# Supabase Global Deployment Readiness Runbook - Terra Vita Hub

## Purpose

This runbook moves the Supabase track from a checklist to a controlled, auditable hardening path for global deployment. It does **not** mean the live database has already been changed. It provides the SQL and operating controls that should be applied first in staging and then in production after review.

## Included SQL

- `sql/172_global_deployment_database_readiness.sql`
- `supabase/migrations/172_global_deployment_database_readiness.sql`

The two files are intentionally identical so the same hardening pack is available both as an operational SQL script and as a Supabase migration artifact.

## What the script adds

1. **Global deployment control register**
   - production/staging separation
   - RLS coverage audit
   - indexes
   - connection pooling review
   - heavy-job queueing
   - PITR/backup restore drill
   - monitoring
   - data-sovereignty memo
   - load testing
   - incident response

2. **Data sovereignty configuration**
   - jurisdiction
   - hosting region
   - data-residency requirement
   - sensitive data classes
   - export-control rules
   - retention-policy reference

3. **Data export audit log**
   - actor
   - export type
   - target scope
   - destination
   - legal basis
   - project/programme context
   - export-control result

4. **Background job queue**
   - AI Advice synthesis
   - export-pack generation
   - satellite/GIS interpretation
   - TV-CRI recalculation
   - committee-pack generation
   - retry and status tracking

5. **Risk assurance register**
   - DFI-grade risk note
   - Ministry-facing posture brief
   - donor-submission risk annex
   - institutional safeguards framework

6. **Continuity and MRV quality registers**
   - continuity tests
   - backup/restore evidence
   - MRV evidence-quality checks
   - indicator-lineage checks

7. **Conditional indexes**
   - project/programme lookup fields
   - document workflow fields
   - funding and tranche status fields
   - MRV and satellite fields
   - audit/event fields
   - notification fields

## Run order

1. Confirm you are in the **staging** Supabase project.
2. Export a schema backup.
3. Run `sql/172_global_deployment_database_readiness.sql`.
4. Check that the script completes without errors.
5. Review:
   - `public.global_deployment_controls`
   - `public.global_deployment_readiness_summary`
   - `public.global_rls_table_audit`
6. Run role-based access tests for:
   - admin
   - programme lead
   - reviewer
   - investor/DFI
   - standard project user
   - unauthenticated user
7. Run representative page checks in the Hub.
8. Repeat in production only after staging approval.

## Supabase operational settings to verify outside SQL

These controls are not safely changed by a website ZIP:

- production project separated from staging/test
- production compute sizing
- connection pooling/Supavisor mode
- PITR or backup setting
- database passwords and secret rotation
- storage bucket policies
- MFA for admins
- network restrictions where required
- monitoring/alert destinations
- regional/data-residency selection

## Global deployment readiness definition

The database should not be treated as global-ready until all critical controls in `public.global_deployment_controls` are marked `ready`, or formally accepted as risk by the authorised governance owner.

## Protected boundary

This pack does not change live Supabase automatically. It is a controlled hardening pack that must be applied in Supabase by an authorised operator.