{
  "schema_version": "1.0",
  "version": "2026-09-27-fleet-integration-2026-09-23-r5",
  "public_safe": true,
  "purpose": "Portable Supabase contract for structured data, identity/access boundaries, and designated durable memory.",
  "role": "Supabase can provide PostgreSQL data, authentication, storage, APIs, and row-level security. In Prosper it may hold application records, identity/access components, document references, and designated agent-learning or memory records. The exact project and route must be proved for each task.",
  "connection_rule": "Use the official Supabase MCP or an authenticated API/CLI actually available in the runtime, following /egress-contract.json for the outbound route. A public URL, saved connector, or working connection to one project does not prove access to another project.",
  "data_domains": [
    {"name": "application_or_customer", "rule": "Keep exact business records in their owning system and scope reads to the requested object."},
    {"name": "staff_identity_and_access", "rule": "Verify identity, membership, role, and row scope separately from whether a screen renders."},
    {"name": "document_references", "rule": "Store pointers and metadata where authorized; retrieve original files only from the controlled source."},
    {"name": "agent_memory", "rule": "Store concise, sourced claims and scoped lessons; do not turn the memory project into a dump of customer or credential data."}
  ],
  "project_boundary": {
    "required_before_write": ["project reference and name", "environment", "purpose", "schema and table", "row scope", "caller identity and permission", "expected before/after state"],
    "rule": "The same vendor can host several Prosper projects. A successful SQL statement against the wrong project is a failure.",
    "memory_separation": "Do not send product or customer data to a memory project merely because its identifier is familiar."
  },
  "safe_read_sequence": [
    "Identify the exact project and environment through the authorized route.",
    "Confirm the caller identity, allowed operation, and row-level policy that applies.",
    "Inspect only the tables, schema, logs, or rows needed for the task.",
    "Use read-only queries for diagnosis; bound results and avoid exporting raw sensitive data.",
    "Record source, object identifiers, timestamp, and any stale or missing evidence.",
    "If a mutation is in scope, capture the exact before state before changing anything.",
    "Read back the exact target row or schema after an authorized mutation."
  ],
  "tool_routing": {
    "read_only_examples": ["list_tables", "schema inspection", "execute_sql with SELECT only", "query logs", "read authorized rows"],
    "review_required_examples": ["apply migration", "create or alter table", "RLS policy change", "memory schema change"],
    "destructive_examples": ["DROP", "TRUNCATE", "bulk delete", "irreversible data rewrite"],
    "note": "Tool names vary by host. Availability must be checked in the actual runtime before use."
  },
  "write_policy": [
    "Read-only inspection is allowed within the task scope when the route is authorized.",
    "Draft migrations, schema changes, and RLS changes for Hanna/Craig review; do not apply them without explicit approval.",
    "Destructive database operations require Craig's direct written sign-off.",
    "Never expose service-role keys, database URLs, connection strings, or private tokens.",
    "A UI success message, queued mutation, or API 2xx response is not enough; read back the exact resulting state."
  ],
  "memory_record_contract": {
    "minimum": ["claim", "source", "owner", "observed_at", "effective_at", "verification_status", "sensitivity"],
    "recommended": ["confidence", "supersedes", "expires_at", "task_id", "last_read_back"],
    "principle": "Durable storage is not automatic model memory. A retrieval layer must select authorized rows and load them into the current turn."
  },
  "row_level_security": {
    "meaning": "RLS policies can restrict which rows a caller may read or change.",
    "rule": "Do not bypass RLS with a broader credential just to make a test pass. Inspect the policy and use the least authority that proves the task."
  },
  "failure_interpretation": [
    "MCP tool visible does not prove authentication or project access.",
    "A connection error, paused project, permission error, and empty result are different failure layers.",
    "A row existing does not prove it is current, relevant, authorized, or loaded into an agent's context.",
    "A successful write to the wrong project or wrong table is still a failed integration."
  ],
  "public_boundary": "This is a safe architecture and operating reference. It does not publish a project credential, connection string, private schema, customer rows, or current database health."
}