Almost everyone is a teammate: you build and ship without asking anyone for access. An App Operator is a granted role for the few who also stand apps up — repo, database, hosting, portal — without being an account admin anywhere. This page is the rulebook: what the role grants, who holds it, the rules of the road, and exactly how a migration works.
You already have this — it comes with your @slw.vc sign-in.
Everything a teammate does, plus provisioning — standing up the things apps run on.
Least privilege on every platform: enough to build and run apps, never enough to touch billing or delete an organization. Day to day it splits into two tiers:
Code, hosting, env vars, CI, portal listing. Unrestricted on green CI — this is most of the work.
Creating a database and copying data runs through the migration script (backup → restore → verify), so the one destructive step can’t be fumbled.
| Platform | Can do | Can’t do |
|---|---|---|
| GitHubrivent-dev | ✓Create app repos, push, merge PRs, set CI & secrets on their own apps | ✕Change settings on shared repos, delete the org, billing |
| SupabaseSLW Databases | ✓Create & manage project databases, run migrations | ✕Delete the org, billing, manage members |
| Vercelslw1010 | ✓Deploy apps, manage project env vars | ✕Billing, delete the team |
| Cloudflarerivent.dev | ✓Deploy Pages, edit rivent.dev DNS | ✕Account admin, other zones |
| Replitsource apps | ✓Open, edit & export Repls | ✕Team billing & members |
Live from the same roster the portal uses. Everyone else with an @slw.vc sign-in is a teammate.
| Person | Role | Status |
|---|---|---|
| Loading the roster… | ||
One command on the server grants the role — it handles GitHub + Vercel automatically and prints the three manual invites (Cloudflare, Supabase, Replit). Remove someone by taking them out of the same five places.
Seven rules cover every scenario. They keep operators fast on the safe things and careful on the few that matter.
You’re admin on any repo you create. Org rules still gate the database and production paths — those changes need review, no matter who you are.
If it’s small and tests pass, ship it. Features, migrations, and anything risky go through a pull request with green CI.
Data moves only through the migration script. It backs up first, restores, and verifies row counts — so the one irreversible step can’t go wrong quietly.
A production DB plus a -dev twin, following the house pattern. Spinning them up is your call — just be intentional: each active database ≈ $10/mo (~$20 for the pair).
Practice data only in dev and experiment databases. Real SLW data or secrets go into a dev environment only with Shawn’s OK.
Named for the app; its database matches the name. Keeps the portal, Codespaces, and databases lined up one-to-one.
Use add-app-operator to grant the role. Reverse it by removing them from the same five platforms — membership is the access.
Five stages, same every time. The one that decides the path is Stage 1 — whether the app has a real database.
Run the report prompt in the Replit Agent. It reports the stack, the secrets it needs, and — the deciding question — whether it has a Postgres database.
A new repo in rivent-dev, code pushed, Replit-specific bits stripped out.
If it has one, the script creates its Supabase project (prod + dev), copies the data across, and verifies it. Skipped entirely for apps with no database.
Deploy to Vercel or Cloudflare, load the secrets, add a devcontainer + CI, and list it on the portal.
Smoke-test the live app, then turn the Replit app off. Nothing is deleted until the new one is proven.
Where it ends up living — the same shape as every other SLW app:
The situations that actually come up — click any to expand.
-dev twin). The migration script copies your data across with a backup taken first and a row-count check after, so nothing is lost. Budget ≈ $10/mo per active database (~$20 for the pair), billed to the org.add-app-operator <github-username> <email> on the server. It adds them to GitHub + Vercel automatically and prints the three manual invites (Cloudflare, Supabase, Replit). They accept the GitHub and Vercel emails, and they’re in.