Managed databases

Availability

Managed Postgres not available yet. Current database service is control-plane preview: validates requests, records metadata, generates one-time credential shape, can publish DATABASE_URL, but returns non-routable host stub-shared-pg-01.local. It does not create database server, tenant, schema, backup, recovery point.

Do not connect application to record whose status is stub. Do not treat successful API response as proof storage exists.

What you can test today

Preview useful for testing integration against planned contract:

app ownership checked by MCP wrapper;
database records can be created and listed;
generated password not returned by later metadata reads;
DATABASE_URL can be handed to app-environment producer when producer token configured; and
app records returned database reference.

Publishing placeholder URL does not make it usable. Remove from app environment before real deployment.

MCP tools

Tool	Current behavior
`add_app_database(app_id, engine='postgres')`	Creates `stub` record. May publish placeholder `DATABASE_URL`.
`list_app_databases(app_id)`	Returns metadata only. Never returns password.

Check returned status before doing anything else:


add_app_database(app_id='app-12345678', engine='postgres')


{
  "db_id": "db-a1b2c3d4e5f6",
  "engine": "postgres",
  "status": "stub",
  "env_published": false,
  "publish_skipped_reason": "OPENFACTORY_DB_PRODUCER_TOKEN is not configured"
}

Exact response can also contain one-time connection fields. In preview they point to stub host and must not be used as credentials for real workload.

REST contract

Platform-side routes:

Method	Path	Result
`POST`	`/api/app-infra/databases`	Creates preview record and returns one-time connection-shaped data.
`GET`	`/api/app-infra/databases/{db_id}`	Returns metadata without password.
`GET`	`/api/app-infra/databases?app_id={app_id}`	Lists metadata, optionally filtered by app.

Lower-level routes primarily for internal integration. Prefer owner-scoped MCP tool unless developing platform itself.

Before managed Postgres can be called ready

Production-capable release needs evidence for all following:

reachable Postgres service and real tenant provisioning;
network isolation between apps;
credential rotation and deprovisioning;
backup and restore drills with measured recovery results;
resource limits, monitoring, failure alerts; and
end-to-end application test that writes data, redeploys, reads back.

Until those checks pass in target environment, bring your own database and place real connection string in App environment variables.