Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Database & Supabase·12 in this wave

Verify point-in-time recovery is enabledTo do · blocker Review anon-executable SECURITY DEFINER functionsDone · blocker Approve: Database & SupabaseTo do · blocker MATTHEW: profiles.visibility is nullable with no default, so any profile created without it reads as publicBlocked · blocker Fix v_account_tier security-definer viewTo do Fix allow-all RLS policy on checklists tableTo do URGENT: 202608081500_guard_analytics_rpc_callers.sql is merged to main and NOT applied to productionTo do Hardware-ready data modelDone Document Supabase backup policyTo do Document RLS test planTo do Soft-deleted public destinations stay readableTo do Confirm scan-event logging is rate-limited per destinationDone

Wave

Database & Supabase

Schema is already built (81 tables, 114 migrations, RLS on every table). This wave is the readiness pass plus three real gaps a live audit surfaced.

TacTile › Launch TacTile › Foundations › Database & Supabase

3/12 done9 open3 open blockers

Selected taskclear

Verify point-in-time recovery is enabled

To doOwner · ait_a2ccb527Blocker

Confirm PITR/backup retention is actually on in Supabase settings — unverified in the audit, and it gates the backup policy doc.

Unlocks 2Document Supabase backup policy Approve: Database & Supabase

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Verify point-in-time recovery is enabled** · to do · blocker

Confirm PITR/backup retention is actually on in Supabase settings — unverified in the audit, and it gates the backup policy doc.

Where it sits: TacTile › Launch TacTile › Foundations › Database & Supabase

## Unlocks 2

- Document Supabase backup policy
- Approve: Database & Supabase

## The brief on file

DECIDED 2026-08-31 (Matthew): NOT paying for Supabase Pro/PITR yet — deliberate deferral, revisit at launch prep. This moves it out of the blocked set (the wait was the spend decision; decided: not now). THE RISK IT CARRIES REMAINS UNCHANGED AND IS A LAUNCH GATE: pitr_enabled:false, backups:[], org plan free — verified 2026-07-28 via Management API. There is not one stored backup of production; a bad migration or dropped table is unrecoverable until this is bought. Do not be reassured by pg_settings/WAL archiving (platform infra, not a restorable window). Database-hardening plan step 10 (Postgres upgrade) is also gated on this. When revisited: Supabase Pro + PITR add-on on project xtzqmvfhtremtmbzykeq, then verify pitr_enabled:true via Management API and delete this paragraph.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Database & Supabase

Verify point-in-time recovery is enabled