Live-pivoting a prototype into a multi-tenant SaaS

Multi-tenant RLS via a constrained Postgres role. Prisma 5 connects as ghostpost_app, a role that can only see rows that match the current tenant context, set via set_config('app.org_id', ..., true) at request start. Per-row RLS policies on every tenant-scoped table do the enforcing. No per-query filter in app code – the database refuses to leak. The one place this fails cleanly (admin / cross-org reads from the Stratas side) is a separate ghostpost_admin role used only by internal admin surfaces.

Inline pipeline on Vercel via waitUntil. Trigger.dev was removed in Phase 1C-2c. The generation pipeline now runs attached to the request via @vercel/functions.waitUntil, with withLangfuseFlush + .finally(flushLangfuse) ensuring Langfuse traces survive the lambda freeze that happens the moment the HTTP response is sent. Simpler, cheaper, and the right fit for request-scoped work.

Multi-provider LLM router under src/lib/llm/. Anthropic Claude Sonnet 4.6 primary, OpenAI fallback, picked per tier (e.g. tier: "drafting"). Perplexity Sonar-Pro for research-grounded prompts. The router carries model name and token counts through to Langfuse so per-provider cost is attributable.

Alternatives considered and rejected:

• Tenant-filter in app code. The trust surface is "every developer writing every query, forever". One missing clause leaks the whole org. The database-side version is the one you can rely on.
• Fork the single-user version into a multi-tenant branch. Rejected because the pivot's whole point was to be honest about the direction change in the repo history. GHOSTPOST_PIVOT_BUILD_PLAN.md is dated 2026-10-01 and sits beside the Phase 1–3 PR arc for anyone – buyer, partner, or the team later – to read.
• Keep Trigger.dev "just in case". Rejected because unused infrastructure is still a bill, a dependency, and a thing that breaks.
• One LLM provider. Rejected because a provider outage would silently fail the product; the router costs almost nothing to maintain and buys continuity.

• Atomic quota engine (PR #75). A pg_advisory_xact_lock(orgId) wraps the "consume one generation" write so two concurrent requests from the same org cannot both see N remaining and both decrement to N-1. Fairness is not the point; correctness is.
• Stripe webhook claim-before-work (PR #78). The webhook handler first inserts an idempotency claim row keyed on the Stripe event id, then does the work. A retried event's insert fails on the unique constraint and the handler short-circuits. No double-credit on Stripe retries.
• withLangfuseFlush + .finally(flushLangfuse). Vercel freezes the lambda the moment the HTTP response is sent. Without a flush call, any in-flight Langfuse span is lost. Both the HTTP route and the waitUntil-detached pipeline flush in finally, so every generation call is costed, including the ones that fail halfway.
• Trial-gated generation. Phase 3E re-targets Stripe trials so generation quota is live from signup; trial expiry bounces the user to the plan selector with the correct quota state preserved.
• Phase plan + build log + migration-named deploys. GHOSTPOST_PIVOT_BUILD_PLAN.md for the direction, CHANGELOG.md for the deployed phases, and migration names like 20261002120000_phase_3c_generation_consumption so a deploy can be traced to the phase that produced it.

• 170 Post rows, 175 PostVersion rows, 20 BlogDraftRun rows on the founding Stratas org at Phase 2A backfill. Backfill was itself the integration test of the new multi-tenant model – the real data had to end up readable under the constrained role.
• Migrations applied to prod with verifiable timestamps. 20261002120000_phase_3c_generation_consumption on 2026-10-02 is one of several; the deploy log and the migration timestamp agree.
• Langfuse per-provider split visible on the Agent Fleet dashboard, project stratas-products, trace tag ghostpost. The product's cost is attributable the day it goes live, not retrofitted later.
• Phase 2B regression: when Prisma was switched to the constrained role, three API routes that had been quietly reading cross-org data (admin surfaces that hadn't been gated) failed in staging. Correct behaviour; promoted the admin role, kept the regular role fully constrained.

1. Multi-tenant RLS via constrained Postgres role – Prisma connects as ghostpost_app; tenant context set via set_config; policies do the enforcing. No per-query filter in app code to forget.
2. Atomic quota engine – pg_advisory_xact_lock(orgId) around the consume write; Stripe webhook claim-before-work on retries; both idempotency problems solved in SQL, not in retry logic.
3. Inline pipeline + Langfuse flush discipline – @vercel/functions.waitUntil + withLangfuseFlush + .finally(flushLangfuse) keeps traces across lambda freeze. Simpler than Trigger for request-scoped work, with correct cost telemetry.
4. Multi-provider LLM router – Anthropic → OpenAI by tier, token counts carried through to Langfuse for per-provider cost split, Perplexity Sonar-Pro for research prompts.
5. Live-pivot discipline in the repo – phase plan + build log + migration-named deploys; the pivot is a readable artifact, not a hidden reset.

1. Multi-tenancy belongs in the database, not in the ORM. The trust surface of "every developer, every query, forever" is too wide. A constrained role costs you one admin-role split and buys you a tenancy boundary you can defend.
2. Not every pipeline wants to be durable. Trigger.dev is excellent when steps are long and need to survive restarts. For a request-scoped generation path, inlining with waitUntil and flushing telemetry in finally is simpler, cheaper, and correct.
3. Pivots are either readable or they are mythology. A dated plan + a phase PR arc + migration names that encode the phase is one more hour of work than a quiet reset, and it's the only version a future reader can audit.