sinapse-ai 7.7.10 → 8.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (91) hide show
  1. package/.claude/CLAUDE.md +10 -10
  2. package/.claude/rules/agent-authority.md +7 -7
  3. package/.claude/rules/agent-memory-imports.md +3 -1
  4. package/.claude/rules/coderabbit-integration.md +1 -0
  5. package/.claude/rules/mandatory-delegation.md +10 -10
  6. package/.claude/rules/mcp-usage.md +1 -1
  7. package/.claude/rules/security-data-protection.md +2 -2
  8. package/.claude/rules/security-scanning.md +10 -0
  9. package/.claude/rules/tool-response-filtering.md +1 -0
  10. package/.sinapse-ai/data/entity-registry.yaml +823 -877
  11. package/.sinapse-ai/data/registry-update-log.jsonl +36 -0
  12. package/.sinapse-ai/data/rls-security-patterns.md +384 -0
  13. package/.sinapse-ai/data/sinapse-kb.md +1 -1
  14. package/.sinapse-ai/development/agents/analyst.md +2 -2
  15. package/.sinapse-ai/development/agents/product-lead/MEMORY.md +1 -1
  16. package/.sinapse-ai/development/agents/product-lead.md +4 -4
  17. package/.sinapse-ai/development/agents/project-lead.md +2 -2
  18. package/.sinapse-ai/development/agents/sprint-lead.md +3 -3
  19. package/.sinapse-ai/development/tasks/analyze-project-structure.md +3 -3
  20. package/.sinapse-ai/development/tasks/create-service.md +1 -1
  21. package/.sinapse-ai/development/tasks/create-worktree.md +1 -1
  22. package/.sinapse-ai/development/tasks/environment-bootstrap.md +1 -1
  23. package/.sinapse-ai/development/tasks/execute-epic-plan.md +5 -5
  24. package/.sinapse-ai/development/tasks/extract-patterns.md +1 -1
  25. package/.sinapse-ai/development/tasks/ids-governor.md +1 -1
  26. package/.sinapse-ai/development/tasks/init-project-status.md +1 -1
  27. package/.sinapse-ai/development/tasks/list-worktrees.md +1 -1
  28. package/.sinapse-ai/development/tasks/next.md +1 -1
  29. package/.sinapse-ai/development/tasks/patterns.md +1 -1
  30. package/.sinapse-ai/development/tasks/plan-create-context.md +1 -1
  31. package/.sinapse-ai/development/tasks/plan-create-implementation.md +1 -1
  32. package/.sinapse-ai/development/tasks/plan-execute-subtask.md +1 -1
  33. package/.sinapse-ai/development/tasks/qa-fix-issues.md +1 -1
  34. package/.sinapse-ai/development/tasks/remove-worktree.md +1 -1
  35. package/.sinapse-ai/development/tasks/setup-github.md +1 -1
  36. package/.sinapse-ai/development/tasks/setup-llm-routing.md +1 -1
  37. package/.sinapse-ai/development/tasks/setup-mcp-docker.md +1 -1
  38. package/.sinapse-ai/development/tasks/spec-assess-complexity.md +1 -1
  39. package/.sinapse-ai/development/tasks/spec-critique.md +1 -1
  40. package/.sinapse-ai/development/tasks/spec-gather-requirements.md +1 -1
  41. package/.sinapse-ai/development/tasks/spec-research-dependencies.md +1 -1
  42. package/.sinapse-ai/development/tasks/spec-write-spec.md +1 -1
  43. package/.sinapse-ai/development/tasks/story-checkpoint.md +1 -1
  44. package/.sinapse-ai/development/tasks/update-sinapse.md +1 -1
  45. package/.sinapse-ai/development/tasks/validate-tech-preset.md +1 -1
  46. package/.sinapse-ai/development/tasks/verify-subtask.md +1 -1
  47. package/.sinapse-ai/infrastructure/scripts/validate-codex-delegation.js +1 -1
  48. package/.sinapse-ai/install-manifest.yaml +78 -74
  49. package/README.md +341 -215
  50. package/bin/utils/staged-secret-scan.js +5 -0
  51. package/docs/architecture-overview.md +239 -0
  52. package/docs/community.md +2 -2
  53. package/docs/feature-process.md +162 -0
  54. package/docs/getting-started.md +115 -231
  55. package/docs/guides/agent-reference.md +203 -0
  56. package/docs/guides/{MEMORY-INTEGRATION.md → memory-integration.md} +2 -2
  57. package/docs/guides/{MEMORY-INTELLIGENCE-SYSTEM.md → memory-intelligence-system.md} +3 -3
  58. package/docs/guides/workflows-overview.md +282 -0
  59. package/docs/guiding-principles.md +188 -0
  60. package/docs/legal/license-clarification.md +120 -15
  61. package/docs/legal/privacy.md +93 -80
  62. package/docs/legal/terms.md +90 -103
  63. package/docs/{ORQX-PLAN.md → orqx-plan.md} +15 -15
  64. package/docs/pt/FEATURE_PROCESS.md +2 -2
  65. package/docs/pt/GUIDING-PRINCIPLES.md +2 -2
  66. package/docs/pt/community.md +2 -2
  67. package/docs/pt/roadmap.md +2 -2
  68. package/docs/pt/security.md +215 -79
  69. package/docs/roadmap.md +2 -2
  70. package/docs/security/{PR_SECURITY_CHECKLIST.md → pr-security-checklist.md} +1 -1
  71. package/docs/security.md +215 -79
  72. package/package.json +1 -1
  73. package/packages/installer/src/manifest-signature.js +194 -0
  74. package/squads/claude-code-mastery/agents/config-engineer.md +7 -7
  75. package/squads/claude-code-mastery/agents/hooks-architect.md +4 -4
  76. package/squads/claude-code-mastery/agents/mcp-integrator.md +6 -6
  77. package/squads/claude-code-mastery/agents/project-integrator.md +8 -8
  78. package/squads/claude-code-mastery/agents/roadmap-sentinel.md +7 -7
  79. package/squads/claude-code-mastery/agents/skill-craftsman.md +10 -10
  80. package/squads/claude-code-mastery/agents/swarm-orqx.md +4 -4
  81. package/squads/squad-brand/agents/brand-creative-engineer.md +1 -1
  82. package/squads/squad-brand/agents/brand-motion-vfx.md +1 -1
  83. package/squads/squad-brand/agents/brand-sonic-designer.md +1 -1
  84. package/squads/squad-brand/agents/brand-system-architect.md +2 -2
  85. package/docs/FEATURE_PROCESS.md +0 -93
  86. package/docs/GUIDING-PRINCIPLES.md +0 -95
  87. /package/docs/{CHANGELOG.md → changelog.md} +0 -0
  88. /package/docs/guides/{IDS-CONCEITOS-EXPLICADOS.md → ids-conceitos-explicados.md} +0 -0
  89. /package/docs/guides/{MEMORY-SYSTEM.md → memory-system.md} +0 -0
  90. /package/docs/security/{MANIFEST_SIGNING.md → manifest-signing.md} +0 -0
  91. /package/docs/{SQUAD-COMMANDS-REFERENCE.md → squad-commands-reference.md} +0 -0
@@ -574,3 +574,39 @@
574
574
  {"timestamp":"2026-04-03T02:10:30.505Z","action":"change","path":".sinapse-ai/core/health-check/checks/project/constitution-consistency.js","trigger":"watcher"}
575
575
  {"timestamp":"2026-04-03T02:10:30.506Z","action":"change","path":".sinapse-ai/product/templates/ide-rules/claude-rules.md","trigger":"watcher"}
576
576
  {"timestamp":"2026-04-03T03:23:08.944Z","action":"change","path":".sinapse-ai/development/agents/sinapse-orqx.md","trigger":"watcher"}
577
+ {"timestamp":"2026-04-03T07:21:28.300Z","action":"add","path":".sinapse-ai/data/rls-security-patterns.md","trigger":"watcher"}
578
+ {"timestamp":"2026-04-03T07:21:28.300Z","action":"change","path":".sinapse-ai/development/agents/analyst.md","trigger":"watcher"}
579
+ {"timestamp":"2026-04-03T07:21:28.301Z","action":"change","path":".sinapse-ai/development/agents/product-lead.md","trigger":"watcher"}
580
+ {"timestamp":"2026-04-03T07:21:28.301Z","action":"change","path":".sinapse-ai/development/agents/product-lead/MEMORY.md","trigger":"watcher"}
581
+ {"timestamp":"2026-04-03T07:21:28.302Z","action":"change","path":".sinapse-ai/development/agents/project-lead.md","trigger":"watcher"}
582
+ {"timestamp":"2026-04-03T07:21:28.302Z","action":"change","path":".sinapse-ai/development/agents/sprint-lead.md","trigger":"watcher"}
583
+ {"timestamp":"2026-04-03T15:12:00.693Z","action":"change","path":".sinapse-ai/development/tasks/analyze-project-structure.md","trigger":"watcher"}
584
+ {"timestamp":"2026-04-03T15:12:00.694Z","action":"change","path":".sinapse-ai/development/tasks/create-service.md","trigger":"watcher"}
585
+ {"timestamp":"2026-04-03T15:12:00.694Z","action":"change","path":".sinapse-ai/development/tasks/create-worktree.md","trigger":"watcher"}
586
+ {"timestamp":"2026-04-03T15:12:00.695Z","action":"change","path":".sinapse-ai/development/tasks/environment-bootstrap.md","trigger":"watcher"}
587
+ {"timestamp":"2026-04-03T15:12:00.695Z","action":"change","path":".sinapse-ai/development/tasks/execute-epic-plan.md","trigger":"watcher"}
588
+ {"timestamp":"2026-04-03T15:12:00.696Z","action":"change","path":".sinapse-ai/development/tasks/extract-patterns.md","trigger":"watcher"}
589
+ {"timestamp":"2026-04-03T15:12:00.696Z","action":"change","path":".sinapse-ai/development/tasks/ids-governor.md","trigger":"watcher"}
590
+ {"timestamp":"2026-04-03T15:12:00.696Z","action":"change","path":".sinapse-ai/development/tasks/init-project-status.md","trigger":"watcher"}
591
+ {"timestamp":"2026-04-03T15:12:00.696Z","action":"change","path":".sinapse-ai/development/tasks/list-worktrees.md","trigger":"watcher"}
592
+ {"timestamp":"2026-04-03T15:12:00.697Z","action":"change","path":".sinapse-ai/development/tasks/next.md","trigger":"watcher"}
593
+ {"timestamp":"2026-04-03T15:12:00.697Z","action":"change","path":".sinapse-ai/development/tasks/patterns.md","trigger":"watcher"}
594
+ {"timestamp":"2026-04-03T15:12:00.697Z","action":"change","path":".sinapse-ai/development/tasks/plan-create-context.md","trigger":"watcher"}
595
+ {"timestamp":"2026-04-03T15:12:00.698Z","action":"change","path":".sinapse-ai/development/tasks/plan-create-implementation.md","trigger":"watcher"}
596
+ {"timestamp":"2026-04-03T15:12:00.698Z","action":"change","path":".sinapse-ai/development/tasks/plan-execute-subtask.md","trigger":"watcher"}
597
+ {"timestamp":"2026-04-03T15:12:00.699Z","action":"change","path":".sinapse-ai/development/tasks/qa-fix-issues.md","trigger":"watcher"}
598
+ {"timestamp":"2026-04-03T15:12:00.699Z","action":"change","path":".sinapse-ai/development/tasks/remove-worktree.md","trigger":"watcher"}
599
+ {"timestamp":"2026-04-03T15:12:00.699Z","action":"change","path":".sinapse-ai/development/tasks/setup-github.md","trigger":"watcher"}
600
+ {"timestamp":"2026-04-03T15:12:00.700Z","action":"change","path":".sinapse-ai/development/tasks/setup-llm-routing.md","trigger":"watcher"}
601
+ {"timestamp":"2026-04-03T15:12:00.700Z","action":"change","path":".sinapse-ai/development/tasks/setup-mcp-docker.md","trigger":"watcher"}
602
+ {"timestamp":"2026-04-03T15:12:00.700Z","action":"change","path":".sinapse-ai/development/tasks/spec-assess-complexity.md","trigger":"watcher"}
603
+ {"timestamp":"2026-04-03T15:12:00.701Z","action":"change","path":".sinapse-ai/development/tasks/spec-critique.md","trigger":"watcher"}
604
+ {"timestamp":"2026-04-03T15:12:00.701Z","action":"change","path":".sinapse-ai/development/tasks/spec-gather-requirements.md","trigger":"watcher"}
605
+ {"timestamp":"2026-04-03T15:12:00.701Z","action":"change","path":".sinapse-ai/development/tasks/spec-research-dependencies.md","trigger":"watcher"}
606
+ {"timestamp":"2026-04-03T15:12:00.701Z","action":"change","path":".sinapse-ai/development/tasks/spec-write-spec.md","trigger":"watcher"}
607
+ {"timestamp":"2026-04-03T15:12:00.702Z","action":"change","path":".sinapse-ai/development/tasks/story-checkpoint.md","trigger":"watcher"}
608
+ {"timestamp":"2026-04-03T15:12:00.702Z","action":"change","path":".sinapse-ai/development/tasks/update-sinapse.md","trigger":"watcher"}
609
+ {"timestamp":"2026-04-03T15:12:00.702Z","action":"change","path":".sinapse-ai/development/tasks/validate-tech-preset.md","trigger":"watcher"}
610
+ {"timestamp":"2026-04-03T15:12:00.702Z","action":"change","path":".sinapse-ai/development/tasks/verify-subtask.md","trigger":"watcher"}
611
+ {"timestamp":"2026-04-03T15:13:09.088Z","action":"change","path":".sinapse-ai/data/sinapse-kb.md","trigger":"watcher"}
612
+ {"timestamp":"2026-04-03T17:07:46.494Z","action":"change","path":".sinapse-ai/infrastructure/scripts/validate-codex-delegation.js","trigger":"watcher"}
@@ -0,0 +1,384 @@
1
+ # RLS Security Patterns Reference
2
+
3
+ > Standalone reference for @data-engineer (Tensor)
4
+ > Constitution Article X -- Security and Data Protection
5
+
6
+ ---
7
+
8
+ ## What is RLS
9
+
10
+ Row Level Security (RLS) is a database feature that restricts which rows a user can access in a table. In Supabase and PostgreSQL, RLS policies are the primary mechanism for data isolation between users, organizations, and roles.
11
+
12
+ **Rule:** Every table that stores user data MUST have RLS enabled. No exceptions.
13
+
14
+ ---
15
+
16
+ ## Pattern 1: Basic User Isolation
17
+
18
+ The most common pattern. Each user can only see and modify their own data.
19
+
20
+ ```sql
21
+ -- Enable RLS on the table
22
+ ALTER TABLE user_profiles ENABLE ROW LEVEL SECURITY;
23
+
24
+ -- Policy: users can only read their own rows
25
+ CREATE POLICY "users_read_own_data"
26
+ ON user_profiles
27
+ FOR SELECT
28
+ USING (auth.uid() = user_id);
29
+
30
+ -- Policy: users can only insert rows with their own user_id
31
+ CREATE POLICY "users_insert_own_data"
32
+ ON user_profiles
33
+ FOR INSERT
34
+ WITH CHECK (auth.uid() = user_id);
35
+
36
+ -- Policy: users can only update their own rows
37
+ CREATE POLICY "users_update_own_data"
38
+ ON user_profiles
39
+ FOR UPDATE
40
+ USING (auth.uid() = user_id)
41
+ WITH CHECK (auth.uid() = user_id);
42
+
43
+ -- Policy: users can only delete their own rows
44
+ CREATE POLICY "users_delete_own_data"
45
+ ON user_profiles
46
+ FOR DELETE
47
+ USING (auth.uid() = user_id);
48
+ ```
49
+
50
+ **When to use:** Personal data, user settings, individual records.
51
+
52
+ **Key point:** Always include both `USING` (which rows to read) and `WITH CHECK` (which rows to write) on UPDATE policies.
53
+
54
+ ---
55
+
56
+ ## Pattern 2: Organization-Based Access
57
+
58
+ Users belong to organizations and can see all data within their organization.
59
+
60
+ ```sql
61
+ ALTER TABLE projects ENABLE ROW LEVEL SECURITY;
62
+
63
+ -- Policy: users can see projects in their organization
64
+ CREATE POLICY "org_members_read_projects"
65
+ ON projects
66
+ FOR SELECT
67
+ USING (
68
+ organization_id IN (
69
+ SELECT org_id FROM organization_members
70
+ WHERE member_user_id = auth.uid()
71
+ )
72
+ );
73
+
74
+ -- Policy: users can create projects in their organization
75
+ CREATE POLICY "org_members_create_projects"
76
+ ON projects
77
+ FOR INSERT
78
+ WITH CHECK (
79
+ organization_id IN (
80
+ SELECT org_id FROM organization_members
81
+ WHERE member_user_id = auth.uid()
82
+ )
83
+ );
84
+ ```
85
+
86
+ **Performance tip:** Use a security definer function to avoid repeated subqueries:
87
+
88
+ ```sql
89
+ -- Helper function (runs with elevated privileges)
90
+ CREATE OR REPLACE FUNCTION auth.user_org_ids()
91
+ RETURNS SETOF uuid
92
+ LANGUAGE sql
93
+ SECURITY DEFINER
94
+ STABLE
95
+ AS $$
96
+ SELECT org_id FROM organization_members
97
+ WHERE member_user_id = auth.uid()
98
+ $$;
99
+
100
+ -- Simplified policy using the helper
101
+ CREATE POLICY "org_members_read_projects"
102
+ ON projects
103
+ FOR SELECT
104
+ USING (organization_id IN (SELECT auth.user_org_ids()));
105
+ ```
106
+
107
+ **When to use:** Multi-tenant applications, team workspaces, shared resources.
108
+
109
+ ---
110
+
111
+ ## Pattern 3: Role-Based Access
112
+
113
+ Different roles within an organization have different access levels.
114
+
115
+ ```sql
116
+ ALTER TABLE documents ENABLE ROW LEVEL SECURITY;
117
+
118
+ -- Admins can do everything
119
+ CREATE POLICY "admins_full_access"
120
+ ON documents
121
+ FOR ALL
122
+ USING (
123
+ EXISTS (
124
+ SELECT 1 FROM organization_members
125
+ WHERE member_user_id = auth.uid()
126
+ AND org_id = documents.organization_id
127
+ AND role = 'admin'
128
+ )
129
+ );
130
+
131
+ -- Editors can read and update, but not delete
132
+ CREATE POLICY "editors_read_update"
133
+ ON documents
134
+ FOR SELECT
135
+ USING (
136
+ EXISTS (
137
+ SELECT 1 FROM organization_members
138
+ WHERE member_user_id = auth.uid()
139
+ AND org_id = documents.organization_id
140
+ AND role IN ('admin', 'editor')
141
+ )
142
+ );
143
+
144
+ CREATE POLICY "editors_update"
145
+ ON documents
146
+ FOR UPDATE
147
+ USING (
148
+ EXISTS (
149
+ SELECT 1 FROM organization_members
150
+ WHERE member_user_id = auth.uid()
151
+ AND org_id = documents.organization_id
152
+ AND role IN ('admin', 'editor')
153
+ )
154
+ );
155
+
156
+ -- Viewers can only read
157
+ CREATE POLICY "viewers_read"
158
+ ON documents
159
+ FOR SELECT
160
+ USING (
161
+ EXISTS (
162
+ SELECT 1 FROM organization_members
163
+ WHERE member_user_id = auth.uid()
164
+ AND org_id = documents.organization_id
165
+ AND role IN ('admin', 'editor', 'viewer')
166
+ )
167
+ );
168
+ ```
169
+
170
+ **When to use:** Applications with distinct permission levels (admin, editor, viewer).
171
+
172
+ **Key point:** Define policies from most restrictive to least restrictive. Each policy is OR-ed -- if any policy grants access, access is granted.
173
+
174
+ ---
175
+
176
+ ## Pattern 4: Public and Private Data
177
+
178
+ Some data is public (visible to all), while other data is private.
179
+
180
+ ```sql
181
+ ALTER TABLE posts ENABLE ROW LEVEL SECURITY;
182
+
183
+ -- Anyone can read published posts (including anonymous users)
184
+ CREATE POLICY "public_posts_readable"
185
+ ON posts
186
+ FOR SELECT
187
+ USING (status = 'published');
188
+
189
+ -- Authors can read their own drafts
190
+ CREATE POLICY "authors_read_own_drafts"
191
+ ON posts
192
+ FOR SELECT
193
+ USING (author_id = auth.uid());
194
+
195
+ -- Authors can update their own posts
196
+ CREATE POLICY "authors_update_own"
197
+ ON posts
198
+ FOR UPDATE
199
+ USING (author_id = auth.uid())
200
+ WITH CHECK (author_id = auth.uid());
201
+ ```
202
+
203
+ **When to use:** Blogs, content platforms, marketplaces with public listings.
204
+
205
+ ---
206
+
207
+ ## Service Role Usage Guidelines
208
+
209
+ ### What is service_role
210
+
211
+ The `service_role` key bypasses all RLS policies. It has full, unrestricted access to every row in every table.
212
+
213
+ ### Rules
214
+
215
+ | Rule | Severity |
216
+ |------|----------|
217
+ | NEVER use service_role in frontend code | ABSOLUTE BLOCKER |
218
+ | NEVER expose service_role in client-side bundles | ABSOLUTE BLOCKER |
219
+ | Use service_role ONLY in server-side code | REQUIRED |
220
+ | Use service_role ONLY for admin operations | REQUIRED |
221
+ | Prefer anon key + RLS for all user-facing queries | REQUIRED |
222
+
223
+ ### Appropriate Uses
224
+
225
+ ```javascript
226
+ // SERVER-SIDE ONLY (Edge Functions, API routes, cron jobs)
227
+
228
+ // Admin dashboard: list all users (requires service_role)
229
+ const { data } = await supabaseAdmin
230
+ .from('user_profiles')
231
+ .select('id, email, created_at');
232
+
233
+ // System operations: clean up expired sessions
234
+ const { error } = await supabaseAdmin
235
+ .from('sessions')
236
+ .delete()
237
+ .lt('expires_at', new Date().toISOString());
238
+ ```
239
+
240
+ ### Inappropriate Uses (BLOCKED)
241
+
242
+ ```javascript
243
+ // FRONTEND CODE -- NEVER DO THIS
244
+ import { createClient } from '@supabase/supabase-js';
245
+
246
+ // This exposes service_role to every user
247
+ const supabase = createClient(url, process.env.SUPABASE_SERVICE_ROLE_KEY);
248
+ ```
249
+
250
+ ---
251
+
252
+ ## Common RLS Anti-Patterns
253
+
254
+ ### 1. Forgetting to Enable RLS
255
+
256
+ ```sql
257
+ -- Table created without RLS -- ALL data is public by default
258
+ CREATE TABLE sensitive_data (
259
+ id uuid PRIMARY KEY,
260
+ user_id uuid REFERENCES auth.users(id),
261
+ secret_info text
262
+ );
263
+ -- Missing: ALTER TABLE sensitive_data ENABLE ROW LEVEL SECURITY;
264
+ ```
265
+
266
+ **Fix:** Always enable RLS immediately after CREATE TABLE.
267
+
268
+ ### 2. Overly Permissive Policies
269
+
270
+ ```sql
271
+ -- BAD: Allows any authenticated user to read ALL rows
272
+ CREATE POLICY "bad_policy"
273
+ ON user_data
274
+ FOR SELECT
275
+ USING (auth.uid() IS NOT NULL);
276
+ ```
277
+
278
+ **Fix:** Always filter by user_id, org_id, or role.
279
+
280
+ ### 3. Missing WITH CHECK on Write Policies
281
+
282
+ ```sql
283
+ -- BAD: User can read own rows but insert rows for OTHER users
284
+ CREATE POLICY "incomplete_insert"
285
+ ON user_data
286
+ FOR INSERT
287
+ WITH CHECK (true); -- No restriction on who can insert what
288
+ ```
289
+
290
+ **Fix:** Always include `WITH CHECK (auth.uid() = user_id)` on INSERT/UPDATE.
291
+
292
+ ### 4. Using FOR ALL Without Thinking
293
+
294
+ ```sql
295
+ -- DANGEROUS: Grants read + write + delete to everyone matching
296
+ CREATE POLICY "too_broad"
297
+ ON orders
298
+ FOR ALL
299
+ USING (customer_id = auth.uid());
300
+ ```
301
+
302
+ **Concern:** Users can delete their own orders, which may not be desired.
303
+
304
+ **Fix:** Create separate policies for SELECT, INSERT, UPDATE, and DELETE.
305
+
306
+ ### 5. N+1 Subquery Performance
307
+
308
+ ```sql
309
+ -- SLOW: Runs a subquery for EVERY row
310
+ CREATE POLICY "slow_policy"
311
+ ON documents
312
+ FOR SELECT
313
+ USING (
314
+ organization_id IN (
315
+ SELECT org_id FROM org_members WHERE user_id = auth.uid()
316
+ )
317
+ );
318
+ ```
319
+
320
+ **Fix:** Use a SECURITY DEFINER helper function (see Pattern 2) or a materialized view for complex access patterns.
321
+
322
+ ---
323
+
324
+ ## Testing RLS Policies
325
+
326
+ ### Manual Testing with Role Switching
327
+
328
+ ```sql
329
+ -- Test as a specific user
330
+ SET request.jwt.claim.sub = 'user-uuid-here';
331
+ SET role = 'authenticated';
332
+
333
+ -- Run a query -- should only return rows for that user
334
+ SELECT * FROM user_profiles;
335
+
336
+ -- Reset
337
+ RESET role;
338
+ RESET request.jwt.claim.sub;
339
+ ```
340
+
341
+ ### Automated Testing Approach
342
+
343
+ ```javascript
344
+ // In Jest tests with Supabase client
345
+ describe('RLS Policies', () => {
346
+ it('user can only see own profile', async () => {
347
+ // Create client as User A
348
+ const clientA = createClient(url, anonKey, {
349
+ global: { headers: { Authorization: `Bearer ${tokenA}` } }
350
+ });
351
+
352
+ // Insert profile for User A
353
+ await clientA.from('profiles').insert({ user_id: userAId, name: 'A' });
354
+
355
+ // Create client as User B
356
+ const clientB = createClient(url, anonKey, {
357
+ global: { headers: { Authorization: `Bearer ${tokenB}` } }
358
+ });
359
+
360
+ // User B should NOT see User A's profile
361
+ const { data } = await clientB
362
+ .from('profiles')
363
+ .select('*')
364
+ .eq('user_id', userAId);
365
+
366
+ expect(data).toHaveLength(0);
367
+ });
368
+ });
369
+ ```
370
+
371
+ ### Verification Checklist
372
+
373
+ - [ ] Every table with user data has RLS enabled
374
+ - [ ] SELECT policies filter by user_id, org_id, or role
375
+ - [ ] INSERT policies use WITH CHECK to validate ownership
376
+ - [ ] UPDATE policies use both USING and WITH CHECK
377
+ - [ ] DELETE policies are intentionally scoped (not too broad)
378
+ - [ ] service_role is NOT referenced in any frontend file
379
+ - [ ] Helper functions use SECURITY DEFINER where needed
380
+ - [ ] Policies are tested with multiple user contexts
381
+
382
+ ---
383
+
384
+ *Last updated: 2026-04-03*
@@ -838,7 +838,7 @@ For full details, see `CONTRIBUTING.md`. Key points:
838
838
  - Atomic commits - one logical change per commit
839
839
  - Must align with guiding principles
840
840
 
841
- **Core Principles** (from docs/GUIDING-PRINCIPLES.md):
841
+ **Core Principles** (from docs/guiding-principles.md):
842
842
 
843
843
  - **Dev Agents Must Be Lean**: Minimize dependencies, save context for code
844
844
  - **Natural Language First**: Everything in markdown, no code in core
@@ -224,7 +224,7 @@ Type `*help` to see all commands, or `*yolo` to skip confirmations.
224
224
  **I collaborate with:**
225
225
 
226
226
  - **@project-lead (Beacon):** Provides research and analysis to support PRD creation
227
- - **@product-lead (Pax):** Provides market insights and competitive analysis
227
+ - **@product-lead (Axis):** Provides market insights and competitive analysis
228
228
 
229
229
  **When to use others:**
230
230
 
@@ -266,6 +266,6 @@ Type `*help` to see all commands, or `*yolo` to skip confirmations.
266
266
  ### Related Agents
267
267
 
268
268
  - **@project-lead (Beacon)** - Primary consumer of research
269
- - **@product-lead (Pax)** - May request market insights
269
+ - **@product-lead (Axis)** - May request market insights
270
270
 
271
271
  ---
@@ -1,4 +1,4 @@
1
- # PO Agent Memory (Pax)
1
+ # PO Agent Memory (Axis)
2
2
 
3
3
  ## Active Patterns
4
4
  <!-- Current, verified patterns used by this agent -->
@@ -51,7 +51,7 @@ activation-instructions:
51
51
  - STAY IN CHARACTER!
52
52
  - CRITICAL: On activation, ONLY greet user and then HALT to await user requested assistance or given commands. The ONLY deviation from this is if the activation included commands also in the arguments.
53
53
  agent:
54
- name: Pax
54
+ name: Axis
55
55
  id: product-lead
56
56
  title: Product Owner
57
57
  icon: 🎯
@@ -77,10 +77,10 @@ persona_profile:
77
77
 
78
78
  greeting_levels:
79
79
  minimal: '🎯 po Agent ready'
80
- named: "🎯 Pax (Balancer) ready. Let's prioritize together!"
81
- archetypal: '🎯 Pax the Balancer ready to balance!'
80
+ named: "🎯 Axis (Balancer) ready. Let's prioritize together!"
81
+ archetypal: '🎯 Axis the Balancer ready to balance!'
82
82
 
83
- signature_closing: '— Pax, equilibrando prioridades 🎯'
83
+ signature_closing: '— Axis, equilibrando prioridades 🎯'
84
84
 
85
85
  persona:
86
86
  role: Technical Product Owner & Process Steward
@@ -298,7 +298,7 @@ Type `*help` to see all commands, or `*yolo` to skip confirmations.
298
298
 
299
299
  **I collaborate with:**
300
300
 
301
- - **@product-lead (Pax):** Provides PRDs and strategic direction to
301
+ - **@product-lead (Axis):** Provides PRDs and strategic direction to
302
302
  - **@sprint-lead (Sync):** Coordinates on sprint planning and story breakdown
303
303
  - **@architect (Stratum):** Works with on technical architecture decisions
304
304
 
@@ -369,7 +369,7 @@ Type `*help` to see all commands, or `*yolo` to skip confirmations.
369
369
  ### Related Agents
370
370
 
371
371
  - **@analyst (Scope)** - Provides research and insights
372
- - **@product-lead (Pax)** - Receives PRDs and manages backlog
372
+ - **@product-lead (Axis)** - Receives PRDs and manages backlog
373
373
  - **@architect (Stratum)** - Collaborates on technical decisions
374
374
 
375
375
  ---
@@ -207,7 +207,7 @@ Type `*help` to see all commands.
207
207
  **I collaborate with:**
208
208
 
209
209
  - **@developer (Pixel):** Assigns stories to, receives completion status from
210
- - **@product-lead (Pax):** Coordinates with on backlog and sprint planning
210
+ - **@product-lead (Axis):** Coordinates with on backlog and sprint planning
211
211
 
212
212
  **I delegate to:**
213
213
 
@@ -254,7 +254,7 @@ Type `*help` to see all commands.
254
254
 
255
255
  ### Prerequisites
256
256
 
257
- 1. Backlog prioritized by @product-lead (Pax)
257
+ 1. Backlog prioritized by @product-lead (Axis)
258
258
  2. Story templates available
259
259
  3. Story draft checklist accessible
260
260
  4. Understanding of current sprint goals
@@ -278,7 +278,7 @@ Type `*help` to see all commands.
278
278
 
279
279
  ### Related Agents
280
280
 
281
- - **@product-lead (Pax)** - Provides backlog prioritization
281
+ - **@product-lead (Axis)** - Provides backlog prioritization
282
282
  - **@developer (Pixel)** - Implements stories
283
283
  - **@github-devops (Pipeline)** - Handles push operations
284
284
 
@@ -31,7 +31,7 @@
31
31
 
32
32
  ```yaml
33
33
  task: analyzeProjectStructure()
34
- responsible: architect (Aria)
34
+ responsible: architect (Stratum)
35
35
  responsible_type: Agent
36
36
  atomic_layer: Analysis
37
37
  elicit: true
@@ -405,7 +405,7 @@ Generate `docs/architecture/project-analysis.md`:
405
405
  # Project Analysis: {feature_name}
406
406
 
407
407
  **Generated:** {date}
408
- **Generated By:** @architect (Aria)
408
+ **Generated By:** @architect (Stratum)
409
409
  **Story:** WIS-15
410
410
 
411
411
  ---
@@ -470,7 +470,7 @@ Generate `docs/architecture/recommended-approach.md`:
470
470
  # Recommended Approach: {feature_name}
471
471
 
472
472
  **Generated:** {date}
473
- **Generated By:** @architect (Aria)
473
+ **Generated By:** @architect (Stratum)
474
474
  **Story:** WIS-15
475
475
 
476
476
  ---
@@ -401,7 +401,7 @@ token_usage: ~1,000-2,000 tokens
401
401
  story: WIS-11
402
402
  version: 1.0.0
403
403
  created: 2025-12-24
404
- author: "@developer (Dex)"
404
+ author: "@developer (Pixel)"
405
405
  dependencies:
406
406
  templates:
407
407
  - service-template/ (from WIS-10)
@@ -3,7 +3,7 @@
3
3
  **Task ID:** create-worktree
4
4
  **Version:** 1.0
5
5
  **Created:** 2026-01-28 (Story 1.3)
6
- **Agent:** @devops (Gage)
6
+ **Agent:** @devops (Pipeline)
7
7
 
8
8
  ---
9
9
 
@@ -4,7 +4,7 @@
4
4
  **Version:** 1.1.0
5
5
  **Created:** 2025-12-02
6
6
  **Updated:** 2025-12-02
7
- **Agent:** @devops (Gage)
7
+ **Agent:** @devops (Pipeline)
8
8
 
9
9
  ---
10
10
 
@@ -870,11 +870,11 @@ This task is owned by:
870
870
  - `@project-lead` (Morgan/Bob) - Primary orchestrator
871
871
 
872
872
  This task spawns:
873
- - `@product-lead` (Pax) - Story validation, checkpoints
874
- - `@developer` (Dex) - Story implementation (via development-cycle)
875
- - `@architect` (Aria) - Wave gates, final gate
876
- - `@devops` (Gage) - Branch merge, push
877
- - `@quality-gate` (Quinn) - Quality gates (via development-cycle)
873
+ - `@product-lead` (Axis) - Story validation, checkpoints
874
+ - `@developer` (Pixel) - Story implementation (via development-cycle)
875
+ - `@architect` (Stratum) - Wave gates, final gate
876
+ - `@devops` (Pipeline) - Branch merge, push
877
+ - `@quality-gate` (Litmus) - Quality gates (via development-cycle)
878
878
 
879
879
  ---
880
880
 
@@ -381,7 +381,7 @@ story: "7.3"
381
381
  epic: "Epic 7 - Memory Layer"
382
382
  version: 1.0.0
383
383
  created: 2026-01-29
384
- author: "@developer (Dex)"
384
+ author: "@developer (Pixel)"
385
385
  dependencies:
386
386
  modules:
387
387
  - .sinapse-ai/infrastructure/scripts/pattern-extractor.js
@@ -91,4 +91,4 @@ All commands apply graceful degradation:
91
91
 
92
92
  ---
93
93
 
94
- *IDS-7 | Created 2026-02-10 by @developer (Dex)*
94
+ *IDS-7 | Created 2026-02-10 by @developer (Pixel)*
@@ -3,7 +3,7 @@
3
3
  **Task ID:** init-project-status
4
4
  **Version:** 1.0
5
5
  **Created:** 2025-01-14 (Story 6.1.2.4)
6
- **Agent:** @devops (Gage)
6
+ **Agent:** @devops (Pipeline)
7
7
 
8
8
  ---
9
9
 
@@ -3,7 +3,7 @@
3
3
  **Task ID:** list-worktrees
4
4
  **Version:** 1.0
5
5
  **Created:** 2026-01-28 (Story 1.3)
6
- **Agent:** @devops (Gage)
6
+ **Agent:** @devops (Pipeline)
7
7
 
8
8
  ---
9
9
 
@@ -311,7 +311,7 @@ optimizations:
311
311
  story: WIS-3
312
312
  version: 1.0.0
313
313
  created: 2025-12-25
314
- author: "@developer (Dex)"
314
+ author: "@developer (Pixel)"
315
315
  dependencies:
316
316
  modules:
317
317
  - workflow-intelligence (from WIS-2)
@@ -321,7 +321,7 @@ optimizations:
321
321
  story: WIS-5
322
322
  version: 1.0.0
323
323
  created: 2025-12-26
324
- author: "@developer (Dex)"
324
+ author: "@developer (Pixel)"
325
325
  dependencies:
326
326
  modules:
327
327
  - workflow-intelligence/learning
@@ -845,7 +845,7 @@ metadata:
845
845
  story: '4.2'
846
846
  epic: 'Epic 4 - Execution Engine'
847
847
  created: '2026-01-28'
848
- author: '@architect (Aria)'
848
+ author: '@architect (Stratum)'
849
849
  version: '1.0.0'
850
850
  tags:
851
851
  - plan-pipeline