SEC: portal server actions ungated - unauthenticated read of client queue

ENAMEL-18 enamel Done urgent

portalPen: staff triage surface (read, answer, assign, resolve tickets)

ENAMEL-20 enamel Done high

Shared support tables have zero DB-side access control: no RLS, owning role, cross-tenant with terra

ENAMEL-28 enamel Backlog high

Agent-operable ticket API: REST handlers over /soporte, single auth definition

ENAMEL-27 enamel Blocked high

User + group administration: no UI exists, every grant is a hand-written DB row

ENAMEL-22 enamel Blocked high

Live schema and db/migrations have drifted: full both-directions inventory needed

ENAMEL-26 enamel Backlog high

Access-request form: /solicitar-acceso is a dead end, accessIssueReports never written

ENAMEL-21 enamel Done high

Portal: accept 'venus' as a portal appKey scope tag + grant Puia client under venus

ENAMEL-17 enamel Done high

Greenfield transactional email stack: dispatcher chokepoint, admission+egress guards, durable outbox

ENAMEL-16 enamel Backlog high

Split shared app.bypass_immutable GUC per-guard (enamel half)

ENAMEL-13 enamel Done high

Whole-DB pg_dump insurance for eprpywqwzsvrjeaforei (enamel+terra shared project) does not exist

ENAMEL-12 enamel Blocked high

Scaffold bare Next.js app + push first commit to empty GitHub repo

ENAMEL-5 enamel Done high

Legal review: HC data residency under Ley 25.326

ENAMEL-1 enamel Backlog high

App shell: no navigation, no sign-out, single-branch redirector

ENAMEL-23 enamel Done

Historia clinica: the stated initial focus, zero app surface, pacientes table empty

ENAMEL-24 enamel Backlog

supportTicketCounters has no guard - the instrument used to bound a disclosure incident is itself unprotected

ENAMEL-19 enamel Backlog

Schema-qualify 62 unqualified references in 24 function bodies (enamel_025)

ENAMEL-15 enamel Done

pg_temp search_path hardening across all enamel functions (A2 + 022 + 023A)

ENAMEL-14 enamel Done

Verify coder-enamel-cc Vercel build+runtime-log read before Class-A self-PTD floor is enforceable

ENAMEL-9 enamel Done

Instrument per-task SOLO-METRICS (turn+token baseline) — enamel pilot deliverable

ENAMEL-8 enamel Canceled

sync fouba-institucional.md into enamel checkout + git-add it

ENAMEL-10 enamel Done

P1 router-rebind: codify Class-S→solo-default / Class-A→full-team into enamel project docs

ENAMEL-6 enamel Done

FoUBA shared institutional reference — solo-enamel content assembly + commons trigger-line

ENAMEL-4 enamel Done

Track AR data-protection reform bill + ReNaPDiS registration procedure

ENAMEL-3 enamel Backlog

Confirm if LOINC + DICOM are mandated (not just recommended) for HCE interop

ENAMEL-2 enamel Backlog

Rename portal module to portalPen + give the empty state a next action

ENAMEL-25 enamel Done low

P2 triage-codify: auth-gate-first playbook into solo-enamel-cc.md

ENAMEL-7 enamel Canceled low

Wire applog-listen@enamel error rail when enamel is built

ENAMEL-11 enamel Backlog low