Upstream Mike PR #256 review

[github-actions]

Automated-Upstream-Mike-Sync: true
Upstream-Risk: high

Promising real-stack RLS/auth CI coverage, but ROSS lacks the referenced integration suites and runner. Security, infrastructure, and dependency implications require human approval.

Mike PR Open-Legal-Products#256

• Outcome: needs-decision
• Capability: Run non-skipping Supabase RLS, authentication-contract, access, and tabular-pagination integration tests against a fresh local stack in CI.
• Series: Testing 16
• Dependencies: Upstream stack.supabase.test.ts, access.supabase.test.ts, and tabularPagination.supabase.test.ts suites, A ROSS-native local-stack runner, Pinned Supabase CLI and Docker services, A compatible test runner such as Vitest, backend/schema.sql fresh-database bootstrap contract
• Prerequisites: Review and port the missing suites against current ROSS security invariants, Prove all gated suites execute rather than silently skip, Validate local Supabase keys, service exposure, action pinning, runtime, and resource limits, Confirm schema-only bootstrap matches the supported ROSS fresh-install path
• Reason: ROSS has the relevant RLS schema and baseline CI seam, but none of the referenced integration tests, test-stack script, Vitest dependency, or SUPABASE_TEST_* harness. Direct adoption would therefore provide no reliable coverage and would alter security-boundary CI, infrastructure, and dependencies.

Architecture brief

Add a separate least-privilege baseline partition that boots an isolated, pinned local Supabase stack, loads current backend/schema.sql, derives only ephemeral local credentials, and invokes a ROSS-owned manifest of real-stack tests with an assertion that zero suites were skipped. Keep migration validation separate from fresh-schema security testing.

Implementation plan

• Define ROSS-specific deny-all RLS, authenticated-client denial, service-role access, JWT verification, and tabular pagination assertions.
• Implement the missing integration suites and a single local runner that owns their explicit manifest.
• Evaluate and approve pinned Supabase CLI/action and test-runner dependency changes through security and dependency review.
• Run the harness locally and in a temporary evaluation workflow; capture executed, passed, failed, and skipped counts.
• After approval, integrate it as an isolated required baseline partition with least permissions, concurrency limits, and a bounded timeout.

Required human action

This is a draft state-only architecture record. Review the brief and implementation plan before any code is attempted.