Skip to main content

​
Durable ownership

Production uses Dynamite’s dedicated Postgres. A document store holds workspace/release/setup state, scoped access records, audit records, metadata and other durable product records. Analytics uses dedicated tables rather than rewriting the whole workspace for every event. Updates use transactions and per-record advisory/row locks. Workspace saves also use optimistic versions. These mechanisms protect durable writes; they do not make in-memory preview sessions or active jobs distributed. Drizzle-generated migrations run at startup. Generate schema changes with bun run db:generate in packages/personalization-server, review compatibility and back up production before rollout. Legacy volume import is transactional; retain original volume data for recovery. After cutover that volume is a pre-cutover snapshot, not a current database backup.

​
Process-local state

Preview credentials/connections, active setup execution, caches, counters and parts of scheduling remain in memory. A restart can invalidate previews and interrupt execution. Saved setup/catalog checkpoints support recovery but do not eliminate the need to inspect progress. Deploy one active process/replica. If using a drain/standby release procedure, keep background execution ownership singular and follow the repository’s deployment runbook. Do not infer safe horizontal scaling from Postgres availability.

​
Authentication and roles

Clerk mode scopes dashboard access to the active organization with live membership/role checks. Local password mode is a development/standalone path. Backend grants for internal administration or cross-workspace preview are separate from ordinary organization membership. MCP access maps to read/edit/publish and cannot exceed the creator’s current role. Keys are scoped, expiring, audience-bound and stored as digests; current access is revalidated. A preview token authorizes a preview, not general workspace writes. Origin matching on public runtime routes is delivery scoping, not user authentication.

​
Data trust

Publicly served variants should contain only information appropriate for visitors. Eligibility is not access control: client configuration/content can be inspected. Never hide secrets or private customer records in a supposedly narrow variant.

​
External network access

Public page readers and enrichment use bounded fetch paths with origin/public-network restrictions. Connector secrets stay server-side. Browser enrichment remains readable by same-origin code even though it is signed. Avoid storing unnecessary personal data in traits or logging raw profiles.

​
Release compatibility

Cached scripts can outlive a backend deployment. Keep API changes compatible with cached clients, deploy compatible server support first, and version shared client artifacts with provenance. Content rollback does not roll back a database migration or service binary. Source: database, store, runtime context, MCP access, deployment runbook.