DEP — Pipeline Protocol Architecture Audit

# DEP — Pipeline Protocol Architecture Audit **Date:** 2026-02-23 **Scope:** Full architecture review — security, schema, code quality, dependencies, observability bridge **Systems:** Supabase Edge Functions, Pipeline Protocol DB, Nexus Portal, Nexus Exporter, Prefect Watcher, Grafana, Alert Rules The Pipeline Protocol is a 3-table Supabase schema (`pipeline_definitions`, `pipeline_runs`, `pipeline_step_logs`) with 2 VIEWs, 1 trigger, and a shared TypeScript module consumed by 3 edge functions. It bridges to Nexus observability via a Prometheus exporter, Grafana dashboard, Prefect watcher, and a Next.js portal page. The system works end-to-end (verified: run created, step logged, run completed, metrics collected). However, the audit uncovered **3 critical**, **10 high**, **7 medium**, and **6 low** severity findings across security, schema integrity, code quality, and dependency management. The most urgent issues are: 1. Hardcoded Supabase keys in committed source (nexus-portal) 2. `db-migrate-temp` edge function still deployed (arbitrary DDL execution) 3. Pipeline core tables have no migration files (schema drift) 4. `ensureRun` race condition under concurrent dispatch 5. Column name drift between migrations and edge functions (`sweep_id` vs `campaign_id`, `base_quantity` vs `boxes_per_delivery`) | # | Finding | Location | Risk | |---|---------|----------|------| | S1 | **Hardcoded Supabase anon JWT + project ref** in client-side source. 9-year expiry token committed to git. | `nexus-portal/src/lib/api.ts:87-89` | Key extraction from browser bundle grants read access to all pipeline data | | S2 | **`toggle_pipeline_run_pause` RPC has no auth guard.** SECURITY DEFINER function callable by anon role — anyone with the leaked key can pause/unpause any pipeline run. | RPC function (applied via temp edge fn) | State manipulation by unauthenticated callers | | S3 | **Pipeline tables may lack RLS policies.** Tables created via Management API, not tracked in migrations. Comment says "SELECT RLS for anon" but no migration confirms this. If RLS is not enabled, anon key grants full table access. | `pipeline_runs`, `pipeline_step_logs`, `pipeline_definitions` | Full data exposure via REST API |