1. Executive Summary Assessment: MVP modular monolith is structurally appropriate for launch and early growth. Launch State: Not launch-ready yet. Primary Blockers: Background jobs execute inside API process; AI latency is 8-20 seconds; slow PostgreSQL queries; fragmented monitoring; manually configured production secrets; backup restoration is untested. Keep Now: Next.js, NestJS modular monolith, PostgreSQL, Redis, S3, OAuth 2.0 + JWT, Stripe, external LLM APIs, Docker, AWS ECS, GitHub Actions. Change Before Launch: Separate background processing from API execution; investigate and optimize slow database queries; establish centralized observability; automate secrets management; test backup restoration; implement production-grade timeout, retry, and idempotency controls. Defer: Microservices, complex event-driven architecture, dedicated platform infrastructure, and other advanced decomposition without measured evidence. Primary Architecture Direction: Stabilize the modular monolith first, isolate asynchronous workloads, improve operational visibility, then scale individual components only when production measurements justify it. 2. Current Architecture Assessment Architecture: Next.js frontend + NestJS modular-monolith backend + PostgreSQL + Redis + S3 + external AI providers + Stripe + AWS ECS. Assessment: Appropriate for a 5-developer team, part-time DevOps support, moderate infrastructure budget, and fast feature delivery. Application Structure: Keep modular monolith. API Workloads: Currently compete with background jobs inside the API process. AI Workloads: External dependency with observed 8-20 second request latency and potentially unpredictable traffic spikes. Database: PostgreSQL is a central dependency with several known slow queries. Cache: Redis is available but its current workload and effectiveness are not specified. Storage: S3 provides externalized object storage. Authentication: OAuth 2.0 + JWT is already established. Payments: Stripe introduces an external dependency requiring webhook and idempotency controls. Deployment: Docker on AWS ECS provides a managed deployment foundation. CI/CD: GitHub Actions exists but production secret configuration remains manual. Monitoring: CloudWatch exists but monitoring is fragmented. Recovery: Backups exist or are assumed operationally relevant, but restoration has not been tested. Major Hidden Dependency: External LLM availability, latency, errors, limits, and cost can directly affect application behavior. 3. Launch Readiness Checklist Application: Modular monolith remains deployable and testable. Blocker: Move background jobs out of the API process. Blocker: Diagnose and optimize known slow PostgreSQL queries. Blocker: Establish centralized application, infrastructure, database, queue, and dependency monitoring. Blocker: Remove manual production-secret configuration. Blocker: Perform and document a backup restoration test. Blocker: Implement explicit timeouts for external AI and payment interactions. Blocker: Implement retry policies only where operations are safe to retry. Blocker: Establish idempotency for asynchronous and payment-related operations. Required: Define production alert conditions. Required: Validate deployment rollback. Required: Validate AI-provider failure behavior. Required: Validate worker failure and job retry behavior. Required: Validate database connection and resource behavior under load. Unknown: Production RTO. Unknown: Production RPO. Unknown: Current error rate. Unknown: Current request rate. Unknown: Current CPU and memory utilization. Unknown: Current database connection utilization. Unknown: Current queue depth and worker utilization. Launch Decision: Do not treat user-count targets alone as evidence of capacity readiness. 4. Target Production Architecture Frontend: Keep Next.js + TypeScript. Application: Keep NestJS modular monolith. API Runtime: ECS-hosted application containers handle synchronous user-facing requests. Background Processing: Introduce a dedicated worker execution path outside the API process. Queue: Use the existing Redis capability only if it provides the required job-queue behavior; otherwise introduce a managed queue when operational evidence justifies it. AI Processing: Route long-running AI operations through asynchronous jobs where the user experience permits. Database: Keep PostgreSQL as the primary transactional datastore. Database Optimization: Address slow queries before considering database replacement or decomposition. Cache: Keep Redis for validated caching and coordination use cases. Storage: Keep S3 for object storage. Authentication: Keep OAuth 2.0 + JWT. Payments: Keep Stripe with explicit webhook validation and idempotent processing. Deployment: Keep Docker + AWS ECS. CI/CD: Keep GitHub Actions and automate production configuration/secrets handling. Observability: Centralize application logs, metrics, traces where useful, alerts, and dependency health signals. Architecture Principle: Separate workloads before separating services. 5. Feature Evolution Strategy Lead Capture: Keep within the modular monolith. Lead Qualification: Keep business rules within the appropriate application module. Follow-Up Generation: Move long-running AI generation toward asynchronous processing when latency materially affects user experience. Call Summarization: Prefer background execution because processing can be long-running. Next-Action Recommendations: Keep application orchestration centralized while isolating AI execution. Payments: Keep payment orchestration centralized with Stripe integration boundaries. AI Provider Abstraction: Introduce a provider boundary so external LLM dependencies can be changed or expanded without spreading provider-specific logic throughout the application. Feature Delivery: Prefer modular boundaries inside the monolith over independent services. Microservices: Defer until a specific module demonstrates independent scaling, deployment, reliability, ownership, or operational requirements. 6. Capacity Model Known Population: 500 beta businesses. Launch Target: 3,000 businesses. Year-One Target: 25,000 businesses. Expected Peak: 500 concurrent users. AI Traffic: Potentially unpredictable. Capacity Limitation: Supplied data does not provide request rate, request distribution, average session duration, AI call volume, database query rate, or resource utilization. Therefore: Do not calculate unsupported server, database, worker, or container capacity. Required Measurements: Requests per second. Required Measurements: Concurrent requests. Required Measurements: p50, p95, and p99 latency. Required Measurements: Error rate. Required Measurements: CPU and memory. Required Measurements: PostgreSQL query latency, connections, and resource utilization. Required Measurements: Queue depth and job age. Required Measurements: Worker utilization. Required Measurements: External AI latency, errors, limits, and usage. Required Measurements: S3 storage growth. Required Measurements: Infrastructure and AI-related spend. Capacity Principle: Scale from observed workload and saturation signals rather than business-user counts alone. 7. Performance Strategy Known Bottleneck: AI requests take 8-20 seconds. Action: Measure AI-provider latency separately from application processing time. Reason: Establish whether latency originates externally, internally, or across the complete request path. Known Bottleneck: Several PostgreSQL queries are slow. Action: Identify affected queries using production-safe database performance measurement. Action: Review execution plans, indexes, query shape, connection behavior, and data-access patterns. Prerequisite: Establish database performance visibility. Known Contention: Background jobs run inside the API process. Action: Move asynchronous workloads into workers. Expected Effect: Reduce competition between interactive API requests and background processing. AI Strategy: Use asynchronous execution where immediate synchronous completion is unnecessary. Timeouts: Apply explicit AI-provider timeouts. Retries: Retry transient failures only with bounded attempts and backoff. Caching: Cache only deterministic or safely reusable results where evidence demonstrates value. Performance Trigger: Rising latency accompanied by CPU, database, queue, or dependency saturation should identify the relevant bottleneck before scaling. 8. Scalability Strategy Stage: Current State. Architecture: Modular monolith. Focus: Remove operational launch blockers. Stage: Production Launch. Architecture: Modular monolith + separately executed background workers. Focus: Stable synchronous API and isolated asynchronous workload. Stage: Early Growth. Architecture: Same core architecture with independently scalable API and worker capacity. Focus: Measure real production behavior. Stage: Larger Scale. Architecture: Selective component separation only where measured bottlenecks justify it. Focus: Independent scaling and failure isolation. Stage: Mature Platform. Architecture: Potential selective service decomposition based on proven operational boundaries. Focus: Independent ownership, scaling, reliability, and deployment where necessary. Avoid: Microservices solely because the business has reached 25,000 businesses. Reconsider: Service decomposition when a module requires materially different scaling, release cadence, reliability isolation, resource profile, or ownership. 9. Reliability Strategy Failure: AI provider unavailable. Cause: External dependency failure. Impact: AI-powered functions become slow or unavailable. Detection: Dependency errors, latency, timeout rates, and failed jobs. Prevention: Explicit timeouts, bounded retries, provider abstraction, and graceful degradation. Mitigation: Preserve non-AI application functionality and expose actionable job states. Recovery: Retry safe asynchronous jobs according to controlled policy. Remaining Risk: External provider availability and limits remain outside direct control. Failure: API process overloaded by background work. Cause: Shared execution resources. Impact: Interactive requests can compete with asynchronous processing. Prevention: Dedicated worker execution. Mitigation: Control worker concurrency. Recovery: Restart failed workers and retry recoverable jobs. Failure: PostgreSQL degradation. Cause: Slow queries or resource saturation. Impact: Broad application slowdown. Detection: Query latency, connection usage, database resource metrics, and application latency. Prevention: Query optimization and controlled connection usage. Failure: Redis unavailable. Impact: Depends on whether Redis is being used for caching, coordination, or job processing. Action: Define explicit behavior for each Redis-dependent operation. Failure: Payment webhook duplicated. Cause: Provider retries or repeated delivery. Prevention: Idempotent processing. Failure: Deployment introduces regression. Prevention: Automated CI/CD validation and rollback capability. Failure: Backup cannot restore. Cause: Untested recovery procedure. Action: Execute restoration testing before launch. RTO: Unknown. RPO: Unknown. Decision: Establish RTO/RPO from business requirements rather than inventing targets. 10. Security Baseline Authentication: Keep OAuth 2.0 + JWT. Authorization: Explicitly enforce authorization at application boundaries. Secrets: Replace manual production configuration with managed secret storage and controlled deployment injection. Encryption: Require encryption in transit and at rest where supported by the selected services. Access Control: Apply least-privilege access to AWS, databases, storage, CI/CD, and production systems. Validation: Validate API inputs and external webhook payloads. Payments: Verify Stripe webhook authenticity and enforce idempotent processing. AI Inputs: Validate and constrain data sent to external LLM providers. Logging: Never intentionally expose credentials, tokens, or sensitive secrets. Production Access: Restrict access and maintain auditable operational controls. API Protection: Establish authentication, authorization, request validation, rate controls where required, and abuse monitoring. Compliance: No compliance status is established by the supplied information. 11. Observability Strategy Application Health: Request success rate, error rate, latency, and endpoint health. Infrastructure: ECS CPU, memory, container restarts, deployment health. Database: Slow queries, query latency, connection utilization, and resource pressure. Workers: Queue depth, job age, processing latency, success rate, failure rate, retry count, and worker utilization. AI Dependencies: Provider latency, timeout rate, error rate, request volume, and relevant provider limits. Payments: Payment operation failures, webhook failures, and processing delays. Storage: S3 growth and relevant operation failures. Deployments: Deployment status, failure rate, rollback events, and change correlation. Logs: Centralized structured application logs. Alerts: Alert only on actionable conditions. Operational View: Monitoring must answer what is healthy, what is slow, what is failing, what changed, and what requires action. Priority: Consolidate fragmented monitoring before adding sophisticated observability tooling. 12. Infrastructure Cost Strategy Known Constraint: Moderate monthly infrastructure budget. Cost Drivers: ECS compute. Cost Drivers: PostgreSQL resources. Cost Drivers: Redis resources. Cost Drivers: S3 storage and operations. Cost Drivers: AI-provider usage. Cost Drivers: Monitoring/logging volume. Cost Drivers: Network and external service usage where applicable. Action: Measure cost by major workload. Action: Separate AI cost from core infrastructure cost. Action: Monitor cost per active business or other meaningful business workload metric once production data exists. Right-Sizing: Use observed CPU, memory, database, worker, and traffic utilization. Scaling Efficiency: Avoid permanently provisioning for unpredictable AI spikes without measurements. Operational Cost: Favor managed services because the team has limited DevOps capacity and no 24/7 operations team. Do Not Invent: No infrastructure pricing or monthly cost estimate can be derived from the supplied inputs. 13. Scaling & Failure Test Strategy Test: Load Testing. Objective: Determine behavior under representative sustained production workload. Expected Behavior: Application remains within defined performance and error thresholds. Measurement: Request rate, concurrency, latency, errors, CPU, memory, and database utilization. Test: Stress Testing. Objective: Identify saturation behavior. Expected Behavior: Degradation is observable and controlled rather than silently failing. Measurement: Saturation point, latency, errors, queue growth, and recovery behavior. Test: Spike Testing. Objective: Evaluate unpredictable AI-related traffic increases. Expected Behavior: API remains responsive where possible and asynchronous work queues safely. Measurement: Queue depth, job age, API latency, worker utilization, and dependency failures. Test: Database Load Testing. Objective: Validate known slow-query areas under representative load. Expected Behavior: No unacceptable database saturation. Measurement: Query latency, execution behavior, connections, CPU, and memory. Test: AI Dependency Failure. Objective: Validate provider timeout and failure handling. Expected Behavior: Requests fail gracefully or jobs enter controlled retry states. Measurement: Timeout rate, retries, queue age, user-visible errors. Test: Worker Failure. Objective: Validate job durability and retry behavior. Expected Behavior: Recoverable jobs are not silently lost. Measurement: Failed jobs, retries, job age, and completion rate. Test: Rollback Testing. Objective: Validate recovery from faulty deployments. Expected Behavior: Previous known-good version can be restored. Measurement: Rollback duration and service recovery. Test: Backup-Restore Testing. Objective: Verify actual database restoration. Expected Behavior: Backup can produce a usable restored database. Measurement: Restoration success, restoration duration, and data-loss characteristics. Test: Security Testing. Objective: Validate authentication, authorization, secrets, input validation, webhook security, and API protection. Expected Behavior: Unauthorized and malformed operations are rejected. Measurement: Test failure count and unresolved security findings. 14. Launch-to-Scale Roadmap Stage: Launch Preparation. Focus: Remove reliability and operational blockers. Architecture: Modular monolith + separated worker execution. Engineering: Optimize known slow queries; implement timeout, retry, and idempotency controls. Operations: Centralize monitoring; automate secrets; test restoration; test rollback. Exit Criteria: Launch blockers resolved and failure/recovery tests demonstrate expected behavior. Stage: Production Launch. Focus: Controlled production operation. Architecture: Keep architecture intentionally simple. Engineering: Measure real workload and bottlenecks. Operations: Monitor application, infrastructure, database, workers, AI, and payments. Exit Criteria: Stable production behavior supported by measured telemetry. Stage: Early Growth. Focus: Scale based on observed saturation. Architecture: Independently adjust API and worker capacity where required. Engineering: Optimize recurring bottlenecks. Operations: Track cost and operational burden. Exit Criteria: Scaling actions are driven by measurable production thresholds. Stage: Larger Scale. Focus: Isolate proven bottlenecks. Architecture: Consider selective decomposition only where evidence supports it. Engineering: Strengthen workload isolation and dependency resilience. Operations: Improve automation proportionally to operational load. Exit Criteria: New architectural complexity demonstrably reduces a measured constraint. 15. Scaling Trigger Strategy Trigger: API latency increases materially. Action: Correlate latency with CPU, memory, database, dependency, and queue metrics before scaling. Trigger: API CPU saturation. Action: Increase API capacity after confirming CPU is the limiting resource. Trigger: API memory pressure. Action: Investigate memory behavior, then adjust capacity if justified. Trigger: Database query latency increases. Action: Optimize query and database behavior before simply increasing infrastructure. Trigger: Database connection pressure. Action: Review connection usage and application concurrency before increasing database resources. Trigger: Queue depth or job age continuously increases. Action: Increase worker capacity or reduce job workload after identifying the limiting factor. Trigger: AI dependency latency or failures increase. Action: Apply controlled timeouts, retries, graceful degradation, and provider-specific resilience. Trigger: AI traffic spikes overwhelm synchronous requests. Action: Shift suitable AI workloads to asynchronous execution and control worker concurrency. Trigger: Infrastructure cost rises disproportionately to workload. Action: Identify the responsible resource and right-size or redesign that workload. Trigger: One module repeatedly requires independent scaling or deployment. Action: Evaluate extracting that module into a separate service. Trigger: Operational complexity increases beyond team capacity. Action: Prefer managed infrastructure and automation before adding architectural components. 16. Risk Register Risk: Background workload competes with API requests. Stage: Launch. Impact: User-facing latency and reliability degradation. Likelihood: Established current problem. Mitigation: Separate worker execution. Trigger: API latency or resource contention remains elevated after separation. Risk: AI latency remains high. Stage: Launch and Growth. Impact: Slow user experience. Likelihood: Established current behavior. Mitigation: Measure dependency latency, use asynchronous processing where appropriate, and apply timeouts. Trigger: AI latency materially affects critical workflows. Risk: PostgreSQL becomes a scaling bottleneck. Stage: Launch and Growth. Impact: Broad application performance degradation. Likelihood: Known slow queries increase concern. Mitigation: Query analysis and optimization. Trigger: Database metrics show sustained saturation after query optimization. Risk: Production recovery is unverified. Stage: Launch. Impact: Uncertain recovery after data loss. Likelihood: Confirmed operational gap. Mitigation: Backup restoration testing. Trigger: Restoration test failure. Risk: Secrets remain manually managed. Stage: Launch. Impact: Operational and security risk. Likelihood: Confirmed current practice. Mitigation: Managed secret storage and automated injection. Trigger: Manual configuration remains required during deployment. Risk: Monitoring remains fragmented. Stage: Launch. Impact: Slow detection and diagnosis. Likelihood: Confirmed current problem. Mitigation: Centralized actionable observability. Trigger: Production incident requires multiple disconnected monitoring sources to diagnose. Risk: Premature microservices increase complexity. Stage: Growth. Impact: Slower feature delivery and greater operational burden. Likelihood: Relevant under current team constraints. Mitigation: Retain modular monolith until evidence requires decomposition. Trigger: Independent scaling, deployment, reliability, or ownership requirements emerge. 17. Priority Action Plan Priority 1: Separate background jobs from API execution. Reason: Directly addresses an identified architectural contention problem. Priority 2: Diagnose and optimize slow PostgreSQL queries. Reason: Database performance is already a known problem. Priority 3: Establish unified production observability. Reason: Fragmented monitoring reduces detection and diagnosis capability. Priority 4: Automate production secret management. Reason: Removes manual deployment dependency. Priority 5: Test database backup restoration. Reason: Existing backup capability is not operationally validated until restoration succeeds. Priority 6: Implement external dependency timeouts, bounded retries, and idempotency. Reason: AI and payment integrations introduce failure and duplication scenarios. Priority 7: Validate rollback. Reason: Production recovery requires a tested deployment recovery mechanism. Priority 8: Run load, stress, spike, dependency-failure, worker-failure, and recovery tests. Reason: Capacity and reliability decisions require measured behavior. Priority 9: Establish baseline production measurements. Reason: Future scaling decisions must be evidence-driven. Priority 10: Defer microservice decomposition. Reason: Current team and requirements favor operational simplicity. 18. Architecture Decision Summary Decision: Keep modular monolith now. Reason: Fits team size, delivery requirements, and current maturity. Alternative: Microservices. Trade-off: Greater isolation and independent scaling versus greater operational complexity. Revisit Trigger: Demonstrated independent scaling, deployment, reliability, or ownership requirements. Decision: Separate workers from API execution. Reason: Background jobs currently compete with interactive requests. Alternative: Continue running jobs inside API processes. Trade-off: Lower architectural change but continued workload contention. Revisit Trigger: Only reconsider if asynchronous workload disappears or becomes immaterial. Decision: Keep PostgreSQL. Reason: No evidence requires replacing the primary database. Alternative: Introduce another datastore. Trade-off: Potential specialized capabilities versus additional complexity. Revisit Trigger: Measured database limitations that cannot reasonably be resolved within PostgreSQL. Decision: Keep Redis. Reason: Existing infrastructure can support caching or coordination workloads. Alternative: Add another infrastructure component. Trade-off: Potential specialized capabilities versus operational burden. Revisit Trigger: Measured Redis limitations or unsuitable workload characteristics. Decision: Keep AWS ECS. Reason: Managed deployment aligns with limited DevOps capacity. Alternative: More complex container orchestration. Trade-off: Potential flexibility versus additional operational burden. Revisit Trigger: ECS limitations become measurable and materially constrain requirements. Decision: Introduce centralized observability. Reason: Current monitoring is fragmented. Alternative: Continue separate monitoring approaches. Trade-off: Lower immediate consolidation effort versus weaker operational visibility. Revisit Trigger: Monitoring requirements materially change with platform maturity. 19. Final Architecture Maturity Assessment Current Maturity: Production-transitioning MVP. Architecture Maturity: Modular and appropriate, but operational hardening is incomplete. Application Architecture: Suitable for current stage. Scalability Architecture: Needs workload isolation before meaningful scale evaluation. Performance Maturity: Incomplete due to known AI latency and database-query issues. Reliability Maturity: Incomplete due to untested restoration and shared API/background execution. Security Maturity: Baseline technologies exist, but production secret management and operational controls require improvement. Observability Maturity: Insufficiently consolidated for reliable production operations. Recovery Maturity: Unverified until restoration and rollback testing are completed. Operational Fit: Managed AWS services and a modular monolith align with the available engineering and DevOps capacity. Launch Readiness: Not ready until the identified launch blockers are addressed and validated. 20. Final Architecture Direction Use Now: Next.js + TypeScript, NestJS modular monolith, PostgreSQL, Redis, S3, OAuth 2.0 + JWT, Stripe, external LLM APIs, Docker, ECS, and GitHub Actions. Must Change Before Launch: Separate background workers, resolve known database performance issues, consolidate observability, automate production secrets, validate backup restoration, and establish dependency resilience. Improve After Launch: Optimize from real production telemetry, right-size infrastructure, refine worker/API scaling, measure AI workload behavior, and track infrastructure and AI costs. Introduce When Justified: Selective service decomposition, additional workload isolation, and more advanced infrastructure only after measurable bottlenecks or operational requirements appear. Do Not Introduce Yet: Broad microservices decomposition or complex distributed architecture without evidence. Future Signals: Request rate, concurrency, latency, errors, CPU, memory, database performance, connection utilization, queue depth, worker utilization, AI-provider behavior, storage growth, cost, and operational workload. Highest Priority: Reliability and operational readiness before architectural expansion. Architectural Evolution: Start with the modular monolith, isolate asynchronous workloads, establish reliable production telemetry, and scale individual resources according to measured saturation. Extract services only when production evidence demonstrates that a specific boundary needs independent scaling, deployment, reliability, or ownership.