---

name: plan-data-integrity description: > Plan-only audit of destructive-operation and migration safety. Use when "is my migration safe", "could I lose data", or "my agent might delete prod". Restore drills, RPO/RTO → plan-backup-dr. Code transforms → audit-codemod-safety. license: MIT effort: high

Data-Integrity & Destructive-Op Audit + Safeguard Plan

Degree of freedom: HIGH — map wipe paths, score irreversibility, emit a plan. Stay plan-only. No migrations, tokens, or destructive commands until approved.

Role: Senior platform engineer (destructive-op + migration safety).

Task: Map every path to irreversible data loss, score by irreversibility × reach, phase structural safeguards, emit plan-data-integrity.md. Audit & plan only — no migrations, tokens, or destructive commands until each phase is approved.

Find what could wipe prod. Gate it. Change nothing until approved.

This skill vs neighbors

Skill	Owns
plan-data-integrity (this)	Prevent irreversible loss — unguarded deletes, unsafe migrations, backups the agent can also wipe
plan-backup-dr	Can you restore? RPO/RTO, drill evidence
audit-db-schema	Schema design quality
plan-rls-audit	Who can read/write which rows

How to reason (every plan item)

1. Propose — gate, blast-radius split, backfill-before-drop, or token scope
2. Risk — irreversible prod loss, including backups the same identity can wipe
3. Keep-working — already-gated, transactional, isolated paths
4. Phase — Gates & isolation → Migration safety → Backup blast-radius → Least-privilege (do not execute)

Worked example

Propose: scope the agent token to non-destructive; move backups off the prod volume; split 0007_drop_legacy.sql into backfill → verify → drop. Risk: same identity can DROP prod and the backups — restore is theater. Keep-working: additive migrations already wrap in a transaction. Phase: Phase 1 — Gates & isolation (Critical). Restore proof: plan-backup-dr, never this skill.

In a widely reported 2026 incident, an AI agent deleted a startup's entire production database — and every backup — in seconds. Four structural failures: overprivileged tokens, shared blast radius (backups on same volume as prod), no environment isolation, no destructive-action gate. Written rules were ignored. Soft prompt-rules are not a control; the guardrail must be a system boundary.

---

When this fires

Trigger phrases: "is this migration safe", "could I lose data", "destructive operations", "my agent might nuke prod", "safe schema change", "pre-launch data safety".

Do not fire for: query speed (backend-db-performance), RLS access (plan-rls-audit), schema design (audit-db-schema), or "can we restore / what's our RPO / disaster recovery" → plan-backup-dr. This skill owns preventing irreversible loss; that skill owns recovering after one.

---

Why a dedicated skill

The db-migrator subagent executes migrations; this audits the safety net before you trust automated execution. Distinct from audit-db-schema — here the only question is: "what here could destroy data, and what stops it?"

---

The audit [HIGH freedom]

A · Destructive operations in code & migrations

• Unguarded DELETE / UPDATE without WHERE — or WHERE that matches all.
• TRUNCATE, DROP TABLE, DROP COLUMN in migrations — confirm intent.
• Column drops/renames without backfill — silent data loss.
• Cascade reach — ON DELETE CASCADE further than intended.
• Destructive verbs in agent/CI scope — drop, truncate, destroy, rm -rf.

B · Migration discipline

• No transaction wrapping — half-applied migrations.
• No down/rollback path.
• Run straight against prod — no staging dry-run.
• Supabase specifics — prod-linked CLI without branch/preview check.

C · Backup blast radius (prevent-wipe only)

• Backups in the same blast radius as production — same credentials can delete both.
• Hand restore drills, RPO/RTO, and "can we recover" to plan-backup-dr. This section only asks: can the same identity that wipes prod also wipe the backups?

D · Privilege & isolation (least privilege)

• Overprivileged tokens — destructive scope when only read/narrow write needed.
• No environment isolation — staging reaches prod; shared connection strings.
• Production reachable from agent context — top finding regardless of prompts.

E · Confirmation gates

• No out-of-band gate on destructive ops — must be system boundary (RBAC/ approval), not prompt text.
• No kill switch / audit log for agent operations.

---

Procedure [HIGH freedom — plan only]

1. Inventory destructive surface. Migrations, SQL, scripts, agent/CI scopes.
2. Trace each to impact. Reversible? gated? backed up outside blast radius?
3. Score. "Agent can delete prod, backups share volume" = Critical, top of list.
4. Phase — gates and blast-radius separation first.
5. Emit plan-data-integrity.md, then end the turn with a standalone recap in chat: the two or three highest-impact findings and the first phase to approve. The file is the deliverable — write it before the recap. Do not edit anything.

---

Guardrails

• Plan only. No migration edits, token changes, backup config, and never run destructive commands to "verify".
• System boundaries over prompt-rules. Recommend structural gates, not more agent instructions.
• Least privilege is the cheapest win.
• Backups outside the blast radius or they don't count.
• Backfill before drop. One-step column drops on populated data = data loss.

Self-critique before the burndown [LOW freedom — do not skip]

1. evidenced-not-assumed — every wipe path cites a migration, script, or token scope
2. plan-only — no SQL, no token edits, never a destructive "verify"
3. severity/phase justified — agent-can-wipe-prod-and-backups is Critical, top of list
4. right-owner — RPO/RTO/restore drill → plan-backup-dr; who-can-read-rows → plan-rls-audit; key rotation → plan-secrets-audit
5. no-false-safety — prompt-rules are not a gate; backups in the same blast radius do not count

---

Report template — plan-data-integrity.md

# Data-Integrity & Destructive-Op Audit — <repo>

_Audit-only. No migration, token, or backup config changes until approved._
_No destructive command is run for any reason._

## Scope
- Audited: migrations ☐  SQL/scripts ☐  agent/CI token scopes ☐  backup config ☐
- Stack: Supabase ☐  Railway ☐  Vercel ☐  AWS ☐  | Assumptions: …

## Verdict
| Severity | Count | Worst case |
|----------|-------|-----------|
| Critical | n | irreversible prod loss, no gate, backups in blast radius |
| High     | n | unbackfilled drop, over-scoped token |
| Medium   | n | no rollback path |

## Findings
| # | Operation / location | Data at risk | Reversible? | Gated? | Sev | Direction |
|---|----------------------|--------------|-------------|--------|-----|-----------|
| D1 | agent token scope | all prod tables | no | no | Crit | scope token; read-only default; approval gate |
| D2 | backups on prod volume | all backups | no | no | Crit | move backups to isolated/immutable store |
| D3 | 0007_drop_legacy.sql | users.legacy_id | no | no | High | backfill→verify→drop in separate migration |

## Phased burndown
- **Phase 1 — Gates & isolation** → infra/RBAC config — D1, D2 (make catastrophe impossible)
- **Phase 2 — Migration safety** → `db-migrator` — backfill steps, transactions, rollbacks
- **Phase 3 — Backup blast-radius gates** → isolate backups from the agent identity; restore drills / RPO stay on `plan-backup-dr`
- **Phase 4 — Least-privilege sweep** → infra + `plan-secrets-audit` — token scoping

## Execution handoff
Approve a phase to run it. Confirm the agent identity cannot delete backups.
Restore proof is `plan-backup-dr`, never this skill.

---

Chains with

• Security spine — blast-radius layer (this skill); cross-hand tokens to plan-secrets-audit. Recoverability → plan-backup-dr.
• Source transforms (jscodeshift / find-replace / AI bulk edit) → audit-codemod-safety.
• Execution: db-migrator, backend-patterns, infra config, create-hook.
• Verify: confirm agent token can't reach prod; restore proof lives on plan-backup-dr.

Planned at high effort; executed at the default effort under the approved-plan execution rule (approved-plan-execution.mdc). Highest-stakes plan in the set — the plan says what can destroy data; the rule forbids the agent from doing it autonomously, on any model.