SPROCKET | DEPLOY

Configure the stack.
Protect the intelligence.

One MakeGood console for Hostinger, Supabase, Sprocket OAuth, Reclaim, and PoC release validation.

M

MAKEGOODmanaged deployment

Hostinger front end. Supabase backend. One governed Sprocket system.

DEPLOYMENT 0%

SYSTEM MAP

One stack. Clear ownership.

The front end stays lightweight. Authorization and company intelligence stay behind the backend boundary.

→

DEPLOYMENT CHECKPOINTS

Build it in the right order.

DEPLOYMENT OUTPUTS

Generate the files Hostinger needs.

Export browser-safe configuration and a non-secret deployment record.

02 / HOSTINGER

Make the front end feel intentional.

Host the operator experience on Hostinger. Keep data authority in Supabase.

STATIC FRONT END

01

Public origin

HTTPS required

Environment Company display name Deploy console URLMakeGood-only operator console. Reclaim URLHistory import operator experience. Company slug MakeGood operator email

03 / SUPABASE

Connect the backend without exposing it.

Only browser-safe connection values live here.

BACKEND AUTHORITY

02

Project connection

Publishable key only

Supabase project URL Supabase publishable keySafe in browser code when backend authorization/RLS is correct. Project ref

Supabase dashboard

Not tested

×

Never paste privileged keys into this console.

No sb_secret_…, no service-role JWT, no database password, no OAuth client secret.

04 / DATABASE

Build the data layer in sequence.

The console tracks execution. Supabase SQL Editor remains the migration surface.

CONTROLLED MIGRATIONS

01

Base schema

supabase/01_base_schema.sql

Company, knowledge, settings, history.

02

Single-GPT identity + OAuth + RBAC

supabase/02_single_gpt_identity_oauth_rbac.sql

Users, roles, permissions, clients, codes, tokens.

03

Bootstrap company + OAuth client

supabase/03_bootstrap_company_oauth_and_roles.sql

Create company and save the raw OAuth secret outside this console.

04

Add acceptance-test users

supabase/04_add_or_update_user.sql

Provision Owner and Developing Estimator identities.

R

Sprocket Reclaim history layer

supabase/11_reclaim_legacy_history.sql

Imports, conversations, messages, evidence, review state.

05 / FUNCTIONS

Keep authority server-side.

Edge Functions enforce identity, capabilities, financial visibility, and Reclaim publishing.

RUNTIME

OAUTH

sprocket-oauth

Connect ChatGPT to pre-approved company identities.

Add Supabase URL first

Not tested

DeployedPlatform JWT verification off.

API

sprocket-api

Load current user role and filter company intelligence.

Add Supabase URL first

Not tested

DeployedOpaque Sprocket token validation.

RECLAIM

sprocket-reclaim

Operator-only legacy history intake and publish boundary.

Add Supabase URL first

Not tested

DeployedMakeGood authorization enforced.

CORS ORIGIN

Allow the exact operator origin.

Avoid wildcard CORS for privileged Reclaim endpoints.

Configure Hostinger URL first

Live CORS verified

06 / GPT + OAUTH

One Sprocket. Authenticated per person.

Generate the Action settings and register the callback.

CHATGPT

03

OAuth Action

Client secret stays out

Authorization URL

Token URL

Scope OAuth Client ID ChatGPT callback URLRegister exactly with 05_register_chatgpt_callback.sql.

07 / SPROCKET RECLAIM

Don’t start over.
Bring the intelligence with you.

MakeGood imports the contractor’s prior AI estimating history before PoC release.

04

Operator connection

MakeGood only

Reclaim API base

Import mode Default non-financial visibility

Not tested

08 / VALIDATE

Prove the boundary before release.

The critical PoC test is simple: same Sprocket, separate authenticated people, correct backend visibility.

RELEASE GATE

INFRASTRUCTURE

Connection status

Hostinger HTTPS—

Supabase project—

Sprocket APINot tested

Reclaim APINot tested

CRITICAL ACCEPTANCE

Role boundary

Owner connects/me returns OWNER. Developing Estimator connectsSame GPT, restricted capabilities. Financial isolation holdsNo financial-sensitive retrieval. Capture governance worksCandidates + senior approval. Reclaim preserves evidenceNo automatic company policy.

!

RELEASE STATUS

Not ready to release

Complete the required configuration and acceptance checks.

AUDIT RECORD

Save the deployment state.

Export a non-secret record for the PoC file.

Configure the stack.
Protect the intelligence.

One stack. Clear ownership.

Hostinger

Supabase

Edge Functions

Build it in the right order.

Company + database

GPT + OAuth

Reclaim

Validate access

Generate the files Hostinger needs.

Make the front end feel intentional.

Public origin

Connect the backend without exposing it.

Project connection

Build the data layer in sequence.

Base schema

Single-GPT identity + OAuth + RBAC

Bootstrap company + OAuth client

Add acceptance-test users

Sprocket Reclaim history layer

Keep authority server-side.

sprocket-oauth

sprocket-api

sprocket-reclaim

Allow the exact operator origin.

One Sprocket. Authenticated per person.

OAuth Action

Don’t start over.
Bring the intelligence with you.

Operator connection

Prove the boundary before release.

Connection status

Role boundary

Not ready to release

Save the deployment state.

Configure the stack.Protect the intelligence.

One stack. Clear ownership.

Hostinger

Supabase

Edge Functions

Build it in the right order.

Company + database

GPT + OAuth

Reclaim

Validate access

Generate the files Hostinger needs.

Make the front end feel intentional.

Public origin

Connect the backend without exposing it.

Project connection

Build the data layer in sequence.

Base schema

Single-GPT identity + OAuth + RBAC

Bootstrap company + OAuth client

Add acceptance-test users

Sprocket Reclaim history layer

Keep authority server-side.

sprocket-oauth

sprocket-api

sprocket-reclaim

Allow the exact operator origin.

One Sprocket. Authenticated per person.

OAuth Action

Don’t start over.Bring the intelligence with you.

Operator connection

Prove the boundary before release.

Connection status

Role boundary

Not ready to release

Save the deployment state.

Configure the stack.
Protect the intelligence.

Don’t start over.
Bring the intelligence with you.