Production auth blocked by orphan privacy_workflow_owner role

[twoimo]

Summary

Production login/signup privacy onboarding is blocked by an orphan PostgreSQL role in Supabase project aqlcofblfxdrjhhdmarw.

Observed failures

• 42501 permission denied for table privacy_audit_events
• 42501 permission denied to set role "privacy_workflow_owner"
• Role: privacy_workflow_owner (dashboard role ID 1788689)
• Supabase migration workflow run: 30651920259
• Support ticket: SU-436093

Impact

The audited policy publication and onboarding RPCs cannot complete. Existing authenticated users without a current privacy eligibility receipt remain fail-closed, so login returns to the sign-in surface. New password and Google signup cannot finish audited onboarding.

Required provider action

Supabase must execute the exact manifest-bound G016 migration from protected main commit 58b758470f9d07a5968548c809ecd9118fbda262, or restore the minimum ownership authority required to execute it once. Terminal state must preserve privacy_workflow_owner as NOLOGIN, NOINHERIT, NOBYPASSRLS, with zero role membership in both directions.

Prohibited mitigations

• Do not delete or recreate the owner role.
• Do not disable or weaken RLS/FORCE RLS.
• Do not grant direct Data API access to retained privacy tables.
• Do not insert privacy/consent rows directly.
• Do not bypass auth eligibility in web code.

Execution plan

Code changes must converge all admission checks on the bounded live eligibility RPC receipt. The 16-account roster is classification-only: no age, guardian, policy, or marketing consent is fabricated. Ineligible accounts complete audited onboarding at next login.

[twoimo]

Implementation is ready in PR #2459.

Verified: 78 focused tests passed (1 skipped), focused ESLint passed, production build passed, architecture review CLEAR/CLEAR/CLEAR APPROVE. The web deployment remains intentionally stopped until the provider applies migrations 20260801000100 and 20260801000200 in order, supplies the canonical receipt digest, and hosted terminal readback succeeds. No privacy role deletion, RLS weakening, or fabricated consent/backfill was used.

[twoimo]

Production DB blocker confirmed via Supabase SQL Editor (2026-08-01): migration 20260713002500_g014_catalog_contract.sql is absent from supabase_migrations.schema_migrations. Applying it as dashboard postgres fails closed. The existing privacy_workflow_owner -> postgres membership is granted by supabase_admin; dashboard postgres cannot remove that provider-owned grant or satisfy the zero-membership workflow-owner contract. Even with temporary SET enabled, validation fails because dashboard postgres/owner cannot validate provider-owned public.account_deletion_requests constraints. All attempted migration bodies were transactional and rolled back; temporary SET was restored to FALSE. G014 catalog manifest and both G016 manifests remain absent. Required action: Supabase/provider privileged migration execution as supabase_admin, beginning with 20260713002500, then G016 00100/00200 and terminal readback. Do not bypass the manifest or weaken RLS/owner assertions.

[twoimo]

Post-deployment recovery audit update: production migration/policy readback is healthy and the original orphan-role incident is closed, but the broader controlled auth recovery release is not approved. PR #2464 remains source-merge BLOCKED after terminal architecture/red-team/critic review. Local gates passed (93 focused unit tests, TypeScript, lint, 8 Chromium Playwright cases, production build). Remaining source and external promotion blockers are recorded on PR #2464. No provider migration replay, consent/age/guardian/marketing mutation, or fabricated operator evidence was performed.