> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usedynamite.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Read /start/capabilities before choosing an integration. Use the deployed server’s tools/list for current tool inputs.

# Storage & trust boundaries

> Understand durable records, process-local state, roles, signed contexts and deployment constraints.

## Durable ownership

Production uses Dynamite's dedicated Postgres. A document store holds workspace/release/setup state, scoped access records, audit records, metadata and other durable product records. Analytics uses dedicated tables rather than rewriting the whole workspace for every event.

Updates use transactions and per-record advisory/row locks. Workspace saves also use optimistic versions. These mechanisms protect durable writes; they do not make in-memory preview sessions or active jobs distributed.

Drizzle-generated migrations run at startup. Generate schema changes with `bun run db:generate` in `packages/personalization-server`, review compatibility and back up production before rollout. Legacy volume import is transactional; retain original volume data for recovery. After cutover that volume is a pre-cutover snapshot, not a current database backup.

## Process-local state

Preview credentials/connections, active setup execution, caches, counters and parts of scheduling remain in memory. A restart can invalidate previews and interrupt execution. Saved setup/catalog checkpoints support recovery but do not eliminate the need to inspect progress.

Deploy one active process/replica. If using a drain/standby release procedure, keep background execution ownership singular and follow the repository's deployment runbook. Do not infer safe horizontal scaling from Postgres availability.

## Authentication and roles

Clerk mode scopes dashboard access to the active organization with live membership/role checks. Local password mode is a development/standalone path. Backend grants for internal administration or cross-workspace preview are separate from ordinary organization membership.

| Product role | Typical authority |
| - | - |
| Viewer | Read website state, results, installation and team information |
| Editor | Draft authoring, setup and allowed memory edits |
| Admin | Publish/rollback, live settings and team administration |

MCP access maps to read/edit/publish and cannot exceed the creator's current role. Keys are scoped, expiring, audience-bound and stored as digests; current access is revalidated. A preview token authorizes a preview, not general workspace writes. Origin matching on public runtime routes is delivery scoping, not user authentication.

## Data trust

| Input | Treatment |
| - | - |
| Browser profile | Normalize against current config; never trust as authenticated identity or purchase proof |
| Connector traits | Verify signature, bindings and expiry; interpret source confidence conservatively |
| Imported HTML | Server sanitation plus browser fragment allowlist |
| Fetched website/memory | Reference material, never operational instructions |
| Model response | Validate IDs, probabilities and confidence; fall back on failure |
| Ion request | Verify short-lived signed identity and service audience |

Publicly served variants should contain only information appropriate for visitors. Eligibility is not access control: client configuration/content can be inspected. Never hide secrets or private customer records in a supposedly narrow variant.

## External network access

Public page readers and enrichment use bounded fetch paths with origin/public-network restrictions. Connector secrets stay server-side. Browser enrichment remains readable by same-origin code even though it is signed. Avoid storing unnecessary personal data in traits or logging raw profiles.

## Release compatibility

Cached scripts can outlive a backend deployment. Keep API changes compatible with cached clients, deploy compatible server support first, and version shared client artifacts with provenance. Content rollback does not roll back a database migration or service binary.

Source: [database](https://github.com/ion-design/dynamite/blob/main/packages/personalization-server/src/database.server.ts), [store](https://github.com/ion-design/dynamite/blob/main/packages/personalization-server/src/store.server.ts), [runtime context](https://github.com/ion-design/dynamite/blob/main/packages/personalization-server/src/runtime-context.server.ts), [MCP access](https://github.com/ion-design/dynamite/blob/main/packages/personalization-server/src/mcp/access.server.ts), [deployment runbook](https://github.com/ion-design/dynamite/blob/main/deploy/README.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.