← WI-043 Doc/link hygiene + plan-doc refresh hooks ★ Live Board · Overview WI-050 Tech debt as a live, promotable surface (header tab/drawer + promote-to-sprint) →

WI-049 · Backlog · reviewer-auth

Reviewer authorization (server-side review->done) [auth/RLS]

queued P2 medium risk   Owner: TBD   Reviewer: Paul   0% · 0/0 tasks complete

Gates: — Requirements: REQ-SEC-005 Updated: 2026-06-22

At a glance

CodeWI-049
Phase—
Order79 of 93
Story points5
Primary surfaceworker/tracker-write.mjs + RLS
Retires—
Depends on—
Blocks—
Evidence
deferred

Goals

Reviewer authorization (server-side review->done) [auth/RLS] — advances phase work toward its gate(s).

Implementation — what to build

Deferred

  • Pulled into a future Security/Auth slice; advisory until then (D26 proposal #11).

Scope

  • Server-side policy for review->done; add reviewer to live GET; tie to REQ-SEC-005 / RLS.

Checklist

  • No checklist yet.

Gates & testing

No milestone gates linked.

Requirements

  • REQ-SEC-005 accepted RLS must move from MVP-permissive to owner-scoped on a documented path, and buyer tables scope by buyer_id once Auth lands.
    Done when: owner_id = auth.uid() policies are the documented upgrade for seller tables; buyer_id scoping activates with Auth.
    Spec: docs/technical/data-model.md (RLS)

Verify (done when)

review->done + HITL status changes are restricted to the reviewer/owner server-side; reviewer in live GET.

Cost triggers

No paid API / infra spend triggered by this item.

Status & editing

queued   Sprint: Backlog

Edit status / sprint on the ★ Live Board → — changes are logged live with who / when / why.

Human-in-the-loop

No human tasks linked.

Findings

None recorded yet.

Concerns

None recorded yet.

Risks

None recorded yet.

Tech debt

None recorded yet.

Tools used

No tool calls recorded.

Files & artifacts

No files / artifacts recorded.

Update log

No log entries yet.