Production is live on Cloud Run — with evidence boundaries still explicit.

One platform, two isolation tiers — both demoable

VIP ⇒ database-per-tenant; non-VIP ⇒ shared-table RLS (the "D2" model). Four seeded sites now make both tiers visible: three DATABASE/VIP sites plus tenant-demo on the SCHEMA/non-VIP tier, each rendering identically to the end user.

D2 read path runtime-backed end-to-end

The non-VIP read path is proven on a governed PG15 from primitives → provider → real public MCP read tools → literal HTTP transport, as a genuine non-superuser role, plus a transaction-pool safety proof. A host-capability db-doctor + a one-command provisioning flow make host selection reproducible.

Custom-domain and UAT remain bounded

Cloud Run runtime is live and Cloud SQL RLS is wired; custom-domain browser proof, public-domain /mcp proof, worker, AGE/GraphRAG, multi-region, and UAT are still not claimed.

D2 is the canonical non-VIP model (ADR-RLS-002)

Owner-approved: non-VIP tenancy is shared-table Row-Level Security keyed on the site, enforced by a non-superuser app role. The deprecated schema-per-tenant/search_path code (provider, router, middleware, per-schema rollout) was removed; one model, one rollout (rls-rollout-shared).

Non-VIP SCHEMA tier now exercised by seed

A fourth seeded site tenant-demo (tenancyTier:schema) renders as a public site at /site/tenant-demo and appears in the DR admin "Sites & DR" table with the SCHEMA badge and a Set VIP action (vs Remove VIP for DATABASE sites) — closing the prior "seed only exercises VIP tier" gap.

Host-capability preflight — migrate db-doctor

A read-mostly probe for any candidate Postgres: can it create a non-superuser app role and have FORCE RLS actually confine it, and does it have pgvector + Apache AGE for runtime GraphRAG (advisory)? Turns host selection from a guess into a reproducible check; runtime-backed on a governed PG15.

Turnkey operator flow + pooling safety

A one-command idempotent provision→seed→rollout→verify script (with --dry-run + a documented env contract), a post-deploy /mcp cross-tenant UAT smoke, and a proof that D2 is safe behind a transaction-mode PgBouncer (SET LOCAL is tx-scoped) + default-OFF PgBouncer Helm values.

tenant-demo — SCHEMA tier public site

CMS DR admin — Sites & DR (now 4 sites)

CMS dashboard

Platform public homepage

Showcase site homepage

NAELT volunteer flow

Platform contact flow

CMS page builder

Host preflight — migrate db-doctor

$ migrate db-doctor
✅ privileged-role-can-create-app-role
✅ app-role-is-non-superuser
✅ app-role-non-bypassrls
✅ force-rls-confines-app-role
⚠️  tls          NOT using TLS — set sslmode=require
⚠️  extension:age    NOT available — GraphRAG cannot run here
⚠️  extension:vector NOT available — GraphRAG cannot run here
✅ HOST OK for the D2 shared-table-RLS read path.

Does this prove production readiness?

It proves Cloud Run runtime is live and Cloud SQL shared-table RLS is wired, but it does not prove custom-domain browser behavior, public-domain /mcp cross-tenant isolation, worker runtime, AGE/GraphRAG, multi-region, or UAT sign-off.

What business data is visible?

Backend GraphQL returned 4 seeded sites — platform, naelt, showcase (DATABASE/VIP) and tenant-demo (SCHEMA/non-VIP). The DR admin table renders all four backend-backed; the non-VIP site renders publicly at /site/tenant-demo.

What is the main visual risk?

The non-VIP tier is now exercised, but all four sites set domain none, so the pending-custom-domain Verify affordance and the per-tenant /settings/dr panel are still not seed-exercised; backup/spawn render disabled (unbuilt). CMS captures are hybrid auth with a Next dev "1 Issue" overlay badge.

Is the D2 read path actually wired?

Yes — runtime-backed end-to-end on a governed PG15: primitives → provider → real public MCP read tools → literal HTTP transport, as a non-superuser role, default-off via SCHEMA_TIER_APP_USER. What is NOT done is confirming /mcp over the public custom domain after certificates finish provisioning.

How is auth evidence bounded?

CMS captures used the real CMS runtime plus CMS auth API cookie bootstrap. That is hybrid evidence and must not be described as full browser-login.

What changed since the previous review?

The non-VIP model converged on D2 (ADR-RLS-002) and the deprecated schema-tier code was removed; a non-VIP seed site now exercises the SCHEMA tier visually; and a host-preflight db-doctor + turnkey operator flow + PgBouncer transaction-pool safety shipped.

Resolved this pass

• Non-VIP / SCHEMA tier now visually exercised — seeded tenant-demo on the SCHEMA tier, so the DR admin SCHEMA badge + Set-VIP distinction render with real data and the non-VIP public site loads (closes the top visual gap from 2026-06-15; ISSUE_LOG DR-DEMO-SEED-COVERAGE-001, partial).
• Live D2 read path moved from "SQL-only / pending" to runtime-backed end-to-end (provider → real read tools → HTTP transport, non-superuser role) and wired into /mcp (default-off).
• Host-preflight + operator tooling shipped — db-doctor (incl. pgvector/AGE detection), --dry-run + env contract, post-deploy UAT smoke, PgBouncer transaction-pool safety + Helm.
• Model simplified — D2 is the single canonical non-VIP model (ADR-RLS-002); deprecated schema-tier code removed.
• Seed command fixed — scripts/ops.py db seed corrected to go run ./cmd/migrate (the single-file invocation broke after the migrate package split).

Amazon-style PR note

CMS Platform now demonstrates both tenancy tiers end-to-end: a VIP database-per-tenant site and a non-VIP shared-table-RLS site render identically, while a host-capability preflight and a one-command provisioning flow make standing the non-VIP path up on a new Postgres a reproducible, verifiable operation. The next milestone is not more local proof; it is production-domain closure — certificate-complete browser proof, public-domain /mcp cross-tenant proof, UAT, and later worker/AGE/GraphRAG/multi-region decisions.

1. Custom-domain browser proof + public MCP

After certificates finish, verify www, admin, and api end-to-end, then run the /mcp cross-tenant UAT smoke against the public API URL.

2. Deferred runtime surfaces

Decide and implement worker runtime, AGE/GraphRAG, multi-region/HA, and any remaining production backup/restore drills.

3. UAT sign-off

Run the launch/UAT matrix against production values and keep proof-tier labels separate from local predecessor screenshots.