Sync Write Enforcement V1 (Lite)

Intent

Define a lightweight enforcement baseline for syncable domain-table writes that is strong enough for early implementation, without heavy security engineering.

This document enforces one write path for syncable domain tables while keeping rollout cost low.

Non-Goals (For V1 Lite)

• Full database privilege lockdown matrix
• Trigger-heavy write-path policing
• Cross-service cryptographic signing of mutation envelopes
• Formal policy engine integration

These can be added in later hardening phases.

V1 Lite Enforcement Policy

For syncable domain tables:

1. Only POST /api/mutations to the supabase functions endpoind is an accepted write ingress.
2. Write backend must be pgxsinkit bulk-plpgsql-artifact.
3. Per-route CRUD writes are disabled and treated as policy violations.
4. Operations logging must remain enabled.

Minimal Required Controls

1) Runtime Configuration Guard

Require at startup:

• WRITE_API_BACKEND=bulk-plpgsql-artifact
• WRITE_API_OPS_LOG_ENABLED=true

If either condition is not satisfied, startup should fail in environments handling syncable domain workloads.

Lightweight CI/Verification Gates

Run these gates in CI or pre-release checks:

1. Artifact mode startup verification passes.
2. Batch mutation contract test passes for create/update/delete.
3. Operations log contains rows for successful and failed mutation attempts.

Lightweight Production Checks

At minimum, monitor:

1. Write ingress error rate for /api/mutations
2. operations_log status distribution (succeeded, validation_failed, execution_failed)

Exception Policy

Emergency/manual data repair is allowed, but must be:

1. Time-bounded
2. Documented
3. Followed by reconciliation verification

Use explicit runbook steps rather than silent ad hoc writes.

Planned Hardening (Later)

When needed, add in this order:

1. DB role-level DML restrictions for syncable tables
2. Optional enforced FK linkage from syncable rows to operation log identifiers
3. Automated bypass detection alerts and SLO gating
4. Formal exception workflow tooling

Implementation Anchors

• Write ingress and backend mode: apps/api (runs obligatorily via supabase functions at $SUPABASE_URL/functions/v1)
• Sync integration and diagnostics: packages/offline-data
• Operation logging schema: external pgxsinkit server package
• Domain-table schema linkage fields: packages/db