Prepare isolated CFH signup in shared Supabase

app/actions.ts

@@ -154,6 +154,7 @@ export async function signIn(
         options: {
           emailRedirectTo: callback,
           shouldCreateUser: form.get("intent") === "signup",
+          data: { signup_platform: "coders-for-humanity" },
         },
       });
       if (error)

docs/profile-onboarding.md

@@ -12,12 +12,12 @@ The save operation uses verified `auth.getUser()`, existing origin validation, s
 
 ## Remaining hosted verification
 
-Dedicated Supabase provisioning requires the owner's organization choice and provider cost confirmation. Once provisioned, configure production and staging callback URLs, email delivery and GitHub OAuth; apply and audit the migrations; then verify real signup, callback recovery, duplicate handles, private/public directory visibility, and editing under two distinct accounts. Local policy tests do not substitute for this hosted auth check.
+On October 3, 2026 the owner chose the existing `retehost-cfw` project with CFH data in separate schemas. See `supabase/shared/README.md` for the isolated migration and the current read-only database blocker. After that blocker is resolved, configure exact callback URLs and email delivery, verify any enabled OAuth provider, apply and audit the shared-schema migration, and exercise real signup and two-user isolation. Local policy tests do not substitute for hosted auth checks.
 
 ## Photography
 
 Four real photographs replace the homepage decoration and project card artwork, introduce photographed program cards, and anchor the project overview and profile preview. They are local assets with responsive image optimization. Licensing and source details are in `public/photos/README.md` and `/photo-credits`. Photos are illustrative and do not claim an existing CFH team or completed fieldwork.
 
 ## Release path
 
-This change uses a feature branch and preview. Main requires the three CI checks and independent code-owner approval; branch protection must remain enabled. A review must not be replaced by direct production promotion.
+This change uses a feature branch and preview. Main requires the three CI checks. The owner has final release authority under `docs/owner-authority.md`; everyone else requires owner approval or explicit delegation.

lib/supabase.ts

@@ -14,6 +14,8 @@ export async function createClient() {
     process.env.NEXT_PUBLIC_SUPABASE_URL!,
     process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY!,
     {
+      db: { schema: "cfh" },
+      cookieOptions: { name: "cfh-auth" },
       cookies: {
         getAll() {
           return jar.getAll();

proxy.ts

@@ -12,6 +12,8 @@ export async function proxy(request: NextRequest) {
     process.env.NEXT_PUBLIC_SUPABASE_URL,
     process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY,
     {
+      db: { schema: "cfh" },
+      cookieOptions: { name: "cfh-auth" },
       cookies: {
         getAll: () => request.cookies.getAll(),
         setAll(values) {

scripts/shared-schema.ts

@@ -0,0 +1,29 @@
+import { readFileSync } from "node:fs";
+
+// Preserve the reviewed foundation, but never run its public-schema loops on
+// the shared project. Every object and schema-wide grant is scoped to CFH.
+export function sharedSchemaMigration() {
+  const files = [
+    "20260928025534_institutional_foundation.sql",
+    "20260928034553_community_workspace.sql",
+    "20260928040326_founding_human_work.sql",
+  ];
+  const body = files.map((file) =>
+    readFileSync(`supabase/migrations/${file}`, "utf8")
+      .replace(/^-- Apply to a new, dedicated.*\r?\n/m, "")
+      .replace(/^\s*(begin|commit);\s*$/gim, "")
+      .replace(/\bpublic\./g, "cfh.")
+      .replace(/'public'/g, "'cfh'")
+      .replace(/\bprivate\b/g, "cfh_private"),
+  );
+  return [
+    "-- CFH only. Apply this bundle, not the dedicated-project migrations, to retehost-cfw.",
+    "begin;",
+    "create schema cfh;",
+    "revoke all on schema cfh from public;",
+    "grant usage on schema cfh to anon, authenticated;",
+    ...body,
+    "commit;",
+    "",
+  ].join("\n");
+}

supabase/shared/README.md

@@ -0,0 +1,55 @@
+# CFH in retehost-cfw
+
+The owner authorized the existing `retehost-cfw` project (`msekcqxmwvxxxqcsdpfn`)
+on October 3, 2026 to avoid another paid project. CFH uses the `cfh` schema for
+application tables and API functions, and the unexposed `cfh_private` schema for
+roles, audit records, rate limits, and privileged helpers. Auth identities and
+project capacity are shared; this is data separation, not an independent Auth
+tenant. An existing Retehost identity still needs to create a CFH profile.
+
+**Do not apply `supabase/migrations` directly to the shared project.** Those are
+the historical dedicated-project migrations and contain public-schema grant/RLS
+loops. Apply only this directory's generated migration. `scripts/shared-schema.ts`
+translates all schema references and schema-scoped loops; tests verify unrelated
+public/private tables remain untouched and cross-user CFH edits are rejected.
+
+## Current blocker
+
+On October 3, 2026 the live database reported `default_transaction_read_only=on`
+from its server configuration and a database size of 1566 MB. The migration tool
+rejected the operation before creating its history table. Both CFH schemas remain
+absent. No remote schema changes or production environment changes were applied.
+
+The largest relations were existing EVE gateway attestations (634 MB), device
+signature assertions (364 MB), command receipts (290 MB), and claim commands
+(196 MB). These are existing application records, not disposable CFH test data.
+Do not disable read-only protection, delete these records, or purchase capacity
+without a separately scoped owner instruction and a verified recovery plan.
+
+## Activation sequence
+
+1. Resolve the shared database's read-only state through the approved capacity or
+   retention procedure. Confirm it accepts writes without overriding protection.
+2. Apply `migrations/20261003150827_shared_cfh_namespace.sql`. Run advisors and
+   confirm CFH RLS, explicit grants, and seven founding tasks.
+3. Append `cfh` to the existing exposed API schemas; preserve all current entries.
+   Never expose `cfh_private`.
+4. Append the exact CFH auth callback to allowed redirects, preserving every
+   existing application's redirects and the shared Site URL. Inspect the existing
+   email sender/hook first; do not replace it with a CFH-only implementation.
+5. Configure only the CFH Vercel project with the shared project URL and publishable
+   key. Never put a service-role key in the app. CFH uses its own `cfh-auth` cookie
+   name. Signup metadata identifies `coders-for-humanity` for mail routing only;
+   it is never an authorization claim.
+6. Verify delivered email, callback, profile creation, duplicate usernames,
+   private/public visibility, sign-out, and two-user isolation against the hosted
+   API. Hide any social provider that is not actually configured.
+7. Release through the owner-authority policy after CI passes; verify public signup
+   on the production domain. Until then, leave production unconfigured so it
+   continues to identify browser drafts honestly.
+
+Dashboard sign-in is also needed: the connected database tools do not expose auth
+configuration, the local CLI has no management access token, and the opened
+Supabase dashboard required sign-in. Do not commit downloaded provider config or
+credentials. Current local unit/database and TypeScript tests are not a hosted
+signup acceptance result.