diff --git a/.gitignore b/.gitignore
index 91cda38..2900b6e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,3 +12,4 @@ node_modules/
 .vercel
 .claude/settings.local.json
 .venv/
+supabase/
diff --git a/CLAUDE.md b/CLAUDE.md
index 9103816..bd19232 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -107,7 +107,7 @@ This checklist tracks compliance gates separately from build readiness. Update i
 | Service role keys absent from frontend env vars (VITE_) | PASS — verified 2026-06-05 |
 | Railway-to-Supabase TLS | PASS — Supabase SDK manages SSL at infrastructure level |
 | CSV file disposition post-normalization confirmed | PASS — raw bytes discarded; only hash + normalized records persist |
-| Audit log WORM enforcement (RLS blocks UPDATE/DELETE on audit_log) | NOT DONE |
+| Audit log WORM enforcement (RLS blocks UPDATE/DELETE on audit_log) | PASS — migration 20260607000001_audit_log_worm.sql applied via CLI 2026-06-07; audit_log table created with RLS + WORM policies live in Supabase |
 | PostgreSQL as primary audit log retention sink documented (6-year) | NOT DONE |
 | MFA confirmed on all admin accounts (AWS, Supabase, Railway, Vercel, Clerk) | NOT VERIFIED |
 | payer_rules.json quarterly update cadence documented | PASS — documented in docs/compliance/data-handling.md 2026-06-07 |