inf-lens

name	inf-lens
description	Activate for any ticket that adds or changes a Supabase migration, environment variable, edge function deployment, or runtime configuration. Ensures infrastructure is live in the target QA environment before state:ready-for-qa.
argument-hint	Migration name, env var name, edge function name, or deployment surface

INF — Infrastructure Readiness Lens

Activate this lens when a ticket makes a change that must be applied to the running environment — not just to source files on disk. Infrastructure gaps are the most common reason Tester returns BLOCKED rather than PASS or FAIL. BLOCKED means testing cannot start at all, which wastes the full QA cycle.

When to Activate

Load this lens when the ticket:

• Adds or modifies a Supabase migration (supabase/migrations/)
• Adds or changes an environment variable consumed by the app (.env.local, Supabase project secrets, Vercel environment settings)
• Deploys or updates a Supabase edge function (supabase/functions/)
• Changes a Supabase storage bucket policy, RLS policy, or auth provider setting
• Changes runtime configuration that takes effect on deploy (CORS rules, webhook endpoints, redirect URLs)

The Infrastructure Checklist

Verify each applicable surface before claiming state:ready-for-qa. Tick off only what the ticket actually touches.

Migrations

Check	What to verify
Applied to QA environment	Migration has been pushed to the target Supabase project, not only run locally via supabase db push --local
Correct project linked	supabase status or the Supabase dashboard confirms the correct project is the target — not a stale local or dev link
No dependency gap	The migration's dependencies (functions, tables, or types it references) were applied in earlier migrations that are already present
Rollback path documented	If the migration drops a column, renames a table, or deletes data, a revert migration exists or the impact is explicitly documented on the ticket

Environment variables

Check	What to verify
Set in target environment	The variable is configured in Supabase project secrets (supabase secrets set) or Vercel environment settings for the QA deployment — not only in the local .env.local
Exact name match	Variable name matches exactly what the code reads: process.env.NEXT_PUBLIC_X, process.env.X, or Deno.env.get('X') — no case or prefix mismatch
Not committed to source	The secret value is not in any committed file, .env.local included in git, or source comment
App can read it	If the variable is new, the app has been restarted or redeployed so the running process has the value available

Edge functions

Check	What to verify
Deployed	supabase functions deploy <name> --project-ref <ref> has been run against the target project after the latest code change
Reachable	A smoke request to the function endpoint (/functions/v1/<name>) returns an expected status — not 404 (not deployed) or 500 (deployed but broken)
Secrets available	Any secrets the function reads via Deno.env.get() are set in Supabase secrets for the target project, not just locally

Auth and platform settings

Check	What to verify
Redirect URLs	Any new OAuth or email redirect URLs are added to the allowed list in Supabase Auth settings for the target project
CORS	If a new edge function or API endpoint is called from the browser, the origin is in the allowed CORS list

Naming the Infrastructure Surface

Before implementation, name each surface this ticket requires:

Infrastructure surfaces:
- Migration:    [filename or 'none']
- Env vars:     [VAR_NAME list or 'none']
- Edge function: [function name or 'none']
- Platform settings: [what or 'none']

Pre-Handoff Gate

Before moving the ticket to state:ready-for-qa, post the following confirmation on the GitHub issue:

INF verified:
- Migration [name]:        applied to [project/environment] ✓
- Env var [NAME]:          set in [target] ✓
- Edge function [name]:    deployed, smoke test ✓
- Platform settings:       [what was changed and confirmed] ✓

Omit lines that do not apply to this ticket, but list at least one line. An empty INF confirmation means the lens was declared active but the gate was never checked — Tester will return BLOCKED.