Local build, tests, organization-first gates, decision benchmarks, and deterministic analytics benchmarks pass. Broad external traffic remains disabled until the applied database, backup, regional, monitoring, MFA, privacy, and deployment evidence gates pass.
Organization-first tenancy
The authorization boundary is user → organization → resource. Sites, analytics, guest API tokens, tickets, messages, attachments, quotas, regional admission, and public decision paths must resolve an active organization before access or mutation. Suspended and deleting organizations fail closed. Legacy owner_id anduser_id fields may remain as provenance or requester identity, but they are not the tenant boundary.
Administrative access
/root is the canonical platform-owner administration namespace. The legacy/admin and nested /admin/* paths redirect to /rootcompatibility routes. Direct server mutations remain protected by server-side capability and platform-support checks; a navigation link is not an authorization control.
Operational observability
The self-hosted monitoring topology includes Prometheus, Grafana, Loki, Promtail, Alertmanager, and Sentry integration points. Application alert signals normalize into the database alert state and durable escalation workflow. Live delivery and acknowledgement still require a deployed Alertmanager, notification provider, and independent witness.
Required live evidence
| Gate | Required proof |
|---|---|
| Supabase tenancy | Applied two-tenant RLS, policy, grant, trigger, catalog, and cross-tenant probe evidence. |
| Backup and restore | Encrypted off-host backup restored into a clean target with checksums and application smoke tests. |
| Regional resilience | Two-region smoke, drain, failover, recovery, queue safety, and rollback evidence. |
| Dependency drills | Redis, database, queue, upstream, SMTP, GeoIP/model failure and recovery evidence. |
| Security controls | Fresh MFA, dual-control deployment/rollback, and scoped support-grant evidence. |
| Privacy and licensing | Retention, deletion, consent, GeoIP licensing, and data-inventory approval. |
Local validation
pnpm install --frozen-lockfile
pnpm build
pnpm test -- --run
pnpm exec tsc --noEmit
pnpm run check:tenant-boundaries
pnpm run check:release-gates
node scripts/benchmark-analytics-rollup.mjsThese commands validate the repository and local build. They do not substitute for applied Supabase, deployed-region, backup, monitoring, identity, or compliance evidence. See the internal docs/full-proof-live-evidence-runbook.md for the complete witness bundle.