EVO-71 tooling reference: author fn-REVOKE enforcement — (1) .gitpush-pre.sh static guard flagging CREATE [OR REPLACE] FUNCTION lacking same-tx REVOKE EXECUTE FROM PUBLIC/anon/authenticated + (2) post-apply catalog assertion (proacl excludes PUBLIC/anon/authenticated on new public fns)

EVO-71 mechanization so the fn-REVOKE rule is enforced not oral. Mars authors the REFERENCE once (same author-here-vendor-per-app model as the MARS-408 friction-lint); each app vendors into its own .gitpush-pre.sh + post-apply check as its own EVO-71 per-app child. Two pieces: (1) MIGRATION STATIC GUARD (push-lane, in .gitpush-pre.sh): flag any CREATE FUNCTION / CREATE OR REPLACE FUNCTION in a staged migration that lacks a same-transaction REVOKE EXECUTE ... FROM PUBLIC/anon/authenticated. Watch the known false-positive classes the archive-context/soft-delete lints hit (function bodies containing CREATE FUNCTION text, DO blocks, multi-file txns) — provide an opt-out marker like the friction-lint nsf-allow pattern. (2) POST-APPLY CATALOG ASSERTION: after apply, assert aclexplode(proacl) on new public fns excludes PUBLIC(grantee=0)/anon/authenticated EXECUTE. Root cause context: Supabase supautils.hint_roles force-grants PUBLIC/anon/authenticated EXECUTE on every new public FUNCTION regardless of ALTER DEFAULT PRIVILEGES (function-specific — tables/sequences NOT affected, live-probed MARS-522), so ALTER DEFAULT PRIVILEGES is a no-op for fns and explicit per-fn REVOKE is the only reliable fix. Prefer SECURITY INVOKER where it removes the exfil class. Reversible tooling. Confer with audit-mars-ca on the static-guard false-positive surface before wiring it as hard-fail (WARN-first per the MARS-408/407 lint-strict precedent). Report the reference location + a vendoring note so pluto/venus/enamel coders can pick it up.