Apply Witness

Read back. Compare. Keep the receipt.

Success is a claim.
Readback is proof.

Apply Witness checks every declared Supabase auth field against what the provider returns. Ignored fields stay visibly unknown—never green.

Install the CLI Run a local demo
  • No telemetry
  • Read-only API
  • Secrets redacted
A halftone inspection press turning configuration lines into a checked proof receipt
01 / DECLARE → APPLY → WITNESS

The false-success gap

A CLI can return success while sending none of a configuration section. A diff cannot show fields that never made the request.

01 Hash input02 Fetch readback03 Issue receipt

Live proof desk

See the conservative verdict

This browser demo runs locally. Edit either side, then witness it. Nothing leaves this page.

Declared · config.tomlINPUT
Observed · API readbackREADBACK
Runs entirely in your browser

Receipt press is ready

Run the witness to classify each declared field.

One binary. No daemon.

Put proof in the pipeline.

Use live provider readback after an apply, or a captured JSON response for deterministic tests. Exit code 2 blocks changed and unknown fields.

shell
cargo install --git https://github.com/B-Divyesh/sf-config-apply-witness --locked
export SUPABASE_ACCESS_TOKEN="…"
apply-witness verify \
  --config supabase/config.toml \
  --project-ref abcdefghijklmnop \
  --receipt witness.json

Three honest states

No optimistic guessing.

✓ Applied

Match witnessed

The declared value matches explicit provider readback after a documented normalization.

! Changed

Difference found

The provider returned the field, but its observed value differs from the declaration.

? Unknown

Proof unavailable

The API omitted the field or no audited mapping exists. Unknown always fails the policy.

$29ONE TIME

Team Receipt Kit

Batch the proof, not the risk.

Unlock manifest-based multi-project runs, compact CI summaries, and local daily license caching. Single-project verification, JSON export, redaction, and every safety check stay free.

  • One-time purchase, yours to keep
  • Works across your own machines
  • Sociobot / Dodo is merchant of record
Buy the Team kit · $29

Free CLI active. No license stored.

Privacy · Terms · Refunds are handled by the merchant of record and revoke the license.