Managed databases

Availability

Managed Postgres is not available yet. The current database service is a control-plane preview: it validates requests, records metadata, generates a one-time credential shape, and can publish DATABASE_URL, but it returns the non-routable host stub-shared-pg-01.local. It does not create a database server, tenant, schema, backup, or recovery point.

Do not connect an application to a record whose status is stub. Do not treat a successful API response as proof that storage exists.

What you can test today

The preview is useful for testing an integration against the planned contract:

app ownership is checked by the MCP wrapper;
database records can be created and listed;
the generated password is not returned by later metadata reads;
DATABASE_URL can be handed to the app-environment producer when its producer token is configured; and
the app records the returned database reference.

Publishing the placeholder URL does not make it usable. Remove it from the app environment before a real deployment.

MCP tools

Tool	Current behavior
`add_app_database(app_id, engine='postgres')`	Creates a `stub` record. It may publish a placeholder `DATABASE_URL`.
`list_app_databases(app_id)`	Returns metadata only. It never returns the password.

Check the returned status before doing anything else:


add_app_database(app_id='app-12345678', engine='postgres')


{
  "db_id": "db-a1b2c3d4e5f6",
  "engine": "postgres",
  "status": "stub",
  "env_published": false,
  "publish_skipped_reason": "OPENFACTORY_DB_PRODUCER_TOKEN is not configured"
}

The exact response can also contain one-time connection fields. In preview they point to the stub host and must not be used as credentials for a real workload.

REST contract

The platform-side routes are:

Method	Path	Result
`POST`	`/api/app-infra/databases`	Creates a preview record and returns one-time connection-shaped data.
`GET`	`/api/app-infra/databases/{db_id}`	Returns metadata without the password.
`GET`	`/api/app-infra/databases?app_id={app_id}`	Lists metadata, optionally filtered by app.

These lower-level routes are primarily for the internal integration. Prefer the owner-scoped MCP tool unless you are developing the platform itself.

Before managed Postgres can be called ready

A production-capable release needs evidence for all of the following:

a reachable Postgres service and real tenant provisioning;
network isolation between apps;
credential rotation and deprovisioning;
backup and restore drills with measured recovery results;
resource limits, monitoring, and failure alerts; and
an end-to-end application test that writes data, redeploys, and reads it back.

Until those checks pass in the target environment, bring your own database and place its real connection string in App environment variables.