production boundary

Make failure
legible.

Methodos fails closed where it can, exposes the signals operators need, and leaves deployment ownership explicit where the host must make a decision.

Secure startup

Set METHODOS_ENV=production or staging. Those modes reject missing authentication, weak credentials, and filesystem persistence. Use explicit role mappings for every API key.

METHODOS_ENV=production
METHODOS_API_KEYS='replace-with-a-long-key'
METHODOS_API_KEY_ROLES='replace-with-a-long-key=reader'
PGRAPH_BACKEND=postgres
PGRAPH_POSTGRES_DSN='postgresql://...'

Keep the API behind an authenticated TLS reverse proxy. Bind Compose ports to loopback unless the surrounding network path is intentionally authenticated.

Scale deliberately

Use SQLite for one service process group with a persistent volume. Use Postgres for replicas, shared rate limits, durable jobs, tenant isolation, token budgets, and circuit-breaker state. Run the evolution worker as a separately supervised process with an injected executor.

Observe

Scrape /metrics, send structured logs to your aggregator, and export OpenTelemetry spans if distributed tracing is required. Track request errors/latency, readiness, queue depth, worker liveness, provider failures, and backup age.

SLOsPrometheusOTelGrafanarequest IDs

Recover and release

Schedule atomic SQLite backups and verify them before restore. Use managed Postgres backups and perform separate-destination restore drills. Release images are SBOMed, scanned, attested, signed by digest, and bound to a source revision by a release manifest.

methodos backup /secure/backups/methodos-$(date +%Y%m%d%H%M%S).db
methodos verify-backup /secure/backups/methodos-20261014090000.db
methodos restore-backup backup.db recovery.db