Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Database & Supabase·15 in this wave

Verify point-in-time recovery is enabledTo do · blocker Review anon-executable SECURITY DEFINER functionsDone · blocker Approve: Database & SupabaseTo do · blocker MATTHEW: profiles.visibility is nullable with no default, so any profile created without it reads as publicBlocked · blocker The RLS fixture expires 2026-09-30 and freezes main — only Matthew can refresh it (Touch ID)Done · blocker Fix v_account_tier security-definer viewDone Fix allow-all RLS policy on checklists tableDone URGENT: 202608081500_guard_analytics_rpc_callers.sql is merged to main and NOT applied to productionDone db_url and db_password now EXIST in 1Password — verify:rls-snapshot can run for the first timeTo do RLS snapshot fixture turns pnpm verify red for every branch on 5 Nov (30-day age limit)To do Hardware-ready data modelDone Document Supabase backup policyBlocked Document RLS test planDone Soft-deleted public destinations stay readableDone Confirm scan-event logging is rate-limited per destinationDone

Wave

Database & Supabase

Schema is already built (81 tables, 114 migrations, RLS on every table). This wave is the readiness pass plus three real gaps a live audit surfaced.

TacTile › Launch TacTile › Foundations › Database & Supabase

9/15 done6 open3 open blockers

Selected taskclear

Approve: Database & Supabase

To doOwner · met_6d3c02a5Blocker

Matthew's sign-off gate for the database.

Waiting on 7 · 2 still openVerify point-in-time recovery is enabled Document Supabase backup policy Fix v_account_tier security-definer view Fix allow-all RLS policy on checklists table Review anon-executable SECURITY DEFINER functions Document RLS test plan Hardware-ready data model

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Approve: Database & Supabase** · to do · blocker

Matthew's sign-off gate for the database.

Where it sits: TacTile › Launch TacTile › Foundations › Database & Supabase

## Waiting on 7

- Verify point-in-time recovery is enabled — to do
- Document Supabase backup policy — blocked
- Fix v_account_tier security-definer view — done
- Fix allow-all RLS policy on checklists table — done
- Review anon-executable SECURITY DEFINER functions — done
- Document RLS test plan — done
- Hardware-ready data model — done

2 of those are still open. If one genuinely blocks this, say so and stop rather than working around it.

## The brief on file

[2026-10-15 · Viv] WAITING ON MATTHEW — supersedes the 8 Oct block below (counts corrected; the gate's open prerequisites and the real launch edges now named)
DECISION: LEGAL: approve Database & Supabase now (it holds 81 open tasks, 27 of them Kaitlynn's) and answer t_20f16329: keep dumps 30 days, and no second copy in R2?
RECOMMEND: Yes, approve now with five named follow-ups, not apply-then-approve. What this gate tests holds today: a read-only look at prod (xtzqmvfhtremtmbzykeq, 15 Oct 23:25 PT) shows 93 of 93 public tables with RLS on, 180 policies and nothing applied since 6 Oct (last migration 20261006190341); the runtime matrix (14 tests, covering 93 of 93 tables) and the corrected RLS runbook sit on draft PR https://github.com/TacTile-dev/TacTile/pull/737, whose local gate run was 55 of 56 with only the known-red secrets-rotation (I did not re-run it this round). Red CI on #737, #732, #720 and main is that same known-red check on a saturated host (load1 963 on 10 cores at the start of today's main run), not a database finding. Approving does NOT mean F-1 or the profiles default is fixed, or that a restore was ever rehearsed (~/TacTile-backups/db is still empty).
IF YES, NEXT: You click approve and reply "yes" (= 30 days yes, R2 no; about 3 min): 30 days keeps privacy policy section 6 true ("backups age out ... within 35 days"); R2 adds a bucket token, a passphrase and personal data off the Mac for data you called replaceable on 6 Oct. Viv, no prod, then updates draft PR #720 to your 6 Oct call. Named follow-ups, all still open: (1) t_a70b73b9 hardening batch incl. F-1, the only one wired to block t_50635664, ~90 min (~25 yours); (2) t_a050ee07 profiles default + deploy, ~75 min (~20 yours), goes first, and its 9 Oct slot passed with #718/#722/#723/#727 still draft; (3) t_20f16329 stays blocked until you name #720 for merge and run backup.sh + restore-test.sh once (1 min, Touch ID); (4) t_a2ccb527 (PITR; the answer is no, free plan) is also a prerequisite of this gate and closes only when you say close; (5) #737 needs you to name it (record-only, applies nothing; it shares a migration filename with conflicting #654, so one must yield), and the RLS fixture must be refreshed before 5 Nov 19:09 UTC (1Password unlocked) or verify:unit goes red on every PR.
COST IF YES: About 3 minutes, $0. The follow-ups carry ~45 min of yours over two sittings plus the 1-minute dump run; until they land, F-1 (anon bulk read of public destinations) and 2 profiles with NULL visibility (the gate reads NULL as public) stay open on prod, 54 days from launch, and t_a050ee07 and t_e9812756 (#737) have no hub edge to the launch task today (Viv wires both unless you say not).
COST IF NO: 81 open tasks stay held, 27 of them Kaitlynn's; apply-then-approve means the deploy run (~75 min) then the F-1 batch (~90 min) before any of them move, about 2h45m of sitting (~45 min yours) that has already slipped 6 days.
SAFE TO ASSUME: Viv writes nothing to prod (today's check was read-only) and never marks this gate done; she holds 30 days / no R2 and #720 unmerged until you answer; hardware groundwork (t_1dfac020, done) stays out of v1.0.

[2026-10-08 · Viv] WAITING ON MATTHEW — supersedes any earlier block below
DECISION: LEGAL: approve Database & Supabase now, and answer the two backup questions on t_20f16329: keep dumps 30 days, and no second copy in R2?
RECOMMEND: Yes, approve now with named follow-ups rather than apply-then-approve: what this gate tests is green tonight (RLS on all 93 live tables, the test fixture equals prod, the runtime matrix runs 14/14 on 93 of 93 tables via https://github.com/TacTile-dev/TacTile/pull/737), while what is red is a 90-minute hardening batch, the backup answers and the profiles migration, none of which the 78 downstream tasks need.
IF YES, NEXT: You click approve and reply "30 days yes, R2 no" (about 3 min). 30 days keeps privacy policy section 6 true (it promises backups age out within 35 days); R2 would add a bucket token, a passphrase and personal data off the Mac for data you called replaceable on 6 Oct. Named follow-ups: the hardening batch incl. F-1 (new task that blocks the launch task, runbook doc 2 on https://github.com/TacTile-dev/TacTile/pull/732) and the profiles migration (rides the deploy, t_a050ee07). Viv, no prod: updates PR #720 to your 6 Oct call and refreshes the RLS fixture before it freezes main on 5 Nov.
COST IF YES: About 3 minutes, $0. F-1 (anon bulk read of public destinations) stays open until its task is done; that task blocks launch, so it cannot slip past it.
COST IF NO: 78 open tasks downstream, 26 of them Kaitlynn's; apply-then-approve would hold all of them until you find 90 minutes for six migrations.
SAFE TO ASSUME: Viv writes nothing to prod, treats hardware groundwork (t_1dfac020) as out of v1.0, and holds 30 days / no R2 as proposed until you answer.

Viv — compile the finished Database & Supabase package for review; surface anything needing Matthew's sign-off.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Database & Supabase

Approve: Database & Supabase