A neutral look at one design choice

Supabase, and a small always-on worker beside it

What the worker is good for, and where you do not need one.

Written for a team that already runs on Supabase and a native Mac app. No sales pitch. Each slide stands on its own.

Press → or swipe to start

The question in one picture

Supabase does a lot. A Mac app alone cannot do the rest.

Supabase already does

Hosted, always on, looked after

DatabaseSign-inRow-level securityLive updatesFile storageShort functionsScheduled database jobs
A Mac app alone cannot

Work that needs something awake

  • Run when the lid is closed
  • Receive Slack, email or portal messages
  • Keep keys safe on every laptop
  • Run long jobs, or keep a shared record

Which view fits depends on one thing: what your app does when nobody is looking at it.

The shape

One small worker sits beside Supabase and does the unattended work

Team Mac apps Mac app Mac app Mac app Outside services Slack Email Portal Supabase data and sign-in live updates job table (the queue) Always-on worker one small server (VPS) or container claims jobs, runs the agents, writes results and run records Gateway holds the keys, makes the calls Model providersClaude, GPT, local Replies outSlack, email, portal Keys stay on the server side No keys on the Macs. Every outside call goes through the gateway. view, approve messages in jobs needs a call Team Mac apps Mac app Mac app Mac app view, approve Supabase data and sign-inlive updatesjob table (queue) Outside services Slack Email Client portal jobs messages in Always-on worker one small server (VPS) or container claims jobs, runs the agents,writes results and run records needs a call Gatewayholds the keys, makes the calls Model providersClaude, GPT, local Replies outSlack, email, portal Keys stay on the server sideNo keys on the Macs. Every outside callgoes through the gateway.

Macs talk to Supabase as before. The worker is one more client of Supabase that never sleeps.

An example day

While the laptops sleep, the work still gets done

08:30 Laptops wake. Results wait in "Needs you". Laptops asleep in use asleep Worker always on 1 2 3 4 00:00 03:00 06:00 09:00 12:00 15:00 18:00 21:00 24:00 WorkerLaptops 00:0003:0006:0009:0012:0015:0018:0021:0024:00 always on asleep in use asleep 1234 08:30 Laptops wake Results wait in"Needs you"
1Slack question arrives. A reply is drafted.
2Email arrives. It is sorted and a draft is prepared.
3The scheduled morning report is built.
4A client portal request in the evening gets picked up.

Illustrative day. Times are examples, not measurements.

What needs something awake

Work that needs a fixed, always-on address

Scheduled jobs

A morning client summary or a weekly report. A cron job is an alarm clock for software, and it needs something awake to hear it.

Incoming webhooks

Slack, email and the client portal push messages to a web address. A laptop has no steady address, so the message needs a fixed one.

Laptops asleep

An agent on one person's Mac stops when the lid shuts, the Wi-Fi drops or the system updates.

Fair notepg_cron and Edge Functions handle short database jobs, and "receive, check, store", very well. A worker helps when a schedule starts an agent, calls outside services, or takes a while.

One steady owner

One owner for the job queue, and a record the server writes

Email arrives Job queue Job 41 · doneclosed Job 42 · new emailclaimed by: worker Job 43 · waitingunclaimed Laptop Atries to claim Laptop Btries to claim already taken,so it skips Workersteady owner

Safe retries

A failed job goes back in line, up to a set number of tries. Nothing is sent twice.

Long-running agent jobs

A short function stops at its time limit. A worker keeps going and saves progress as it goes.

Audit trail written by the server

Complete and in one place, not on whichever laptop ran it.

Tip: the picture scrolls sideways on a phone.

Fair noteSupabase can hold the queue and log data changes. The worker is the one steady owner that is always there to claim jobs and record what the agent did.

One place for the sensitive parts

Keys and rules in one place, not on every laptop

Secrets and gateway

A gateway is one doorway that holds the keys and makes outside calls for everyone.

  • Change a key once, not on every machine
  • A lost laptop leaks none

Same rules for all

The harness is the setup around an AI model: its tools, automatic checks (hooks) and alignment rules.

  • Same for every person and agent
  • Applies to scheduled work too

Monitoring and health checks

The worker pings "I am alive". If the pings stop, a person is told.

  • Also flags stuck jobs and failing runs
  • One more small thing to own
Fair noteSupabase can store secrets for its own Edge Functions, and the Mac app can ship with the same rules built in. The worker makes sure automated work follows them too.

Code safety

Tests on every push, and agents on their own copy

Git runners and CI

A runner is a machine that checks the code each time it changes. "It works on my Mac" stops being the end of the discussion.

Push→Runner on the worker→Pass or fail

Agents in isolated branches

A branch is a separate copy of the work. Agents try changes there, and a person approves before anything joins the main version.

Main→Agent branch→Person approves
Fair noteHosted testing services are good, and branches also work on a laptop. A worker suits you if you want tests and agent work next to your keys, with one setup for both.

Always on duty

Service agents, and a request at 2am that still reaches a person

Email inbox agentSlack reply agentClient portal agentIntegration agentsResearch and report jobs
Watchdog: raises an alarm if the triage agent itself goes quiet Classifyurgent or not Answersimple ones Alert on-callSMS, call, Slack Waitfor a reply Escalatenext person simple no reply emergency On-call rota: person A, then B, then C Watchdogalarm if the triage agent goes quiet Classifyurgent or not Answer simple onesdone, no one is woken Alert on-callSMS, call or Slack Waitfor an acknowledgement Escalateto the next person simple no reply emergency On-call rota: person A, then B, then C
Fair noteIf you do not run helpers like these yet, this does not apply yet. Triage is where a sleeping laptop matters most: the alerts must keep running when everyone is offline.

Another option

Hosted agent services versus a small worker

Hosted agent services

Claude or OpenAI hosted runs, Edge Functions, cron

Good at

  • Quickest way to start
  • Nothing to maintain or patch
  • The vendor runs and scales it

Trade-offs

  • Tied to one vendor and its sandbox
  • Time limits, no persistent file system (Edge Functions)
  • Keys and rules sit with each vendor
Small worker

One small server you control

Good at

  • Mixing Claude, GPT and local models per job
  • Rules and keys kept in one place
  • Still able to call hosted agents where they are good enough

Trade-offs

  • Someone looks after it
  • You set up the health check yourself

These are not rivals. A worker can hand a job to a hosted agent when that is the simplest fit.

Being honest

When you need a worker, and when you can skip it

You need one when
  • Work must run while laptops are closed
  • Outside services must reach you at a fixed address
  • Jobs run longer than a short function allows
  • You want one home for keys, rules and run records
  • On-call alerts must not depend on a laptop
You can skip it when
  • The app only reacts while someone has it open
  • All jobs are short and fit Supabase
  • Nothing arrives from Slack, email or a portal
  • You would rather not own another server
  • Hosted agents already cover what you need

If you skip it, Supabase plus the Mac app is a sound choice. You can add a worker later, when a real need shows up.

If you do add one

A suggested minimal starting setup

  1. Supabase stays the source of truth.Data, sign-in and the queue stay where they are.
  2. The Mac app stays a client.Nothing changes for people using it.
  3. One small worker.It picks up jobs from a Supabase table, runs the agent, and writes results and run records back.
  4. Secrets only on the worker.None on the Macs.
  5. A health ping and an alert.So a person hears if it stops.
Mac apps Supabasesource of truth One workerholds the secrets jobs, results ping missed: alert
One questionDoes any work need to happen when nobody has the app open? If not, you are done. If so, add the worker and let it do only that work.
1 / 12