fix: close ApplyGuard production release blockers

.github/workflows/supabase.yml

@@ -1,22 +1,65 @@
-name: Deploy Edge Functions
+name: Deploy Edge Functions & Migrations
 
 on:
   push:
     branches:
       - main
     paths:
       - 'supabase/functions/**'
+      - 'supabase/migrations/**'
+      - 'supabase/tests/**'
+      - 'supabase/config.toml'
+      - '.github/workflows/supabase.yml'
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'supabase/functions/**'
+      - 'supabase/migrations/**'
+      - 'supabase/tests/**'
+      - 'supabase/config.toml'
+      - '.github/workflows/supabase.yml'
 
 jobs:
+  validate:
+    name: Test & Build Validation
+    runs-on: ubuntu-latest
+    concurrency:
+      group: pr-validation-${{ github.ref }}
+      cancel-in-progress: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run unit tests
+        run: npm test
+
+      - name: Run build
+        run: npm run build
+
   deploy:
+    name: Migrate Database & Deploy Edge Functions
+    needs: validate
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
+    concurrency:
+      group: production_deployment_pipeline
+      cancel-in-progress: false
 
     env:
       SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
       PROJECT_ID: ${{ secrets.SUPABASE_PROJECT_ID }}
+      SUPABASE_DB_PASSWORD: ${{ secrets.SUPABASE_DB_PASSWORD }}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - uses: actions/setup-node@v4
         with:
@@ -26,18 +69,27 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Run unit tests
-        run: npm test
-
       - uses: supabase/setup-cli@v1
         with:
           version: latest
 
-      - name: Deploy create-checkout
-        run: supabase functions deploy create-checkout --project-ref $PROJECT_ID
+      - name: Link Supabase Project
+        run: supabase link --project-ref $PROJECT_ID --password $SUPABASE_DB_PASSWORD
+
+      - name: Apply Database Migrations
+        run: supabase db push --password $SUPABASE_DB_PASSWORD
+
+      - name: Deploy ai-proxy
+        run: supabase functions deploy ai-proxy --project-ref $PROJECT_ID
+
+      - name: Deploy create-paypal-order
+        run: supabase functions deploy create-paypal-order --project-ref $PROJECT_ID
+
+      - name: Deploy capture-paypal-order
+        run: supabase functions deploy capture-paypal-order --project-ref $PROJECT_ID
 
-      - name: Deploy paymongo-webhook
-        run: supabase functions deploy paymongo-webhook --project-ref $PROJECT_ID --no-verify-jwt
+      - name: Deploy paypal-webhook
+        run: supabase functions deploy paypal-webhook --project-ref $PROJECT_ID --no-verify-jwt
 
-      - name: Deploy cancel-subscription
-        run: supabase functions deploy cancel-subscription --project-ref $PROJECT_ID
+      - name: Deploy download-message-pack
+        run: supabase functions deploy download-message-pack --project-ref $PROJECT_ID

.gitignore

@@ -18,3 +18,10 @@ supabase-go.exe
 supabase.exe
 supabase_cli.zip
 supabase/.temp/
+
+# pre-reformat backup
+.env
+.env.local
+.env.*.local
+
+.vercel

.qoder/better-loop/2026-07-23/011632-applyguard-ph/011632-applyguard-ph/canvas.json

@@ -0,0 +1,120 @@
+{
+  "schemaVersion": 1,
+  "summary": {
+    "evidenceMode": "session-limited",
+    "evidenceBoundary": {
+      "manifest": {
+        "schemaVersion": 2,
+        "sourceFingerprint": "c230073388d2d558",
+        "adapterVersion": "qoder-task-loop-source-v2",
+        "platform": "qoder",
+        "selection": {
+          "strategy": "all-eligible",
+          "eligibleCount": 0,
+          "analyzedCount": 0,
+          "confidence": "Low"
+        }
+      },
+      "deliveryEvidenceLevels": [],
+      "sourceGaps": []
+    },
+    "semanticFacets": {
+      "schemaVersion": 1,
+      "status": "supplementary",
+      "entries": [
+        {
+          "id": "session-insight:source-coverage",
+          "kind": "redacted-summary",
+          "episodeRef": null,
+          "status": "candidate",
+          "labels": [
+            "source-coverage",
+            "Low"
+          ],
+          "summary": "Analyzed 0 of 0 sessions; 0/5 enabled source roots exist. Use this as the current workspace evidence boundary for final insight cards.",
+          "evidenceRefs": [],
+          "modelVersion": "session-insights-v1"
+        },
+        {
+          "id": "session-insight:validation-behavior",
+          "kind": "redacted-summary",
+          "episodeRef": null,
+          "status": "candidate",
+          "labels": [
+            "validation-behavior",
+            "Low"
+          ],
+          "summary": "No validation command category was observed in the analyzed session sample. Inspect more sessions or add explicit validation guidance before claiming validation-after-edit behavior.",
+          "evidenceRefs": [],
+          "modelVersion": "session-insights-v1"
+        },
+        {
+          "id": "session-insight:post-edit-validation",
+          "kind": "rework-correction",
+          "episodeRef": null,
+          "status": "candidate",
+          "labels": [
+            "post-edit-validation",
+            "Low"
+          ],
+          "summary": "No edit event was observed in the analyzed sample. Inspect more sessions before making claims about edit or validation habits.",
+          "evidenceRefs": [],
+          "modelVersion": "session-insights-v1"
+        },
+        {
+          "id": "session-insight:execution-friction",
+          "kind": "friction-taxonomy",
+          "episodeRef": null,
+          "status": "candidate",
+          "labels": [
+            "execution-friction",
+            "Low"
+          ],
+          "summary": "No strong execution friction signal in the analyzed sample. Keep friction claims narrow unless additional failed commands, rejected actions, or warnings are inspected.",
+          "evidenceRefs": [],
+          "modelVersion": "session-insights-v1"
+        }
+      ]
+    },
+    "learningCapture": {
+      "schemaVersion": 1,
+      "state": "N/A",
+      "summary": "N/A — requires two comparable observation windows and an intervention comparison.",
+      "interventions": []
+    }
+  },
+  "dimensions": [
+    {
+      "id": "task-understanding"
+    },
+    {
+      "id": "controlled-execution"
+    },
+    {
+      "id": "change-validation"
+    },
+    {
+      "id": "reliable-delivery"
+    },
+    {
+      "id": "learning-capture"
+    }
+  ],
+  "findings": [
+    {
+      "id": "agent-instructions-missing"
+    },
+    {
+      "id": "no-frontend-ci-validation"
+    },
+    {
+      "id": "missing-runtime-pin"
+    },
+    {
+      "id": "no-integration-e2e-tests"
+    },
+    {
+      "id": "no-recovery-plan-for-payment-state"
+    }
+  ]
+}