# Supabash 0.6.0 local validation

Validated on 2026-09-06 against an isolated Supabase stack with Postgres 17.6,
Supabase CLI 2.116.0, Deno 2.1.4, and Supabase Edge Runtime v1.74.2. The live runner
installed the repository SQL and exercised the repository package entry points.

## Results

| Gate                                                  | Result                                |
| ----------------------------------------------------- | ------------------------------------- |
| Postgres and Edge Runtime integration                 | 18 scenario groups passed             |
| Unit tests                                            | 249 tests passed across 37 files      |
| Formatting, lint, TypeScript, source-size checks      | Passed                                |
| Package build and built-entry-point regression checks | Passed                                |
| Packed package consumers, including AI SDK and Deno   | Passed                                |
| Deno source entry-point checks                        | Passed                                |
| Integration cleanup verification                      | Passed; zero remaining test resources |

The live suite covers atomic commits, concurrent writers, injected transaction
failure, UTF-8 and frontmatter rendering, history, restore, checkpoints, retention,
idempotency, cross-owner denial, and delegated capability isolation and revocation.

The 0.6 scenarios add a separate shared publisher and two private users. They prove:

- A private user cannot open the publisher's workspace.
- A reader with only `read` and `history` rights can load a retained shared revision,
  but cannot write, commit, or restore it.
- Bash and Apply Patch can change private memory through `/memories` and cannot
  change shared content through `/docs`.
- Private commits contain backing paths and private changes. Another user's
  filesystem does not receive those changes.
- Publisher upserts, updates, and deletes appear in new snapshots. Existing agent
  snapshots retain their original bytes.
- Private restore leaves the publisher's database head unchanged. Shared restore
  reproduces the old snapshot digest without changing already loaded snapshots.
- Supabase Edge Runtime loads a Postgres revision, reads it through a mounted Bash
  tool, and returns a normal denied-write result for a read-only mount.

## Defect found and fixed

Separately bundled root and AI SDK entry points could hold different JavaScript
constructors for `SupabashError`. A mount correctly refused a write, but the tool's
`instanceof` check could miss that error and throw out of the tool call. Errors now
carry a shared symbol marker and use the canonical `isSupabashError` classifier.
The built-package regression check and live Edge Runtime test pass after this fix.

## Repeating the live gate

Run `bun run test:postgres:live` with these environment variables pointing to a
dedicated local test stack:

- `SUPABASH_TEST_SUPABASE_ROOT`: Supabase project directory.
- `SUPABASH_TEST_DATABASE_CONTAINER`: that project's Postgres container name.
- `SUPABASH_TEST_EDGE_MAIN_FILE`: compatible Edge Runtime main-service loader.
- `SUPABASH_TEST_RESULTS_DIR`: optional directory for results and cleanup evidence.

The runner refuses an environment with existing Supabash resources. It installs
the schema and test helpers, runs the suite, and removes its synthetic users,
schemas, functions, roles, runner containers, and runner cache volumes. Use a
dedicated stack because the gate owns the complete Supabash schema during its run.

These results establish local database and runtime compatibility. Production load,
deployment configuration, and each host integration require their own rollout checks.