SEC: portal server actions ungated - unauthenticated read of client queue

ENAMEL-18 enamel Done urgent

Authenticated admin email-correction surface

ENAMEL-76 enamel Done high

Narrow service capability for /api/soporte: create-plus-grant in one call, a non-admin role allowlist, appKey pinned to the service scope, and fn_correctUserEmail exposed - so no service actor ever needs admin@terra

ENAMEL-69 enamel Done high

└─ Withdraw support bearer email rewrite

ENAMEL-73 enamel Done high

GET /api/soporte/tickets returns an unaudited, silently-filtered empty list to an under-granted actor

ENAMEL-72 enamel Done high

Agent-solvable Terra lockout recovery beyond email-only lookup

ENAMEL-70 enamel Done high

ENAMEL-16 Phase A DB half: relax subject/bodyText to nullable with null-or-nonblank CHECKs, add the terminal-or-content invariant and redactedAt

ENAMEL-66 enamel Done high ↳ ENAMEL-16

Enamel pre-push gate is vacuous: .gitpush-pre.sh scopes off the cached set but runs before staging, so lint/tsc/272 tests are skipped on every app-only push

ENAMEL-63 enamel Done high

User + group administration: no UI exists, every grant is a hand-written DB row

ENAMEL-22 enamel Done high

appEvents no-PII property is measured, not enforced

ENAMEL-37 enamel Done high

└─ ENAMEL-37 timer half: schedule fn_runAppEventsPiiScan and alarm on BOTH ok=false and staleness

ENAMEL-43 enamel Done high

pg_net grants EXECUTE to PUBLIC on this ref: every login role holds an outbound-HTTP primitive, so no role here is confined

ENAMEL-35 enamel Done high

Live schema and db/migrations have drifted: full both-directions inventory needed

ENAMEL-26 enamel Done high

Whole-DB pg_dump insurance for eprpywqwzsvrjeaforei (enamel+terra shared project) does not exist

ENAMEL-12 enamel Done high

enamel has not cut over to the EVO-94 host-side email drain: emailOutbox has no invoker, so a queued row is silent mail loss

ENAMEL-33 enamel Done high ↳ ENAMEL-16

└─ Backstop: per-appKey age alarm on the oldest queued emailOutbox row (ENAMEL-33 owns the invoker)

ENAMEL-32 enamel Done

portalPen: staff triage surface (read, answer, assign, resolve tickets)

ENAMEL-20 enamel Done high

Access-request form: /solicitar-acceso is a dead end, accessIssueReports never written

ENAMEL-21 enamel Done high

Portal: accept 'venus' as a portal appKey scope tag + grant Puia client under venus

ENAMEL-17 enamel Done high

Split shared app.bypass_immutable GUC per-guard (enamel half)

ENAMEL-13 enamel Done high

Scaffold bare Next.js app + push first commit to empty GitHub repo

ENAMEL-5 enamel Done high

Enamel migration stem allocation has no serialiser: TERRA-282's origin-tag claim gate is terra-only, so two enamel lanes drafting concurrently can both claim the same enamel_NNN

ENAMEL-88 enamel Done

Write the migration preflight/postflight skeleton as a shared file

ENAMEL-90 enamel Done

loginNoProfile event omits server-resolved auth user ID

ENAMEL-75 enamel Done

Audit identity email-correction preimage protection on shared users rail

ENAMEL-77 enamel Done

appEvents refusal rows lost to an unawaited write on /api/soporte

ENAMEL-71 enamel Done

supportTicketCounters has no guard - the instrument used to bound a disclosure incident is itself unprotected

ENAMEL-19 enamel Done

Drop createVenusSupportTicket(text,text,text,text) - decision gate 2026-09-19, after the enamel_060 revoke has had a week to produce a signal

ENAMEL-49 enamel Done

Historia clinica ships behind a gate no identity can pass: zero admin:enamel grants exist fleet-wide

ENAMEL-56 enamel Done

404 capture + scanner filter (catch-all, Block W parity)

ENAMEL-60 enamel Done

resolveOrCreatePaciente validates documentoType against the global catalog, not the tenant scope

ENAMEL-34 enamel Done

└─ Paciente creation is unattributable: no createdBy column, no appEvents row, and the resolver takes no actor argument

ENAMEL-38 enamel Done high

└─ ENAMEL-38 leg B DB half: actorUserIdArg overload + pacientes.createdByUserId, 10-arg signature dropped in the same transaction

ENAMEL-65 enamel Done high

└─ ENAMEL-34 phase 2: drop the ungated 9-arg resolveOrCreatePaciente

ENAMEL-36 enamel Done high

Historia clinica: the stated initial focus, zero app surface, pacientes table empty

ENAMEL-24 enamel Done

└─ Enamel create-paciente app surface

ENAMEL-59 enamel Done high

└─ Enamel cannot register any paciente: the ForApp write path is fail-closed and enamel has no documentoType vocabularyScopes row - needs one product decision on which document types enamel accepts

ENAMEL-50 enamel Done high

users identity: two humans each hold two live bound rows; duplication sits exactly where the documento axis is disarmed

ENAMEL-40 enamel Done

accessIssueReports gains resolutionNote and fn_resolveAccessIssue threads it as a trailing 6th arg (enamel_058)

ENAMEL-48 enamel Done

app DB pool disables certificate verification (ssl.rejectUnauthorized false) - encrypted but unverified, and the fix needs DATABASE_URL's real host first

ENAMEL-46 enamel Done

vocabularyScopeMembers integrity guard skips 42 percent of member rows: piezasDentarias-backed scopes enter unchecked

ENAMEL-42 enamel Done

terra_209 ships four integrity guards onto enamel-owned shared tables; a rebuild from db/migrations omits them

ENAMEL-39 enamel Done

Decide whether shared pacientes carries provincia/localidad (refiled from terra, DCX-143-20260905)

ENAMEL-31 enamel Done

EVO-93: move this app's email-outbox drain off Supabase pg_cron onto a venus systemd timer

ENAMEL-30 enamel Done

Retire /api/app-version: /api/health is the only version+health surface

ENAMEL-29 enamel Done

Verify coder-enamel-cc Vercel build+runtime-log read before Class-A self-PTD floor is enforceable

ENAMEL-9 enamel Done

App shell: no navigation, no sign-out, single-branch redirector

ENAMEL-23 enamel Done

Schema-qualify 62 unqualified references in 24 function bodies (enamel_025)

ENAMEL-15 enamel Done

pg_temp search_path hardening across all enamel functions (A2 + 022 + 023A)

ENAMEL-14 enamel Done

sync fouba-institucional.md into enamel checkout + git-add it

ENAMEL-10 enamel Done

P1 router-rebind: codify Class-S→solo-default / Class-A→full-team into enamel project docs

ENAMEL-6 enamel Done

FoUBA shared institutional reference — solo-enamel content assembly + commons trigger-line

ENAMEL-4 enamel Done

Stale documented DB credential location in enamel-db-agents.md

ENAMEL-89 enamel Done low

EVO-69 follow-up: add createdAt to supportTicketCounters + terraPracticaCounters

ENAMEL-67 enamel Done low

supportApiAuthRefused cannot name its caller: no ip, no userAgent, no detail, so a probe and an attack are indistinguishable

ENAMEL-64 enamel Done low

Wire applog-listen@enamel error rail when enamel is built

ENAMEL-11 enamel Done low

Rename portal module to portalPen + give the empty state a next action

ENAMEL-25 enamel Done low