Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Database & Supabase·15 in this wave

Verify point-in-time recovery is enabledTo do · blocker Review anon-executable SECURITY DEFINER functionsDone · blocker Approve: Database & SupabaseTo do · blocker MATTHEW: profiles.visibility is nullable with no default, so any profile created without it reads as publicBlocked · blocker The RLS fixture expires 2026-09-30 and freezes main — only Matthew can refresh it (Touch ID)Done · blocker Fix v_account_tier security-definer viewDone Fix allow-all RLS policy on checklists tableDone URGENT: 202608081500_guard_analytics_rpc_callers.sql is merged to main and NOT applied to productionDone db_url and db_password now EXIST in 1Password — verify:rls-snapshot can run for the first timeTo do RLS snapshot fixture turns pnpm verify red for every branch on 5 Nov (30-day age limit)To do Hardware-ready data modelDone Document Supabase backup policyBlocked Document RLS test planDone Soft-deleted public destinations stay readableDone Confirm scan-event logging is rate-limited per destinationDone

Wave

Database & Supabase

Schema is already built (81 tables, 114 migrations, RLS on every table). This wave is the readiness pass plus three real gaps a live audit surfaced.

TacTile › Launch TacTile › Foundations › Database & Supabase

9/15 done6 open3 open blockers

Selected taskclear

The RLS fixture expires 2026-09-30 and freezes main — only Matthew can refresh it (Touch ID)

DoneOwner · met_bad39cbdBlocker

A dated, unavoidable gate failure eight days out. The refresh needs a live database credential, the credential needs biometric approval, and no agent session can supply it.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**The RLS fixture expires 2026-09-30 and freezes main — only Matthew can refresh it (Touch ID)** · done · blocker

A dated, unavoidable gate failure eight days out. The refresh needs a live database credential, the credential needs biometric approval, and no agent session can supply it.

Where it sits: TacTile › Launch TacTile › Foundations › Database & Supabase

## The brief on file

MATTHEW'S — and it is a CLOCK, not a judgement call. Measured 2026-09-22.

WHAT HAPPENS ON 2026-09-30. tests/unit/rls-cross-tenant.test.ts:101 sets MAX_FIXTURE_AGE_DAYS = 30 and
:298-312 asserts the fixture was regenerated inside that window. On origin/main,
tests/fixtures/rls/policy-snapshot.json carries generated_at = 2026-08-31T23:44:49Z. That is 22 days
old today and crosses 30 on 2026-09-30T23:44Z.

When it crosses, `verify:unit` goes RED. verify:unit is in the gate chain, gate.sh is the pre-push hook,
and the pre-push hook is THE ONLY MERGE GATE THIS REPO HAS (branch protection is unavailable on this
plan — both /protection and /rulesets 403). So main freezes for every session until the fixture is
refreshed.

CONFIRMED BY RUNNING IT, not inferred. The canonical checkout at ~/Command/tactile is behind
origin/main and carries the OLDER fixture (2026-08-09), so it is red there ALREADY:

  × the fixture is not stale > was regenerated within the last 30 days
    → the RLS snapshot was taken 44 days ago ... expected 44.504080625 to be less than or equal to 30
  Test Files  1 failed (1)
  Tests  1 failed | 21 passed (22)

The other 21 assertions pass. The guard is working exactly as designed — this is not a bug in it.

WHY NO AGENT CAN CLEAR THIS. The refresh is `pnpm verify:rls-snapshot --write`
(scripts/verify/rls-snapshot-fresh.mjs), which re-runs scripts/verify/rls-snapshot.sql against the LIVE
catalog. That needs the database credential. Measured today: `op read op://TacTile/Supabase/db_url`
HANGS indefinitely on biometric authorization and had to be killed. `op --version` returns 2.34.0
immediately, so the CLI is fine and the vault reference resolves — what is missing is a fingerprint at
this machine. (Note `timeout` does not exist on macOS, so a naive wrapper reports rc=127 and looks like
"op is not installed". It is installed.)

The field itself is NOT the blocker any more. AGENTS.md used to say db_url does not exist and three
briefs inherited that claim; it is real, and it is declared at docs/secrets/secrets.config.yaml:225.
Session 1 corrected the documentation (commit f3d35963, now in PR #619). So the ONLY thing standing
between this repo and its first-ever live RLS snapshot is Matthew being at the laptop.

WHAT TO DO, in order:
 1. `pnpm verify:rls-snapshot` WITHOUT --write first. It is read-only and diffs the live catalog against
    the fixture field-for-field. This has never been run by anyone, so the diff is genuinely unknown —
    and it is the only thing that can tell you whether the last 22 days of migrations moved the schema
    out from under the 21 assertions that are currently passing.
 2. Then `--write` to regenerate, and DELETE every KNOWN_* entry the refresh shows is fixed. Leaving a
    fixed KNOWN_* in place is how the fixture drifts back into lying.
 3. Commit the refreshed fixture.

DO NOT "FIX" THIS BY RAISING MAX_FIXTURE_AGE_DAYS. The constant's own comment at :96-100 says why:
"Shorter and the gate goes red on a schedule nobody can satisfy without database credentials ... Longer
and it stops forcing anything." Raising it converts a loud, dated, correct alarm into permanent silence
about whether production's RLS still looks like the file — and the file is ALL the cross-tenant suite
asserts against. A green run says the FIXTURE is safe, never that the database is.

STANDING RISK THIS EXPOSES, worth its own decision separately: this gate is unsatisfiable by any remote
or agent session by construction. Eight days of notice is the good case. If Matthew is routinely away
from the machine, the real fix is a credential path that does not require presence (a scoped CI secret
for the snapshot refresh), not a longer window.

[2026-09-27 restart audit] Done by #633 (e717f514, 2026-09-23): fixture generated_at 2026-09-23T17:22:41Z; next expiry 2026-10-23T17:22Z.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Database & Supabase

The RLS fixture expires 2026-09-30 and freezes main — only Matthew can refresh it (Touch ID)