wip v28

Author: geraldarthurdavis

BITCODE_SPEC_V28_NOTES.md

@@ -68,6 +68,8 @@ Supabase/PostgreSQL data-health checks are part of the V28 acceptance apparatus,
 
 May 14 staging-testnet verification added the first repository-owned RLS repairs after the dashboard-origin RLS bootstrap. `20260514173000_enable_pipeline_runs_rls.sql` enables RLS on `public.pipeline_runs`, and `20260514175000_enable_pipeline_runtime_rls.sql` enables RLS on server-managed pipeline runtime tables reported by Supabase Security Advisor. These preserve existing service-role pipeline posture and move runtime internals to deny-by-default for browser roles unless a narrower policy is later specified. The live daily data-health suite now passes 24/24 checks against the staging Supabase project, live ORM E2E tests can load `.env.local` directly for local QA parity with the CLI runner, and the advisory-style RLS probe returns no public tables with policies/browser grants while RLS is disabled.
 
+May 14 live deployment QA proved the custom Bitcoin OAuth path through Supabase Auth after the project Site URL was corrected from localhost to `https://bitcode.exchange`. The Supabase custom provider created the expected `auth.users` and `auth.identities` rows for `custom:bitcode-bitcoin`; Bitcode then projected the same user into `public.user_profiles.settings.bitcodeProfile.walletBinding` and `public.user_connections.provider='leather'`. V28 QA SQL and data-health checks therefore read wallet binding through the canonical JSON settings path, not nonexistent flat `user_profiles.wallet_*` columns.
+
 ### Deterministic Model Boundary
 
 V28 must remove the idea that a user can choose ledgerized Bitcode synthesis models.

BITCODE_V28_QA.md

@@ -853,6 +853,13 @@ Deployment judgment:
 - Live staging data-plane readiness: pass baseline. `pnpm db:data-health:daily` checked 24 and passed 24 against `tkpyosihuouusyaxtbau`; the advisor-style RLS probe returned zero rows; saved-query verification still belongs in the first-run onboarding QA evidence.
 - Manual first-run onboarding may proceed after deployment env is confirmed; capture saved-query evidence during the pass.
 
+2026-05-14 first live deployment onboarding evidence:
+
+- The first Leather-auth callback initially fell back to `http://localhost:3000/?code=...` because Supabase Auth URL Configuration still had localhost as the Site URL. V28 now treats `https://bitcode.exchange` as the staging deployment Site URL and keeps `/tps/supabase/callback` in the allowlist.
+- After correcting the Site URL, Supabase Auth created `auth.users` and `auth.identities` rows with `provider='custom:bitcode-bitcoin'` and the Bitcoin testnet subject.
+- The matching Bitcode application projection exists in `public.user_profiles` under `settings.bitcodeProfile.walletBinding`, with the same user UUID as `auth.users.id`, and `public.user_connections` has a matching `provider='leather'` wallet row.
+- The saved `v28_qa_03_user_profiles_wallet_binding` query was corrected to read wallet binding from JSON settings rather than nonexistent flat `wallet_address`, `wallet_provider`, and `wallet_binding_status` columns.
+
 ## Issue Template
 
 ```md
@@ -935,10 +942,13 @@ Saved query name: `v28_qa_03_user_profiles_wallet_binding`
 select
   id,
   username,
-  wallet_address,
-  wallet_provider,
-  wallet_binding_status,
-  settings->'bitcodeProfile'->'walletBinding' as wallet_binding,
+  settings #>> '{bitcodeProfile,walletBinding,address}' as wallet_address,
+  settings #>> '{bitcodeProfile,walletBinding,provider}' as wallet_provider,
+  settings #>> '{bitcodeProfile,walletBinding,status}' as wallet_binding_status,
+  settings #>> '{bitcodeProfile,walletBinding,network}' as wallet_network,
+  settings #>> '{bitcodeProfile,walletBinding,paymentAddress}' as payment_address,
+  settings #>> '{bitcodeProfile,walletBinding,authAddress}' as auth_address,
+  settings #> '{bitcodeProfile,walletBinding}' as wallet_binding,
   updated_at
 from public.user_profiles
 order by updated_at desc

packages/orm/src/data-health/checks.ts

@@ -384,10 +384,18 @@ export const DATA_HEALTH_CHECKS: DataHealthCheckDefinition[] = [
       WITH profile_wallets AS (
         SELECT
           id AS user_id,
-          settings #>> '{walletBinding,provider}' AS provider,
-          settings #>> '{walletBinding,address}' AS address
+          coalesce(
+            settings #>> '{bitcodeProfile,walletBinding,provider}',
+            settings #>> '{walletBinding,provider}'
+          ) AS provider,
+          coalesce(
+            settings #>> '{bitcodeProfile,walletBinding,address}',
+            settings #>> '{walletBinding,address}'
+          ) AS address
         FROM public.user_profiles
-        WHERE settings ? 'walletBinding'
+        WHERE
+          settings #> '{bitcodeProfile,walletBinding}' IS NOT NULL
+          OR settings ? 'walletBinding'
       ),
       drift AS (
         SELECT

supabase/DATA_HEALTH.md

@@ -109,6 +109,11 @@ reusable checks:
   `supabase/queries/data_health_wallet_github_readiness.sql`
 - `Bitcode Data Health - BTD Ledger Reconciliation`:
   `supabase/queries/data_health_btd_ledger_reconciliation.sql`
+- `v28_qa_staging_hard_reset`:
+  `supabase/queries/v28_qa_staging_hard_reset.sql` is a destructive,
+  staging-only reset for early QA. It preserves schema/migrations, deletes
+  Supabase Auth users, truncates Bitcode-owned public projection data, and
+  reseeds `public.btd_supply_state`.
 
 The script runner is authoritative for pass/fail automation. The saved queries
 are for operator inspection and QA narration.

supabase/config.toml

@@ -42,8 +42,13 @@ file_size_limit = "50MiB"
 
 [auth]
 enabled = true
-site_url = "http://localhost:3000"
-additional_redirect_urls = []
+site_url = "https://bitcode.exchange"
+additional_redirect_urls = [
+  "https://bitcode.exchange/tps/supabase/callback",
+  "https://bitcode.exchange/auxillaries/wallet",
+  "http://localhost:3000/tps/supabase/callback",
+  "http://localhost:3001/tps/supabase/callback",
+]
 jwt_expiry = 3600
 enable_refresh_token_rotation = true
 refresh_token_reuse_interval = 10

supabase/queries/data_health_wallet_github_readiness.sql

@@ -4,13 +4,27 @@
 WITH profile_wallets AS (
   SELECT
     id AS user_id,
-    settings #>> '{walletBinding,provider}' AS profile_wallet_provider,
-    settings #>> '{walletBinding,address}' AS profile_wallet_address,
-    settings #>> '{walletBinding,status}' AS profile_wallet_status,
-    settings #>> '{walletBinding,network}' AS profile_wallet_network,
+    coalesce(
+      settings #>> '{bitcodeProfile,walletBinding,provider}',
+      settings #>> '{walletBinding,provider}'
+    ) AS profile_wallet_provider,
+    coalesce(
+      settings #>> '{bitcodeProfile,walletBinding,address}',
+      settings #>> '{walletBinding,address}'
+    ) AS profile_wallet_address,
+    coalesce(
+      settings #>> '{bitcodeProfile,walletBinding,status}',
+      settings #>> '{walletBinding,status}'
+    ) AS profile_wallet_status,
+    coalesce(
+      settings #>> '{bitcodeProfile,walletBinding,network}',
+      settings #>> '{walletBinding,network}'
+    ) AS profile_wallet_network,
     updated_at AS profile_updated_at
   FROM public.user_profiles
-  WHERE settings ? 'walletBinding'
+  WHERE
+    settings #> '{bitcodeProfile,walletBinding}' IS NOT NULL
+    OR settings ? 'walletBinding'
 ),
 wallet_connections AS (
   SELECT

supabase/queries/v28_qa_staging_hard_reset.sql

@@ -0,0 +1,33 @@
+-- Saved query name: v28_qa_staging_hard_reset
+-- Purpose: destructive staging-only reset for early V28 QA.
+-- Do not run against production. This preserves schema/migrations and removes
+-- Supabase Auth users plus Bitcode-owned public projection rows.
+
+begin;
+
+delete from auth.users;
+
+do $$
+declare
+  truncate_sql text;
+begin
+  select
+    'truncate table ' ||
+    string_agg(format('%I.%I', table_schema, table_name), ', ' order by table_name) ||
+    ' restart identity cascade'
+  into truncate_sql
+  from information_schema.tables
+  where table_schema = 'public'
+    and table_type = 'BASE TABLE'
+    and table_name <> 'spatial_ref_sys';
+
+  if truncate_sql is not null then
+    execute truncate_sql;
+  end if;
+end $$;
+
+insert into public.btd_supply_state (id)
+values ('global')
+on conflict (id) do nothing;
+
+commit;

uapi/app/login/callback/LoginCallbackClient.tsx

@@ -7,6 +7,7 @@ import TypingAnimation from '@/components/base/bitcode/typing-animation';
 
 interface LoginCallbackClientProps {
   code: string;
+  codeKind?: 'oauth_code' | 'token_hash' | 'none';
   /** Where to redirect after session established ("/" by default) */
   nextPath?: string;
 }
@@ -15,13 +16,17 @@ interface LoginCallbackClientProps {
  * Client-side interactive UI for the login callback route.
  * Includes animation effects and copy-to-clipboard.
  */
-export default function LoginCallbackClient({ code, nextPath = '/' }: LoginCallbackClientProps) {
+export default function LoginCallbackClient({
+  code,
+  codeKind = 'none',
+  nextPath = '/',
+}: LoginCallbackClientProps) {
   const [copied, setCopied] = useState(false);
   const [redirecting, setRedirecting] = useState(false);
   const containerRef = useRef<HTMLDivElement>(null);
 
   // Determine if this is an OTP flow (magic-link) or an OAuth redirect
-  const isOtpFlow = Boolean(code && code.trim().length > 0);
+  const isOtpFlow = codeKind === 'token_hash' && Boolean(code && code.trim().length > 0);
 
   // Track mouse for subtle effect
   const mx = useMotionValue(0);
@@ -117,6 +122,19 @@ export default function LoginCallbackClient({ code, nextPath = '/' }: LoginCallb
       // `#access_token=…`).  Supabase doesn’t parse the hash automatically in
       // the browser SDK, so we do it manually and call `setSession()`.
       const hash = typeof window !== 'undefined' ? window.location.hash || '' : '';
+      if (codeKind === 'oauth_code' && code) {
+        try {
+          const { error } = await supabase.auth.exchangeCodeForSession(code);
+          if (error) throw error;
+          complete();
+          return;
+        } catch (exchangeError) {
+          const message = exchangeError instanceof Error ? exchangeError.message : String(exchangeError);
+          window.location.href = `/?loginError=server_error&loginErrorDescription=${encodeURIComponent(message)}`;
+          return;
+        }
+      }
+
       if (hash.startsWith('#')) {
         const p = new URLSearchParams(hash.slice(1));
         const access_token = p.get('access_token');
@@ -154,7 +172,7 @@ export default function LoginCallbackClient({ code, nextPath = '/' }: LoginCallb
     return () => {
       cleanup?.();
     };
-  }, [nextPath]);
+  }, [code, codeKind, nextPath]);
 
   const handleCopy = () => {
     if (!code) return;

uapi/app/page.tsx

@@ -1,4 +1,5 @@
 import type { Metadata } from 'next';
+import { redirect } from 'next/navigation';
 
 import PublicShellFrame from './(root)/components/PublicShellFrame';
 import MarketingLandingPage from './(root)/components/MarketingLandingPage';
@@ -12,7 +13,32 @@ export const metadata: Metadata = {
   },
 };
 
-export default function Home() {
+type SearchParams = Record<string, string | string[] | undefined>;
+
+function appendSearchParams(target: URLSearchParams, searchParams: SearchParams) {
+  for (const [key, value] of Object.entries(searchParams)) {
+    if (Array.isArray(value)) {
+      for (const entry of value) {
+        if (entry) target.append(key, entry);
+      }
+    } else if (value) {
+      target.set(key, value);
+    }
+  }
+}
+
+function hasSupabaseCallbackParams(searchParams: SearchParams) {
+  return Boolean(searchParams.code || searchParams.token_hash || searchParams.error || searchParams.error_description);
+}
+
+export default function Home({ searchParams = {} }: { searchParams?: SearchParams }) {
+  if (hasSupabaseCallbackParams(searchParams)) {
+    const params = new URLSearchParams();
+    appendSearchParams(params, searchParams);
+    if (!params.has('next')) params.set('next', '/auxillaries/wallet');
+    redirect(`/tps/supabase/callback?${params.toString()}`);
+  }
+
   return (
     <PublicShellFrame>
       <MarketingLandingPage />

uapi/app/tps/supabase/callback/page.tsx

@@ -19,7 +19,13 @@ export default function SupabaseCallbackPage({ searchParams }: { searchParams: S
   }
 
   const nextPath = firstParam(searchParams.next) || '/';
-  const code = firstParam(searchParams.code) || firstParam(searchParams.token_hash);
-  return <LoginCallbackClient code={code} nextPath={nextPath} />;
+  const authCode = firstParam(searchParams.code);
+  const tokenHash = firstParam(searchParams.token_hash);
+  return (
+    <LoginCallbackClient
+      code={authCode || tokenHash}
+      codeKind={authCode ? 'oauth_code' : tokenHash ? 'token_hash' : 'none'}
+      nextPath={nextPath}
+    />
+  );
 }
-