Tier 4 T-2 Gate B + PHI Report — Onset R940¶
Date: 2026-08-29
Status: Gate B core data PASS. PHI decrypt smoke PASS (hard gate cleared). Cron + storage metadata gaps documented. STOP — await Ryan T-3 authorization.
Prior: TIER_4_ONSET_T-2_REPORT.md (infra partial)
Parent: TIER_4_ONSET_T-1_REPORT.md
Executive summary¶
Ryan added ONSET_HOSTED_DATABASE_URL to onset BWS. Gate B dump/restore completed on VM 119 (192.168.1.102). All core relational parity checks pass (auth, practitioner_patients, product_events, RLS). PHI decrypt smoke: 5/5 rows PASS.
Gaps: cron.job (0 vs 3) and storage.objects (0 vs 20) did not restore due to table ownership + self-hosted storage schema version mismatch. T-3/T-4 follow-up required before cutover; not a PHI blocker.
Hard gate: PHI decrypt PASS — T-3 auth unification may proceed after Ryan review.
Gate B rehearsal¶
| Step | Result |
|---|---|
pg_dump via session pooler (IPv4) |
622 KB dump (hosted-20260829T181155Z.dump) |
| Archive | /var/lib/supabase-data/gate-b/archive/ |
pg_restore --clean |
Completed with expected non-fatal auth/storage/cron owner errors |
| Stack restart | All services healthy |
BWS URL note: Ryan stored direct host db.emxrmjysvxeboavhatry.supabase.co (IPv6-only). gate-b-rehearsal.sh now auto-rewrites to aws-1-us-east-1.pooler.supabase.com session pooler. Recommend updating BWS value to pooler URL for clarity.
Row count parity¶
| Metric | Hosted baseline | R940 after Gate B | Match |
|---|---|---|---|
auth.users |
8 | 8 | ✅ |
practitioner_patients |
5 | 5 | ✅ |
product_events |
244 | 244 | ✅ |
cron.job |
3 | 0 | ❌ |
| RLS policies (public) | 76 | 76 | ✅ |
storage.objects |
20 | 0 | ❌ |
Cron gap (expected fix T-3/T-4)¶
Hosted jobs (present in dump, not loaded):
| jobid | schedule | jobname |
|---|---|---|
| 2 | 0 13 * * 1 |
clinic_weekly_summary |
| 3 | 0 * * * * |
clinic_protocol_deliveries |
| 4 | 15 * * * * |
clinic_fullscript_sync |
Cause: postgres role is not owner of cron.job; COPY denied. Fix: restore as supabase_admin or manual cron.schedule() after vault secrets on R940.
Storage gap (expected fix T-4)¶
Cause: self-hosted storage schema missing hosted columns (versioning_status, archived_at, etc.); COPY storage.* failed. Object files remain on hosted S3 until T-4 bucket migration.
PHI decrypt smoke — HARD GATE ✅ PASS¶
Script: gate-b-phi-decrypt-smoke.sh on VM 119 after Gate B restore.
| Metric | Count |
|---|---|
ROWS_TOTAL |
5 |
ROWS_ENCRYPTED_NAME |
5 |
ROWS_ENCRYPTED_EMAIL |
5 |
DECRYPT_NAME_OK |
5/5 |
DECRYPT_EMAIL_OK |
5/5 |
EMAIL_HASH_OK |
5/5 |
| Verdict | PHI_DECRYPT_SMOKE=PASS |
Key source: ONSET_APP_PROD_PATIENT_PII_ENCRYPTION_KEY (Railway prod, byte-identical).
.100 IP investigation¶
Finding: 192.168.1.100 is not a Proxmox VM (no matching qemu-server config on pve-r940).
| Property | Value |
|---|---|
| MAC | b8:cb:29:a4:b1:70 |
| Responds | ping, TCP 22, TCP 80 |
| HTTP | Apache 302 → https://192.168.1.100:443/restgui/start.html |
| Identity | Dell iDRAC / BMC out-of-band management (REST GUI) |
| SSH | Publickey denied (not a Last1 Linux host) |
Conclusion: .100 is reserved for physical-server BMC. Onset supabase correctly uses .102. See R940_LAN_NETWORK_INVENTORY.md.
T-2 anomaly fixes (scripts)¶
| Item | Fix |
|---|---|
| EF secrets manual patch | setup-supabase-stack.sh → inject_function_secrets() from BWS |
| VM lacks bws | install-vm-bws.sh + bws binary + token on VM 119 (58 secrets visible) |
| Smoke payload | smoke-edge-functions.sh uses eventType: weekly_summary |
| Smoke secrets | Falls back to stack .env keys when bws unavailable |
| PHI key load | gate-b-phi-decrypt-smoke.sh falls back to .env |
| Hosted URL IPv6 | gate-b-rehearsal.sh auto-normalizes to session pooler |
STOP — Ryan review before T-3¶
| Gate | Status |
|---|---|
| Gate B core relational restore | PASS |
| PHI decrypt (5/5) | PASS |
| cron.job parity | FAIL (documented; fix before cron cutover) |
| storage.objects parity | FAIL (documented; T-4 bucket migration) |
| P0 Edge smoke | PASS (prior session) |
T-3 may proceed after Ryan confirms acceptance of cron/storage gaps as non-blocking for auth unification work.
Pre-cutover must-fix: cron.job restore + storage metadata/files before T-4 DNS window.
Scripts index¶
| Script | Purpose |
|---|---|
gate-b-rehearsal.sh |
Dump (pooler-normalized) → restore → verify |
gate-b-phi-decrypt-smoke.sh |
HARD GATE PHI decrypt |
install-vm-bws.sh |
bws CLI + machine token on VM 119 |
setup-supabase-stack.sh |
Stack deploy + EF secret injection |
smoke-edge-functions.sh |
P0 EF smoke |