DB CPU exceeds 60% at p95 for 15 minutes, connection-pool use exceeds 70%, or indexed query p95 remains above 200 ms.
Guide 09 · Phase 7
Scale by evidence. Recover by rehearsal.
The operating design for shared-schema tenancy, managed compute, cache, reporting, observability, backups, edge protection, and a 50-user load profile.
01 / Architecture
Shared schema, explicit tenant boundary
organization_id is the canonical tenant key on every operational table. Postgres row-level security filters authenticated access; update triggers reject tenant reassignment; service credentials remain server-only. Schema-per-tenant is deferred because it would multiply migrations, connection pools, and recovery work without improving the current 50-user risk profile.
Cloudflare / CDN→Sites or Cloud Run→Redis REST cache→Supabase primary→Reporting replica
Runtime choice: keep the current edge deployment while it meets the load thresholds. The checked-in Cloud Run profile is the managed-container escape hatch. Kubernetes is intentionally deferred until multiple services, custom networking, or sustained orchestration needs justify its operating cost.
02 / Capacity
Upgrade triggers
Reads exceed 70% of database work and KPI/report queries consume more than 25% of query time after indexes and materialization.
The connected 50-user test exceeds 750 ms p95 or 1% errors after cache and query tuning.
Cache budget, bandwidth, or throughput warnings recur; production HA requires a multi-zone plan and service commitment.
Monthly storage exceeds 50 GB or attachment egress materially affects field latency or the storage budget.
Supabase plan limits or regional requirements remain binding after compute, pooling, query, and replica options are exhausted.
Run both checked-in k6 profiles against an isolated staging tenant. The gate is less than 1% failed requests, application p95 under 750 ms, dashboard p95 under 500 ms, and attachment p95 under 1.5 seconds. Do not run destructive load tests against production.
03 / Recovery
Backups are inputs; restores are evidence
- 1Nightly logical export
Validate the archive catalog, calculate SHA-256, and upload the dump plus manifest to private Backblaze B2 storage.
- 2Managed PITR
Enable seven-day PITR for production when the Standard or HA plan is activated.
- 3Quarterly restore drill
Restore one exact object only into a database whose name contains
forge_restore; verify checksum, schema, and record access. - 4Record RPO and RTO
Store observed recovery point and duration in the operations evidence table, then close any gaps.
04 / Observability
Measure the user path
/api/health is the liveness probe. /api/health/ready checks the database path and reports cache posture. The bearer-protected /api/metrics endpoint emits Prometheus gauges without tenant labels. A five-minute monitor records availability, p95 latency, and dependency state; JSON logs carry service, environment, request, and event context for a hosted log drain.
05 / Security
Independent review is an activation gate
The repository includes WAF rules, rate limits, security headers, tenant-isolation tests, a penetration-test scope, and a remediation register. A professional penetration test must be performed by an independent qualified firm against the connected staging environment; Revolution Road does not label that control complete until a signed report is received and all critical/high findings are retested.
Review security controls →06 / Cost plan
Monthly planning bands
Free or entry tiers, no production SLA, nightly exports.
Paid database/frontend, fixed or usage Redis, monitoring, and backup storage.
PITR, replica, multi-zone cache, business WAF, managed container capacity, and alerting.
Planning bands exclude tax, email/SMS usage, staff time, and the independent penetration test. Current provider references: Supabase pricing, Supabase PITR, Upstash Redis, Cloud Run, Backblaze B2, and Cloudflare WAF. Recalculate before purchase.