Role created on the Sase.tr standalone Postgres with SELECT-only
privileges on schema public + ALTER DEFAULT PRIVILEGES so future
tables inherit the grant. Panel-web DATABASE_URL_SASE_RO switched to
this role; panel redeployed; UPDATE/INSERT/DELETE rejected with
'permission denied' as expected; SELECT count(*) FROM users still
works.
Process: temporarily exposed sase-postgres on port 54320, ran the
SQL via psql, then closed the public port. Password generated with
openssl rand -hex 24 (lives only in Coolify env).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Phase 7 (user mgmt, all of A–F) and Phase 8 (VIN observability Faz 1–4
+ regression alert) are shipped. Teknikborc previously listed many of
those as open — clean it up and section the remaining work into:
- Phase 7 still-open items (support actions, KVKK, sessions, bulk ops,
automation) — explicitly listed at top
- Phase 8 still-open items (alert config UI, vin_anomaly_log table,
pointing to RUNBOOK.md for documentation)
- PRD ↔ Sase.tr reality gaps (EFT killed, B2B doesn't exist, etc.)
- Defansif teknik borç (super_panel_reader rol, prisma db push
multi-replica risk, pre-existing Sase.tr typecheck errors)
- Sase.tr-side work (Faz 0+1 PostHog events; notes that the backend
VIN telemetry was tried and reverted because query_logs already has
everything we need)
- BIP open work (P1 fix, eval golden set, pattern bundle, embedding
similarity, multi-project routing)
- Minor / low priority polish items
RUNBOOK.md is new: founder operations guide. Sections:
- Telegram alert → response matrix (success drop, regression, p95
spike, volume drop/spike, timeout dominance)
- Founder daily review walkthrough (the / "Bugün" page sequence)
- Pipeline/cron health (job cadences + how to check)
- Coolify quick reference (app UUIDs + deploy command)
- User report → fix call chain
- Security model summary
- Local dev + new endpoint scaffolding steps
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Panel-side only — first writable feature on the Sase user detail page.
Notes are stored in the panel database (sase_user_notes); the spoke is
never touched (KVKK minimize).
Model
- SaseUserNote { id, saseUserId, authorUserId, body, pinned, createdAt }
- Index on (saseUserId, pinned, createdAt) for the default render order
API
- GET /api/sase/users/[id]/notes — list (pinned first, then newest)
- POST /api/sase/users/[id]/notes — { body, pinned } create (audit'li)
- PATCH/DELETE /api/sase/notes/[noteId] — toggle pin / hard delete
UI
- New "Notlar" tab on user detail. Textarea + pinned checkbox + submit;
list shows TR-localized timestamps, per-row pin/unpin and delete.
Schema sync
- package.json `start` now runs `prisma db push --skip-generate` before
`next start`. Panel uses db-push style (no migrations dir); this lets
the new table land on next deploy without a separate manual step.
Future destructive changes will require a smarter migration approach.
teknikborc.md updated: super_panel_reader role still needs to be created
on the new sase-postgres (current panel uses sase superuser).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
8-item insight category covering pilot success closure, push-notification
gap, Sase.tr Faz 0+1 prerequisites that unblock 9 dormant tag rules, eval
golden set requirement, and deferred volume-dependent work (bundle mode,
embedding similarity, multi-project routing).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
