chore(infra): simplify production database operations

Remove orphaned release and local database contracts.
Use production Supabase roles locally and retire dead compatibility surfaces.
Align migrations with managed Supabase role and Vault behavior.

Author: iamjr15

.env.example

@@ -1,21 +1,11 @@
-# Root .env.local is the only local credential file. Cloudflare and Vercel
-# receive production values directly in their dashboards; never copy this file there.
-
-# Local Postgres. Generate four distinct URL-safe passwords and keep each Worker
-# password identical to the password in only its own connection URL.
-LOCAL_POSTGRES_PASSWORD=replace_with_64_hex_postgres_password
-LOCAL_APP_GATEWAY_PASSWORD=replace_with_64_hex_app_gateway_password
-LOCAL_APP_AGENT_PASSWORD=replace_with_64_hex_app_agent_password
-LOCAL_APP_WEBHOOKS_PASSWORD=replace_with_64_hex_app_webhooks_password
-LOCAL_DATABASE_PORT=54322
-CHEATCODE_LOCAL_DATABASE=true
-SUPABASE_MIGRATION_URL=postgresql://postgres:replace_with_64_hex_postgres_password@database:5432/postgres
-SUPABASE_MIGRATION_EXPECTED_HOST=database
-SUPABASE_MIGRATION_EXPECTED_DATABASE=postgres
-SUPABASE_MIGRATION_EXPECTED_ROLE=postgres
-LOCAL_GATEWAY_DATABASE_URL=postgresql://app_gateway:replace_with_64_hex_app_gateway_password@database:5432/postgres
-LOCAL_AGENT_DATABASE_URL=postgresql://app_agent:replace_with_64_hex_app_agent_password@database:5432/postgres
-LOCAL_WEBHOOKS_DATABASE_URL=postgresql://app_webhooks:replace_with_64_hex_app_webhooks_password@database:5432/postgres
+# Root .env.local is the only local application credential file. Local Workers
+# use the production Supabase database through its public session pooler and the
+# same three least-privilege roles as production Hyperdrive. Keep each password
+# identical to the password configured on only its matching production role.
+# Administrative migration credentials belong in .env.migrate, never here.
+SUPABASE_GATEWAY_DATABASE_URL=postgresql://app_gateway.snqtclnmhcaupqynjyux:replace_with_gateway_role_password@aws-0-ap-south-1.pooler.supabase.com:5432/postgres?sslmode=require&uselibpqcompat=true
+SUPABASE_AGENT_DATABASE_URL=postgresql://app_agent.snqtclnmhcaupqynjyux:replace_with_agent_role_password@aws-0-ap-south-1.pooler.supabase.com:5432/postgres?sslmode=require&uselibpqcompat=true
+SUPABASE_WEBHOOKS_DATABASE_URL=postgresql://app_webhooks.snqtclnmhcaupqynjyux:replace_with_webhooks_role_password@aws-0-ap-south-1.pooler.supabase.com:5432/postgres?sslmode=require&uselibpqcompat=true
 
 # Clerk development instance. These test keys are for this laptop only; every
 # Vercel environment uses the production Clerk instance.

.env.migrate.example

@@ -0,0 +1,11 @@
+# Copy to .env.migrate only on an authorized operator workstation. This file
+# targets the production Supabase database and is never loaded by the app,
+# Compose, Wrangler, Next.js, or any Worker.
+SUPABASE_MIGRATION_URL=postgresql://postgres:replace_with_production_admin_password@db.snqtclnmhcaupqynjyux.supabase.co:5432/postgres?sslmode=require
+SUPABASE_MIGRATION_EXPECTED_HOST=db.snqtclnmhcaupqynjyux.supabase.co
+SUPABASE_MIGRATION_EXPECTED_DATABASE=postgres
+SUPABASE_MIGRATION_EXPECTED_ROLE=postgres
+SUPABASE_MIGRATION_EXPECTED_SYSTEM_IDENTIFIER=replace_with_pg_control_system_identifier
+
+# Optional one-time protected migration attestation envelope.
+CHEATCODE_MIGRATION_ATTESTATIONS=

.github/workflows/deploy-workers.yml

@@ -15,6 +15,7 @@ qa-*.png
 .env
 .env.*
 !.env.example
+!.env.migrate.example
 apps/*/.dev.vars
 apps/*/wrangler.local-dev.generated.jsonc
 apps/*/wrangler.production.*.generated.json

.gitignore

@@ -117,22 +117,18 @@ not write, run, or keep scripts to submit prompts, click UI, drive auth, wrap
 ## Run locally
 
 ```bash
-pnpm dev                                # Compose: Postgres + migrations + Next + chained Workers
+pnpm dev                                # Compose: Next + chained Workers against production Supabase
 pnpm dev:down                           # Stop the local Compose stack
 ```
 
 Required local env vars in `.env.local` (template in `.env.example`):
 
 ```
-# Local Postgres + per-Worker roles (distinct URL-safe passwords)
-LOCAL_POSTGRES_PASSWORD=
-LOCAL_APP_GATEWAY_PASSWORD=
-LOCAL_APP_AGENT_PASSWORD=
-LOCAL_APP_WEBHOOKS_PASSWORD=
-SUPABASE_MIGRATION_URL=postgresql://postgres:<local-password>@database:5432/postgres
-LOCAL_GATEWAY_DATABASE_URL=postgresql://app_gateway:<gateway-password>@database:5432/postgres
-LOCAL_AGENT_DATABASE_URL=postgresql://app_agent:<agent-password>@database:5432/postgres
-LOCAL_WEBHOOKS_DATABASE_URL=postgresql://app_webhooks:<webhooks-password>@database:5432/postgres
+# Production Supabase session-pooler URLs for the three isolated Worker roles.
+# Administrative migration credentials never belong in .env.local.
+SUPABASE_GATEWAY_DATABASE_URL=
+SUPABASE_AGENT_DATABASE_URL=
+SUPABASE_WEBHOOKS_DATABASE_URL=
 
 # Per-Worker signed tenant context (three distinct secrets, each at least 32 bytes)
 DATABASE_CONTEXT_SIGNING_SECRET_GATEWAY=
@@ -173,9 +169,11 @@ RELEASE_DATABASE_READINESS_SECRET=
 NEXT_PUBLIC_GATEWAY_URL=http://127.0.0.1:8787
 ```
 
-Never commit `.env.local`. It is the sole laptop credential file and accepts only
-Clerk test keys plus sandbox/local credentials. Vercel and Cloudflare receive
-production credentials directly through their protected production environments.
+Never commit `.env.local`. It is the sole laptop application credential file;
+its database URLs contain only the three least-privilege production runtime
+roles. Vercel and Cloudflare receive production credentials directly through
+their protected production environments. Administrative migration credentials
+live only in git-ignored `.env.migrate` on authorized operator workstations.
 
 ## Code conventions (CI-enforced)