Tier 3 structural enforcement: DB invariant gate in CI (+ crew sync v2 phase docs)

.github/workflows/ci.yml

@@ -5,6 +5,26 @@ on:
   push:
     branches: [main]
 
+# Cancel a still-running CI run for this branch/PR when a new commit lands
+# on it, instead of letting both run to completion. Without this, rapid
+# successive pushes spawn overlapping e2e runs that all target the SAME
+# live E2E Supabase project (not per-run isolated) — two runs' global-setup/
+# global-teardown can race and delete [E2E]-prefixed seed rows out from
+# under each other's still-in-progress tests, surfacing as unexplained
+# "did not find some options" / element-not-found flakes that have nothing
+# to do with the actual code under test.
+#
+# Not scoped to github.ref — github.ref differs between a pull_request event
+# (refs/pull/<pr>/merge) and a push event for the same branch/commit
+# (refs/heads/<branch>), so a per-ref group lets a push run and a
+# pull_request run for the same change execute concurrently, which is
+# exactly the race this block exists to prevent. A single group for the
+# whole workflow serializes every run (across all branches and PRs) that
+# touches the shared E2E Supabase project.
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
 jobs:
   checks:
     runs-on: ubuntu-latest
@@ -96,3 +116,28 @@ jobs:
           name: playwright-report
           path: playwright-report/
           retention-days: 14
+
+  # ── Database invariants (structural enforcement Tier 3) ──────────────────
+  # Checks the live schema for what no code-side check can see: RLS enabled
+  # on every public table, no unexpected policy-less (deny-all) tables, a
+  # covering index on every FK column, zero anon table grants. Runs against
+  # the DEDICATED E2E project (same secrets as the e2e job — CI never holds
+  # production credentials); both projects receive every migration, so
+  # schema invariants verified there hold for production by construction.
+  # Self-disarming like the e2e job: secrets absent → warning annotation,
+  # job passes. See scripts/check-db-invariants.mjs for the check details.
+  db-invariants:
+    runs-on: ubuntu-latest
+    env:
+      NEXT_PUBLIC_SUPABASE_URL:  ${{ secrets.NEXT_PUBLIC_SUPABASE_URL }}
+      SUPABASE_SERVICE_ROLE_KEY: ${{ secrets.SUPABASE_SERVICE_ROLE_KEY }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # This job only reads the repo and runs one script — no reason to
+          # leave the checkout token on disk.
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: node scripts/check-db-invariants.mjs

CLAUDE.md

@@ -1057,8 +1057,8 @@ item below" as part of the definition of done for any non-trivial change.
 ## Structural Enforcement — Guardrails
 
 Conventions in this file are enforced in code wherever they can be, so
-following them stops being a memory test. Three layers, checked in CI via
-`npm run lint` and `vitest run`:
+following them stops being a memory test. Four layers, checked in CI via
+`npm run lint` and `vitest run` (plus the `db-invariants` CI job for layer 4):
 
 1. **ESLint rules** (`eslint.config.mjs`, the "Structural enforcement"
    config block) — AST-level bans scoped to `app/`, `lib/`, `components/`:
@@ -1087,6 +1087,16 @@ following them stops being a memory test. Three layers, checked in CI via
 
 3. **`check:ui-classes`** — the raw `btn-*`/`badge-*`/`card` class grep.
 
+4. **DB invariant gate** (`scripts/check-db-invariants.mjs`, CI
+   `db-invariants` job) — the live-schema invariants no code-side check can
+   see, via `public.db_invariant_report()` against the dedicated E2E
+   project: RLS enabled on every public table, no policy-less (deny-all)
+   tables outside the script's shrink-only `SERVICE_ROLE_ONLY_TABLES`
+   allowlist, a covering index on every FK column, and zero `anon` table
+   grants (all revoked 2026-07-24 — no client reads tables
+   unauthenticated). Self-disarms with a warning when the E2E secrets are
+   absent, same as the e2e job.
+
 **The meta-rule: a new convention ships WITH its guardrail.** If a rule is
 worth adding to this file, add its ESLint rule or `unit/guardrails/` test in
 the same PR — and the CLAUDE.md prose for mechanically-checkable rules

app/(dashboard)/maintenance/CreateWorkOrderModal.tsx

@@ -30,6 +30,7 @@ export function CreateWorkOrderModal({
   vendorCompliance = [],
   orgId = '',
   onClose,
+  onSuccess,
   onWarning,
 }: Readonly<{
   properties:       PropertyOptionWithCoords[]
@@ -39,6 +40,7 @@ export function CreateWorkOrderModal({
   vendorCompliance?: VendorComplianceRow[]
   orgId?:           string
   onClose:          () => void
+  onSuccess?:       () => void
   onWarning?:       (msg: string) => void
 }>) {
   const [state, action, pending]          = useActionState(createWorkOrder, null)
@@ -77,6 +79,13 @@ export function CreateWorkOrderModal({
   useEffect(() => {
     if (!state?.success || !state.workOrderId) return
 
+    // revalidatePath() in the createWorkOrder Server Action refreshes the
+    // Server Component's data on the NEXT navigation, but this modal closes
+    // without one — the parent board's props otherwise go stale until some
+    // other navigation happens to trigger a refetch. router.refresh() (via
+    // onSuccess, wired in maintenance-board.tsx) forces that refetch now.
+    onSuccess?.()
+
     if (state.warning) onWarning?.(state.warning)
 
     // No photos attached — close immediately

app/(dashboard)/maintenance/maintenance-board.tsx

@@ -1,7 +1,7 @@
 'use client'
 
 import { useState, useTransition, useEffect } from 'react'
-import { useSearchParams } from 'next/navigation'
+import { useRouter, useSearchParams } from 'next/navigation'
 import {
   Plus, ChevronDown, X, Wrench, Calendar, DollarSign,
   User, ChevronRight, AlertTriangle, CheckCircle2, Clock,
@@ -855,6 +855,7 @@ export function MaintenanceBoard({
   orgId?:           string
   role:             string
 }) {
+  const router        = useRouter()
   const searchParams  = useSearchParams()
   const urlFilter     = searchParams.get('filter')
 
@@ -1240,6 +1241,7 @@ export function MaintenanceBoard({
           vendorCompliance={vendorCompliance}
           orgId={orgId}
           onClose={() => setShowCreate(false)}
+          onSuccess={() => router.refresh()}
           onWarning={setWarning}
         />
       )}

app/(dashboard)/maintenance/page.tsx

@@ -8,13 +8,13 @@ export default async function MaintenancePage() {
   const { supabase, membership } = await requireOrgMember()
 
   const [
-    { data: workOrders },
-    { data: properties },
-    { data: vendors },
-    { data: schedules },
-    { data: crewMembers },
-    { data: propertyAssets },
-    { data: vendorCompliance },
+    workOrdersResult,
+    propertiesResult,
+    vendorsResult,
+    schedulesResult,
+    crewMembersResult,
+    propertyAssetsResult,
+    vendorComplianceResult,
   ] = await Promise.all([
     supabase
       .from('work_orders')
@@ -89,15 +89,28 @@ export default async function MaintenancePage() {
       .eq('org_id', membership.org_id),
   ])
 
+  // A query erroring (bad filter value, RLS misconfiguration, etc.) and a
+  // query legitimately returning zero rows both leave `data` empty — `?? []`
+  // below can't tell them apart, so without this the board just silently
+  // renders as if nothing exists instead of surfacing a real outage.
+  const results = [
+    ['work_orders', workOrdersResult], ['properties', propertiesResult], ['vendors', vendorsResult],
+    ['maintenance_schedules', schedulesResult], ['crew_members', crewMembersResult],
+    ['property_assets', propertyAssetsResult], ['vendor_compliance_status', vendorComplianceResult],
+  ] as const
+  for (const [name, result] of results) {
+    if (result.error) console.error(`[MaintenancePage] ${name} query failed:`, result.error)
+  }
+
   return (
     <MaintenanceBoard
-      workOrders={workOrders ?? []}
-      properties={properties ?? []}
-      vendors={vendors ?? []}
-      schedules={schedules ?? []}
-      crewMembers={crewMembers ?? []}
-      propertyAssets={propertyAssets ?? []}
-      vendorCompliance={vendorCompliance ?? []}
+      workOrders={workOrdersResult.data ?? []}
+      properties={propertiesResult.data ?? []}
+      vendors={vendorsResult.data ?? []}
+      schedules={schedulesResult.data ?? []}
+      crewMembers={crewMembersResult.data ?? []}
+      propertyAssets={propertyAssetsResult.data ?? []}
+      vendorCompliance={vendorComplianceResult.data ?? []}
       orgId={membership.org_id}
       role={membership.role}
     />

app/(dashboard)/turnovers/turnover-board.tsx

@@ -262,7 +262,7 @@ function CrewAssignment({
                     onClick={() => handleAdd(c.id)}
                     className="w-full text-left px-3 py-2 text-sm hover:bg-canvas-themed transition-colors flex items-center gap-2"
                   >
-                    <span className="w-6 h-6 rounded-full bg-brand-100 text-brand-700 text-xs font-bold flex items-center justify-center flex-shrink-0">
+                    <span aria-hidden="true" className="w-6 h-6 rounded-full bg-brand-100 text-brand-700 text-xs font-bold flex items-center justify-center flex-shrink-0">
                       {c.name[0]?.toUpperCase()}
                     </span>
                     {c.name}
@@ -353,6 +353,7 @@ function TurnoverCard({
 
   return (
     <div
+      data-testid={`turnover-card-${turnover.id}`}
       className={cn(
         'bg-card-themed rounded-xl border transition-shadow',
         CARD_BORDER_CLASS[urgencyTone],