userGroups write triggers skip any grant with a future toAt, so a future-dated INSERT evades the deleted-user, inactive-group and enamel-admin-minimum guards while the corrected read counts it as current

ENAMEL-82 enamel Canceled high

Historia clinica ships behind a gate no identity can pass: zero admin:enamel grants exist fleet-wide

ENAMEL-57 enamel Canceled high ↳ ENAMEL-24

Agent-operable ticket API: REST handlers over /soporte, single auth definition

ENAMEL-27 enamel Canceled high

enamel has no .gitpush-pre.sh, so an enamel push runs no tests, no typecheck and no lint - the per-repo hook is the only check path and the other four repos have one

ENAMEL-83 enamel Canceled

Should enamel have a second admin? Live count is one with zero headroom

ENAMEL-85 enamel Canceled

db/migrations/draft/ is untracked, so a reviewed Class-A digest is one in-place edit from unrecoverable

ENAMEL-79 enamel Canceled

bindSupabaseAuthId noMatch arm writes no appEvents row: a signup with no roster row leaves zero trace on the bind rail

ENAMEL-62 enamel Canceled

Instrument per-task SOLO-METRICS (turn+token baseline) — enamel pilot deliverable

ENAMEL-8 enamel Canceled

Enamel is default-open on documentoType: no vocabularyScopes row, so it accepts all five while terra accepts two

ENAMEL-58 enamel Canceled low

P2 triage-codify: auth-gate-first playbook into solo-enamel-cc.md

ENAMEL-7 enamel Canceled low