Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Database & Supabase·15 in this wave

Verify point-in-time recovery is enabledTo do · blocker Review anon-executable SECURITY DEFINER functionsDone · blocker Approve: Database & SupabaseTo do · blocker MATTHEW: profiles.visibility is nullable with no default, so any profile created without it reads as publicBlocked · blocker The RLS fixture expires 2026-09-30 and freezes main — only Matthew can refresh it (Touch ID)Done · blocker Fix v_account_tier security-definer viewDone Fix allow-all RLS policy on checklists tableDone URGENT: 202608081500_guard_analytics_rpc_callers.sql is merged to main and NOT applied to productionDone db_url and db_password now EXIST in 1Password — verify:rls-snapshot can run for the first timeTo do RLS snapshot fixture turns pnpm verify red for every branch on 5 Nov (30-day age limit)To do Hardware-ready data modelDone Document Supabase backup policyBlocked Document RLS test planDone Soft-deleted public destinations stay readableDone Confirm scan-event logging is rate-limited per destinationDone

Wave

Database & Supabase

Schema is already built (81 tables, 114 migrations, RLS on every table). This wave is the readiness pass plus three real gaps a live audit surfaced.

TacTile › Launch TacTile › Foundations › Database & Supabase

9/15 done6 open3 open blockers

Selected taskclear

Document RLS test plan

DoneOwner · Vivt_6058439f

Test plan proving RLS actually isolates tenants; write after the three fixes land.

Waiting on 3 · all clearFix v_account_tier security-definer view Fix allow-all RLS policy on checklists table Review anon-executable SECURITY DEFINER functions

Unlocks 1Approve: Database & Supabase

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Document RLS test plan** · done

Test plan proving RLS actually isolates tenants; write after the three fixes land.

Where it sits: TacTile › Launch TacTile › Foundations › Database & Supabase

## Waiting on 3

- Fix v_account_tier security-definer view — done
- Fix allow-all RLS policy on checklists table — done
- Review anon-executable SECURITY DEFINER functions — done

## Unlocks 1

- Approve: Database & Supabase

## The brief on file

[2026-10-09 · Viv] DONE on r30/db-record (draft PR #737). Replica regen and the 4 tables mapped: 202c3f10 (replica 93 tables, snapshot 93/180, owner-map has analytics_events_2026_09/10/11 and destination_events). Counts fixed to 93/180 plus the 2026-11-05 age-limit and partition clocks: 7e9fb29e. F-1 marked pending Matthew sign-off: 7e9fb29e; baseline and F-1 text corrected: 03bccc45. Refresh recipe: debfad0f points it at the app DB; fa590ffe stops asserting db_url is the RAG DB (repo sources conflict, check the ref first). No prod writes. PR #737 also carries t_e9812756 record-only migrations. F-1 yes/no lives in t_a70b73b9, not here. fa590ffe is pushed (PR head fa590ffe; gate.sh 55/56, only the sanctioned secrets-rotation red). Draft PR https://github.com/TacTile-dev/TacTile/pull/737, not merged; reviewed by an adversarial pass.

[2026-10-08 · Viv] STAYS OPEN, small. The plan exists: docs/runbooks/rls-policy-tests.md on origin/main 4f2c1d6b. Layer 1 (tests/unit/rls-cross-tenant.test.ts) re-run today on a scratch export: 29/29. Layer 2 cannot start as documented: policy-snapshot.json has 93 tables/180 policies but replica-schema.sql has 89, so scripts/rls/start-replica.sh aborts MISMATCH (missing analytics_events_2026_09/10/11, destination_events); tests/rls/owner-map.ts lacks the same 4. Runbook still says 89/177, omits that the fixture freezes verify:unit on 2026-11-05 (30-day limit, rls-cross-tenant.test.ts:101), and calls public-destination reads 'the product' while audit F-1 (High, anon bulk-reads wifi/payment/menu rows) stays open until Matthew names a yes to migration 202608272335. TO CLOSE (Viv, one docs+fixtures PR, no prod): regen replica-schema, map the 4 tables, fix counts, add F-1 sign-off.

Viv — write a test plan proving RLS actually isolates tenants, after the three fixes land; surface anything needing Matthew's sign-off.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Database & Supabase

Document RLS test plan