Impulsion access test — Farah Bhatti

Self-audit against the Team Agentic Access Policy checklist.

Name: Farah Bhatti
Run at: 2026-08-25 14:02 BST
Hostname: Mac.Home
Account: farah@impulsion.io

4 PASS 0 FAIL 2 UNVERIFIED

Not a clean pass — two checks could not be run at all. No personal scoped database role exists to test the vault boundary against, and no Cloudflare API token has been issued. Both need action from Brian. Nothing on this machine failed.

#	Check	Status	Evidence / what's missing	Section
1	Machine	PASS	FileVault On. `~/impulsion-secrets/agent.env` created, mode 600, directory 700, `git rev-parse` fails as required, and the path is not under Dropbox / Google Drive / iCloud. Real credentials live in credential helpers, all at 600: `~/.config/gh/hosts.yml` (token actually in macOS Keychain, not on disk), `~/.wrangler/config/default.toml`, `~/.railway/config.json`.	1 — MACHINE
2	Hygiene (inverted)	PASS	No forbidden material. No `sk_live_` / `rk_live_` key, no `TWILIO_AUTH_TOKEN`, no QuickBooks or GHL token. Two initial hits were false positives and are worth fixing in the policy: `SUPABASE_SERVICE_ROLE_KEY` is the stock Supabase CLI local key (`iss: supabase-demo`, `exp: 1983812996`) — public, identical on every dev machine; and `GHL_CLIENT_SECRET` / `RESEND_API_KEY` are 21-char `local-dev-…` stubs. Stripe is a `sk_test_` stub. The whole file points at `127.0.0.1`.	2 — HYGIENE
3	GitHub	PASS	`gh auth status` OK as `farah309`; `.permissions.push` on `Homewood-Capital-Management-East-LLC/horse_riding` = true.	3 — GITHUB
4	Railway	PASS	`railway whoami` → `farah@impulsion.io`. Nothing deployed.	4 — RAILWAY
5	Supabase	UNVERIFIED	Could not be run — and that is the finding. The only connection string on this machine, `SUPABASE_DB_URI`, points at `127.0.0.1:54322` — the local dev database, not the client database. There is no personal scoped production role to test against; prod access goes through `railway run` on the service's own shared credential. Whether my role can read `vault.decrypted_secrets` is unknown — not proven negative.	5 — SUPABASE
6	Cloudflare	UNVERIFIED	No `CLOUDFLARE_API_TOKEN` exists on this machine, so there was nothing to check against `/client/v4/user/tokens/verify`. Auth is wrangler OAuth instead: `farah@impulsion.io`, `pages (write)`. Note: that session also lists Brian@impulsion.io's Account alongside mine.	6 — CLOUDFLARE
W1	Proof site	PASS	This page, deployed to `access-test-farah` pinned to Farah's account ID. No other project touched.	ALLOWED WRITE 1
W2	Report to Brian	PASS	Emailed to brian@impulsion.io from Farah's own account on 2026-08-25.	ALLOWED WRITE 2

Still open

No personal scoped database role exists. The vault-boundary check — the substance of the whole test — cannot be performed until one is issued. Needs Brian.
No Cloudflare API token has been issued, so check 6 can never pass as written. A Pages-Edit-only token scoped to Farah's account would close it.
Cloudflare OAuth reaches Brian's account as well as Farah's. Worth confirming that is intended.
Check 2 is mis-specified. It matches on key names and JWT role claims, so it flags every developer running a standard local Supabase, while never inspecting ~/.wrangler or ~/.railway where the real tokens actually live. Suggest it compare against known-public constants and scan the credential stores.
Not exercised: Twilio and QuickBooks — no access currently held.