Kyntrava Guard

Customer data stays gated until remote table reachability, public exposure controls, and signed client mismatch-denial proof are all verified.

locked

Protected Supabase workflow

Database Verification Workbench

Run the live Supabase isolation proof, inspect the client-claim gate, and see exactly what still blocks real client production data.

Expected Tables0

Service Reachable0

Public Controlled0

Mismatch Denials0

Production isolation

Current Gate

Remote table smoke

Table Checks

Table	Service	Publishable

Actions

Run Verification

This calls the protected verifier. If signed client inputs or the Auth Admin verifier mode are configured, it seeds temporary verification-only rows, checks valid and mismatched claims, then cleans them up.

Signed client claim

Required Inputs

Use temporary Supabase Auth verifier users

Fastest safe path when available: check SUPABASE_AUTH_ADMIN_CLIENT_PROBE to create temporary Supabase Auth verifier users with app_metadata.client_id, issue real access tokens, seed verification-only rows, check isolation, then delete users and rows. Alternate paths: enter only SUPABASE_JWT_SECRET, or provide SUPABASE_CLIENT_TEST_ID with SUPABASE_CLIENT_TEST_JWT and SUPABASE_MISMATCH_TEST_JWT. Values are posted only to the protected verifier and are not rendered in proof output.

Evidence

Latest Proof

Unlock to load proof state.

Signed isolation handoff

Final Data Gate

Open Readiness Runner