{"id":"rls_isolation_validation_drill_company_client_demo_company_internal","format":"markdown","content":"# RLS Isolation Validation Drill local-only\n\n- Estado: RLS_ISOLATION_VALIDATION_DRILL_READY_LOCAL_ONLY\n- Modo: LOCAL_ONLY_TWO_COMPANY_RLS_VALIDATION\n- Tenant scope: COMPANY_LEVEL_RLS\n- Database target: SUPABASE_LOCAL_REQUIRED_NOT_APPLIED\n- T-057 Cloud validation: T-057_RLS_CLOUD_EVIDENCE_INVALID_OR_MISSING\n- T-057 Cloud target: NOT_VALIDATED\n- T-057 evidence source: NOT_AVAILABLE\n- Execution pack: T-057_RLS_EXECUTION_PACK_READY_LOCAL_ONLY\n- Execution mode: LOCAL_SUPABASE_EXECUTION_PREP_ONLY\n- T-057 local preflight: T-057_RLS_LOCAL_PREFLIGHT_RECORDED\n- Docker status: DOCKER_CLI_AVAILABLE_ENGINE_UNAVAILABLE\n- Supabase CLI status: SUPABASE_CLI_AVAILABLE_2_102_0\n- Supabase local status: Supabase local: UNAVAILABLE\n- RLS live validation: RLS_LIVE_VALIDATION_BLOCKED_UNTIL_SUPABASE_LOCAL\n- Credential policy: REFERENCE_ONLY_NO_RAW_SECRETS\n- Production readiness: BLOCKED_BY_SECURITY_GATE\n- NO_CUSTODY_OF_FUNDS: true\n\n## Validacion RLS dos empresas\n\n- Primary company: Cliente Demo (company_client_demo)\n- Comparison company: AltiroPay (company_internal)\n\n## Casos allow deny RLS\n\n- primary_reads_own_company: select_growth_company_rows -> ALLOW_OWN_COMPANY_READ (READY_FOR_SUPABASE_LOCAL_EXECUTION)\n- primary_denied_comparison_company: select_growth_company_rows -> DENY_CROSS_COMPANY_READ (READY_FOR_SUPABASE_LOCAL_EXECUTION)\n- comparison_reads_own_company: select_growth_company_rows -> ALLOW_OWN_COMPANY_READ (READY_FOR_SUPABASE_LOCAL_EXECUTION)\n- comparison_denied_primary_company: select_growth_company_rows -> DENY_CROSS_COMPANY_READ (READY_FOR_SUPABASE_LOCAL_EXECUTION)\n- primary_client_write_denied: insert_growth_provider_account -> DENY_CLIENT_WRITE (READY_FOR_SUPABASE_LOCAL_EXECUTION)\n- comparison_client_write_denied: insert_growth_provider_account -> DENY_CLIENT_WRITE (READY_FOR_SUPABASE_LOCAL_EXECUTION)\n\n## Checklist SQL local\n\n- apply_growth_platform_rls_migration: Apply growth platform RLS migration in Supabase local (REQUIRED_WHEN_DOCKER_AVAILABLE)\n- seed_two_company_memberships: Seed two authenticated users mapped to two company memberships (REQUIRED_WHEN_SUPABASE_LOCAL_AVAILABLE)\n- run_allow_deny_select_cases: Run own-company allow and cross-company deny select cases (REQUIRED_BEFORE_PRODUCTION)\n- run_client_write_denied_cases: Confirm client viewers cannot mutate provider, payment or evidence rows (REQUIRED_BEFORE_PRODUCTION)\n\n## Comandos ejecucion T-057\n\n- show_t057_safe_local_pack: .\\local.cmd rls-t057 (REQUIRED_BEFORE_RLS_EXECUTION)\n- doctor_local_environment: .\\local.cmd doctor (REQUIRED_BEFORE_RLS_EXECUTION)\n- check_docker_engine: docker info (REQUIRED_BEFORE_RLS_EXECUTION)\n- start_supabase_local: supabase start (REQUIRED_WHEN_DOCKER_AVAILABLE)\n- apply_growth_platform_rls_migration: supabase migration up (REQUIRED_WHEN_SUPABASE_LOCAL_AVAILABLE)\n- run_t057_live_validator: .\\local.cmd rls-t057-live (REQUIRED_WHEN_SUPABASE_LOCAL_AVAILABLE)\n- run_static_schema_tests: npm.cmd test -- tests/supabase-schema.test.js (REQUIRED_BEFORE_SECURITY_GATE_REVIEW)\n\n## Evidencia esperada T-057\n\n- bellezapro_allow_own_company_read: ALLOW_OWN_COMPANY_READ (PENDING_SUPABASE_LOCAL)\n- bellezapro_deny_cross_company_read: DENY_CROSS_COMPANY_READ (PENDING_SUPABASE_LOCAL)\n- comparison_allow_own_company_read: ALLOW_OWN_COMPANY_READ (PENDING_SUPABASE_LOCAL)\n- client_write_denied: DENY_CLIENT_WRITE (PENDING_SUPABASE_LOCAL)\n\n## Evidencia RLS requerida\n\n- two_user_two_company_rls_result: Two users and two companies RLS result captured as sanitized evidence (REQUIRED_BEFORE_PRODUCTION) /api/growth-platform/client-evidence-packages\n- security_preflight_after_rls: Security Gate Preflight rerun after RLS drill (REQUIRED_BEFORE_PRODUCTION) /api/security/preflight\n- no_cross_company_leakage: No cross-company rows visible in client portal or API evidence (REQUIRED_BEFORE_PRODUCTION) /growth-platform/client-portal\n\n## Acciones bloqueadas\n\n- approve_production_rls: Aprobar RLS productivo (BLOCKED_BY_SECURITY_GATE)\n- enable_public_client_portal: Habilitar portal cliente publico (BLOCKED_BY_SECURITY_GATE)\n- store_raw_credentials: Guardar credenciales crudas o secretos (PROHIBITED)\n","productionReadiness":"BLOCKED_BY_SECURITY_GATE","productionEnabled":false}