How it's built

Tenant separation is enforced by Postgres Row-Level Security, not by application-side WHERE org_id filtering. Each request sets a transaction-scoped GUC (SET LOCAL app.current_org_id) that the RLS policies key off; the app connects as a non-superuser role with FORCE ROW LEVEL SECURITY. If the variable is never set, the database returns zero rows rather than leaking — it fails closed.

A dedicated load test fires interleaved requests from different organizations through the same async connection pool — the exact scenario the SET LOCAL design exists to survive, and one sequential tests never exercise. Each org's rows carry an owner-encoding reference, so any foreign reference in a response is an unambiguous, decodable leak rather than a fuzzy count mismatch. Run against real Postgres, the pass records 20 of 20 with zero cross-org leakage.

One table — the native error log — is deliberately kept out of RLS, because an error can be captured before any org context resolves. That exemption quietly made a role check the only thing standing between two tenants' error rows. The fix was to move enforcement to the read boundary: a manager sees only their own org's rows, and only the pre-existing platform-admin capability sees the global view. An internal verify pass caught it before it could matter.

Aircraft positions come from an AFF (Automated Flight Following) adapter — the open aff.gov XML-over-HTTPS standard that Spidertracks, TracPlus, and SKYTRAC/Latitude all speak, so one adapter covers many vendors. Both halves are real: an authenticated HTTPS transport and a namespace-tolerant XML parser that reads position, altitude, speed, and heading and maps each device serial to an aircraft. It runs a clearly labeled bundled sample feed by default and flips to a live operator feed with three environment variables and no code change; an optional OpenSky ADS-B feed supplements it as a fill-in. Every fix is stamped with its source, so the map can never show a sample as live.

Background pollers — aircraft position tracking, check-in escalation — use Postgres advisory-lock leader election so exactly one worker runs each named job even with several workers behind the load balancer. Live updates ship over Server-Sent Events, in-process by default and swappable to Redis pub/sub across workers. Real external feeds are wired in: NWS/METAR weather, OpenSky Network ADS-B, and an avalanche.org/CAIC advisory feed.

Integrations that would need real credentials are stubbed and clearly labeled rather than faked. The Twilio SMS escalation path never texts a real phone, billing tiers only change on a real webhook, and the avalanche-danger widget is an operator-entered hazard plainly badged as not an official forecast — shown beside a real avalanche.org/CAIC feed that reads "not mapped" rather than inventing a rating. The offline UI shows a truthful "N changes queued, last synced Xm ago" state instead of a false all-synced. The rule — never claim something the code doesn't do — is enforced down to the marketing copy.

The safety surface is built on records that can't be quietly rewritten: an append-only audit log of every mutating action, append-only GPS breadcrumb history with scrub-and-replay, and immutable sign-off records. On top of those sit a Part 135-style duty-hours log, an MEL/squawk discrepancy board, a guide certification and currency tracker, an incident/near-miss log, and pilot-attributed weight-and-balance sign-offs.

The field-facing app is a progressive web app: a service worker caches the shell so it loads without a connection, and writes like a check-in are queued in IndexedDB and replayed once the network returns. Getting the service worker right in development — where an unstamped cache collided with the dev bundler and triggered a full-page reload loop — was its own debugging story.

The public webhook feature lets a manager register an outbound URL. The guard resolves the hostname and rejects private, loopback, link-local, reserved, multicast, and unspecified addresses — and re-checks at delivery time, not only at save time, specifically to defend against DNS rebinding, where the answer can change between when a URL is saved and when it's called.