rollbackable release contract.
• Audit tenant, authentication, and request security boundaries — retain the working org-admin/application authorization core, but production is blocked on agent/MCP isolation, execution-time object binding, org-scoped encrypted credentials, tenant status, browser sessions, and clean dependency audits.
• Audit run lifecycle and data integrity under failure — retain the database-enforced project-lock uniqueness and normal happy path, but replace receipt-before-success, process-local queues, independent run/session/lock effects, silent delivery/audit loss, and partial startup reset with durable, recoverable state machines; explicitly decide failed-run workspace semantics.

Fog

• The production topology after the initial single-host pilot (HA, horizontal workers, multi-region, or managed container orchestration) depends on measured demand and failure experience.
• Commercial self-service concerns such as billing plans and automated tenant provisioning remain beyond the accepted ADR boundary; revisit after the initial safety and operability route is clear.
• Regulatory retention, residency, and customer-specific compliance controls require product/legal inputs that the repository does not currently contain.