Current synthesis from the research packet. Exact records and complete source artifacts remain visible below.
Run a workload-driven data-plane bake-off across owned Postgres, donor API, event read model and local state.
[private local source withheld]research/packs/source-files/reusable-block-framework-report.mdresearch/actionmodel-builder-research-2026-08-26/phase-2/outputs/block-contract-v1.mdThis is where their architecture is most exposed: the browser talks near-directly to Postgres and the row-level-security policies protecting it are written by the model, with no dev/prod separation. When the platform owns schema, migrations and policies, that whole failure class is removed rather than mitigated.
35 mined records. Search and inspect the full agent output; nothing is collapsed into a top-ten headline.
| Rank | Identity | What the agent found | Evidence | Source |
|---|---|---|---|---|
| — | Neonmanaged-postgres | Neon documents three tenancy patterns (database-per-user, schema-per-user, shared schema) and explicitly recommends project-per-tenant: 'We recommend setting up one project per user, rather than, for example, using a branch per customer.' Projects provision in milliseconds and idle ones are 'virtually free' via scale-to-zero. TOP10: this is the only Postgres surface where per-tenant physical isolation is economically free at rest, which is exactly the shape a host needs when absorbing donor systems that each want their own database. | observedtop10 | Source ↗ |
| — | Cloudflare D1embedded-edge-sql | D1 allows 50,000 databases per account on Workers Paid (10 free), with a footnote that paid plans can request 'millions to tens-of-millions of databases (or more) per account'. Docs state D1 'is designed for horizontal scale out across multiple, smaller (10 GB) databases, such as per-user, per-tenant or per-entity databases' at no extra cost since billing is queries+storage only. TOP10: proves database-per-tenant at a cardinality no Postgres surface matches, and prices tenancy at zero. | observedtop10 | Source ↗ |
| — | Cloudflare Durable Objectsembedded-edge-actor | Each SQLite-backed Durable Object is a uniquely addressable actor bundling compute with its own private embedded SQLite DB, giving a single-threaded serialization point per entity without external locking. Idle objects are evicted and 'Inactive objects receiving no requests do not incur any duration charges'; an empty DB costs ~12 KB. TOP10: this is the cleanest commercial precedent for per-tenant state that is also a per-tenant compute/coordination boundary, which a federating host needs for donor-app session and lock state. | observedtop10 | Source ↗ |
| — | Tursoembedded-edge-sql | Turso prices for the many-database pattern: 100 databases on Free and 'Unlimited' on Developer ($4.99/mo), Scaler ($24.92/mo) and Pro ($416.58/mo), metering row reads (500M free to 250B on Pro) and row writes (10M free to 250M on Pro) rather than database count. Its Partner Program references companies 'helping companies adopt the many-database architecture'. | observedregister | Source ↗ |
| — | Supabasemanaged-postgres-baas | Supabase is the reference implementation of RLS-based tenancy: shared tables with a tenant_id column and Postgres row-level security policies, with the client automatically attaching the authenticated user's JWT so policies enforce isolation below the application layer. Prevailing guidance is shared-DB+RLS as default, reserving DB-per-tenant for compliance-bound enterprise tenants. TOP10: establishes the baseline the host must beat or adopt, and shows tenancy enforced in the database rather than in app code. | observedtop10 | Source ↗ |
| — | Supabase (OSS core licence)licence-check | Read the LICENSE body directly rather than trusting a badge: supabase/supabase is Apache-2.0 on the master branch (the main branch returns 404), and the supabase/postgres image carries The PostgreSQL License. This is a genuinely permissive core, unlike several sync/streaming peers surveyed here. | observedregister | Source ↗ |
| — | Convexsync-reactive-backend | Convex is a reactive document database where queries are subscriptions. Critically, the LICENSE body is 'Functional Source License, Version 1.1, Apache 2.0 Future License' (FSL-1.1-Apache-2.0), NOT an OSI licence: any 'Competing Use' making the software available in a product that substitutes for Convex is prohibited, converting to Apache-2.0 later. TOP10: a host foundation that resold a Convex-derived backend would be a textbook Competing Use, so this is a licence landmine to name explicitly. | observedtop10 | Source ↗ |
| — | Convex (commercial tiers)sync-reactive-backend | Convex prices per developer seat plus resources: Free/Starter at $0, Professional at $25 per developer/month, Business & Enterprise at a $2,500 monthly minimum. Included resources on Free/Pro: 1M/25M function calls, 0.5/50 GB database storage, 1/100 GB file storage, 1/50 GB egress. | observedregister | Source ↗ |
| — | ElectricSQLsync-local-first | Electric syncs 'Shapes' (filtered table views fetched over plain HTTP via GET /v1/shape) and deliberately does NOT enforce row-level security itself: 'you don't have to codify your auth logic into a database rule system.' Tenancy is enforced by a proxy or gatekeeper that sets the table and WHERE clause server-side, and client-supplied subset queries are AND-ed so they 'can only narrow results, never widen them.' TOP10: this is the strongest architectural precedent for a host that must federate donor stores it does not control, since authorization lives above the database rather than inside each donor's schema. | observedtop10 | Source ↗ |
| — | ElectricSQL (licence)licence-check | electric-sql/electric is Apache-2.0 (SPDX confirmed via GitHub API, ~10.3k stars), making it one of only two genuinely permissive sync engines in this survey and the safest to embed in a commercial host foundation. | observedregister | Source ↗ |
| — | PowerSyncsync-local-first | PowerSync syncs a server subset into a full local SQLite, giving genuine offline support, with writes uploaded through your own API. Its server LICENSE body is 'Functional Source License, Version 1.1, ALv2 Future License' (FSL-1.1-ALv2): source-available, not OSI, barring Competing Use, converting to Apache-2.0 two years after release. Client SDKs are Apache-2.0/MIT. | observedregister | Source ↗ |
| — | Zero (Rocicorp)sync-local-first | Zero (rocicorp/mono, Apache-2.0 confirmed via SPDX, ~3.4k stars, tagline '99% of Queries in Zero Milliseconds') is a server-authoritative bidirectional sync engine: the server accepts or rejects each mutation, which is the correct trust posture for a host that cannot let donor clients write authoritatively. | observedregister | Source ↗ |
| — | Cloudflare R2object-storage | R2 is S3-compatible with 'no charges for egress bandwidth for any storage class', billing only storage plus Class A (mutating, up to $9.00/million) and Class B (reading, $0.36-$0.90/million) operations, with Infrequent Access adding $0.01/GB retrieval. Register rationale: for a host federating donor systems, egress is the tax that scales with the number of systems you bridge, and R2 removes it outright. | observedregister | Source ↗ |
| — | Cloudflare R2 (migration path)object-storage | R2 supports progressive migration by sitting in front of a legacy S3 bucket and copying objects on demand as requested, avoiding a large upfront migration. This is directly analogous to the strangler pattern a host needs when absorbing a donor system's existing file store. | observedregister | Source ↗ |
| — | AWS Auroramanaged-postgres | Aurora Serverless v2 bills per second in 0.5 ACU increments and lists 'Starting capacity: 0 ACU' (scale to zero), at roughly $0.12/ACU-hour Standard or $0.156 I/O-Optimized. Aurora Limitless Database (PostgreSQL only) distributes writes across multiple writer instances while preserving a single-database experience. | observedregister | Source ↗ |
| — | PlanetScalemanaged-postgres-mysql | PlanetScale removed its free Hobby tier in April 2024 and has not restored it; entry is a $5/month PS-5 single-node Postgres cluster, HA is ~3x single-node, and Vitess MySQL starts at $39/month for 3-node HA. Sharded keyspaces are creatable on any plan; Postgres sharding is not Vitess but a separate project (Neki). | observedregister | Source ↗ |
| — | MongoDB Atlasdocument | Atlas has no hard collection cap but recommends maxima counting collections AND indexes together: 5,000 (M10), 10,000 (M20/M30), 100,000 (M40+); exceeding them slows checkpoints and can stall operations. TOP10: this is the clearest quantified proof that collection-per-tenant and database-per-tenant have a hard economic ceiling in the document world, forcing shared-collection tenant discriminators at scale. | observedtop10 | Source ↗ |
| — | Google Firestoredocument | Firestore enforces a hard 'Maximum number of databases per project: 100' (increase only via support request), and CMEK databases default to a quota of 0 behind an allowlist. This makes database-per-tenant structurally unavailable on Firestore, pushing all tenancy into collection paths plus Security Rules. | observedregister | Source ↗ |
| — | Faunadocument | LIVE NEGATIVE FINDING: Fauna is dead. The service ended 30 May 2025 at 12:00 Pacific, after which all accounts and associated data were permanently deleted; the company cited an inability to raise the capital needed to run a global operational database. Reported impact: 195+ databases and 3,000+ development teams. Any Actionist design doc listing Fauna as a candidate is out of date. | observedrejected | Source ↗ |
| — | ClickHouse Cloudanalytics | ClickHouse Cloud is usage-based with compute and storage scaled independently and explicitly 'automatically scale unused resources down to zero so that you don't pay for idle services', plus configurable autoscaling limits to cap runaway query spend. The OSS engine is Apache-2.0 (confirmed via GitHub SPDX, ~49.5k stars). | observedregister | Source ↗ |
| — | Tinybirdanalytics | Tinybird is managed ClickHouse that turns SQL into REST endpoints, priced Free / Developer ($49-mo, page also shows 'Starting at $25/month') / SaaS / Enterprise, with vCPU overage at $0.0002/second and storage at $0.058/GB. JWT support on all paid tiers is the mechanism for per-tenant API scoping. Register rationale: it is the clearest commercial pattern for handing an analytics slice to a tenant's browser without exposing the warehouse, which a host needs when donor apps must show their owners metrics. | observedregister | Source ↗ |
| — | MotherDuckanalytics | MotherDuck prices internal users, not end users: 'unlimited end users' on all plans with only internal users metered, Business at $250/org/month plus usage (storage $0.04/GB/mo, compute $0.60-$24/hr by instance class). It markets 'Hypertenancy', giving each internal or end user an isolated compute instance, plus up to 16 read-scaling replicas. | observedregister | Source ↗ |
| — | Confluent Cloudevents-streaming | Confluent bills elastic CKUs plus networking and storage: Basic (first eCKU free, then $0.14/hr, $0.05/GB, 5 TB cap), Standard ($0.75/hr, ~$385/mo start), Enterprise ($1.75-2.25/hr, ~$895/mo), Freight ($2.25/hr min 2 eCKUs, ~$2,300/mo). There is no per-partition charge, only partition limits (1,500 Basic to 96,000 Enterprise). | observedregister | Source ↗ |
| — | Redpandaevents-streaming | Redpanda is Kafka-API compatible but its LICENSE body is Business Source License 1.1 with an Additional Use Grant that bars using it for a 'Streaming or Queuing Service' -- explicitly including any commercial offering letting third parties cause topic creation, and naming infrastructure/hosting providers. Change Date is four years from release. TOP10: a host foundation that let tenants create topics could fall inside this carve-out, making it a direct legal constraint on a multi-tenant event plane. | observedtop10 | Source ↗ |
| — | NATS / Synadiaevents-streaming | nats-io/nats-server is Apache-2.0 (SPDX confirmed, ~20.6k stars), 'the cloud and edge native messaging system'. Unlike Redpanda's BSL, a permissive licence imposes no carve-out on offering messaging to third parties, making it the licence-safe choice for a host that must let donor systems publish and subscribe. | observedregister | Source ↗ |
| — | Elastic / Elasticsearchsearch | Read the body, not the badge: Elasticsearch is triple-licensed under 'GNU Affero General Public License v3.0 only', 'the Server Side Public License, v 1', and 'the Elastic License 2.0', with code licensed SOLELY under ELv2 found in the x-pack folder. GitHub's API returns no licence field at all for this repo. TOP10: the ELv2-only x-pack carve-out is precisely the hosting-clause trap this project has already been burned by, and it sits inside the most commonly assumed-safe search dependency. | observedtop10 | Source ↗ |
| — | Algoliasearch | Algolia documents tenancy WITHOUT per-tenant indices: 'This doesn't mean you need one index per user.' Records carry a filterable access attribute (e.g. visible_by), and the backend mints a secured API key with an embedded filter that 'users can't alter', so a browser-side key is cryptographically constrained to one tenant's rows. TOP10: the strongest commercial precedent for pushing a tenant-scoped credential to an untrusted client, which is exactly what a host must do for donor-app frontends it does not control. | observedtop10 | Source ↗ |
| — | Algolia (commercial tiers)search | Algolia meters search requests and records: Free (10K searches, 50K records), Grow ($0.50 per additional 1K searches, $0.40 per 1K records), Grow Plus ($1.75 per 1K searches), Elevate (annual, custom). A search request counts once per exchange even across multiple indices, and Algolia ignores the 3 highest-record days each month. | observedregister | Source ↗ |
| — | Typesensesearch | Typesense is GPL-3.0 (SPDX confirmed and corroborated by the LICENSE.txt body reading 'GNU GENERAL PUBLIC LICENSE', ~26.5k stars), self-describing as an 'Open Source alternative to Algolia + Pinecone'. GPL-3.0 is a genuine OSI licence with no hosting carve-out, but its copyleft reach is a different question from ELv2/BSL commercial restrictions. | observedregister | Source ↗ |
| — | Pineconevector | Pinecone's namespace is the tenancy primitive, with documented per-index limits of 100 (Starter), 1,000 (Builder) and 100,000 (Standard and Enterprise), making namespace-per-tenant viable at scale. Pricing is serverless/usage-based: $0.33/GB/mo storage, ~$4-4.50 per million write units and ~$16-18 per million read units on Standard, with $50 (Standard) and $500 (Enterprise) monthly minimums. | observedregister | Source ↗ |
| — | Temporal Cloudworkflow-state | Temporal Cloud makes durable workflow state a metered product: Actions billed at $50/million falling to $25/million at volume, active storage $0.042/GBh and retained storage $0.00105/GBh, with plans from Essentials $100/mo to Enterprise, paying 'the greater of your monthly plan or 5%-10% of usage'. Namespaces default to On-Demand at 500 APS, autoscaling on 7-day usage. The OSS server is MIT (SPDX confirmed, ~22.6k stars). | observedregister | Source ↗ |
| — | Inngestworkflow-state | Inngest ('The leading workflow orchestration platform', ~5.8k stars) carries a LICENSE body of 'Server Side Public License, Version 1.0' with an Apache 2.0 Future License. SSPL is the strongest copyleft-for-service licence in this survey: offering the functionality as a service triggers obligations over the entire service stack. | observedregister | Source ↗ |
| — | Liveblockssync-collaborative | Liveblocks prices the room as the collaborative-state unit: unlimited monthly active users AND unlimited monthly active rooms on every tier, metering instead on simultaneous connections per room (10/10/50/100), realtime collaboration minutes ($0.002/minute beyond 3,000), and realtime data stored per room (10 MB Free/Pro, 50 MB Team). Yjs is included on all tiers alongside Liveblocks Storage. Plans: Free, Pro $25/mo, Team $500/mo (annual). | observedregister | Source ↗ |
| — | Y-Sweet (Jamsocket)sync-collaborative | y-sweet is MIT-licensed (verified by reading the LICENSE body, which returns 'MIT License'), providing a self-hostable Yjs CRDT server with S3-compatible persistence. It is the licence-safe alternative to Liveblocks for collaborative state, with no Competing Use or hosting carve-out. | observedregister | Source ↗ |
| — | Crunchy Data / Crunchy Bridgemanaged-postgres | Crunchy Bridge is a managed Postgres offering positioned for enterprises wanting standard Postgres without proprietary extensions, which for a host means donor databases can be lifted in and out without a vendor-specific dialect. Marked INFERRED: the pricing page fetch was blocked by a rate limit and no page was read in this run. | inferredrejected | Source ↗ |
41 mined records. Search and inspect the full agent output; nothing is collapsed into a top-ten headline.
| Rank | Identity | What the agent found | Evidence | Source |
|---|---|---|---|---|
| — | PostgreSQLpostgres-core | Owns the Actionist-side system of record: tenant registry, app manifests, install/grant state, run history, audit log. Every other component in this plane is a satellite of this one. | observedtop10 | Source ↗ |
| — | pgvectorpostgres-extension | Owns embedding storage and similarity search for donor-app capability matching and semantic retrieval over Actionist-owned state, inside the same Postgres as relational state — no second datastore to make consistent. | observedregister | Source ↗ |
| — | pg_partmanpostgres-extension | Owns time-based partition lifecycle for the high-churn tables in the plane: run history, event log, audit trail. Turns unbounded append tables into a retention policy. | observedregister | Source ↗ |
| — | Cituspostgres-scale-out | Would own horizontal sharding of tenant data by distribution column if Actionist outgrew a single Postgres writer. | observedrejected | Source ↗ |
| — | TimescaleDBpostgres-extension | Would own time-series compression and continuous aggregates over run/telemetry history. | observedrejected | Source ↗ |
| — | Drizzle ORMorm-migration | Owns the typed schema definition and query layer for Actionist-owned Postgres, and is the natural place to encode the tenant-scoping convention so RLS is enforced in types as well as in the database. | observedtop10 | Source ↗ |
| — | Prismaorm-migration | Alternative schema/migration owner with the largest ecosystem (47.5k stars, push 2026-08-27). | observedregister | Source ↗ |
| — | Kyselyorm-migration | Owns type-safe SQL construction where the host needs to emit dynamic queries against donor-app-shaped schemas that are not known at Actionist compile time. | observedregister | Source ↗ |
| — | Atlasorm-migration | Owns declarative schema-as-code migration and, critically, drift detection: the mechanism that answers whether a donor app's native store still matches the contract Actionist believes it has. | observedtop10 | Source ↗ |
| — | sqlcorm-migration | Generates typed accessors from hand-written SQL; would own the query layer if the host prefers SQL-first over ORM-first. | observedregister | Source ↗ |
| — | Flywayorm-migration | Versioned SQL migration runner, JVM-hosted, for donor apps that already standardize on it. | observedregister | Source ↗ |
| — | Liquibaseorm-migration | Would own XML/YAML-described migrations across heterogeneous donor databases. | observedrejected | Source ↗ |
| — | Debeziumcdc-events | Owns change data capture from donor-app-owned native stores into the Actionist event plane, reading the Postgres WAL so donor apps need no write-path modification — the key property for federating stores Actionist does not control. | observedregister | Source ↗ |
| — | Sequincdc-events | Postgres-native CDC to streams/queues with far less operational weight than Debezium; would own change capture if the host wants WAL streaming without a JVM. | observedregister | Source ↗ |
| — | NATS / JetStreamcdc-events | Owns the message and event transport between host control plane and per-tenant runtimes, with JetStream supplying persistence and replay. Subject hierarchies map cleanly onto tenant/app isolation. | observedtop10 | Source ↗ |
| — | Redpandacdc-events | Would own a Kafka-API-compatible event log without JVM/ZooKeeper. | observedrejected | Source ↗ |
| — | ElectricSQLread-model-sync | Owns partial replication of Postgres state to clients as shapes: the read-model seam that lets donor-app UIs read Actionist-owned state without each one implementing its own polling and cache invalidation. | observedtop10 | Source ↗ |
| — | PowerSync Serviceread-model-sync | Would own bidirectional offline-first sync between Postgres and embedded client SQLite. | observedrejected | Source ↗ |
| — | Zero (Rocicorp)read-model-sync | Owns query-driven sync with client-side caching and optimistic mutation — the most complete answer to 'donor app UI reads and writes Actionist state and stays live' in one mechanism. | observedregister | Source ↗ |
| — | RisingWaveread-model-sync | Owns streaming materialized views over CDC input, maintaining derived cross-tenant read models (usage rollups, capability indexes) incrementally instead of by batch recompute. | observedregister | Source ↗ |
| — | Materializeread-model-sync | Would own incrementally-maintained SQL materialized views over streams. | observedrejected | Source ↗ |
| — | SQLiteembedded | Owns per-tenant or per-run embedded state inside sandboxed runtimes where a network round-trip to central Postgres is the wrong shape. | observedregister | Source ↗ |
| — | libSQLembedded | Owns per-tenant embedded databases that also need a server protocol and replication — the database-per-tenant model without a Postgres schema explosion. | observedregister | Source ↗ |
| — | DuckDBembedded | Owns in-process analytical queries over exported tenant state — usage reporting and cross-app analysis without an OLAP cluster or moving data to a warehouse. | observedregister | Source ↗ |
| — | Meilisearchsearch | Would own capability/app catalog search with typo tolerance. | observedregister | Source ↗ |
| — | Typesensesearch | Would own the searchable capability catalog. | observedregister | Source ↗ |
| — | OpenSearchsearch | Owns full-text search and log/audit analytics at scale; the Apache-2.0 escape hatch from Elasticsearch's SSPL/ELv2 relicensing. | observedregister | Source ↗ |
| — | MinIOfiles | Would own S3-compatible storage for tenant artifacts and build outputs. | observedrejected | Source ↗ |
| — | SeaweedFSfiles | Owns S3-compatible blob storage for tenant artifacts, build outputs, and uploads — the Apache-2.0 replacement for MinIO now that MinIO is both AGPL and archived. | observedtop10 | Source ↗ |
| — | Garagefiles | Would own geo-distributed S3 storage for small self-hosted deployments. | observedrejected | Source ↗ |
| — | Temporalqueues-workflow | Owns durable execution for long-running multi-step operations — app installs, migrations, connector syncs — where a crash mid-sequence must resume rather than restart or corrupt state. | observedtop10 | Source ↗ |
| — | Inngestqueues-workflow | Would own event-driven durable step functions with a far lighter developer surface than Temporal. | observedrejected | Source ↗ |
| — | Riverqueues-workflow | Owns transactional background job execution in Go with jobs enqueued in the same Postgres transaction as the state change that caused them — removing the enqueue-vs-commit race entirely. | observedregister | Source ↗ |
| — | pg-bossqueues-workflow | Owns Node/TypeScript background jobs on Postgres with no additional infrastructure — the lowest-cost credible queue for a TS host that already runs Postgres. | observedtop10 | Source ↗ |
| — | graphile-workerqueues-workflow | Postgres-backed job queue for Node with LISTEN/NOTIFY-driven low latency; can run jobs triggered directly by database triggers. | observedregister | Source ↗ |
| — | pgmqqueues-workflow | Owns SQS-style message queue semantics as a pure Postgres extension, usable from any language rather than only Node or Go — relevant when donor-app runtimes are polyglot. | observedregister | Source ↗ |
| — | Tenancy for Laravelmulti-tenancy | The single most-adopted general multi-tenancy framework found (4.4k stars, push 2026-08-27): automatic tenant identification, per-tenant database switching, and tenant-scoped cache/filesystem. | observedregister | Source ↗ |
| — | django-multitenantmulti-tenancy | Enforces tenant scoping at the ORM layer so every query carries a tenant predicate automatically — the pattern Actionist needs, demonstrated in Python. | observedregister | Source ↗ |
| — | PostgRESTapi-over-postgres | Turns the Actionist Postgres schema into a REST API where RLS policies are the authorization layer, so tenant isolation is enforced by the database for both internal and donor-app read paths rather than reimplemented per service. | observedtop10 | Source ↗ |
| — | Hasura GraphQL Engine (v2)api-over-postgres | Would own an auto-generated GraphQL API with declarative row-level permissions over Actionist state. | observedregister | Source ↗ |
| — | Supabase (meta-repo)api-over-postgres | Supplies unbundled Postgres-native components the host can adopt individually — auth, realtime WebSocket fan-out of Postgres changes, S3-backed storage with Postgres metadata — rather than adopting the platform wholesale. | observedtop10 | Source ↗ |
27 mined records. Search and inspect the full agent output; nothing is collapsed into a top-ten headline.
| Rank | Identity | What the agent found | Evidence | Source |
|---|---|---|---|---|
| 1 | Two-kind adapter model driven by authorization reachability— | Classify every donor store on one axis: can the host reach its authorization layer? Yes gets in-database RLS; no gets host-proxy-enforced shapes where client subsets may only narrow, never widen. Two adapter kinds, not N per donor. | inferredtop10 | — |
| 2 | Tenant context as a typed wrapper that cannot emit an unscoped query— | Build the missing multi-tenancy library in the type system, since none exists for a TypeScript host: a query builder where omitting the tenant predicate is a compile error rather than a review finding. | inferredtop10 | — |
| 3 | Licence-body CI gate reading LICENSE text, not API SPDX fields— | Fail the build on FSL/BSL/SSPL/ELv2/AGPL entering the dependency tree, reading the licence body rather than the badge. This run produced 12+ corrections; five surfaces would have passed an automated SPDX scan silently. | observedtop10 | — |
| 4 | Shape contract as the donor read agreement— | Give every donor system a versioned, reviewable declaration of the tables, columns and WHERE clause the host may read. It becomes the audit artifact for what the host actually consumes from an absorbed app. | inferredtop10 | — |
| 5 | Continuous drift detection against donor-owned stores— | Run schema diffing continuously against donor stores so 'the donor changed its schema under us' becomes a monitored, alertable event rather than a production outage. | inferredtop10 | — |
| 6 | Transactional outbox as the federation event substrate— | Enqueue the event in the same transaction as the state change, eliminating the enqueue-vs-commit race across every federation boundary. Pairs with a consumer-side idempotency gate for effectively-once. | inferredtop10 | — |
| 7 | Cost-at-rest as the tenancy selection rule— | Place low-activity tenants on a scale-to-zero substrate and promote to shared-RLS only when activity justifies always-on compute. The dividing line between tenancy models is cost at rest, not capability. | inferredtop10 | — |
| 8 | Owned versus federated state distinguished in the type system— | Make a query that joins across the ownership boundary fail at compile time rather than silently read a donor's stale replica. | inferredtop10 | — |
| 9 | Shadow-read verification to quantify federation drift— | Serve from Actionist state while comparing against the donor's native store, measuring divergence before the read model is trusted for a client-visible workflow. | inferredtop10 | — |
| 10 | Exit plan required wherever a vendor owns the state machine— | Sync and workflow are the classes where the vendor owns your state machine rather than your bytes. Any adoption there requires a documented exit path on day one. | observedtop10 | — |
| 11 | Narrowing-only filter composition— | Client filters are AND-ed with the host filter, never OR-ed, eliminating a whole class of cross-tenant widening bugs. | inferredregister | — |
| 12 | Host-issued tenant-scoped capability token as the federation primitive— | One signed, unalterable, filter-bearing credential every donor adapter must honour. | inferredregister | — |
| 13 | Per-tenant coordination actor— | One single-threaded actor per tenant for locks, sequencing and in-flight donor sync state, avoiding a distributed lock service entirely. | inferredregister | — |
| 14 | RLS as the single authorization source binding every access path— | Host service and any API layer are both subject to the same policies, so isolation cannot be bypassed by adding a service. | inferredregister | — |
| 15 | Licence carve-outs encoded as testable policy rules— | Redpanda's 'third parties cause topic creation' and Elastic's 'x-pack only' are testable conditions against a planned architecture, not prose to remember. | inferredregister | — |
| 16 | One retrieval plane rather than separate search and vector planes— | Search and vector have converged commercially; build one plane with a tenancy filter, chosen for licence safety. | inferredregister | — |
| 17 | Meter tenants on the dimension the substrate meters— | Price on rows read/written where the substrate does, so host pricing cannot invert against supplier cost; budget egress as a federation tax since bridging N donors multiplies data movement. | inferredregister | — |
| 18 | Deliberate per-tenant storage ceiling— | Set a hard ceiling so sharding is an early design decision rather than a late migration. | inferredregister | — |
| 19 | Conflict strategy chosen per data class— | Last-write-wins only where truthful; server-authoritative mutations or CRDTs where edits genuinely conflict. | inferredregister | — |
| 20 | Per-tenant embedded databases for hot runtime state— | libSQL per tenant for hot state with Postgres as durable registry: database-per-tenant without a schema explosion. | inferredregister | — |
| 21 | Retention enforced by the database, not a cron script— | Partition-managed audit retention with the policy encoded as tenant configuration, so retention promises are structurally enforced. | inferredregister | — |
| 22 | Durable workflow per capability install— | A partially-completed install becomes a resumable object rather than manual cleanup. | inferredregister | — |
| 23 | Event-plane tenant boundary mirroring the state-plane boundary— | Subject hierarchy as the event tenant boundary so both planes share one mental model. | inferredregister | — |
| 24 | Prefer permissive cores at every load-bearing layer— | Electric over PowerSync for sync, NATS over Redpanda for events, y-sweet over Liveblocks for collaborative state, SeaweedFS for object storage. | observedregister | — |
| 25 | Cross-donor operations as compensating workflows— | Model durable cross-donor operations with explicit compensation rather than distributed transactions. | inferredregister | — |
| 26 | Capability catalogue as embeddings plus relational filters in one query— | pgvector alongside relational predicates avoids a separate search service and its licence problems. | inferredregister | — |
| 27 | Deferred substrate options— | DuckDB over exported Parquet for per-tenant usage reporting with no warehouse; pgmq for polyglot donor runtimes; Supabase Realtime as component-level change fan-out; RisingWave materialized views if batch recompute becomes the bottleneck. | inferredregister | — |
11 mined records. Search and inspect the full agent output; nothing is collapsed into a top-ten headline.
| Rank | Identity | What the agent found | Evidence | Source |
|---|---|---|---|---|
| — | P09-S-001local-decision-record | SQLite-vs-Postgres is decided by donor-fork cost not writer concurrency ('the cost is the fork, not the database'); one Postgres server with separate schemas per donor chosen over shared-schema (migration coupling) and per-donor servers (ops burden); cross-schema joins explicitly traded away and answered by consuming donor events into owned tables; Convex rejected as hosted proprietary. | observedload-bearing | [private local source withheld] |
| — | P09-S-002local-decision-record | Supersedes federation: absorb donors, copy code, repoint data layer at one Postgres, delete donor login. One app, one database, one schema with real foreign keys between brokerage records and document/table records. Explicitly kills Ed25519 launch tokens, external-ref mapping, Svix event projection and six identity adapters for absorbed donors. Names the honest cost: rewriting a data layer per donor (models, queries, migrations, background jobs, file handling). | observedload-bearing | [private local source withheld] |
| — | P09-S-003local-decision-record | Concrete absorption seam questions for a Postgres-native donor: own schema vs merged, who owns migrations per table (one owner never two), auth seam for host-session injection, exact cut line. Observable success criteria include rows surviving a Postgres restart and donor and host tables visible in the same database. | observedload-bearing | [private local source withheld] |
| — | P09-S-004local-research-report | Block dossier data vocabulary (mode none/read_only_external/owned_postgres/api_only, tables_owned/read/write, columns_sensitive, tenant_key, rls_policy, migrations, transaction_policy, idempotency, rollback) plus Postgres boundary primitives: schemas as namespaces with an unsafe-search_path warning, information_schema portability, privilege vs ownership distinction, RLS default-deny with no applicable policy, constraints at the boundary. Drizzle introspection proves a database-first path. | observedvocabulary-source | clients/actionmodel/research/packs/source-files/reusable-block-framework-report.md |
| — | P09-S-005local-architecture | Assigns a platform DB view/schema adapter (introspect allow-listed schema, tenant-scoped views, generated clients never own or migrate platform tables) and a deny-by-default policy engine with no LLM-authored production policy. Generated applications receive a typed tenant-scoped resource interface, never arbitrary DB credentials or migration authority. | observedhypothesis-to-test | clients/actionmodel/architecture/feature-matrix/ARCHITECTURE.md |
| — | P09-S-006local-synthesis | A08 Postgres-as-default-for-new-owned-transactional is inferred; A09 every-block-uses-Postgres rejected; A10 one-ORM-in-the-contract rejected; A11 one-owner-per-table-and-migration observed/principle; A12 events/read-models over shared-table mutation inferred. | observedgoverning | clients/actionmodel/knowledge/02-ASSUMPTION-LEDGER.md |
| — | P09-S-007local-research-report | ML6 architectural critique: browser talks near-directly to Postgres via PostgREST with LLM-authored RLS policies, a known data-leak class, no dev/prod separation. Scoped case removes this because the platform owns schema and policies. | observedsupporting | clients/actionmodel/research/lovable-teardown-2026-08-26.md |
| — | P09-S-008local-synthesis | Loop 2 defines the data-plane bake-off across owned Postgres via typed ports, donor-native service API, event-fed read model and SQLite/libSQL, measuring adaptation hours, expressiveness, tenancy clarity, migration ownership, rollback, testability, runtime burden and storage-logic leakage. | observedexperiment-vehicle | clients/actionmodel/knowledge/05-EXPERIMENT-ROADMAP.md |
| — | P09-S-009local-schema | Assembly records require components with work_id, role, responsibilities, depends_on and evidence arrays, plus an operating_loop and capability_model; immutable versioned records with machine validation already exist locally. | observedcompatibility-constraint | [private local source withheld] |
| — | P09-S-010this-run-packet | 35 commercial surfaces surveyed, 10 top10. Five licence-badge traps quantified where the GitHub API would mislead an automated pipeline (Convex FSL, PowerSync FSL, Inngest SSPL, Redpanda BSL reported null, Elasticsearch triple-licence with document-level security inside ELv2-only x-pack). | observedthis-run-evidence | clients/actionmodel/research/workstreams/p09-data-plane/runs/2026-08-27-sprint-1-fable/top-companies.jsonl |
| — | P09-S-011this-run-packet | 41 OSS projects surveyed, 10 top10, 32 licence bodies actually read. Landmines: Citus AGPL-3.0, Liquibase FSL-1.1 (API says 'Other'), Redpanda licence null to the API, Meilisearch now MIT AND BUSL-1.1, MinIO AGPL and archived. Multi-tenancy frameworks for a TypeScript host: effectively none exist — tenant isolation is bespoke work Actionist must own. | observedthis-run-evidence | clients/actionmodel/research/workstreams/p09-data-plane/runs/2026-08-27-sprint-1-fable/top-repos.jsonl |
Source: site/system-map/data/parts.json#P09 · preserved research datasets remain inline below their source-backed synthesis.