Keep infrastructure out of the player’s way.

Reproduce the action and record the friendly error, route, campaign role, and time. Confirm whether the problem affects one user, one campaign, or everyone before changing infrastructure.

• ✓

  Retry the exact action once.

• ✓

  Check the browser console and Vercel runtime errors without exposing them to the user.

• ✓

  Confirm the expected environment variables exist in Production.

• ✓

  Prefer a reversible application fix over asking users to clear all browser data.

Migrations live in the supabase directory and should be run only when a release names the exact file. Most thread fields live in JSON payloads and do not require a migration.

• ✓

  Read the entire migration before running it.

• ✓

  For the engagement release, run supabase/campaign-engagement-migration.sql.

• ✓

  Run it in the Supabase SQL Editor for the production project.

• ✓

  Run its validation queries when provided.

• ✓

  Confirm RLS, grants, RPC execution privileges, and Realtime publication membership.

• ✓

  Record the production confirmation in docs/product-roadmap.md.

Google and Apple redirect through the Supabase callback. Email registration depends on Supabase Auth and the configured SMTP provider.

• ✓

  Google and Apple must allow https://chwpocsxgwiqoysnnhur.supabase.co/auth/v1/callback.

• ✓

  Supabase Site URL should use https://www.loreatlas.studio.

• ✓

  Add every deliberate local or preview redirect URL rather than using broad wildcards.

• ✓

  For Apple private relay, verify the email communication domain and forwarding setup.

• ✓

  Never place a Supabase service-role key in browser code or a public environment variable.

Registration confirmation and recovery email should use the configured SMTP provider. A generic red box or raw object is an application error and should be translated into user-facing language.

• ✓

  Verify the sending domain and required DNS records.

• ✓

  Confirm the SMTP host, port, username, password, and From address in Supabase Auth.

• ✓

  Review provider delivery logs for the recipient and timestamp.

• ✓

  Test confirmation and password recovery separately.

The OpenAI key belongs only in the server-side Vercel OPENAI_API_KEY environment variable. The curator should degrade gracefully to manual Loot creation.

• ✓

  Confirm the OpenAI project has credits and usable rate limits.

• ✓

  Confirm OPENAI_API_KEY exists in Vercel Production and redeploy after changing it.

• ✓

  Review the /api/ai/loot function logs for status and request ID.

• ✓

  Do not log the API key or complete private campaign payload.

• ✓

  AI-created original items must become valid system-owned Homebrew before the Loot thread references them.

Handouts depend on the private Supabase Storage bucket and campaign-scoped policies installed by the campaign handouts migration.

• ✓

  Verify the bucket exists and is private.

• ✓

  Test upload as the campaign owner.

• ✓

  Test revealed access as a joined player.

• ✓

  Confirm an unrelated user cannot read the object.

• ✓

  Keep signed URLs short-lived and regenerate them when needed.

Normal users should see an actionable message, not SQL, JSON, stack traces, null references, or migration filenames unless they are the site owner.

• ✓

  Run typecheck, lint, tests, and the production build before deployment.

• ✓

  Verify the Vercel deployment reaches READY for the intended commit.

• ✓

  Scan runtime errors after deployment.

• ✓

  Check the affected route on desktop and mobile.

• ✓

  If a database change is involved, verify player-safe RLS with separate accounts.

Publishable Supabase keys can appear in the browser. Service-role and OpenAI keys cannot. Keep secrets in Vercel server-side environment variables and rotate any key that is exposed.

• ✓

  Never commit .env.local.

• ✓

  Use the publishable Supabase key in the client.

• ✓

  Use the service-role key only in trusted server code with explicit authorization checks.

• ✓

  Scope OpenAI keys to the project and endpoint permissions actually required.

• ✓

  Redeploy after changing Production variables.