Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Database & Supabase·15 in this wave

Verify point-in-time recovery is enabledTo do · blocker Review anon-executable SECURITY DEFINER functionsDone · blocker Approve: Database & SupabaseTo do · blocker MATTHEW: profiles.visibility is nullable with no default, so any profile created without it reads as publicBlocked · blocker The RLS fixture expires 2026-09-30 and freezes main — only Matthew can refresh it (Touch ID)Done · blocker Fix v_account_tier security-definer viewDone Fix allow-all RLS policy on checklists tableDone URGENT: 202608081500_guard_analytics_rpc_callers.sql is merged to main and NOT applied to productionDone db_url and db_password now EXIST in 1Password — verify:rls-snapshot can run for the first timeTo do RLS snapshot fixture turns pnpm verify red for every branch on 5 Nov (30-day age limit)To do Hardware-ready data modelDone Document Supabase backup policyBlocked Document RLS test planDone Soft-deleted public destinations stay readableDone Confirm scan-event logging is rate-limited per destinationDone

Wave

Database & Supabase

Schema is already built (81 tables, 114 migrations, RLS on every table). This wave is the readiness pass plus three real gaps a live audit surfaced.

TacTile › Launch TacTile › Foundations › Database & Supabase

9/15 done6 open3 open blockers

Selected taskclear

Verify point-in-time recovery is enabled

To doOwner · ait_a2ccb527Blocker

Confirm PITR/backup retention is actually on in Supabase settings — unverified in the audit, and it gates the backup policy doc.

Unlocks 2Document Supabase backup policy Approve: Database & Supabase

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Verify point-in-time recovery is enabled** · to do · blocker

Confirm PITR/backup retention is actually on in Supabase settings — unverified in the audit, and it gates the backup policy doc.

Where it sits: TacTile › Launch TacTile › Foundations › Database & Supabase

## Unlocks 2

- Document Supabase backup policy
- Approve: Database & Supabase

## The brief on file

[2026-10-15 · Viv] WAITING ON MATTHEW, reply "close" or "hold". Supersedes my 8 Oct status note below; every fact in it re-checked 15 Oct.
DECISION: MONEY (a decline, nothing spent): close t_a2ccb527 now as answered NO (PITR is off and the org plan is free, per your 6 Oct no-Pro-before-launch call), or hold it open to revisit Pro at launch prep?
RECOMMEND: Close it, and give the one live question inside it (buy Pro at or after launch, when real users' data stops being replaceable) its own dated task. This is one of two open prerequisites on Approve: Database & Supabase (t_6d3c02a5, node 2 of the 10-node critical path; the schedule's week of 5 Oct for Backend API ended 11 Oct) and it holds 83 open tasks, 27 Kaitlynn's. The answer is verified today, not assumed: org plan free (Supabase get_organization, 15 Oct), ~/TacTile-backups/db empty, origin/main unchanged since 6 Oct (4f2c1d6b).
IF YES, NEXT: Reply "close". Viv, no prod, same day: (1) retitle and close it as "Supabase Pro/PITR off by decision 6 Oct, plan free verified 15 Oct" so a done box cannot read as PITR on; (2) add one task for you, due 5 Nov (launch prep, t_3e28c5b5): Pro at launch, ~$25/mo (runbook's pricing-page figure, unconfirmed) or ~$35 with a staging branch, PITR $100/mo no, carrying what Pro gates for v1.0: log drain (obs-6, t_4ca97537), leaked-password protection (t_8cd71e61), staging DB/branching; (3) fix the docs on main that still say buy Pro on launch day (docs/runbooks/launch-day-database.md:3,18,143; docs/launch/LAUNCH-SCHEDULE.md:29) and update draft #720 (head ff404826, 5 Oct, predates your call) in one docs PR before the 5 Nov freeze. The gate's other open prerequisite, t_20f16329, still waits on your two answers (30 days / R2, asked on t_6d3c02a5).
COST IF YES: $0 spent, one word from you. It leaves what 6 Oct already accepted: no platform backup or PITR and no kept dump (t_6eb97a80, 1 min of your Touch ID, stays open and does not gate), so a bad migration or dropped table is unrecoverable; log drain and leaked-password protection stay unmet on free until the 5 Nov task.
COST IF NO: $0 now, but t_6d3c02a5 keeps an open prerequisite that cannot close before your revisit (early Nov at best), so Backend API (28 direct dependents) and the 83 tasks behind it cannot go green cleanly, with launch 54 days out (Tue 8 Dec); 8 open tasks keep citing a title that reads as an unfinished check.
SAFE TO ASSUME: Plan stays free, nothing bought or staged, no prod write, no gate marked done, and until you reply Viv changes nothing on this task. Your 6 Oct call covers pre-launch only: buying Pro on 8 Dec is not decided either way, and I will not stage it.

[2026-10-08 · Viv] STAYS OPEN, do not close on the title. The answer to the title is NO: Supabase get_organization today returns plan free, so no PITR. That is Matthew's 6 Oct call (no Pro/PITR before launch, data replaceable), which already superseded the launch-gate and dump-before-DDL text below. But that note ends 'Status and owner unchanged', so it is not a close instruction, and 10 other hub tasks cite this one as the record of the no-Pro/no-staging-DB decision (t_68803c02, t_6eb97a80, t_557d52d9). Still stale: docs/runbooks/launch-day-database.md on main ('buy Pro on launch day', 'not runnable yet'); draft PR #720 (t_20f16329, waiting on Matthew's 2 answers) predates the call. ~/TacTile-backups/db is empty, so no dump exists. Closes when Matthew says close or revisits at launch prep.

[2026-10-06 · Matthew decided] BACKUPS / SUPABASE PRO. No paid database backup (no Supabase Pro, no PITR) before launch. Production data is treated as replaceable; GitHub is the code backup. His words: "GitHub keeps the backup of our code, and right now I'm not too worried about the database data being backed up because we could replace that anytime."
- This supersedes the "launch gate" framing and the "do not apply the queued DDL until a dump exists" instruction below: a verified dump is NO LONGER a precondition for applying a migration. Each prod migration still needs Matthew's named yes.
- Status and owner unchanged by this note.

[DECIDED 30 Sep 2026 — Matthew: NO to Supabase Pro. Stay on free; the deferral stands.]
The free mitigation is now STEP 0 of rotation night (t_185119c7, decided yes this week): run scripts/db/backup.sh + restore-test.sh in that same 1Password-unlocked sitting, BEFORE the DB password reset. Context from 30 Sep verification: the leaked service_role key (full delete power) stays live until the legacy-key deactivation, targeted mid-October — the dump is the only copy of prod until then. Do not apply the queued DDL (202608312340, 202608081500, 202609261245) until a dump exists.
[/DECIDED]

[overnight 29→30 Sep — DECISION, read this first]
VERIFIED LIVE 29 Sep 21:55 (read-only): delete_account_cascade and the other three destructive functions are CLOSED (since 30 Jul) — DAILY-PLAN's "Right now" item is stale. v_account_tier is correct in prod (PR #654 adds the missing repo migration).
STILL OPEN: zero backups of any kind (free plan; ~/TacTile-backups/db has never held a dump); current_account_tier() lets any signed-in user read any account's tier (fix 202608312340 is on main, not applied; its allowlist entry expires 30 Sep).
DECISION (MONEY): buy Supabase Pro now, or keep deferring it to launch as decided 28 Jul? RECOMMEND: keep deferring Pro, but take the first backup tomorrow — `scripts/db/backup.sh` + `restore-test.sh`, free, ~10 min, 1Password unlocked — then apply 202608312340, 202608081500 and 202609261245 (restores trigger-scan recording, lost since 1 Sep) in that same sitting.
IF NO BACKUP → every migration and every seed run stays one mistake from permanent loss.
[/overnight]

DECIDED 2026-08-31 (Matthew): NOT paying for Supabase Pro/PITR yet — deliberate deferral, revisit at launch prep. This moves it out of the blocked set (the wait was the spend decision; decided: not now). THE RISK IT CARRIES REMAINS UNCHANGED AND IS A LAUNCH GATE: pitr_enabled:false, backups:[], org plan free — verified 2026-07-28 via Management API. There is not one stored backup of production; a bad migration or dropped table is unrecoverable until this is bought. Do not be reassured by pg_settings/WAL archiving (platform infra, not a restorable window). Database-hardening plan step 10 (Postgres upgrade) is also gated on this. When revisited: Supabase Pro + PITR add-on on project xtzqmvfhtremtmbzykeq, then verify pitr_enabled:true via Management API and delete this paragraph.

[overnight 29→30 Sep] NEEDS MATTHEW — MONEY: buy Supabase Pro now (~$25/mo per org), or keep deferring to launch as you decided? PITR is a separate add-on on top; my read is still no to that.

WHAT I DID: re-checked read-only tonight (2026-09-29 ~21:55 PT). The answer to this task's title is NO: the Supabase organization plan is `free` (Supabase MCP get_organization); free carries no PITR and no platform backups. I did not re-read the Management API backups endpoint (1Password was locked, PAT unreachable); the last direct reading, 2026-07-28, was pitr_enabled:false, backups:[]. Nothing purchased or changed.
THE FREE MITIGATION HAS NEVER RUN: ~/TacTile-backups/db exists (created 2026-08-06) and is EMPTY — scripts/db/backup.sh has never produced a dump, so scripts/db/restore-test.sh has never been rehearsed. It needs only 1Password unlocked (op://TacTile/Supabase/db_password now exists, per the 2026-09-21 note on t_fb01dea1; not re-read tonight). Runbook current-state updated in draft PR #654.

THE FIGURES, as the repo records them (I looked nothing up): docs/proposals/database-hardening-plan.md cost table — Pro ~$25/mo per org, "[page]" (a pricing-page figure, not a quote — confirm on the billing screen), daily backups with 7-day retention; ~$35/mo all-in with one always-on staging branch (~$9.82/mo, from $0.01344/branch-hour); PITR-7 a separate $100/mo add-on ("[API] pitr_7", the confirmed floor; the "+$15 compute" that would make it ~$115 is UNVERIFIED — do not quote $115). Your recorded calls: 2026-07-28 "Upgrade to Pro? yes, at launch — not today"; "Buy PITR on top? No… Revisit at a few GB"; 2026-08-31 (this task): deliberate deferral, revisit at launch prep. Gated on Pro: hardening-plan step 10 (Postgres upgrade) and any real staging DB or branching.
WHY IT IS ASKED NOW: docs/launch/LAUNCH-SCHEDULE.md (13 Sep, in main) recommends REVERSING the deferral — "buy Supabase Pro now, not at launch" — because a live unauthenticated delete function sits on a backup-less database. That premise is stale: the four destructive functions have been closed since 2026-07-30 (re-read tonight: delete_account_cascade, purge_account_analytics, drop_old_analytics_partitions, enforce_analytics_retention all anon_exec=false, authed_exec=false) and v_account_tier is fixed. The no-backups half is still true, and the 2026-07-28 deferral was explicitly justified as "mitigated rather than accepted" by the free dump — which has never been taken.

IF YOU SAY A (buy Pro now: ~$25/mo, ~$35 with the staging branch): I stage docs/runbooks/launch-day-database.md steps 1-5 (PITR stays "no"); keep the local dump running until the first platform backup is restore-tested.
IF YOU SAY B (keep deferring to launch): no purchase; the risk stays a launch gate, as this task already says.
MY READ: B on Pro, PROVIDED the free dump + restore rehearsal gets run this week — about 15 minutes, and a daytime session can do it as soon as 1Password is unlocked (no decision needed from you). Deferring Pro without ever running the dump is the one combination that leaves the database with zero copies anywhere, and every DDL apply waiting on you (e.g. t_b6fccf27) runs with no undo. If you would rather not do that, it is the argument for A. PITR: no.
SAFE TO ASSUME: nothing here is time-critical tonight; nothing purchased; the 2026-08-31 deferral stands until you say otherwise.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Database & Supabase

Verify point-in-time recovery is enabled