data-safety

Use before a repository or its content crosses the line it cannot come back from — flipping private to public, publishing an extract, pushing to a host others can read. Fires on "make it public", "open source this", "check nothing confidential leaks". Do NOT fire on a repo that is already public — its history is already out, and the task is exposure response, not a sweep — or for content that never leaves the machine.

Use when a change adds or alters a SQL migration whose effect is a behaviour — an RLS policy, a view, a trigger, a grant, an enum, a constraint — and you want to know what it really does before opening the PR. Especially when there is no local Postgres: a transaction against the dev database that is rolled back costs nothing and leaves nothing. Do NOT fire for a bulk data write you intend to keep (that is reversible-bulk-write), for a migration that only adds a column nothing reads yet, or when the only database reachable is production.

Use when a claim needs numbers from a live database and no committed report already produces them — sizing a cohort before a design decision, verifying a reviewer's assertion against the data instead of arguing, checking what a load actually left behind. Produces a throwaway read-only script in the session scratchpad and quotes what it printed. Do NOT fire for anything that writes (that is reversible-bulk-write), or when the repo ships a report command that already answers the question — run that instead.

Use when about to write in bulk to a live datastore — importing a dataset, backfilling a column, a mass UPDATE, any statement whose blast radius is "lots of rows". Fire before the first write, not after it goes wrong. Also fire when a bulk write has already gone in and needs undoing. Do NOT fire for ordinary single-row writes, for schema migrations (those have their own review and apply path), or for writes to a throwaway or local database.

Use before writing or reviewing any migration that references Supabase-managed schemas — `auth.users`, `auth.uid()`, `storage.objects`, `storage.buckets`, `realtime.subscription`, `supabase_functions.*`, or any policy / function that depends on `auth.jwt()`. Auto-fire when a diff in `supabase/migrations/*.sql` matches the regex `(auth|storage|realtime)\.|to_regnamespace|create or replace function .* returns`. Also fire when the user says "fix the CI migration job" / "migration failed in CI" / "vanilla postgres errored on this migration" / "schema auth does not exist". Skip if the migration only touches the `public` schema with no Supabase-namespace references.