Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Foundations›Database & Supabase·12 in this wave

Verify point-in-time recovery is enabledTo do · blocker Review anon-executable SECURITY DEFINER functionsDone · blocker Approve: Database & SupabaseTo do · blocker MATTHEW: profiles.visibility is nullable with no default, so any profile created without it reads as publicBlocked · blocker Fix v_account_tier security-definer viewTo do Fix allow-all RLS policy on checklists tableTo do URGENT: 202608081500_guard_analytics_rpc_callers.sql is merged to main and NOT applied to productionTo do Hardware-ready data modelDone Document Supabase backup policyTo do Document RLS test planTo do Soft-deleted public destinations stay readableTo do Confirm scan-event logging is rate-limited per destinationDone

Wave

Database & Supabase

Schema is already built (81 tables, 114 migrations, RLS on every table). This wave is the readiness pass plus three real gaps a live audit surfaced.

TacTile › Launch TacTile › Foundations › Database & Supabase

3/12 done9 open3 open blockers

Selected taskclear

Fix v_account_tier security-definer view

To doOwner · Vivt_fb01dea1

View runs with creator privileges and bypasses the querying user's RLS. Found by live audit.

Unlocks 2Document RLS test plan Approve: Database & Supabase

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Fix v_account_tier security-definer view** · to do

View runs with creator privileges and bypasses the querying user's RLS. Found by live audit.

Where it sits: TacTile › Launch TacTile › Foundations › Database & Supabase

## Unlocks 2

- Document RLS test plan
- Approve: Database & Supabase

## The brief on file

REOPENED 2026-08-09 — closed as done; three independent refutation routes all failed to find the work.

Row: "Fix v_account_tier security-definer view". Its closure note said the only remaining ask was "the migration is UNTRACKED in git, commit it" and that it was tracked. The verifier could not confirm the underlying view is actually fixed in production, and the migration reconstruction is not present.

**Do not re-close this on the tracked-file question.** That was the closure's mistake: it answered a bookkeeping sub-question and treated it as the whole row. The row is about a SECURITY DEFINER view in `public`, which is the shape `verify:migration-grants` exists to catch — a view created without `security_invoker` runs with the definer's privileges and bypasses the caller's RLS.

WHAT TO ESTABLISH FIRST, before writing any migration:
 1. What does the LIVE view look like? `pg_get_viewdef` plus `reloptions` on `v_account_tier` will say whether `security_invoker` is set. That needs database credentials — 1Password is currently unavailable (`op read` returns an authorization timeout), so if you cannot read it, say so and stop rather than guessing from the tree.
 2. Which migration in `supabase/migrations/` last defined or altered it, and does that file's DDL match what production has? This repo has already found a fixture and a database disagreeing for ten days.

THEN, and only then, write the corrective migration. **Do not apply it** — production has `pitr_enabled:false` and zero stored backups; applying is Matthew's.

If the live view turns out to be correct and only the repo's record of it is wrong, that is a fine outcome — close it on THAT evidence, with the `pg_get_viewdef` output quoted, not on a file being tracked.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Database & Supabase

Fix v_account_tier security-definer view