Branch per task

A preview environment is a copy of production (sanitized by default) with its own URL, keys and database, and a time to live. An agent can migrate, seed and break it freely; production only changes when you approve a merge.

The loop

Terminal

TASK=add-invoices
scribase env create acme my-app "pr-$TASK" preview sanitized aws-eu-central-1 "create-pr-$TASK" 24
scribase operation get acme <operation-id>                 # until succeeded
scribase branch register acme my-app "pr-$TASK" --base production
scribase apps switch acme my-app --env "pr-$TASK" --format dotenv > .env.preview

scribase migrate acme my-app "pr-$TASK" --dir supabase/migrations --apply
scribase gen types acme my-app "pr-$TASK" --out src/database.types.ts

scribase branch diff  acme my-app production "pr-$TASK"
scribase branch merge acme my-app production "pr-$TASK" --dry-run

The agent shows you the diff and the dry run. After you approve:

Terminal

scribase backup create acme my-app production "pre-$TASK"
scribase branch merge  acme my-app production "pr-$TASK"
scribase env delete    acme my-app "pr-$TASK" "delete-pr-$TASK"

Over MCP the same steps are environment.create, operation.get, branch.register, migrate.run, branch.diff, branch.merge, backup.create and environment.delete. The scribase-safe-change skill walks an agent through this loop, including the RLS proof with policy.test.

Data modes

Mode	What the preview gets
`sanitized`	A copy of the parent's data, then anonymized. The default for previews.
`snapshot`	An exact copy. Only when you ask for real data.
`schema_only`	Schema, no rows.

Pull requests

Link the preview to its pull request so each shows the other:

Terminal

scribase branch pr acme my-app "pr-$TASK" github acme/app 42

A preview is removed automatically when its TTL expires. Extend it with scribase env renew acme my-app "pr-$TASK" 24 "renew-pr-$TASK".

See Branching for how branches work underneath.