FAST & FLOW Software01<br>Measured checkpoints
92h reported compressed engineering sprint<br>91,344 tracked repository text lines — not pure production LOC<br>50 canonical forward-only PostgreSQL migrations at Release 1.5<br>527 / 527 automated tests passing at the sealed Production Readiness checkpoint<br>244.5 ms p95 in the controlled pilot capacity baseline<br>100 / 100 requests passed at concurrency 10, with 0 failures
These figures belong to independently verifiable engineering checkpoints and are not presented as if every number originated from the exact same Git SHA.
02<br>Stack and architectural choices
Principal stack<br>TypeScript<br>Node.js 24<br>React 19<br>TanStack React Start + Router<br>Vite<br>Supabase<br>PostgreSQL 17<br>Native CSS<br>GitHub Actions
Deliberate constraints<br>No application ORM. Persistence uses Supabase clients, explicit SQL migrations, and narrow PostgreSQL RPCs.<br>No Tailwind as the canonical styling layer. The product design system uses native CSS custom properties and semantic React primitives.<br>These are project-specific architectural choices, not universal recommendations.
03<br>Multi-tenant trust chain
Platform<br>→ Organization<br>→ Location<br>→ Project<br>→ Product / Module DataOrganization is the primary tenant and security boundary. Location and Project are subordinate scopes.<br>Supabase Auth<br>→ Application User<br>→ Membership<br>→ Organization<br>→ Trusted Tenant Context<br>→ Permission Engine<br>→ Server Operation<br>→ PostgreSQL / RPC<br>→ Row Level SecurityAuthentication ≠ authorizationMembership ≠ permissionServer authorization ≠ RLSRLS ≠ server authorization<br>Browser-supplied tenant identifiers express intent, not authority. The server independently resolves current identity, membership, tenant context, and permissions before consequential operations.
04<br>How the AI context limit was handled
AI context = disposable working memory. Git + immutable SQL migrations + tests + contracts + hosted database state = durable engineering memory.<br>The process did not depend on a model remembering migration 1 while implementing migration 40. Earlier engineering decisions were externalized into canonical repository artifacts: immutable migration history, architecture contracts, exact SHAs, CI gates, tests, role and permission registries, schema fingerprints, and hosted verification evidence.<br>Before extending a domain, the relevant state was reconstructed from those artifacts. The model was not the system of record; the engineering system was.
05<br>RLS and cross-tenant isolation
RLS validation went beyond checking that policies existed in SQL files. Hosted Supabase environments were exercised with independent tenant fixtures.<br>User A → Organization A → ALLOW<br>User A → Organization B → DENY / no unauthorized rows
User B → Organization B → ALLOW<br>User B → Organization A → DENY / no unauthorized rowsAdditional adversarial controls included:<br>anonymous denial<br>forged Organization IDs<br>forged Membership IDs<br>forged Auth metadata<br>inactive Memberships<br>inactive Organizations<br>revoked authority<br>direct Product-table writes<br>cross-environment JWT rejection<br>logout invalidation<br>A global Super Admin fixture can legitimately see across tenants and therefore mask isolation failures. Synthetic platform authority was prevented from contaminating tenant-local negative controls.
06<br>Atomic security mutations + audit
validate current actor<br>→ validate tenant<br>→ validate role-assignment authority<br>→ INSERT role assignment<br>→ append RoleAssigned audit event<br>→ COMMITPrivileged mutation and required audit append execute in the same PostgreSQL transaction. If the audit append fails, PostgreSQL rolls back the mutation. Audit history is append-oriented; direct historical UPDATE and DELETE are rejected.
07<br>What 91,344 tracked lines actually means
91,344 tracked lines does not mean 91,344 lines of hand-written production application code.<br>Repository surfaceApprox. linesApprox. sharePostgreSQL migrations + SQL verification~30,00032.8%Server/backend TypeScript~12,50013.7%React/TSX/CSS/i18n frontend~10,50011.5%Automated tests + hosted verification scripts~16,50018.1%CI/tooling/configuration~5,5006.0%Engineering docs/metadata/lockfiles~16,34417.9%Total tracked text 91,344 100%<br>The category breakdown is an analytical estimate, not a cloc-certified set of subcounts.
08<br>50 forward-only PostgreSQL migrations
At the Release 1.5 checkpoint, the canonical repository-controlled chain contained exactly 50 migrations. Historical migrations are immutable; corrections are forward-only.<br>Migration governance checks deterministic filenames, UTC timestamps, strict chronological ordering, expected authorization of the migration set, and historical immutability. Existing migrations cannot be modified, deleted, or renamed as a shortcut for rollback.
09<br>527 / 527 automated tests
The main repository suite uses the native Node.js test runner:<br>node --testAt the sealed Production Readiness checkpoint: 527 tests, 527 passed, 0 failed. Coverage included domain contracts, lifecycle transitions, authorization boundaries,...