Architecture overview

Every service in the fleet follows one rule: it must be explainable on a whiteboard in ninety seconds. If the diagram needs an apology, the design is not done. This page is the ninety-second version, written down.

The shape of the system

Traffic enters through a single reverse proxy that terminates TLS and applies the fleet-wide middleware stack: security headers, rate limits, and auth gates. Behind it, each product runs as an isolated compose stack with its own database. Nothing shares a datastore, so the blast radius of any failure is exactly one product.

The data plane

Databases run with row-level security enabled from the first migration. The application role cannot read across tenants even if a WHERE clause is forgotten; isolation is the database's job, not the code reviewer's.

-- tenant isolation, enforced by Postgres itself
CREATE POLICY tenant_isolation ON documents
  USING (tenant_id = current_setting('app.tenant')::uuid);

Failure domains

Each product's blast radius is itself. A crash auto-restarts in seconds; a database issue touches one product's data and restores from a nightly snapshot; only the shared proxy can take the whole fleet down, so every change to it is rehearsed on staging first.

Where AI agents fit

Agents write migrations, tests and doc drafts. They do not hold production credentials and cannot merge. Every agent-written line passes the same review gate as a human's, and the incident runbook applies to agent-caused incidents identically.