pg_net EXECUTE to PUBLIC: measure whether this ref grants net.http_post to every login role

PLUTO-736 pluto Blocked high

Non-owner app role for archive/fraud/audit table write containment (real remedy, migration 100 is hygiene-only)

PLUTO-670 pluto Backlog high

Extend /api/internal/support-action: access/participant/user/assignment ops (Elazar GO 2026-09-22)

PLUTO-753 pluto Blocked high

Supabase instance-level slowness 2026-09-11 22:34Z - 2026-09-12 01:54Z (3h20m continuous): 42 slow queries incl. 'SELECT now()' at 35s, AT LEAST 4 user-facing 500s on /mi-cursada (3 logged + 1 whose own serverError INSERT left no row), one operator alert LOST

PLUTO-742 pluto Blocked high

Real-time error tee: appEvents AFTER-INSERT pg_notify trigger on Pluto Supabase (error→PM DM, warn stays in digest). GATED on nw-venus's exact spec (channel name, WHEN-clause, payload — byte-identical channel+payload across 3 apps; host listener LISTENs + DMs PM). Pluto level vocab = error|warn|info (NO fatal) so WHEN-clause = level='error'. Pre-apply audit review per DDL discipline. Additive/reversible. Do NOT start until spec lands + 112 done.

PLUTO-116 pluto Backlog high

EVO-123: convert 4 UPDATE OF invariant guards to AFTER/no-column-list

PLUTO-780 pluto Backlog

Applied Pluto migrations missing from registry can be skipped by registry-driven rebuild

PLUTO-779 pluto Backlog

reactivateInactive motivo has no persistence other than the truncated archive-reason slice

PLUTO-769 pluto Blocked

Archive-reason content rule: ban call expressions inside a reason interpolation (shape validator cannot reach it)

PLUTO-771 pluto Backlog

mig 130 primaryRoleId guard is advisory: app.allow_primaryroleid_write is caller-settable, and the wording calls it enforcement

PLUTO-765 pluto Backlog

Plan: paciente DNI + HC central store — autocomplete, dedup warning, estadísticas

PLUTO-437 pluto Todo

└─ fn_restorePaciente + sentineled in-place correction: the remedy for a document number trapped on a soft-deleted pacientes row

PLUTO-764 pluto Backlog high

EVO-93: move this app's email-outbox drain off Supabase pg_cron onto a venus systemd timer

PLUTO-733 pluto Blocked

Why fn_getInformesBundle takes 5-30 s for some users; tighten bundle cap from measured p99

PLUTO-748 pluto Blocked

Flip NOTFOUND_PAGING_ENABLED once fleet gates clear (mirrors VENUS-27)

PLUTO-762 pluto Backlog

Email rail lacks cross-rail dedup of one render's alerts

PLUTO-749 pluto Backlog

Adopt fleet ticket-triage protocol (bs-mr4xk6nnuu2) — Pluto replication

PLUTO-487 pluto Blocked

Comment notification quotes empty-content comments and fires on aprobado practicas

PLUTO-703 pluto Blocked

Retro cross-vendor review queue: 10 unreviewed pushes since audit-pluto-ca went dark

PLUTO-636 pluto Backlog

Email-identity SSOT campaign: users.emailCanonical generated key + getUserByCanonicalEmail chokepoint (absorbs PLUTO-61 display-write fix + PLUTO-36 JS/DB parity fix as acceptance criteria)

PLUTO-154 pluto Backlog

Scheduled GoTrue config-drift check (cron/applog rail, alerts not blocks)

PLUTO-634 pluto Backlog

Stats glossary: footnote + tooltip explaining stat abbreviations in user-facing text

PLUTO-495 pluto Backlog

Fleet appEvents schema standardization (mirror MARS-411) — DESIGN-HOLD

PLUTO-533 pluto Backlog

CR 39: Crear una sección interna accesible para usuarios autenticados con manual de uso, SOP operativos y ayudas de carga/revisión. Debe poder crec

PLUTO-265 pluto Deferred

CR 30: utilizar varias direcciones de correo para mensajes diferentes que envía la app: noreply@pensatna.com soporte@pensanta.com, notificación@pen

PLUTO-256 pluto Deferred

Audit-trail schema plan (Pluto, EVO-57 child)

PLUTO-583 pluto Deferred ↳ EVO-57

└─ Actor backfill, provable-only (PLUTO-583D)

PLUTO-587 pluto Deferred

└─ Write-path actor-field population (PLUTO-583C)

PLUTO-586 pluto Deferred

└─ Additive lifecycle-column migration (PLUTO-583B)

PLUTO-585 pluto Deferred

└─ Lifecycle contract + sensitivity matrix (PLUTO-583A)

PLUTO-584 pluto Deferred

└─ Historial mapping update + regression + drift checks (PLUTO-583F)

PLUTO-589 pluto Backlog low

└─ DB enforcement for future rows (PLUTO-583E)

PLUTO-588 pluto Backlog low

Pluto fly-solo-kill execution brief (bs-mqpzo3ly470 / EVO-26) — execute on next Elazar-launched team session, do NOT act between sessions. (A) COMMONS/DOC: delete fly-solo/autonomy doctrine + flip log-review=work-order to report-only-Elazar-decides + add Agent-Boundary PM-never-spawns-hands-brief. Pluto-repo files (pluto-commons.md, pm-pluto-role.md) = Pluto coder; shared evolutiva-commons/evolutiva-pm-commons deletes route via bin-whey-cc (whey-canonical, mem shared-commons-edit-routing), NOT Pluto coder. (B) PROBE NOISE (Pluto app code, coder): port venus X-Audit-Probe demotion + internal-probe UA marker so scanner/probe traffic self-classifies to security/info and emits NO page_not_found warn row (source = not-found.tsx capture, mem pluto-notfound-capture-redirect-overfire); + downstream expected-signal allowlist: /wp-* & CMS-scanner paths, apple-touch-icon* 404s, pm-triage NOTIFY probe, gate-correct login-unknown, mobile fetch-abort. (C) RAIL RE-POINT (nw-owned venus daemons = Elazar-launched nw edit, NOT Pluto coder): applog-listen/pull@pluto + pluto-pm-triage-listen.service (EVO-32) -> REAL-severity DM Elazar only, everything else log/queue row no PM DM. (D) DEFERRED per decision pt7: headless sendWelcomeEmail(userId) path (the Agustina exhibit) - policy stands, conversion not scheduled yet.

PLUTO-201 pluto Backlog

LEG-2 aro-retarget: applog-listen alert DM pm-pluto-cc -> POST aro:pluto (aro tag) so Elazar sees in-room + PM runs error-incident troubleshoot IN aro:pluto. DEPS: nw-venus daemon target change + keepalive restart 60cf5e6; pm-llmmsgsrv re-enable fan-out aro:pluto. Pluto verified Elazar in aro:pluto.

PLUTO-167 pluto Backlog

Real-time error reporting + auto-heal — Pluto leg (ratified protocol bs-mqn2ze006f7)

PLUTO-164 pluto Backlog

Verify applog error→aro:pluto live-PM routing survives EVO-5 rail rename (kpi-n-optimization migration bs-mqmr47bwkk4)

PLUTO-157 pluto Backlog

KPI-rework /informes (gathering inputs, do NOT implement yet): teacher-scoped report quality pass. Inputs so far: (a) wrap bare CohortAndProcedureCards grid (teacher-report.tsx:818) in titled ReportSection; (b) Moda operador/asistente cards mislabeled (modal per-student count, not most-frequent person) + redundant beside Promedio -> cut or relabel; (c) EPI RE-WEIGHT: Puia wants MORE epidemiology on pluto+venus -> KEEP/EXPAND porSexo/porProvincia/etc (REVERSES earlier generic-remove rec; do NOT cut epi buckets). Grounding: judge on ACTUAL teacher-scoped values via audit-venus KPI->source-view map + db-pluto value pull, NOT admin-proxy shape. Awaiting full KPI->view map (~20-30min from audit-venus) + Elazar per-item rulings before WI splits into coder/db work.

PLUTO-121 pluto Backlog

Duplicate practicas: operador + asistente each create the SAME clinical event picking each other as counterpart -> 2 mirror practica rows for 1 real práctica. Need duplicate-detection + canonical-record rule (natural key candidates: fecha+comision+paciente/tratamiento+the operador/asistente pair). Design WITH Elazar; covers (a) prevent new dupes at create, (b) reconcile existing dupes in prod. Cross-team lessons-learned for mars/venus.

PLUTO-78 pluto Backlog

Vercel log-drain setup: Elazar greenlit (2026-06-12) true 24h+ runtime-log retention (currently logs are point-in-time only via Vercel MCP). Scope: pick drain destination (log service/endpoint), configure Vercel log-drain, implementer is infra (nw-whey/nw-venus) not coder. PM owes Elazar the concrete scoped plan before dispatch.

PLUTO-46 pluto Backlog

Soft-deleted-user restore + identity-attach explicit two-step design

PLUTO-620 pluto Backlog ↳ EVO-79

Fleet deliverable: draft BACKTEST SPEC + TRIAGE-CODIFICATION CHECKLIST template (Pluto-owned)

PLUTO-524 pluto Backlog

EVO-12 deploy-skew guard leg (b): daemon-side skew suppression (nw-venus + audit-pluto)

PLUTO-722 pluto Backlog

PLUTO D8 compute-placement remediation (self-scan)

PLUTO-98 pluto Backlog

/administrar/comisiones spreadsheet grid — Stage 4 editable comisión/day rows por período

PLUTO-339 pluto Deferred

supautils force-grant census: public functions holding EXECUTE outside their allowed set (R6 forbidden-set read, inventory only)

PLUTO-785 pluto Backlog low

Orphaned active userRoles survive user soft-delete (hygiene)

PLUTO-639 pluto Blocked low

└─ Restore soft-deleted users with explicit role regrant decision

PLUTO-783 pluto Backlog

no demo/seed exclusion mechanism exists - vPracticaParticipantFacts cannot exclude demo prácticas from scoped teacher stats

PLUTO-103 pluto Backlog low

Add value/codigo machine-key column to lookupOptions

PLUTO-551 pluto Backlog low

Audit + sync prod public-fn DDL drift to checked-in migrations (search_path pins) — pluto mirror of venus EVO-8

PLUTO-153 pluto Backlog low

PLUTO-139 outcome: add 6 scope-join FK indexes, drop 2 zero-scan indexes, retire the dead isUserRowSafeToSupersede fn

PLUTO-724 pluto Backlog low

Port Terra's participant-dispute mechanism to Pluto (replaces building a removal kind)

PLUTO-763 pluto Backlog low ↳ PLUTO-744

Google has been fetching /.well-known/assetlinks.json 1275 times over three months and getting a 404 every time: an Android App Links association is declared against pluto and has never verified

PLUTO-757 pluto Backlog low

Alert email bodies show 12-hour clock without AM/PM

PLUTO-750 pluto Backlog low

EVO-70 Tier 1 follow-up: retire app after() calls (gated on passive prod evidence)

PLUTO-615 pluto Blocked low ↳ EVO-70

practicas.numeroHistoriaClinica non-blank + trimmed CHECK, and clean the one untrimmed row

PLUTO-738 pluto Backlog low

Solicitudes: evaluate+fold net-new features into Pluto from mars/venus (brainstorm bs-mr4h5azsk3g)

PLUTO-477 pluto Backlog low

Adopt curated repo-visible knowledge .md for Pluto agent team (bs-mr3bt2c0vgy consensus)

PLUTO-470 pluto Backlog low

Investigate stray uncommitted .agent-name change in solo-pluto team tree

PLUTO-562 pluto Backlog low

Proxy viewport tooling: chrome-devtools-mcp (CDP) for Pluto needs an auth path — Pluto is OAuth-only

PLUTO-51 pluto Backlog low

Advisory (low pri): enable auth_leaked_password_protection (HaveIBeenPwned check) in Supabase auth — currently disabled. Low value for Pluto (allowlist-only, no open signup) but a free defense-in-depth toggle. From PLUTO-123 security sweep.

PLUTO-125 pluto Backlog low

Shared push-tree same-file concurrent-edit handoff protocol

PLUTO-683 pluto Backlog low

Consume venus-side applog cursor-age instrument (report pluto's rail age)

PLUTO-651 pluto Backlog low

Applog burst-dedup: duplicate event ID replay within 60s synthesizes x2 burst

PLUTO-650 pluto Backlog low

User-facing self-suggestion surface (is-this-you link-to-existing)

PLUTO-622 pluto Backlog low ↳ EVO-79

Pluto Historial change-history panels: audit gap + build (HOLD for Elazar go)

PLUTO-531 pluto Backlog low

Logging-hardening: clientError:global-error rows persist with EMPTY detail (no digest/errorName/message/route) — un-diagnosable from appEvents alone. Capture digest+message+route at the global-error boundary so future global-error volume is triageable. Low-pri; only escalate if global-error volume rises (currently sparse/benign: 2-4/day transient).

PLUTO-221 pluto Backlog low

404 telemetry anomaly: 7-row burst is nextUrlPresent=TRUE with clientBuildId=NULL - the exact inverse of the 12-row confirmation set, unexplained

PLUTO-726 pluto Backlog low

404 telemetry: isSoftNav keys on sec-fetch-dest=empty, which any fetch() sets - scanner traffic confirmed misclassified as soft-nav (5 of 29 rows)

PLUTO-725 pluto Backlog low

PLUTO-700 follow-up: live confirmation the retired 10-arg fn_insertSupportTicket shape stays unused - one authenticated browser /soporte submit against the shipped build, then db-pluto-cc reads pg_stat_statements (11-arg queryid rises, 10-arg does not)

PLUTO-716 pluto Backlog low

User contact profile split — userProfile 1:1 table para campos opcionales

PLUTO-325 pluto Deferred low

Large-screen sales-surface polish: add xl/2xl density tiers (more grid cols / master-detail / side-rail filters), data tables over stacked cards, ~40-48rem line-length cap on prose+forms, persistent sidebar + fluid type >=1280 + responsive imgs. Scope: /informes + KPI dashboards + /admin tables + public landing ONLY. Does NOT touch alumno (PLUTO-159) or docente grading mobile-first paths. Verify via proxy pixel-confirm at 1920/2560. Ship-timing = Elazar's call (low current N). From bs-mqmxqxwop02 decision.

PLUTO-162 pluto Backlog low

db/schema.md omits function bodies, so it cannot answer what is installed for any fn

PLUTO-704 pluto Backlog low

PLUTO-34 contract step: DROP flat columns on 7 archive tables after jsonb expand verified in prod (irreversible)

PLUTO-65 pluto Backlog low

Phase-2 demo cleanup (BLOCKED on demo-row purge): strip the now-unneeded demo filters/labels/tab once Elazar purges demo rows. These are PROTECTIVE while rows exist — removing earlier leaks demo data into real reports. Sites: admin/page.tsx:11 (@demo pendingUsers filter), informes/page.tsx:117-121 + practicas/page.tsx:139-142 ('Demo ' comision filter), admin-user-detail.tsx:68/127 + audit-log.tsx:122 (isDemo/demo_seed label map), complication-rate/dificultad-distribution/procedure-type cards '(no demo)' text, admin/usuarios 'Usuarios demo' tab. Coupled to PLUTO-118 phase-1 + the row purge.

PLUTO-120 pluto Backlog low

PKCE callbackExchangeFailed: add benign-vs-attack discriminator (volume-gated, no action yet)

PLUTO-698 pluto Backlog low

Comisión-remainder section is read-only but canGradePractica permits grading it — affordance and permission disagree

PLUTO-687 pluto Backlog low

Migrate all touch primitives (Button/Select/Input) to uniform pointer-coarse:min-h-11 for 44px touch targets — replaces the 3-way convention (Button h-11 sm:h-9 / Select flat h-11 / Input sm:-gated); keys on input modality not viewport so a narrowed desktop window stays 36px. Ref Venus impl. Do AFTER PLUTO-40 lands.

PLUTO-41 pluto Backlog low

No reachable contact channel on /solicitar-acceso or /acceso-denegado

PLUTO-649 pluto Backlog low

FUTURE (recommend, separate from skew fast-follow): enable next.config deploymentId + Vercel Skew Protection (if Pluto's plan allows) for a SOUND client-vs-server build compare — gives the app a real origin-build signal (today the build-ID is COARSE: app sees only its own serving build, never the client's origin build, which is why an app-side skew downgrade is unsound and the daemon owns the deploy-timing discriminator). Also makes a real end-to-end deploy-skew test possible. Low pri.

PLUTO-170 pluto Backlog low

DEFERRED: extract userDocumentoReview workflow table from users.documento* cols if documento approval flow grows. Workflow entity with natural FK, not generic profile split. Counter to WI#119 verdict.

PLUTO-410 pluto Backlog someday

Análisis estadístico — rol researcher dedicado + acceso a datos anonimizados

PLUTO-306 pluto Backlog someday

Should info/malicious page_not_found bulk (8304 rows) be visible on any digest/surface

PLUTO-660 pluto Backlog someday

Decide whether the 7 remaining baselined Button overrides want semantic colour tokens (--warning) or stay one-offs

PLUTO-723 pluto Backlog someday

Rename tipoDocumento->documentoType, numeroDocumento->documentoNumber (users+accessRequests)

PLUTO-527 pluto Backlog someday

admin/usuarios:97 8-wide fan-out collapse (descoped from PLUTO-102)

PLUTO-486 pluto Backlog someday

Purge 4 synthetic persona rows - superseded by 'Ver como' view-as

PLUTO-598 pluto Deferred someday ↳ EVO-54

Impersonation banner 'Volver a mi cuenta' button: verify mobile touch-target — CDP click() no-op, JS element.click() worked

PLUTO-574 pluto Backlog someday