EPIC: move app email drains off Supabase pg_cron to venus systemd timers, keep an authenticated relay for transport

EVO-93 evolutiva Blocked high

api.pensanta.com RSTs a FRACTION of connects while serving others: not listener loss, not load, upstream of PHP - a per-account connection limiter nobody can measure

EVO-103 evolutiva Blocked high

nw-venus repo has no git remote: the emaildrain + gdrive-auth-check units are version-controlled but NOT off-disk recoverable

EVO-112 evolutiva Backlog high

EVO-93: templated venus systemd timer that drains an app's email outbox over its bearer route

EVO-94 evolutiva Backlog high

Fleet roster and model/effort policy: retire pm-*-cc, coder holds PM, Sonnet 5 on the 02 seats, coder03 as coder-plus-auditor, /clear handoff with an idle guard

EVO-101 evolutiva Backlog high

Split terra onto its own Supabase project - PLAN ONLY, no build, no migration until Elazar sees the plan

EVO-100 evolutiva Backlog high

Fleet CR + client-questions surface (replace Google Sheets/Docs for client change-requests and our questions-to-client)

EVO-83 evolutiva In progress high

EVO-93: resolve ownership of VENUSINF-3/16/17 and decide the transport shape given port 25 is blocked

EVO-95 evolutiva Backlog high

Account access-state (Activa/Desactivada), no-soft-delete-for-inactivity

EVO-81 evolutiva Backlog high

Supabase supautils force-grants PUBLIC EXECUTE on new public objects: fleet REVOKE-explicit standing pattern + live-exposure sweep

EVO-71 evolutiva Backlog high

SOP support-ticket API: full CRUD + private stakeholder comments + notify-list, per app

EVO-52 evolutiva Backlog high

Fleet server-side error/404 capture: client-side-only logging leaves 3 blind spots (non-JS clients, auth-redirect-before-render, API/server 404s) — push-tier errors can be silently dropped upstream of the applog rail

EVO-12 evolutiva In progress high

Cross-app nav-link normalization: one criteria for sidebar/navbar links per role in mars+pluto+venus

EVO-51 evolutiva Blocked

api-images: off-box backup of uploads/ with a REHEARSED restore - 2.64GB exists in exactly one place, and it is the precondition for the first ?purge=1 caller

EVO-121 evolutiva Backlog

applog-listen rail: alert '×N' count inflated, decoupled from actual DB insert count

EVO-24 evolutiva Blocked

EVO-91 retired /api/app-version fleet-wide but never registered it, and probe-curl.sh still documents it as the usage example

EVO-105 evolutiva Backlog

Vercel MCP read path is dead for this lane: list_projects returns zero for a team that demonstrably holds projects, so every env-var question is unanswerable

EVO-104 evolutiva Backlog

Support API: record acting agent on every write (traceability) + per-agent API keys

EVO-102 evolutiva Backlog

Existing duplicate-account reconciliation: detect + merge users with >1 account already in prod (Elazar still finding dupes) — mars+venus+pluto

EVO-74 evolutiva Backlog

└─ EVO-74 prevention: access-request flow must link-to-existing, not spawn a duplicate account (mars/pluto/venus)

EVO-79 evolutiva Backlog

└─ Document as durable person key (DNI/legajo/passport/CUIT); email+googleSub are rotatable credentials; build email-change re-link flow

EVO-82 evolutiva Backlog

Fleet sweep: authz gate on a side-effecting function call in a FROM clause is not a gate - the function's INSERT fires before the enclosing WHERE

EVO-99 evolutiva Backlog

push-scope-guard write-side recovery tooling (captured-index disentangle)

EVO-87 evolutiva Backlog

Friction-telemetry action/category labeling hygiene (fleet)

EVO-63 evolutiva Backlog

Friction-log-driven UI fix campaign (fleet)

EVO-62 evolutiva Backlog

Adopt PMs-24/7 + spawn-workers-on-demand RAM-reduction model (brainstorm bs-mqor18api1w)

EVO-26 evolutiva Backlog

PM DB-fed triage loop (bs-mqotdmmk6b5): PMs run a DB-fed ticket/triage queue + dispatch fixes in each app's own aro. Elazar greenlit per pm-venus relay 2026-06-22. Per-app legs tracked as children.

EVO-29 evolutiva Backlog

└─ Triage-loop leg: PLUTO — ACTIVE. Tickets (net-new surface) + access; live app. pm-pluto dispatching in aro:pluto.

EVO-32 evolutiva Backlog high

└─ Triage-loop leg: MARS — per its own (mars already has both surfaces: tickets + access).

EVO-31 evolutiva Backlog

└─ Triage-loop leg: VENUS — DEFERRED (authorized by Elazar 'venus can wait'). On un-defer, carries prereqs: canonicalizeEmail + createAuthUserSafe.

EVO-30 evolutiva Backlog

Vercel + Supabase optimization — reduce Fluid Active CPU bill creep, eliminate dashboard misconfig, lower latency

EVO-36 evolutiva Backlog

Admin pending-items digest email (open support tickets + pending access requests + pending correcciones) to admin — mars+venus+pluto

EVO-75 evolutiva Backlog

Inactive / never-used user cleanup: identify users who never logged in or never used the app, decide disposition (archive vs exclude-from-comms) — mars+venus+pluto

EVO-73 evolutiva Backlog

applog-listen venus rail: burst-dedup for opaque client errors (Script error. / Failed to fetch) — N same-UA+session within 60s → 1 alert+count; isolated 1-offs → log-only. pm-venus amend 2026-06-22 (mars cross-app: Samsung Internet crash-loop found in this class). Supersedes blanket log-only.

EVO-27 evolutiva Backlog

Central patient DB + shared identity/auth hub in enamel (mars/pluto/venus consume) - item f

EVO-80 evolutiva Backlog

Weekly KPI/report email quality: stop noisy+wrong sends (recipients with no practicas or all-zero KPIs; some users get 4+ emails) — mars+venus+pluto

EVO-72 evolutiva Backlog

Migration 042 (pluto applog-view-reshape) is designed + audit-PASS'd but HELD for fleet-lockstep GO — do NOT apply solo

EVO-49 evolutiva Backlog

general-pm role + mgmt-aro topology decision (bs-mqolw0w7gcg/bs-mqom01jn5ww): keep general-pm THIN (cross-project convener + EVO-* umbrella owner + router/scribe + authoritative bwi writer); NO bulk .md; depth=pull-on-demand; tiny PM-owned routing map ~1-2k/app (kill-on-drift); pm-mars=fleet-pattern-lead w/ pluto per-app-divergence carve-out; api-image per-topic invite; single-app incidents stay in project aro. FORK resolved CONDITIONALLY on hub non-quorum capability: YES->one-aro non-quorum lurker / NO->two-aro fallback. GATES: (1) Elazar nod on routing-map + mars pattern-lead + lurker model; (2) pm-llmmsgsrv feasibility verdict on member-non-quorum (Q sent). Nothing structural moves until both clear.

EVO-25 evolutiva Backlog

venus Tier-0 drain guard predicate does not byte-match worker claim eligibility

EVO-89 evolutiva Backlog

Applog relay daemon conflates DATABASE with TENANT — no per-tenant routing on shared-DB co-tenants

EVO-84 evolutiva Backlog

End-of-term xray-file retention + disposal policy (fleet)

EVO-65 evolutiva Deferred

Audit-trail schema normalization (coverage + field-name naming), planned per-project

EVO-57 evolutiva Deferred

└─ Fleet audit: createdBy/At + deletedBy/At + changelog/archive coverage on every table

EVO-55 evolutiva Backlog

└─ Decide archived-PII retention/redaction policy (fleet)

EVO-60 evolutiva Deferred someday

Per-agent Postgres login roles for DB-layer attribution (Mars/Pluto/Venus)

EVO-56 evolutiva Backlog

Minimize demo-data technical debt fleet-wide

EVO-54 evolutiva Backlog

Daily trash purge runs INLINE under LiteSpeed: one real customer request per day pays the full trash-walk

EVO-119 evolutiva In progress low

Weekly api-images storage read + surface storage.warning (schedule half of EVO-58)

EVO-116 evolutiva Backlog low ↳ EVO-58

infra: policy-grade attribution separation for identity-mutating DB writes - archive owner role, limited non-owner app role, distinct human credentials

EVO-113 evolutiva Backlog low

Drain Vercel runtime logs into venus telemetry so an agent can read them

EVO-107 evolutiva Blocked low

applog-listen venus rail: probe-IP/UA filter — drop alerts for rows originating from venus host IP (91.99.136.171) or UA matching curl/* or *-coder-*/audit. Catches self-test 500s + probe 404s. pm-venus pilot 2026-06-22; table to fleet error-alerting standard.

EVO-28 evolutiva Deferred low

api-images: reconcile 67 orphan images in flat uploads/2026/ with no mars/pluto DB owner — decide trash vs reassign

EVO-2 evolutiva Blocked low

venus: rename telemetry field widthBand→viewportBand (bs-mqmscr4k3wh)

EVO-10 evolutiva Backlog low

errscan.sh digest mislabels signature-rollup occurrence count as a per-path count -> false per-path warn spikes (e.g. 'page_not_found x42 @/email/sendgrid.env' when that path has 2 rows; 42 = aggregate env-shape warn occurrences across N paths under one message-derived signature). Lane 1 (bin-whey, errscan.sh ~L244/L309): relabel so count reads as signature rollup + path as a SAMPLE ('[42x total] page_not_found e.g. action=/email/sendgrid.env'). Lane 2 (per-project db: vAppAlertsRecent/vAppErrorsRecent): expose distinctPaths so display can render '42x / 7 paths'. Affects all 3 apps (shared errscan + EVO-12 scanner down-tier shape). Triage-noise only, no data/security. Low-pri.

EVO-46 evolutiva Backlog someday