Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Database & Supabase·15 in this wave

Verify point-in-time recovery is enabledTo do · blocker Review anon-executable SECURITY DEFINER functionsDone · blocker Approve: Database & SupabaseTo do · blocker MATTHEW: profiles.visibility is nullable with no default, so any profile created without it reads as publicBlocked · blocker The RLS fixture expires 2026-09-30 and freezes main — only Matthew can refresh it (Touch ID)Done · blocker Fix v_account_tier security-definer viewDone Fix allow-all RLS policy on checklists tableDone URGENT: 202608081500_guard_analytics_rpc_callers.sql is merged to main and NOT applied to productionDone db_url and db_password now EXIST in 1Password — verify:rls-snapshot can run for the first timeTo do RLS snapshot fixture turns pnpm verify red for every branch on 5 Nov (30-day age limit)To do Hardware-ready data modelDone Document Supabase backup policyBlocked Document RLS test planDone Soft-deleted public destinations stay readableDone Confirm scan-event logging is rate-limited per destinationDone

Wave

Database & Supabase

Schema is already built (81 tables, 114 migrations, RLS on every table). This wave is the readiness pass plus three real gaps a live audit surfaced.

TacTile › Launch TacTile › Foundations › Database & Supabase

9/15 done6 open3 open blockers

Selected taskclear

Review anon-executable SECURITY DEFINER functions

DoneOwner · met_6a588183Blocker

35 RPC functions callable by anon/authenticated; confirm each is intentional (several analytics_group_* look wrong). Found by live audit.

Unlocks 2Document RLS test plan Approve: Database & Supabase

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Review anon-executable SECURITY DEFINER functions** · done · blocker

35 RPC functions callable by anon/authenticated; confirm each is intentional (several analytics_group_* look wrong). Found by live audit.

Where it sits: TacTile › Launch TacTile › Foundations › Database & Supabase

## Unlocks 2

- Document RLS test plan
- Approve: Database & Supabase

## The brief on file

DONE 2026-08-08 — PR #291, merged to main. The analytics_group_* revoke IS APPLIED to production.

⚠️ BUT THE TITLE OVERSTATES WHAT WAS FINISHED. "Review anon-executable SECURITY DEFINER functions" describes a review that is NOT complete. Closed on the specific revoke it shipped, not on the review.

Still exposed as of round 14 (2026-08-09), all three confirmed anon-executable in the live ACL:
  - cleanup_expired_oauth_codes()  — revoke written twice, both UNAPPLIED
      (202608081500:506, 202608091200:82)
  - log_analytics_event(34 args)   — revoke written round 14, UNAPPLIED
      (202608091400_revoke_public_scan_path_fns.sql)
  - log_open_event(5 args)         — same migration, UNAPPLIED

tests/unit/rls-cross-tenant.test.ts already carries a comment flagging this
exact contradiction (closed task, open hole).

The remaining work is tracked on t_449fbef0 (unblocked, re-pointed) and on the
new resolve_trigger_destination task. Do not reopen this one.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Database & Supabase

Review anon-executable SECURITY DEFINER functions