Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Database & Supabase·15 in this wave

Verify point-in-time recovery is enabledTo do · blocker Review anon-executable SECURITY DEFINER functionsDone · blocker Approve: Database & SupabaseTo do · blocker MATTHEW: profiles.visibility is nullable with no default, so any profile created without it reads as publicBlocked · blocker The RLS fixture expires 2026-09-30 and freezes main — only Matthew can refresh it (Touch ID)Done · blocker Fix v_account_tier security-definer viewDone Fix allow-all RLS policy on checklists tableDone URGENT: 202608081500_guard_analytics_rpc_callers.sql is merged to main and NOT applied to productionDone db_url and db_password now EXIST in 1Password — verify:rls-snapshot can run for the first timeTo do RLS snapshot fixture turns pnpm verify red for every branch on 5 Nov (30-day age limit)To do Hardware-ready data modelDone Document Supabase backup policyBlocked Document RLS test planDone Soft-deleted public destinations stay readableDone Confirm scan-event logging is rate-limited per destinationDone

Wave

Database & Supabase

Schema is already built (81 tables, 114 migrations, RLS on every table). This wave is the readiness pass plus three real gaps a live audit surfaced.

TacTile › Launch TacTile › Foundations › Database & Supabase

9/15 done6 open3 open blockers

Selected taskclear

db_url and db_password now EXIST in 1Password — verify:rls-snapshot can run for the first time

To doOwner · ait_0d2c04f1

AGENTS.md and three task briefs still say db_url does not exist. It does, as of 2026-09-21. That unblocks the only check that can detect the RLS fixture drifting from production, plus the restore test.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**db_url and db_password now EXIST in 1Password — verify:rls-snapshot can run for the first time** · to do

AGENTS.md and three task briefs still say db_url does not exist. It does, as of 2026-09-21. That unblocks the only check that can detect the RLS fixture drifting from production, plus the restore test.

Where it sits: TacTile › Launch TacTile › Foundations › Database & Supabase

## The brief on file

[2026-10-09 · Viv] Skeptic review, KEEP OPEN. Only Job 1 is stale-done (fixture refreshed from the live catalog: e717f514 #633, 4f2c1d6b #724). Job 3 is NOT done: AGENTS.md:679 on origin/main 4f2c1d6b still says db_url does not exist, 'which is why verify:rls-snapshot has never run'; the fix is draft #638 (head e2715132), unmerged. Job 2 is NOT done: restore-test.sh has never exited 0, ~/TacTile-backups/db is empty (ls 2026-10-09), and #720 (head ff404826) is draft. Closes when #638 and #720 merge and one backup.sh + restore-test.sh run is pasted (needs Matthew to unlock 1Password). Edit AGENTS.md then cp -f to CLAUDE.md.

FOUND 2026-09-21 (Viv) while probing credential availability. This is a documentation correction plus two newly-reachable jobs.

THE FACT: `op item get Supabase --vault TacTile` now lists url, anon_key, service_role_key, personal_access_token, project_ref, jwt_secret, **db_url** and **db_password**. The last two did not exist before.

WHY IT MATTERS — three places in the repo assert the opposite and route people away from work they can now do:
  · Root AGENTS.md §Secrets: "What still needs Matthew is never the fingerprint. It is one of: a field that does not exist (db_url — which is why verify:rls-snapshot has never run, by anyone)". Now false.
  · t_20f16329 (Document Supabase backup policy) item 1: "A tested restore path... Blocked only on op://TacTile/Supabase/db_password." Now unblocked.
  · t_fb01dea1 and t_081dcf20 both blame 1Password for being cold. 1Password works; verified by USE (op read returns a live value, rc=0). Never gate on `op whoami` — it exits 1 while printing "Logged in".

=== JOB 1: run verify:rls-snapshot, which has never been run by anyone ===
AGENTS.md's own section says the RLS cross-tenant gate asserts entirely against tests/fixtures/rls/policy-snapshot.json, so a green run says THE FIXTURE is safe, not the database — and that the two silently disagreed once for ten days (the fixture recorded delete_account_cascade as anon-executable for ten days after a migration closed it, with eighteen tests green about a schema that no longer existed). scripts/verify/rls-snapshot-fresh.mjs is the only thing that can detect that; it re-runs the snapshot SQL against the live catalog and deep-diffs.
CAUTION, measured: the script does NOT read db_url. Run without credentials it prints "SKIP rls-snapshot: SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY not set" and exits 0 — a loud skip, by design. So it wants the service-role key, which is the full RLS-bypass master key over a database with pitr_enabled:false and zero stored backups. Read-only diff, but treat the credential accordingly.
Without --write it only diffs. With --write it regenerates the fixture; if you do that, delete in the SAME change every KNOWN_* entry the refresh shows is fixed, or verify:unit goes red.

=== JOB 2: the restore test (finishes t_20f16329 item 1) ===
docs/runbooks/database-backup.md claims a tested restore path and nobody has run scripts/db/restore-test.sh. db_password now exists, so it can be. This also partly answers the kickstart's "test the rollback against a branch" — which is otherwise IMPOSSIBLE, since Supabase branching needs Pro and t_a2ccb527 records the 2026-08-31 decision not to buy it. A dump restored into a throwaway local Postgres is the available substitute; say plainly that it does not exercise the DDL/ACL rollback statements against a disposable copy of production.

=== JOB 3: correct the docs ===
Fix the AGENTS.md §Secrets sentence. Remember AGENTS.md and CLAUDE.md are byte-identical mirrors gated by verify:agents-sync — edit both (`cp -f AGENTS.md CLAUDE.md`) or the next mirror silently reverts you.

=== ONE POLICY NOTE FOR WHOEVER PICKS THIS UP ===
A Claude session in auto mode is BLOCKED from production database reads — I hit that denial today on a read-only ACL audit via the Supabase Management API and did not route around it. This task needs either explicit authorisation or a session permitted to touch production. That is the obstacle now; it is no longer the credential.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Database & Supabase

db_url and db_password now EXIST in 1Password — verify:rls-snapshot can run for the first time