docs(audits): issue ledger for the 2026-07 stabilization pass - #782
Merged
Conversation
Phase 14 of the HelmV3 stabilization brief — final deliverable. Classifies every issue named in the brief against evidence gathered this session. No issues closed automatically (recommendations only, per the brief's guardrail). Headline findings: - #516 (hardcoded service-role key) was marked closed but was NOT actually fixed — reopened in spirit via PR #774, key rotation is still an outstanding manual action. - #651, #728, and both #772 linked-lint findings verified resolved directly against production. - #736's "prevent recurrence" criterion was not actually met until this pass (PR #775) — the RPC layer never migrated off the gate model that caused the original incident. - #390 and #388 (CI runbook issues) were already fully closed and verified accurate — no new work needed. - #477, #442/#443, #415 gained regression coverage this pass (PR #776); #406 and true #442 concurrency are blocked on Docker not being available in this environment. Full PR list, dependency-PR triage (2 merged, 1 blocked on a real Review Gate failure, 6 left for individual review), and everything explicitly out of scope are listed at the bottom. Co-authored-by: Cursor <cursoragent@cursor.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
|
PR title or description contains an excluded keyword. |
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Summary by CodeRabbit
WalkthroughAdds a new documentation file, docs/audits/ISSUE_LEDGER_2026-07-03.md, recording a HelmV3 stabilization Phase 14 issue ledger across buckets (DB drift, data integrity, admin dashboard, CI, security, generated files, dead code, dependencies, git hygiene), listing shipped PRs and out-of-scope items. No code changes. ChangesIssue Ledger Documentation
Estimated code review effort: 1 (Trivial) | ~5 minutes Compact metadata:
Related issues: None specified Poem: 🚥 Pre-merge checks | ✅ 11 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (11 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
PR Summary by Qododocs(audits): add issue ledger for 2026-07 stabilization pass
AI Description
High-Level Assessment
Files changed (1)
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Code Review by Qodo
Context used✅ Tickets:
🎫 P0 SECURITY: production Supabase service_role key hardcoded in 9 tracked scripts 🎫 [Supabase] recalculate_baseball_season_stats live body drifted to stale column b.so — broke all callers (RESOLVED via hotfix; needs drift guard)✅ Compliance rules (platform):
97 rules 1. Nonexistent drift-check command
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| | Issue | Title | State | Classification | Evidence | Next action | | ||
| |---|---|---|---|---|---| | ||
| | #651 | Baseball schema drift (12 missing columns) | open | **fixed — needs evidence comment** | All 12 columns confirmed present via direct `information_schema.columns` query against production. Matching migrations exist on disk and in the remote ledger. See `docs/audits/SUPABASE_DRIFT_REPORT_2026-07-03.md`. | Comment with evidence + close. | | ||
| | #728 | `recalculate_baseball_season_stats` `b.so` drift | open | **fixed — needs regression** | Live function body has no `b.so` reference; now includes a coach-auth guard. Hotfix held. | Comment with evidence. Drift guard (`npm run db:drift:check`, PR #775) now asserts this on every run — closes the "needs regression" gap. | |
There was a problem hiding this comment.
2. Nonexistent drift-check command 🐞 Bug ⚙ Maintainability
The ledger claims a drift guard exists as npm run db:drift:check, but package.json defines no db:drift:check script, so the documented verification step will fail. This can also create false confidence that a runnable drift-check entry point exists when it does not.
Agent Prompt
### Issue description
`docs/audits/ISSUE_LEDGER_2026-07-03.md` references `npm run db:drift:check`, but that script is not present in `package.json`.
### Issue Context
This is presented as an always-on regression guard for #728 drift, so it needs to be runnable via the documented command (or the doc needs to reference the real command).
### Fix Focus Areas
- docs/audits/ISSUE_LEDGER_2026-07-03.md[18-18]
- package.json[5-58]
### What to change
- Option A (docs-only): Update the ledger to reference the correct existing script (if one already exists) or remove the claim.
- Option B (preferred if intended): Add a `db:drift:check` script to `package.json` that runs the actual drift guard implementation, and (if applicable) wire it into CI so the ledger statement is accurate.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Phase 14 (final deliverable) of the HelmV3 stabilization brief. Classifies every issue named in the brief against evidence gathered this session. No issues closed automatically — recommendations only, per the brief's guardrail.
Headline findings
main. Reopened in spirit via fix(security): remove live hardcoded service-role secrets from scripts (#516) #774; key rotation itself is still an outstanding manual action requiring Supabase dashboard access.information_schema/pg_proc.users.role='admin'gate that caused the original incident, so it was still fully reproducible.docker: command not found).Contents
scripts/__tests__wiring, remaining dependency PRs, stash cleanup).Related
This is the final PR of the stabilization sequence — #774, #775, #776, #777, #778, #779, #780, #781.
Made with Cursor