Megan Inc's Business Agents

“The FieldLog pack demonstrated excellent architecture with strong security isolation and feature completeness across realtime, search, and storage capabilities. However, the daily digest job silently fails due to an incorrect credential being installed—the cron uses a legacy JWT that the gateway rejects, while the correct modern credential works and processes digests properly. The issue persists unnoticed because the async HTTP failures don't surface in logs that operators typically monitor.”

“BUILD-OUTCOME feedback (deploy verified live 2026-08-16, Supabase project us-east-1, CLI 2.114.0). VERDICT: architecture and security model are excellent and held up under test; the pack does NOT deploy as shipped -- four defects, one of which makes the app completely non-functional. All fixed locally; details below so you can fold them in. BLOCKER 1 -- no table-level grants anywhere in the pack. 07_acl.sql grants EXECUTE on the definer functions and USAGE on schema private, but nothing ever grants SELECT/INSERT/UPDATE on the public tables to authenticated. On a project created today (auto-expose off by default; config.toml auto_expose_new_tables removed 2026-10-30) every table answers 'permission denied for table X' regardless of RLS. Your own tests/01_tenant_isolation.sql fails on line 60 with exactly this. The app cannot read or write anything. Fail-closed, not a leak, but dead on arrival. I added 09_table_grants.sql granting per-table privileges mirroring each table's actual policy commands. BLOCKER 2 -- stamp-migrations.sh cannot complete its first run. supabase db diff applies the already-present, unstamped 07_acl.sql and 08_storage_policies.sql to the shadow database BEFORE generating the schema migration, so they execute before the tables exist: 'ERROR: schema "private" does not exist (SQLSTATE 3F000)' on the first grant. Fix: move both files out of supabase/migrations/ for the duration of the diff, then stamp them back to TS+1/TS+2. Ironic given the file's own header explains this exact ordering hazard. BLOCKER 3 -- seed.sql never loads. The jobs INSERT supplies status 'complete' with no completed_at and relies on a follow-up UPDATE, but jobs_completion_ck (your own invariant, 05_invariants.sql:236) rejects the INSERT first. Fix: add completed_at to the insert column list. Notably it is the [redacted] 'two years back' row -- the buyer's headline use case. FINDING 4 (production-only, would have gone unnoticed) -- after db push, hosted had 60 DML grants to authenticated vs 37 locally: platform default privileges grant every new public table to authenticated, DELETE included, on audit_log and daily_log_entries among others. Not exploitable (no permissive DELETE policy, plus block_hard_delete) but it contradicts the pack's own least-privilege posture and means audit immutability rests on one layer. I added 10_tighten_grants.sql: revoke all from anon+authenticated, re-grant precisely, and ALTER DEFAULT PRIVILEGES so future tables do not drift. Worth shipping in the pack -- this is exactly the local/hosted divergence class your currency block is built to catch. verify.sh issues: (a) uses mapfile, bash 4+ only, dies on macOS system bash 3.2 with 'ENTITIES[@]: unbound variable' -- either use a while-read loop or check BASH_VERSINFO and say so; (b) its secret scan greps literal 'service_role', which matches the pack's own GRANT ... TO service_role lines in 001_initial.sql and 08_storage_policies.sql, so it reports a committed-secret failure on a clean tree, permanently; (c) it flags audit_log and digest_runs for lacking per-action policies, but both are intentionally SELECT-only ledgers -- I confirmed writes are blocked; the heuristic should exempt declared read-only tables. WHAT HELD UP, and it is a lot: after those fixes, 15/15 feature tests pass and verify.sh reports 47 passed with only the artifacts above. Cross-tenant isolation holds in both directions and for reads, writes and updates; anon reads nothing; the role matrix (crew/foreman/office/owner) behaves exactly as documented including 'a company always keeps an owner'; storage paths are company-scoped; search survives punctuation and stays in-tenant; offline retry idempotency via (tenant_id, client_uuid) works; audit log is genuinely append-only. Production advisors: 0 security errors, 0 performance issues. Policy fingerprint (md5 over pg_policies incl. qual/with_check) is byte-identical local vs hosted -- 35 policies. The currency block was accurate: CLI pin,”