Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Database & Supabase·15 in this wave

Verify point-in-time recovery is enabledTo do · blocker Review anon-executable SECURITY DEFINER functionsDone · blocker Approve: Database & SupabaseTo do · blocker MATTHEW: profiles.visibility is nullable with no default, so any profile created without it reads as publicBlocked · blocker The RLS fixture expires 2026-09-30 and freezes main — only Matthew can refresh it (Touch ID)Done · blocker Fix v_account_tier security-definer viewDone Fix allow-all RLS policy on checklists tableDone URGENT: 202608081500_guard_analytics_rpc_callers.sql is merged to main and NOT applied to productionDone db_url and db_password now EXIST in 1Password — verify:rls-snapshot can run for the first timeTo do RLS snapshot fixture turns pnpm verify red for every branch on 5 Nov (30-day age limit)To do Hardware-ready data modelDone Document Supabase backup policyBlocked Document RLS test planDone Soft-deleted public destinations stay readableDone Confirm scan-event logging is rate-limited per destinationDone

Wave

Database & Supabase

Schema is already built (81 tables, 114 migrations, RLS on every table). This wave is the readiness pass plus three real gaps a live audit surfaced.

TacTile › Launch TacTile › Foundations › Database & Supabase

9/15 done6 open3 open blockers

Selected taskclear

Soft-deleted public destinations stay readable

DoneOwner · Vivt_4863dc1a

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Soft-deleted public destinations stay readable** · done

Where it sits: TacTile › Launch TacTile › Foundations › Database & Supabase

## The brief on file

[2 Oct 2026 overnight — Viv: premise fixed: supabase/migrations/202608091500_destinations_public_select_excludes_deleted.sql is applied (header says APPLIED 2026-08-09; the policy now reads visibility = 'public' AND deleted_at IS NULL) and tests/unit/rls-cross-tenant.test.ts:213-224 shows KNOWN_OPEN_PUBLISHED emptied after a live pg_policy read on 2026-08-31. Closing.]

`p_destinations_public_select` on `public.destinations` has qual `(visibility = 'public')` with no `deleted_at IS NULL` clause. It is the ONLY one of the 14 published-destination read policies that omits the soft-delete check — every child table (action_destinations, bluetooth_destinations, form_destinations, link_hub_destinations, menu_destinations, payment_destinations, wifi_destinations, and the menu_* tree) correctly gates on `visibility = 'public' AND deleted_at IS NULL`.

Effect: after a user soft-deletes a public destination, the parent row remains readable by anon. The child content rows correctly stop resolving, so this leaks the destination record itself (title, hash_id, owner_account_id, timestamps), not its payload.

Fix: new migration adding `AND deleted_at IS NULL` to `p_destinations_public_select`, matching the child policies. Soft delete came in via 202606280600_destinations_soft_delete_security_definer.sql — check that migration for the intended semantics before changing the policy.

After fixing: re-run scripts/verify/rls-snapshot.sql, save over tests/fixtures/rls/policy-snapshot.json, and DELETE the `destinations.p_destinations_public_select` entry from KNOWN_OPEN_PUBLISHED in tests/unit/rls-cross-tenant.test.ts — the suite fails until you do. See docs/runbooks/rls-policy-tests.md.

Found 2026-07-29 while building the RLS cross-tenant gate (t_b067b57c).

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Database & Supabase

Soft-deleted public destinations stay readable