Upstream Mike PR review

[github-actions]

Automated-Upstream-Mike-Sync: true
Upstream-Risk: high

PR open-legal-products#332 proposes database-enforced ownership integrity, but requires a ROSS-native migration decision.

Mike PR open-legal-products#332

• Outcome: needs-decision
• Capability: Enforce foreign keys from application-owned user identifiers to Supabase auth.users, with explicit deletion semantics and auth-backed integration fixtures.
• Series: auth-user-referential-integrity
• Dependencies: Supabase auth.users, Current ROSS ownership schema and RPC contracts, Auth-backed database integration fixtures
• Prerequisites: Inventory every current ROSS user-reference column and intended ON DELETE behavior, Audit production-like data for malformed UUIDs and orphaned users, Rehearse migration, validation, rollback, and RPC compatibility against a disposable Supabase database, Add focused tests for valid ownership, orphan rejection, deletion behavior, and text-to-UUID API boundaries
• Reason: The capability is valuable, but upstream targets tables and RPCs that diverge from current ROSS while ROSS still stores several ownership IDs as text. Because this changes schemas, Supabase boundaries, deletion behavior, and existing data, it needs an explicit architecture and migration decision rather than direct adoption.

Architecture brief

Implement at the ROSS database seam through a new dated migration plus synchronized backend/schema.sql updates. Derive constraints only from current ROSS tables, preserve public RPC parameter/return compatibility where required, choose cascade versus set-null per data-retention policy, and validate existing rows before committing constraints. Do not import upstream workflow changes.

Implementation plan

• Create a current-schema matrix of user-reference columns, types, nullability, ownership meaning, and retention requirements.
• Decide deletion semantics for projects, documents, workflows, chats, reviews, shares, submissions, and audit records.
• Build an idempotent ROSS-native migration that detects malformed and orphaned identifiers before conversion, adds NOT VALID constraints, then validates them transactionally.
• Update affected RPC bodies with explicit boundary casts while retaining existing API signatures.
• Create disposable-Supabase integration fixtures backed by real auth users and test constraint enforcement, cascades, set-null behavior, RPC pagination, and rollback.
• Run the migration against a sanitized production-shaped snapshot and obtain security/data-retention approval before release.

Required human action

This is a draft state-only architecture record. Review the brief and implementation plan before any code is attempted.