{"id":"rls_isolation_validation_drill_company_bellezapro_company_internal","status":"RLS_ISOLATION_VALIDATION_DRILL_READY_LOCAL_ONLY","drillMode":"LOCAL_ONLY_TWO_COMPANY_RLS_VALIDATION","tenantScope":"COMPANY_LEVEL_RLS","databaseTarget":"SUPABASE_LOCAL_REQUIRED_NOT_APPLIED","accessModel":"READ_ONLY_CLIENT_VIEW","credentialPolicy":"REFERENCE_ONLY_NO_RAW_SECRETS","primaryCompanyId":"company_bellezapro","primaryCompanyName":"BellezaPro","comparisonCompanyId":"company_internal","comparisonCompanyName":"AltiroPay","productionEnabled":false,"productionReadiness":"BLOCKED_BY_SECURITY_GATE","noCustodyOfFunds":true,"notPaymentGateway":true,"notRegulatedFinancialProvider":true,"cloudValidation":{"status":"T-057_RLS_CLOUD_VALIDATED_SANDBOX_ONLY","validated":true,"databaseTarget":"SUPABASE_CLOUD_SANDBOX","projectRef":"uhwwwwlhmcombdrxvcrr","source":"docs/qa/t057-supabase-cloud-rls-validation.md","executedOn":"2026-08-09","evidence":[{"id":"bellezapro_allow_own_company_read","status":"PASSED"},{"id":"bellezapro_deny_cross_company_read","status":"PASSED"},{"id":"comparison_allow_own_company_read","status":"PASSED"},{"id":"client_write_denied","status":"PASSED"},{"id":"no_custody_of_funds","status":"PASSED"}],"missingChecks":[]},"executionPack":{"status":"T-057_RLS_EXECUTION_PACK_READY_LOCAL_ONLY","executionMode":"LOCAL_SUPABASE_EXECUTION_PREP_ONLY","dockerStatus":"REQUIRED_NOT_CONFIRMED","supabaseLocalStatus":"SUPABASE_LOCAL_REQUIRED_NOT_APPLIED","localPreflight":{"status":"T-057_RLS_LOCAL_PREFLIGHT_RECORDED","dockerStatus":"DOCKER_CLI_AVAILABLE_ENGINE_UNAVAILABLE","supabaseCliStatus":"SUPABASE_CLI_AVAILABLE_2_102_0","supabaseLocalStatus":"Supabase local: UNAVAILABLE","liveValidationStatus":"RLS_LIVE_VALIDATION_BLOCKED_UNTIL_SUPABASE_LOCAL","recordedEvidence":[{"id":"docker_info_engine_unavailable","command":"docker info","status":"DOCKER_CLI_AVAILABLE_ENGINE_UNAVAILABLE"},{"id":"supabase_cli_available","command":"supabase --version","status":"SUPABASE_CLI_AVAILABLE_2_102_0"},{"id":"local_doctor_supabase_unavailable","command":".\\local.cmd doctor","status":"Supabase local: UNAVAILABLE"}]},"productionEnabled":false,"productionReadiness":"BLOCKED_BY_SECURITY_GATE","commands":[{"id":"show_t057_safe_local_pack","label":"Mostrar pack local seguro T-057","command":".\\local.cmd rls-t057","expectedResult":"T-057 local pack shows preflight, manual commands, evidence cases and blocked decisions","status":"REQUIRED_BEFORE_RLS_EXECUTION"},{"id":"doctor_local_environment","label":"Confirmar entorno local antes de tocar Supabase","command":".\\local.cmd doctor","expectedResult":"Supabase local available only when Docker engine is running","status":"REQUIRED_BEFORE_RLS_EXECUTION"},{"id":"check_docker_engine","label":"Confirmar Docker Engine disponible","command":"docker info","expectedResult":"Docker server responds without pipe or permission errors","status":"REQUIRED_BEFORE_RLS_EXECUTION"},{"id":"start_supabase_local","label":"Iniciar Supabase local","command":"supabase start","expectedResult":"Local Supabase services are available","status":"REQUIRED_WHEN_DOCKER_AVAILABLE"},{"id":"apply_growth_platform_rls_migration","label":"Aplicar migraciones Growth Platform RLS","command":"supabase migration up","expectedResult":"Growth Platform RLS migration applied locally","status":"REQUIRED_WHEN_SUPABASE_LOCAL_AVAILABLE"},{"id":"run_t057_live_validator","label":"Ejecutar validador vivo RLS T-057","command":".\\local.cmd rls-t057-live","expectedResult":"BellezaPro allow/deny, comparison allow and client write denied evidence are produced locally","status":"REQUIRED_WHEN_SUPABASE_LOCAL_AVAILABLE"},{"id":"run_static_schema_tests","label":"Validar evidencia estatica de schema Supabase","command":"npm.cmd test -- tests/supabase-schema.test.js","expectedResult":"Static migration assertions pass","status":"REQUIRED_BEFORE_SECURITY_GATE_REVIEW"}],"evidenceOutputs":[{"id":"bellezapro_allow_own_company_read","label":"BellezaPro actor reads own company rows","expectedDecision":"ALLOW_OWN_COMPANY_READ","status":"PENDING_SUPABASE_LOCAL"},{"id":"bellezapro_deny_cross_company_read","label":"BellezaPro actor cannot read AltiroPay rows","expectedDecision":"DENY_CROSS_COMPANY_READ","status":"PENDING_SUPABASE_LOCAL"},{"id":"comparison_allow_own_company_read","label":"AltiroPay actor reads own company rows","expectedDecision":"ALLOW_OWN_COMPANY_READ","status":"PENDING_SUPABASE_LOCAL"},{"id":"client_write_denied","label":"Client viewer cannot mutate provider, payment or evidence rows","expectedDecision":"DENY_CLIENT_WRITE","status":"PENDING_SUPABASE_LOCAL"}],"blockers":[{"id":"docker_engine_unavailable","label":"Docker Engine must be running before Supabase local RLS execution","status":"BLOCKED_UNTIL_DOCKER_AVAILABLE"},{"id":"supabase_local_not_applied","label":"Supabase local migration has not been applied in this environment","status":"SUPABASE_LOCAL_REQUIRED_NOT_APPLIED"},{"id":"no_production_rls_approval","label":"Local RLS evidence cannot approve production RLS","status":"BLOCKED_BY_SECURITY_GATE"}]},"summary":{"companyCount":2,"actorCount":2,"validationCases":6,"crossCompanyDeniedCases":2,"clientWriteDeniedCases":2,"productionApproved":false},"tenantReviews":[{"id":"tenant_isolation_review_company_bellezapro_brand_bellezapro","companyId":"company_bellezapro","brandId":"brand_bellezapro","status":"TENANT_ISOLATION_REVIEW_READY_LOCAL_ONLY","href":"/api/growth-platform/tenant-isolation-review?companyId=company_bellezapro&brandId=brand_bellezapro&format=markdown"},{"id":"tenant_isolation_review_company_internal_brand_altiropay","companyId":"company_internal","brandId":"brand_altiropay","status":"TENANT_ISOLATION_REVIEW_READY_LOCAL_ONLY","href":"/api/growth-platform/tenant-isolation-review?companyId=company_internal&brandId=brand_altiropay&format=markdown"}],"actorRows":[{"id":"rls_actor_company_bellezapro","companyId":"company_bellezapro","companyName":"BellezaPro","role":"client_viewer","accessMode":"READ_ONLY_CLIENT_VIEW","credentialPolicy":"REFERENCE_ONLY_NO_RAW_SECRETS"},{"id":"rls_actor_company_internal","companyId":"company_internal","companyName":"AltiroPay","role":"client_viewer","accessMode":"READ_ONLY_CLIENT_VIEW","credentialPolicy":"REFERENCE_ONLY_NO_RAW_SECRETS"}],"validationCases":[{"id":"primary_reads_own_company","actorId":"rls_actor_company_bellezapro","targetCompanyId":"company_bellezapro","targetCompanyName":"BellezaPro","operation":"select_growth_company_rows","expectedDecision":"ALLOW_OWN_COMPANY_READ","status":"READY_FOR_SUPABASE_LOCAL_EXECUTION"},{"id":"primary_denied_comparison_company","actorId":"rls_actor_company_bellezapro","targetCompanyId":"company_internal","targetCompanyName":"AltiroPay","operation":"select_growth_company_rows","expectedDecision":"DENY_CROSS_COMPANY_READ","status":"READY_FOR_SUPABASE_LOCAL_EXECUTION"},{"id":"comparison_reads_own_company","actorId":"rls_actor_company_internal","targetCompanyId":"company_internal","targetCompanyName":"AltiroPay","operation":"select_growth_company_rows","expectedDecision":"ALLOW_OWN_COMPANY_READ","status":"READY_FOR_SUPABASE_LOCAL_EXECUTION"},{"id":"comparison_denied_primary_company","actorId":"rls_actor_company_internal","targetCompanyId":"company_bellezapro","targetCompanyName":"BellezaPro","operation":"select_growth_company_rows","expectedDecision":"DENY_CROSS_COMPANY_READ","status":"READY_FOR_SUPABASE_LOCAL_EXECUTION"},{"id":"primary_client_write_denied","actorId":"rls_actor_company_bellezapro","targetCompanyId":"company_bellezapro","targetCompanyName":"BellezaPro","operation":"insert_growth_provider_account","expectedDecision":"DENY_CLIENT_WRITE","status":"READY_FOR_SUPABASE_LOCAL_EXECUTION"},{"id":"comparison_client_write_denied","actorId":"rls_actor_company_internal","targetCompanyId":"company_internal","targetCompanyName":"AltiroPay","operation":"insert_growth_provider_account","expectedDecision":"DENY_CLIENT_WRITE","status":"READY_FOR_SUPABASE_LOCAL_EXECUTION"}],"sqlChecklist":[{"id":"apply_growth_platform_rls_migration","label":"Apply growth platform RLS migration in Supabase local","command":"supabase migration up","status":"REQUIRED_WHEN_DOCKER_AVAILABLE"},{"id":"seed_two_company_memberships","label":"Seed two authenticated users mapped to two company memberships","targetTable":"growth_company_members","status":"REQUIRED_WHEN_SUPABASE_LOCAL_AVAILABLE"},{"id":"run_allow_deny_select_cases","label":"Run own-company allow and cross-company deny select cases","status":"REQUIRED_BEFORE_PRODUCTION"},{"id":"run_client_write_denied_cases","label":"Confirm client viewers cannot mutate provider, payment or evidence rows","status":"REQUIRED_BEFORE_PRODUCTION"}],"evidenceRequired":[{"id":"two_user_two_company_rls_result","label":"Two users and two companies RLS result captured as sanitized evidence","status":"REQUIRED_BEFORE_PRODUCTION","href":"/api/growth-platform/client-evidence-packages"},{"id":"security_preflight_after_rls","label":"Security Gate Preflight rerun after RLS drill","status":"REQUIRED_BEFORE_PRODUCTION","href":"/api/security/preflight"},{"id":"no_cross_company_leakage","label":"No cross-company rows visible in client portal or API evidence","status":"REQUIRED_BEFORE_PRODUCTION","href":"/growth-platform/client-portal"}],"safeActions":[{"id":"open_rls_isolation_validation_drill","label":"Abrir RLS Isolation Validation Drill","href":"/growth-platform/rls-isolation-validation-drill"},{"id":"open_security_preflight","label":"Ejecutar Security Gate Preflight","href":"/api/security/preflight"}],"blockedActions":[{"id":"approve_production_rls","label":"Aprobar RLS productivo","status":"BLOCKED_BY_SECURITY_GATE"},{"id":"enable_public_client_portal","label":"Habilitar portal cliente publico","status":"BLOCKED_BY_SECURITY_GATE"},{"id":"store_raw_credentials","label":"Guardar credenciales crudas o secretos","status":"PROHIBITED"}],"exports":[{"label":"Exportar RLS Isolation Validation Drill JSON","href":"/api/growth-platform/rls-isolation-validation-drill?primaryCompanyId=company_bellezapro&comparisonCompanyId=company_internal","format":"json"},{"label":"Exportar RLS Isolation Validation Drill Markdown","href":"/api/growth-platform/rls-isolation-validation-drill?primaryCompanyId=company_bellezapro&comparisonCompanyId=company_internal&format=markdown","format":"markdown"}]}