rls-enforcelisted

# RLS Enforce — apply Row-Level Security, correctly Fixes what /rls-audit finds. Parity partner: /rls-audit enumerates the anon surface and emits findings (`surface` · `table_class` · `gap` · `severity` · `reproduction`); this skill consumes exactly that list and closes each. If run standalone (no prior audit), do the coverage scan in Step 0 to produce the same findings shape first. Postgres/Supabase-generic; no assumptions about the schema beyond what you read from it. > Open-source note: this skill is project-agnostic. It reads the target DB's own schema and applies general RLS best practice. Nothing project-specific is hardcoded. ## Step 0 — Ingest or map 1. **If /rls-audit findings exist**, take them as the work list — each finding already carries `surface` · `table_class` · `gap` · `severity`. Skip re-discovery; go to the plan. 2. **If standalone**, run the coverage scan to build the same findings: for every base table in `public`, is RLS enabled (`pg_class.relrowsecurity`), does any write policy expose `anon`/`authenticated`/`public` (`pg_policies`), any PII/cost column client-reachable, any world-callable `SECURITY DEFINER` function? Classify each table: **owner-scoped** · **reference/config** · **server-internal** · **public-catalog**. 3. Map each `gap` → the pattern in Step 1 that closes it. Present the plan (finding → migration) and WAIT for green. Nothing applied unsolicited. ## Step 1 — Apply the pattern library (pick per table class) Each becomes a migration.