SEC: portal server actions ungated - unauthenticated read of client queue

ENAMEL-18 enamel Done urgent

userGroups write-side liveness is narrower than read-side: future-dated toAt INSERT skips all write guards

ENAMEL-81 enamel In progress high

The admin-minimum guard's advisory lock is an UNFORCED control: its mutual-exclusion effect cannot be rehearsed rollback-only, and forcing it red needs a disposable DB or authorised committed DML on the sole live admin grant

ENAMEL-86 enamel Backlog high

userGroups write triggers skip any grant with a future toAt, so a future-dated INSERT evades the deleted-user, inactive-group and enamel-admin-minimum guards while the corrected read counts it as current

ENAMEL-82 enamel Canceled high

Authenticated admin email-correction surface

ENAMEL-76 enamel Done high

Narrow service capability for /api/soporte: create-plus-grant in one call, a non-admin role allowlist, appKey pinned to the service scope, and fn_correctUserEmail exposed - so no service actor ever needs admin@terra

ENAMEL-69 enamel Done high

└─ Withdraw support bearer email rewrite

ENAMEL-73 enamel Done high

└─ groupNotPermitted telemetry cannot say which group was refused - report the resolved group identity from SQL

ENAMEL-74 enamel Backlog

GET /api/soporte/tickets returns an unaudited, silently-filtered empty list to an under-granted actor

ENAMEL-72 enamel Done high

Agent-solvable Terra lockout recovery beyond email-only lookup

ENAMEL-70 enamel Done high

Greenfield transactional email stack: dispatcher chokepoint, admission+egress guards, durable outbox

ENAMEL-16 enamel Blocked high

└─ ENAMEL-16 Phase A DB half: relax subject/bodyText to nullable with null-or-nonblank CHECKs, add the terminal-or-content invariant and redactedAt

ENAMEL-66 enamel Done high

└─ enamel has not cut over to the EVO-94 host-side email drain: emailOutbox has no invoker, so a queued row is silent mail loss

ENAMEL-33 enamel Done high

└─ Backstop: per-appKey age alarm on the oldest queued emailOutbox row (ENAMEL-33 owns the invoker)

ENAMEL-32 enamel Done

pg_net ACLs: ask Supabase to apply the hardening its own issue_pg_net_access trigger defines but version-gates out at 0.20.3

ENAMEL-41 enamel Blocked high

Shared support tables have zero DB-side access control: no RLS, owning role, cross-tenant with terra

ENAMEL-28 enamel Blocked high

EVO-83 central build: client CR + questions on the extended supportTickets queue, portal UI, and the appKey-VALIDATED SECURITY DEFINER RPC - the only EVO-83 leg still outstanding

ENAMEL-47 enamel Blocked high ↳ EVO-83

Enamel pre-push gate is vacuous: .gitpush-pre.sh scopes off the cached set but runs before staging, so lint/tsc/272 tests are skipped on every app-only push

ENAMEL-63 enamel Done high

User + group administration: no UI exists, every grant is a hand-written DB row

ENAMEL-22 enamel Done high

appEvents no-PII property is measured, not enforced

ENAMEL-37 enamel Done high

└─ ENAMEL-37 timer half: schedule fn_runAppEventsPiiScan and alarm on BOTH ok=false and staleness

ENAMEL-43 enamel Done high

pg_net grants EXECUTE to PUBLIC on this ref: every login role holds an outbound-HTTP primitive, so no role here is confined

ENAMEL-35 enamel Done high

Live schema and db/migrations have drifted: full both-directions inventory needed

ENAMEL-26 enamel Done high

Whole-DB pg_dump insurance for eprpywqwzsvrjeaforei (enamel+terra shared project) does not exist

ENAMEL-12 enamel Done high

Legal review: HC data residency under Ley 25.326

ENAMEL-1 enamel Backlog high

Agent-operable ticket API: REST handlers over /soporte, single auth definition

ENAMEL-27 enamel Canceled high

portalPen: staff triage surface (read, answer, assign, resolve tickets)

ENAMEL-20 enamel Done high

Access-request form: /solicitar-acceso is a dead end, accessIssueReports never written

ENAMEL-21 enamel Done high

Portal: accept 'venus' as a portal appKey scope tag + grant Puia client under venus

ENAMEL-17 enamel Done high

Split shared app.bypass_immutable GUC per-guard (enamel half)

ENAMEL-13 enamel Done high

Scaffold bare Next.js app + push first commit to empty GitHub repo

ENAMEL-5 enamel Done high

Memory sweep: split project_enamel_shipped_surface_state.md, re-verify stale memory files

ENAMEL-93 enamel Backlog

Enamel migration stem allocation has no serialiser: TERRA-282's origin-tag claim gate is terra-only, so two enamel lanes drafting concurrently can both claim the same enamel_NNN

ENAMEL-88 enamel Done

Write the migration preflight/postflight skeleton as a shared file

ENAMEL-90 enamel Done

EVO-123: convert 10 UPDATE OF invariant guards to AFTER/no-column-list

ENAMEL-87 enamel Backlog

enamel has no .gitpush-pre.sh, so an enamel push runs no tests, no typecheck and no lint - the per-repo hook is the only check path and the other four repos have one

ENAMEL-83 enamel Canceled

Should enamel have a second admin? Live count is one with zero headroom

ENAMEL-85 enamel Canceled

Enamel has exactly one live admin grant with zero headroom - decide whether a second is provisioned

ENAMEL-84 enamel Backlog

db/migrations/draft/ is untracked, so a reviewed Class-A digest is one in-place edit from unrecoverable

ENAMEL-79 enamel Canceled

Class-A migration artifacts live in untracked db/migrations dirs

ENAMEL-80 enamel Backlog

loginNoProfile event omits server-resolved auth user ID

ENAMEL-75 enamel Done

groups.value is editable with no immutability constraint - the stable-code convention that every lookup-backed gate rests on is unenforced, and a rename silently changes which rows match

ENAMEL-78 enamel Backlog

Audit identity email-correction preimage protection on shared users rail

ENAMEL-77 enamel Done

bindSupabaseAuthId noMatch arm writes no appEvents row: a signup with no roster row leaves zero trace on the bind rail

ENAMEL-62 enamel Canceled

appEvents refusal rows lost to an unawaited write on /api/soporte

ENAMEL-71 enamel Done

supportTicketCounters has no guard - the instrument used to bound a disclosure incident is itself unprotected

ENAMEL-19 enamel Done

Drop createVenusSupportTicket(text,text,text,text) - decision gate 2026-09-19, after the enamel_060 revoke has had a week to produce a signal

ENAMEL-49 enamel Done

Venus-resident monitoring has no external liveness watcher: every enamel alarm dies silently with its host

ENAMEL-44 enamel Todo

Historia clinica ships behind a gate no identity can pass: zero admin:enamel grants exist fleet-wide

ENAMEL-56 enamel Done

404 capture + scanner filter (catch-all, Block W parity)

ENAMEL-60 enamel Done

resolveOrCreatePaciente validates documentoType against the global catalog, not the tenant scope

ENAMEL-34 enamel Done

└─ Paciente creation is unattributable: no createdBy column, no appEvents row, and the resolver takes no actor argument

ENAMEL-38 enamel Done high

└─ ENAMEL-38 leg B DB half: actorUserIdArg overload + pacientes.createdByUserId, 10-arg signature dropped in the same transaction

ENAMEL-65 enamel Done high

└─ ENAMEL-34 phase 2: drop the ungated 9-arg resolveOrCreatePaciente

ENAMEL-36 enamel Done high

Historia clinica: the stated initial focus, zero app surface, pacientes table empty

ENAMEL-24 enamel Done

└─ Enamel create-paciente app surface

ENAMEL-59 enamel Done high

└─ Enamel cannot register any paciente: the ForApp write path is fail-closed and enamel has no documentoType vocabularyScopes row - needs one product decision on which document types enamel accepts

ENAMEL-50 enamel Done high

└─ Historia clinica ships behind a gate no identity can pass: zero admin:enamel grants exist fleet-wide

ENAMEL-57 enamel Canceled high

└─ Historia clinica: statutory HC-copy export (Ley 26.529) vs no-export scope boundary - needs a ruling

ENAMEL-51 enamel Backlog

└─ Historia clinica: 10-year retention floor has no enforcement mechanism

ENAMEL-55 enamel Backlog low

└─ Historia clinica: mental-health RBAC tier + daily-recording requirement (Ley 26.657)

ENAMEL-54 enamel Backlog low

└─ Historia clinica: FHIR R4 + SNOMED CT AR interop (Ley 27.706)

ENAMEL-53 enamel Backlog low

└─ Historia clinica: firma digital + versioned consent + minors' consent banding (CCyC art.26)

ENAMEL-52 enamel Backlog low

users identity: two humans each hold two live bound rows; duplication sits exactly where the documento axis is disarmed

ENAMEL-40 enamel Done

accessIssueReports gains resolutionNote and fn_resolveAccessIssue threads it as a trailing 6th arg (enamel_058)

ENAMEL-48 enamel Done

app DB pool disables certificate verification (ssl.rejectUnauthorized false) - encrypted but unverified, and the fix needs DATABASE_URL's real host first

ENAMEL-46 enamel Done

vocabularyScopeMembers integrity guard skips 42 percent of member rows: piezasDentarias-backed scopes enter unchecked

ENAMEL-42 enamel Done

Vocabulary guard mirror hole: a piezasDentarias row deleted out from under a scope member

ENAMEL-45 enamel Backlog

terra_209 ships four integrity guards onto enamel-owned shared tables; a rebuild from db/migrations omits them

ENAMEL-39 enamel Done

Decide whether shared pacientes carries provincia/localidad (refiled from terra, DCX-143-20260905)

ENAMEL-31 enamel Done

EVO-93: move this app's email-outbox drain off Supabase pg_cron onto a venus systemd timer

ENAMEL-30 enamel Done

Retire /api/app-version: /api/health is the only version+health surface

ENAMEL-29 enamel Done

Verify coder-enamel-cc Vercel build+runtime-log read before Class-A self-PTD floor is enforceable

ENAMEL-9 enamel Done

App shell: no navigation, no sign-out, single-branch redirector

ENAMEL-23 enamel Done

Schema-qualify 62 unqualified references in 24 function bodies (enamel_025)

ENAMEL-15 enamel Done

pg_temp search_path hardening across all enamel functions (A2 + 022 + 023A)

ENAMEL-14 enamel Done

Instrument per-task SOLO-METRICS (turn+token baseline) — enamel pilot deliverable

ENAMEL-8 enamel Canceled

sync fouba-institucional.md into enamel checkout + git-add it

ENAMEL-10 enamel Done

P1 router-rebind: codify Class-S→solo-default / Class-A→full-team into enamel project docs

ENAMEL-6 enamel Done

FoUBA shared institutional reference — solo-enamel content assembly + commons trigger-line

ENAMEL-4 enamel Done

Track AR data-protection reform bill + ReNaPDiS registration procedure

ENAMEL-3 enamel Backlog

Confirm if LOINC + DICOM are mandated (not just recommended) for HCE interop

ENAMEL-2 enamel Backlog

Census enamel's functions against the EVO-114 R6 forbidden-set shape (report only, no REVOKE authority)

ENAMEL-92 enamel Backlog low

supautils force-grant census: public functions holding EXECUTE outside their allowed set (R6 forbidden-set read, inventory only)

ENAMEL-91 enamel Backlog low

Stale documented DB credential location in enamel-db-agents.md

ENAMEL-89 enamel Done low

page_not_found records no requester on enamel: ip, userAgent and actor are all NULL, so every 404 needs a DM to the lane to attribute

ENAMEL-68 enamel Backlog low

EVO-69 follow-up: add createdAt to supportTicketCounters + terraPracticaCounters

ENAMEL-67 enamel Done low

supportApiAuthRefused cannot name its caller: no ip, no userAgent, no detail, so a probe and an attack are indistinguishable

ENAMEL-64 enamel Done low

Enamel /image 404s x2 organic in 5 minutes - no route, no link on any reachable page, unattributable by construction

ENAMEL-61 enamel Deferred low

Enamel is default-open on documentoType: no vocabularyScopes row, so it accepts all five while terra accepts two

ENAMEL-58 enamel Canceled low

Wire applog-listen@enamel error rail when enamel is built

ENAMEL-11 enamel Done low

P2 triage-codify: auth-gate-first playbook into solo-enamel-cc.md

ENAMEL-7 enamel Canceled low

Rename portal module to portalPen + give the empty state a next action

ENAMEL-25 enamel Done low