Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Database & Supabase·12 in this wave

Verify point-in-time recovery is enabledTo do · blocker Review anon-executable SECURITY DEFINER functionsDone · blocker Approve: Database & SupabaseTo do · blocker MATTHEW: profiles.visibility is nullable with no default, so any profile created without it reads as publicBlocked · blocker Fix v_account_tier security-definer viewTo do Fix allow-all RLS policy on checklists tableTo do URGENT: 202608081500_guard_analytics_rpc_callers.sql is merged to main and NOT applied to productionTo do Hardware-ready data modelDone Document Supabase backup policyTo do Document RLS test planTo do Soft-deleted public destinations stay readableTo do Confirm scan-event logging is rate-limited per destinationDone

Wave

Database & Supabase

Schema is already built (81 tables, 114 migrations, RLS on every table). This wave is the readiness pass plus three real gaps a live audit surfaced.

TacTile › Launch TacTile › Foundations › Database & Supabase

3/12 done9 open3 open blockers

Selected taskclear

Document Supabase backup policy

To doOwner · ait_20f16329

Written backup + restore policy, including retention and a tested restore path.

Waiting on 1 · 1 still openVerify point-in-time recovery is enabled

Unlocks 1Approve: Database & Supabase

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Document Supabase backup policy** · to do

Written backup + restore policy, including retention and a tested restore path.

Where it sits: TacTile › Launch TacTile › Foundations › Database & Supabase

## Waiting on 1

- Verify point-in-time recovery is enabled — to do

1 of those is still open. If one genuinely blocks this, say so and stop rather than working around it.

## Unlocks 1

- Approve: Database & Supabase

## The brief on file

UNBLOCKED 2026-07-28 and MOSTLY WRITTEN. It was blocked because there was nothing to
document — pitr_enabled false, backups [], no mechanism. That is no longer true.

docs/runbooks/database-backup.md now exists and is the interim policy: what the backup
covers, the credential and where it lives, where dumps land, the manual cadence, and an
explicit "what this does NOT cover versus real PITR" section (no point-in-time granularity,
no schedule until armed, local-only storage, only as current as the last run).

WHAT IS STILL MISSING before this can be called done — all small:
  1. A tested restore path. The policy claims one; nobody has run restore-test.sh yet.
     Blocked only on op://TacTile/Supabase/db_password. See t_6eb97a80.
  2. A stated retention number for the dumps themselves. The script prunes after N days;
     the policy should name N and justify it, and it must not be shorter than the audit_log
     commitment — the legal pack promises 24 months of audit records as evidence, and a
     backup horizon shorter than that quietly undermines it.
  3. The post-launch version. Once Pro lands, daily backups with 7-day retention become the
     real policy and the dump becomes the belt-and-braces copy. Write that section against
     docs/runbooks/launch-day-database.md rather than rewriting the whole doc.
  4. Off-machine storage. Dumps currently land in ~/TacTile-backups/db on one disk. A dead
     disk takes production with it. The policy should say where the second copy goes; that
     is a decision, not a doc edit.
  5. Register db_password in docs/secrets/secrets.config.yaml. Deliberately left out so far
     — adding it regenerates secrets.manifest.json and puts the secret on a rotation clock,
     which has its own CI consequences. Until then the rotation audit does not know it
     exists.

Do NOT restate the hardening plan here. This document should be readable by someone who
needs to restore the database at 2am and has read nothing else.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Database & Supabase

Document Supabase backup policy