Task: Confirm remote Supabase schema/API alignment and release preflight readiness

[KazanderDad]

Parent Goal: #74
Depends on: GitHub Environment confirmation where workflow needs remote Supabase settings
Blocks: Release-alignment workflow green state

Objective

Confirm remote Supabase schema/API alignment and release preflight readiness for TCOIN.

Expected Surfaces

• Remote Supabase project Data API schema exposure
• PostgREST schema cache reload path
• public, storage, graphql_public, indexer, and chain_data schemas
• wallet_release_health_v1 and related release-health RPCs

Scope

• Confirm schema/API exposure for Preview first, then Production.
• Prepare or run release-alignment workflow checks where safe.
• Ask for explicit approval before any linked Supabase write.

Non-Goals

• Do not silently run linked supabase db push, migration up, or schema writes.
• Do not mutate Production database state without explicit approval.

Guardrails

• Linked Supabase writes require separate approval at the moment of action.
• Read-only checks are preferred whenever sufficient.

Acceptance Criteria

• Remote schema/API readiness is confirmed or precise blockers are documented.
• PostgREST reload requirement is documented and executed only with approval if write-like.
• Evidence is added to Goal Goal: Align hosted release environments and remote Supabase readiness #74.

Validation Plan

• Release-alignment workflow and wallet preflight outputs.
• Read-only Supabase API/RPC checks where available.

Stop Condition

Stop after Supabase readiness or explicit linked-write blockers are recorded on Goal #74.

[KazanderDad]

Vetting Note

This issue is part of Sprint #78 and is vetted for the shared implementation branch/worktree below.

Implementation Worktree

• Repo: GreenPill-TO/Genero
• Base branch: origin/dev
• Worktree path: /Users/botmaster/src/greenpill-TO/Genero
• Worktree branch: codex/tcoin-production-launch-readiness
• Use this same worktree for related Sprint Sprint: TCOIN production launch readiness #78 issues: Goal: Align hosted release environments and remote Supabase readiness #74, Goal: Prove Preview sandbox smoke and Buy TCOIN sandbox #79, Goal: Prove Supabase-side worker scheduling #80, Goal: Prove Production smoke and live Buy TCOIN gate #81, and Tasks Task: Configure GitHub Environment secrets and vars for TCOIN release alignment #82-Task: Enforce live Buy TCOIN approval gate and disabled fallback #93.
• Worktree owner: Sprint Sprint: TCOIN production launch readiness #78 / sprint-orchestrator.
• Retain until: Sprint PR is merged and approved-cleanup completes.
• Cleanup owner: sprint-orchestrator via approved-cleanup.
• Do not implement the parent Sprint issue directly; implement unblocked Ready Task issues first, then validate their parent Goal.

Implementation Expectations

• Update code, docs, tests, and agent-context/session-log/ as relevant to the issue.
• Capture evidence directly on the relevant Goal issue, not in a separate evidence packet.
• Never print or persist secret values.
• Do not run linked Supabase writes without explicit just-in-time human approval.
• For UI/browser smoke, provide route/result notes and screenshots or comparable visual evidence when practical.

Issue Validator

After implementation, local validation, session-log update, and commit, the orchestrator must run issue-validator before moving high-risk Tasks or Goals to In Review.

Validator input should include: issue URL, parent issue URL, commit hash, worktree path, changed files summary, validation commands/results, smoke evidence, visual evidence where relevant, non-goals/guardrails, skipped checks, and residual risks.

Expected validator output: pass, pass-with-notes, or fail, with concise evidence and required fixes. The validator reports back to the orchestrator; the orchestrator moves Project status only after validation passes.

[KazanderDad]

Implementation evidence for Task #84

Read-only checks attempted:

• pnpm ops:wallet:preflight:supabase-remote
• pnpm exec tsx scripts/run-with-env-profile.ts .env.local-supabase-remote -- pnpm ops:torontocoin
• pnpm exec tsx scripts/run-with-env-profile.ts .env.local-supabase-remote -- pnpm ops:torontocoin:pools
• Direct DNS/fetch probe against the configured remote Supabase REST endpoint, without printing keys.

Result:

• All remote checks failed before schema/RPC validation with TypeError: fetch failed.
• Direct DNS lookup failed with getaddrinfo ENOTFOUND for the configured remote Supabase host.

Exact blocker:

• .env.local-supabase-remote points at a Supabase host that does not resolve from this environment. An operator must confirm whether the remote project URL is stale, the Supabase project is paused/deleted, DNS is unavailable, or the profile should point at a different Supabase project.

What was not reached because of the DNS blocker:

• wallet_release_health_v1 RPC validation.
• Data API schema exposure checks for public, storage, graphql_public, indexer, and chain_data.
• PostgREST schema cache reload validation.
• TorontoCoin ops/indexer health validation.

Boundary check:

• No linked Supabase writes were run.
• No supabase db push, migration, linked reset, schema write, or PostgREST reload was attempted.
• No secret values were printed or persisted.

[KazanderDad]

Issue Validator result

Result: pass-with-notes

Target issue: #84
Commit reviewed: abf8c97
Evidence reviewed:

• Task body and implementation evidence comment.
• Goal Goal: Align hosted release environments and remote Supabase readiness #74 evidence comment.
• Read-only wallet remote preflight output.
• TorontoCoin ops and pool compatibility outputs.
• Direct Node DNS/fetch probe output.
• Session-log commit diff.

Validation rerun/inspected:

• pnpm ops:wallet:preflight:supabase-remote failed before RPC/schema validation with TypeError: fetch failed.
• pnpm exec tsx scripts/run-with-env-profile.ts .env.local-supabase-remote -- pnpm ops:torontocoin failed with TypeError: fetch failed.
• pnpm exec tsx scripts/run-with-env-profile.ts .env.local-supabase-remote -- pnpm ops:torontocoin:pools failed with TypeError: fetch failed.
• Direct DNS/fetch probe failed with getaddrinfo ENOTFOUND for the configured remote Supabase host.

Boundary check:

• No linked Supabase writes were run.
• No PostgREST reload was attempted.
• No secret values were printed or persisted.

Notes:

• This passes the Task Task: Confirm remote Supabase schema/API alignment and release preflight readiness #84 stop condition only because the precise remote Supabase blocker is documented.
• Sprint implementation must pause before Preview smoke / worker / Production goals until the remote Supabase project URL is corrected, restored, or replaced and the read-only preflight can reach it.

Ready for Project status: In Review for Task #84; parent Goal #74 remains blocked pending operator action.

[KazanderDad]

Restored Supabase validation evidence for Task #84

Re-run after the Supabase projects were restored on 2026-07-19.

Read-only checks run:

• pnpm ops:wallet:preflight:supabase-remote
• pnpm exec tsx scripts/run-with-env-profile.ts .env.local-supabase-remote -- pnpm ops:torontocoin
• pnpm exec tsx scripts/run-with-env-profile.ts .env.local-supabase-remote -- pnpm ops:torontocoin:pools

Result:

• The previous DNS blocker is resolved; remote Supabase is reachable and the release-health/read paths are returning structured data.
• Remote readiness is still blocked by release-health/ops findings.

Current blockers from remote preflight:

• pg_cron is not installed in the target Supabase project.
• Cron job wallet-payment-request-links-cleanup is not configured.
• Indexer run control reports latest run status as error.

Current warnings from remote preflight:

• NEXT_PUBLIC_APP_ENVIRONMENT is development; use staging or production for a real go-live preflight.
• Onramp secrets are present while NEXT_PUBLIC_ENABLE_BUY_TCOIN_CHECKOUT=false; confirm dormant production secrets are intentional.
• Indexer active token set does not include the current runtime cplTCOIN address.

Current blockers from TorontoCoin ops checks:

• Indexer is not tracking the required cplTCOIN token.
• Toronto Swap Pool is expected to be indexed but is not currently tracked.
• Toronto's Circular Economy is expected to be indexed but is not currently tracked.
• Pool compatibility reports Toronto's Circular Economy preview as failed, plus both expected pools missing from the tracked-pool set.

Positive evidence:

• paymentRequestLinksReachable=true.
• Release-health RPC/schema access is reachable enough to report cleanup cron/indexer fields.
• Reserve route health is reported healthy by TorontoCoin ops checks.
• Indexer queue reports pending=0 and blocked=false.

Boundary check:

• No linked Supabase writes were run.
• No supabase db push, migration, linked reset, schema write, pg_cron install, cron job creation, or PostgREST reload was attempted.
• No secret values were printed or persisted.

Stop condition:

• Task Task: Confirm remote Supabase schema/API alignment and release preflight readiness #84 can now replace the stale DNS blocker with precise remote readiness blockers. Continuing to fix them requires explicit linked Supabase/operator approval and likely scheduler/indexer follow-up under Goal Goal: Prove Supabase-side worker scheduling #80.

[KazanderDad]

Issue Validator result after restored Supabase check

Result: pass-with-notes

Target issue: #84
Commit reviewed: 888ca50
Evidence reviewed:

• Restored Supabase validation evidence comment.
• Goal Goal: Align hosted release environments and remote Supabase readiness #74 restored validation evidence comment.
• Session-log commit diff.
• Read-only remote preflight/ops outputs from 2026-07-19.

Validation rerun/inspected:

• pnpm ops:wallet:preflight:supabase-remote now reaches the remote release-health RPC but fails on release blockers: missing pg_cron, missing wallet-payment-request-links-cleanup cron, and indexer latest status error.
• pnpm exec tsx scripts/run-with-env-profile.ts .env.local-supabase-remote -- pnpm ops:torontocoin now reaches chain/ops checks but fails because the required cplTCOIN token and expected pools are not tracked by the indexer.
• pnpm exec tsx scripts/run-with-env-profile.ts .env.local-supabase-remote -- pnpm ops:torontocoin:pools reaches pool compatibility checks but fails because expected pools are missing from the tracked-pool set.

Boundary check:

• No linked Supabase writes were run.
• No PostgREST reload, pg_cron install, cron creation, migration, or schema write was attempted.
• No secret values were printed or persisted.

Notes:

• The previous DNS blocker is resolved.
• Task Task: Confirm remote Supabase schema/API alignment and release preflight readiness #84 meets its stop condition by replacing the stale blocker with precise remote readiness blockers.
• Parent Goal Goal: Align hosted release environments and remote Supabase readiness #74 should not be considered launch-ready until a human/operator explicitly approves and completes the remaining linked Supabase/indexer/scheduler configuration work.

Ready for Project status: In Review for Task #84.

[KazanderDad]

Preview Supabase repair evidence after operator approval

Approved scope: linked Supabase changes for Preview TCOIN / GeneroDev only. No Production Supabase writes were run.

Remote changes performed:

• Enabled pg_cron in the linked Preview project.
• Scheduled wallet-payment-request-links-cleanup as active with 15 6 * * * and command select public.cleanup_payment_request_links();.
• Set PostgREST schema exposure for public,storage,graphql_public,indexer,chain_data and reloaded config/schema.
• Repaired TCOIN indexer metadata visibility for the two expected pools after the one-shot queue worker timed out without checkpoint progress.

Important scheduler note:

• The indexer touch queue worker was attempted twice and timed out/hung before checkpoint progress.
• I marked those queue attempts failed and used a narrow metadata visibility repair so release-health reads can validate pool/token visibility.
• The worker should not be scheduled yet; Goal Goal: Prove Supabase-side worker scheduling #80 still needs to inspect/fix bounded worker execution before enabling a recurring scheduler.

Validation after repair:

• pnpm ops:wallet:preflight:supabase-remote passed with blockers: [].
• pnpm exec tsx scripts/run-with-env-profile.ts .env.local-supabase-remote -- pnpm ops:torontocoin passed with releaseBlockers: [].
• pnpm exec tsx scripts/run-with-env-profile.ts .env.local-supabase-remote -- pnpm ops:torontocoin:pools passed with releaseBlockers: [].
• pnpm exec vitest run shared/lib/indexer/statusReadModel.test.ts passed.
• pnpm exec tsc --noEmit --pretty false passed.
• pnpm lint passed.
• pnpm test passed.
• git diff --check passed.

Remaining notes:

• Wallet preflight still warns that this remote profile is development, Buy TCOIN onramp secrets are present while checkout is disabled, and the newly created cron has no recent cron.job_run_details yet.
• The Circular Economy preview remains preview=fail, but it is not acceptanceEnabled, so it is not a release blocker in the current ops contract.