Unattributed full-DB reader on venus Supabase project (~3/day, postgres role, incl. vault.secrets) — attribute or treat as compromise

VENUS-350 venus Blocked urgent

venus-db-backup.sh: trash||rm precedence hard-deletes clinical dumps when trash exists and FAILS

VENUS-359 venus Blocked high

venus-db-backup.sh: prune glob spans plaintext+encrypted lanes, sharing one KEEP budget

VENUS-358 venus Blocked high

Consolidate Evolutiva backups into one performed/monitored/inventoried lane

VENUS-357 venus Backlog high

applog rail: 404/probe path CLASSIFIER + 4-outcome taxonomy — must land BEFORE any suppression predicate on any rail (both per-app predicates withdrawn)

VENUS-327 venus Backlog high

applog-listen category filters assume VENUS literals — both are INERT on pluto (security=0 rows, access=0 rows); four rails, one file, four vocabularies

VENUS-326 venus Backlog high

getFrictionDigest: column reference "createdAt" is ambiguous — real SQL error, invisible 14 days because category='security' is bot-filtered to log-only

VENUS-325 venus Backlog high

applog alert delivery: pages routed to the emitter script (scrp-applog-*) instead of a human inbox, all rails

VENUS-322 venus Backlog high

GoTrue-config verify-script via Supabase Management API (read-only, field-selected)

VENUS-303 venus In progress high

hourly LLM concision sampler for agent-to-agent messages

VENUS-224 venus Backlog high

Admin action: agregar participante omitido a una practica fuera de la ventana de 48h

VENUS-372 venus Backlog

applog-pull zero-row path skips writeWatermark — permanent cold-start gap

VENUS-370 venus Backlog

VENUS-367 — telemetry delivery-health: failed friction writes are indistinguishable from zero friction

VENUS-367 venus In progress

VENUS-364 — dedup 8 copies of the role-label map onto practica-roles.roleLabel()

VENUS-364 venus Backlog

Audit student-facing counts for operador-vs-participacion conflation

VENUS-362 venus Backlog

Quote SOL-VENUS-N in requester-facing access-request emails

VENUS-361 venus Backlog

PostgREST pg_pgrst_no_exposed_schemas error fires every ~32s, drowning the venus postgres log

VENUS-356 venus Backlog

venus-db-backup.sh prune glob crosses lanes — retention 84 total not 84 encrypted; effective 6 days not 7

VENUS-355 venus Backlog

venus-db-backup.sh: trash-fails fallback hard-deletes (rm -f) instead of degrading safely

VENUS-354 venus Backlog

PostgREST empty-exposed-schema sentinel floods postgres log (~2700 ERROR rows/day) — silence or document

VENUS-349 venus Backlog

Harden append-only surfaces: revoke/guard UPDATE-DELETE-TRUNCATE on appEvents + practicasArchive + practicaParticipationsArchive

VENUS-347 venus In progress

fn_isadmin/fn_istitular gate on JWT app_metadata.role — banned shape, dormant while RLS off

VENUS-346 venus Backlog

Sweep SECURITY DEFINER functions for pg_temp shadowing (fleet finding)

VENUS-345 venus Backlog

Exports (CSV + catedra PDF) ignore /informes taxonomy filter params

VENUS-341 venus Backlog

venus applog-pull rail has emitted nothing for 24 days with every liveness instrument green — process alive, function idle, indistinguishable

VENUS-338 venus Backlog

slow-query notice prints to stdout and writes NO ledger row — classify.ts:133's slowQueryPageMs gate has had nothing to act on

VENUS-337 venus Backlog

applog rails execute a LIVE WORKING TREE — point them at a checkout-of-record; venus/scripts is an unrepresented production surface for mars and pluto

VENUS-336 venus Backlog

Enumerate every gate AND discriminator-mutating transform between an appEvents write and a human — venus leg

VENUS-331 venus Backlog

Venus PTD cannot bind a SHA to a deployment: no githubCommitSha in either vercel inspect form

VENUS-330 venus Backlog

Venus 404 evidence loss at proxy.ts:114 — the middleware matcher excludes static extensions, so an asset 404 is structurally pathless before any writer runs

VENUS-329 venus Backlog

v_appEvents_404 groups by a half-dead key: no venus 404 writer populates appEvents.path (NULL on 100% of 969 rows)

VENUS-328 venus Backlog

Venus-side applog rail instrument: DB-to-cursor WORK LAG across all 4 rails + unit-alive assertion

VENUS-320 venus Backlog

applog-listen catch-up watermark stalls permanently when every caught-up row is filtered (venus pinned 15d at 2026-07-15)

VENUS-318 venus Backlog

audit-venus-ca retro-review queue (reviewer outage since 2026-07-23)

VENUS-307 venus Backlog

View-as writes attributed to real admin

VENUS-299 venus Backlog

CR G8+G10 — structured pre-op diagnosis + post-op medication fields (v2 candidate, client-decision-pending)

VENUS-295 venus Backlog

Pathology/treatment conflation cleanup — client mixed patologías with tratamientos in option lists

VENUS-290 venus Backlog

Static guard: mandatory three-way REVOKE (PUBLIC, anon, authenticated) on every public function-creating migration

VENUS-289 venus Backlog

EVO-69: add createdAt to 15 static catalog tables + fix lookupOptions.createdAt NOT NULL

VENUS-285 venus Backlog

EVO-58: admin storage tile (GB-left / % of 25GB shared api-images quota)

VENUS-278 venus Backlog

Classify 5 unclassified (category,action) pairs in appEventFrictionClass — false user-facing fallthrough

VENUS-276 venus Backlog

Telemetry-quality: advisory-only log rows mislabeled as error-shown, inflate friction digest

VENUS-275 venus Backlog

Remove vestigial isDemoDomain branch in email-domains.ts (post VENUS-270)

VENUS-271 venus Backlog

Down-tier recurring Failed-to-fetch rejection alert on /practicas/nueva

VENUS-257 venus Backlog

Postgres-offload campaign (5 items): push report/KPI dedup+join logic into DB views

VENUS-237 venus Backlog

to:[] array /send path skips rule-1a origin_aro membership check

VENUS-223 venus Backlog

busy-nudge false-fires on working: sent without re=<ask tag>

VENUS-221 venus Backlog

KPI report defects surfaced by coaching run-1: v_ack_heavy_7d header/threshold mismatch + v_cli_drift_7d lifetime column

VENUS-211 venus Backlog

Promote feedback mechanism from jsonb blob to first-class column on appLog tables (fleet)

VENUS-193 venus Backlog

Optimize Venus mobile-first for its own most-used viewport (data-driven)

VENUS-192 venus Backlog

ux-pain-digest retune + per-field granularity after feedback-category unification

VENUS-190 venus Backlog

appEvents schema standardization (fleet, mirror of MARS-411)

VENUS-183 venus Backlog

remove single-active-role constraint — support multi-role per user

VENUS-166 venus Backlog

feat(identity): email-change changelog — one email per account + history

VENUS-156 venus Backlog

Patient-registry name correction path (pacientes.nombreCompleto)

VENUS-148 venus Backlog

Close/resolve-via-API endpoint for support tickets

VENUS-143 venus Backlog

Cleanup: Puia has 2 non-deleted titular userRoles rows (likely dupe)

VENUS-142 venus Backlog

feat(monitoring): venus EVO-12 email-ENABLE flip — light the dormant own-route-404 email leg (today: capture+classify+LEG-2-DM live, email gated dormant). Gates ALL of: (1) surgical deploy-skew guard audited PASS, (2) Elazar Q3 paging-policy ratify, (3) Q4 alerts@ send-as ruling if migrating off soporte-evolutiva-venus@. Per fleet error-alerting standard + deploy-skew guard.

VENUS-27 venus Backlog

Pestaña-2 client answer: complicaciones intra/post pooling + tratamientos pool (quistes/tumores/cáncer) — draft sent to Elazar 2026-07-02, awaiting review

VENUS-101 venus Backlog

Post-window edit fulfillment: after 48h, student requests correction via botón Ayuda ticket → admin can edit ANY field (no per-field lock unless PM/Puia/Elazar restrict). Policy set Elazar 2026-06-26. Fulfillment mechanism (admin-edit-via-ticket UI vs manual) NOT built yet per his 'not for now'; this WI holds the agreed design.

VENUS-56 venus Backlog

Mendez Bovio DNI client-confirm: source xlsx has dni=95438931 (9-prefix, out-of-AR-range) + surname 'Bovio' absent in source → identity ambiguity, hold until client confirms value+identity before backfill

VENUS-59 venus Backlog

CU-15b: alumno-facing 'ver posición relativa a su camada' — BLOCKED on client anonymization contract (own-position-only vs named-peers). New alumno_postgrado exposure to a KPI surface isStaffRole blocks today; needs self-scoped predicate (effective.id===id) + client ruling on whether alumno sees named peers or only aggregate/own-position. Client flagged 'muy verde, hay que darle forma'. Class-A. Follow-up to CU-15(A) staff camada-compare.

VENUS-105 venus Backlog

feat(ptd): authed-route PTD tooling — PTD render-GET can't exercise authed routes (302/login); authed pages + authed-only behavior (toast/error-shown producer, práctica gates) never runtime-verified. Fix: in-process self-check route (preferred) or least-priv stored session for manual authed pass. Sibling: MARS-118.

VENUS-14 venus Backlog

bug(validation): D3-4/5 antecedentes parent-checked-no-children + complicaciones notas/ids mismatch — advisory-log-only to measure real-user frequency

VENUS-11 venus Deferred

feat(infra): DB perf snapshot+diff collector (dbperfSnapshots)

VENUS-19 venus Backlog

applog-listen: catchUp logs route-suppressed-held rows as 'missed event(s)'

VENUS-376 venus Backlog low

Verify auth-actions.ts:1572 .email compare without canonicalizeEmail is not a match gate

VENUS-283 venus Backlog low

userAgent ''-vs-NULL: trigger COALESCE + 2 callers leak empty string (diagnosability)

VENUS-344 venus Deferred low

appEvents.path dead column — drop or populate (never-populated query trap)

VENUS-343 venus Backlog low

.gitpush-pre.sh WARN: migrations/applied/ change without schema.md change

VENUS-342 venus Backlog low

pm-triage-listen.ts: realtime watermark can permanently skip rows during outage window

VENUS-314 venus Backlog low

appEvents.status free-text drift (7739 rows, ~25% coverage of declared union)

VENUS-310 venus Backlog low

IdentityBindTier dbBackfill contract cleanup

VENUS-312 venus Backlog low

Verify-script: applied/ migrations vs live catalog diff

VENUS-301 venus Backlog low

Prune stale password-login-actions.ts entry from .gitpush-pre.sh email-canonical guard

VENUS-282 venus Backlog low

chore(lookup): explicit valor/codigo column on venus lookupOptions

VENUS-155 venus Todo low

Adopt Pluto comisiones-list reference pattern for venus admin list pages

VENUS-263 venus Backlog low

support-core: split SupportActor into domain userId vs telemetry accountableUserId (VENUS-111 follow-up)

VENUS-260 venus Backlog low

Filter benign framework-chunk unhandledrejection noise from errscan alert rail

VENUS-256 venus Backlog low

Add self-join to errscan hub_register() (shared template, latent gap)

VENUS-255 venus Backlog low

Surface vFriction7d convention to mgmt ARO (Fri Jul-10)

VENUS-195 venus Backlog low

Remove viewport-size logging to appEvents

VENUS-191 venus Backlog low

test: approve-path doc-carry coverage (approveAccessRequest → alumno)

VENUS-158 venus Backlog low

Log-plane parity w/ pluto: applog notify emit warn + userAgent in payload

VENUS-152 venus Backlog low

C1 single shared complic. pool filterable by modulo — reverses confirmed §9, needs Sebastian go

VENUS-47 venus Backlog low

pacientes archive coverage + cross-práctica demographic propagation

VENUS-86 venus Backlog low

D5 Otros modulo empty ok? — ask Sebastian

VENUS-53 venus Backlog low

D4 keep/drop Enucleacion coadyuvante (Tumores) — ask Sebastian

VENUS-52 venus Backlog low

D3 Infecciones cervicofaciales tratamientos — ask Sebastian

VENUS-51 venus Backlog low

D1 patient localidad field for residence distribution — ask Sebastian

VENUS-49 venus Backlog low

C2 shared tratamiento pool Quistes/Tumores/Cancer — reverses confirmed §10, needs Sebastian go

VENUS-48 venus Backlog low

B6 student-vs-student/camada compare (design-pending)

VENUS-43 venus Backlog low

bug(auth): seed scripts use raw admin.createUser → NULL-token login-lockout in seeded users

VENUS-20 venus Backlog low

VENUS-4-E relay sidecar (deferred)

VENUS-218 venus Backlog someday

Support-thread UI/UX copy parity diff vs mars (optional)

VENUS-217 venus Backlog someday