Duplicate-PM-copy: detection view + hub sender-coaching + per-PM memory rule (Elazar: active mechanism, not guide text)

MSG-322 llmmsg-srv Backlog urgent

EPIC: ONEDB target flip — telemetry consolidation onto venus-pg (supersede whey-pg)

VENUSINF-1 venusinfra Backlog urgent

└─ Repoint venus-kpi-collect + whey/lezama remote writers to venus-pg

VENUSINF-9 venusinfra Backlog

└─ Provision postgres17 on venus (data dir, listen_addresses, telemetry db + telemetry_rw role)

VENUSINF-7 venusinfra Backlog

└─ pg_hba + network: allow whey + lezama as remote writers to venus-pg

VENUSINF-8 venusinfra Backlog

└─ Cross-update ONEDB WIs (ONEDB-12 ingestion, ONEDB-10 pg-write flip) for new target host

VENUSINF-10 venusinfra Backlog

└─ Confirm + record: venus-pg is the consolidation target; supersede whey-pg in ONEDB-12/10 + one-db/DESIGN.md

VENUSINF-6 venusinfra Backlog

RUTAP full-history refactor

MOVILBA-125 movilba Backlog high

EPIC: unificar modificaciones de vehículo y normalizar Entidad → Línea → Vehículo

MOVILBA-167 movilba Backlog high

Decide the Explorer threshold: 3, not 2

WEBCERTI-19 webcertify Backlog high

Participant eligibility admits the bedel-only support service actor as a recorded practica teammate

TERRA-279 terra Backlog high ↳ TERRA-277

└─ Re-test inactive Terra grant refusal if either shared guard changes

TERRA-287 terra Backlog low

The admin-minimum guard's advisory lock is an UNFORCED control: its mutual-exclusion effect cannot be rehearsed rollback-only, and forcing it red needs a disposable DB or authorised committed DML on the sole live admin grant

ENAMEL-86 enamel Backlog high

Venus coder lane cannot read Vercel runtime logs (MCP get_runtime_logs 403) - Class-A PTD instrument unreachable

VENUS-462 venus Backlog high

Non-owner app role for archive/fraud/audit table write containment (real remedy, migration 100 is hygiene-only)

PLUTO-670 pluto Backlog high

fn_restorePaciente + sentineled in-place correction: the remedy for a document number trapped on a soft-deleted pacientes row

PLUTO-764 pluto Backlog high ↳ PLUTO-437

Demo 1/10: 14 genuine-Google identities hit noProfile; classify and route

TERRA-278 terra Backlog high

nw-venus repo has no git remote: the emaildrain + gdrive-auth-check units are version-controlled but NOT off-disk recoverable

EVO-112 evolutiva Backlog high

codex queue delivery acks on ENQUEUE not on drain: an interrupted -ca session is a silent mail sink and the respawn safety net is disarmed

MSG-437 llmmsg-srv Backlog high

EVO-93: templated venus systemd timer that drains an app's email outbox over its bearer route

EVO-94 evolutiva Backlog high

lezama/codex token feed has never produced a row - install the collector before codex carries fleet load

KPI-71 kpi Backlog high

forced-red harness used the PRODUCTION mountpoint and its cleanup trap umount+rmdir'd it - recovered, no data loss, needs mechanical isolation

OPS-261 agent-ops Backlog high

~/.claude/file-history/ mints versioned plaintext copies of every edited dotenv - 24 credential copies on venus, named by no hygiene rule in the fleet

OPS-253 agent-ops Backlog high

EPIC wasteNot: detect DMs the recipient did not need, opinion loop, coach, then hub-side deterministic block

MSG-326 llmmsg-srv Backlog high

└─ wasteNot: wastenot_candidates table in v2.sqlite + verdict write path

MSG-327 llmmsg-srv Backlog high

└─ wasteNot: the pm-adopted duplicate-reason demoter was never built - and 25 days of data now argue about its priority, not its correctness

MSG-438 llmmsg-srv Backlog

└─ wasteNot: hub-side deterministic block/tag of agreed patterns

MSG-330 llmmsg-srv Backlog

└─ wasteNot: 8h review trigger scrp-wastenot_review-venus -> monitor-llmmsgsrv-cc

MSG-329 llmmsg-srv Backlog

MSG-207 lezama host: wire idle over-budget self-compact actuator

MSG-403 llmmsg-srv Backlog high

multi-subscriber SSE + sender echo + client dedupe (chat-duo + chat-duo-web cohabit)

MSG-118 llmmsg-srv Backlog high

eq backend unbuilt: hub.mjs has no /eq_* routes + no elazar_questions table — eq CLI POSTs to non-existent endpoints (/eq_ls returns not_found). chat-duo Pending panel reads elazar_questions, so no Elazar question can ever surface. Implement hub-side /eq_add /eq_ls /eq_show /eq_answer /eq_dismiss /eq_stale + elazar_questions schema per eq-spec.md

OPS-49 agent-ops Backlog high

monitor-context-cc DOES NOT EXIST and owns 33 open rows (7 p1, 1 inProgress) - while its actuator still compacts the whole host and global CLAUDE.md tells every agent to send objections to it

OPS-244 agent-ops Backlog high

Fleet roster and model/effort policy: retire pm-*-cc, coder holds PM, Sonnet 5 on the 02 seats, coder03 as coder-plus-auditor, /clear handoff with an idle guard

EVO-101 evolutiva Backlog high

Split terra onto its own Supabase project - PLAN ONLY, no build, no migration until Elazar sees the plan

EVO-100 evolutiva Backlog high

kpi.pensanta.com: a plain sortable agent table over Postgres - nothing fancy, and it replaces the current page

OPS-224 agent-ops Backlog high

ONE telemetry lane: keep Postgres agent_telemetry, retire the sqlite/kpi-t pipeline and the ccusage lane - and edit the CLAUDE.md rule FIRST or it regrows

OPS-223 agent-ops Backlog high

gitcommit.sh --only ADDS paths instead of RESTRICTING the commit to them, so the fleet strict-repo rule does not deliver what it promises

OPS-222 agent-ops Backlog high

Lock primitive: ttl default 3600->900, notify-on-release waiters, waiter-requested steal on a stale holder

MSG-362 llmmsg-srv Backlog high

elazar-contact durable must-reach backstop: hub liveness + unread-age email fallback

MSG-264 llmmsg-srv Backlog high

agents-efficiency-KPI v2: settle the actuator coverage gap and make the report recurring

SAVETOKE-35 saveTokenz Backlog high ↳ SAVETOKE-33

Plugin hygiene v2 - rollout completion (lezama + deferred items)

OPS-58 agent-ops Backlog high

└─ Plugin hygiene v2 - lezama host portion: telegram uninstall + host-global lean flip + movilba per-agent enables (see parent 459)

OPS-59 agent-ops Backlog high

context.v_kpi_compact_7d counts a failed-read sentinel as a real sample, splitting over-cap episodes

ONEDB-19 one-db Backlog high

Remote-cluster Supabase creds in shared ltm.md - attribution leak, VENUS-350 sibling of OPS-191

OPS-209 agent-ops Backlog high

Legal review: HC data residency under Ley 25.326

ENAMEL-1 enamel Backlog high

EVO-93: resolve ownership of VENUSINF-3/16/17 and decide the transport shape given port 25 is blocked

EVO-95 evolutiva Backlog high

Fleet token accounting: truthful top-X/N-hours report

KPI-66 kpi Backlog high

whey /data-venus: adopt lezama's .automount shape, or route to the mount-unit owner

OPS-201 agent-ops Backlog high

MSG-371: harden 3 comparison-consumed env reads missed by MSG-370 sweep (audit BLOCK P2)

MSG-371 llmmsg-srv Backlog high

env-int sweep: 10 more hub guards fail open/silent on a typo'd env value

MSG-370 llmmsg-srv Backlog high

getpage.py: fetch a URL past UA-checking WAFs and emit html/txt/md/yaml (replaces cancelled getmethaturl API)

OPS-193 agent-ops Backlog high

└─ Global CLAUDE.md: one-line pointer to getpage.py (blocked on OPS-193 shipping)

OPS-194 agent-ops Backlog

Daemon-fork loses channels flag: CC session silently stops waking on llmmsg mail - detect, prevent, recover

MSG-346 llmmsg-srv Backlog high

└─ Shim: inherited LLMMSG_AGENT env makes daemon-spawned workers register under the wrong agent name

MSG-352 llmmsg-srv Backlog high

PII in PM-triage NOTIFY payloads (venus+pluto), live since Jun/Jul, needs Elazar policy call

OPS-192 agent-ops Backlog high

blackboard cancel does not delete responses - cascade never fires on an UPDATE

MSG-339 llmmsg-srv Backlog high ↳ MSG-332

gitpush.sh split by stack: retire the 2408-line monolith, per-stack scripts, bump-after-gate, deploy health poll

OPS-173 agent-ops Backlog high

└─ gitpush-prestage-abort-test.sh: absorb_policy_handshake's branch has not run since gitpush.sh v5.0, warning 7x per run into nothing

OPS-279 agent-ops Backlog

└─ Flip GITPUSH_RETIRED on by default: the cross-host cutover the stub rehearses

OPS-278 agent-ops Backlog

Shared mutable state: agents contend over the same files with no isolation (sh.git checkout, CLAUDE.md, commons, pm/)

OPS-156 agent-ops Backlog high

└─ sh.git: ~/.local/bin becomes a deployed versioned artifact, not a live editable checkout

OPS-158 agent-ops Backlog high

└─ sh.git: one working tree per agent (worktree or clone), branch per change - decide and implement

OPS-157 agent-ops Backlog high

└─ 4be883c deleted 11 files under an auto-commit message; 1 proven collateral, 1 more in the same class

OPS-282 agent-ops Backlog

└─ sh.git ~/.local/bin on lezama: same parent shape, evidenced version-string collision 2026-08-30

OPS-169 agent-ops Backlog

└─ maintainer registry: 4.1MB uncheckpointed WAL, ~30 hand-made backups with orphan sidecars, no verified backup rail

OPS-168 agent-ops Backlog

└─ jobreg.tsv: 5 agents across 3 hosts write one shared file in sh.git

OPS-167 agent-ops Backlog

└─ whey: ~/.claude/*.md symlinks share OPS-157/158 sh.git shape

OPS-166 agent-ops Backlog

└─ Survey whey for shared-mutable-file contention between agents (incl. CLAUDE.md, commons .md, pm/)

OPS-160 agent-ops Backlog

└─ systemd --user unit dir on lezama: shared namespace, no collision evidenced, ownership already lives in maintainer registry

OPS-170 agent-ops Backlog low

Evidence-led compact/change/shutdown recommendation workflow

KPI-49 kpi Backlog high ↳ KPI-45

Fleet running-agent/model inventory without DM storms

KPI-48 kpi Backlog high ↳ KPI-45

Fleet inventory: every token/context/llmmsg-srv script, monitor, service each agent owns/knows

KPI-1 kpi Backlog high ↳ KPI-45

└─ DECOY DATASTORES: whey /var/lib/llmmsg-srv holds a 2-month-stale v2.sqlite + 2 zero-byte husks, all silent

KPI-41 kpi Backlog high

└─ guard-unbounded-output.py — global PreToolUse Bash hook, venus, all agents

KPI-4 kpi Backlog high

└─ Completed dataset: full census of traffic addressed to write-only scrp-* emitters (614 msgs)

KPI-23 kpi Backlog

└─ Known-of KPI/context collectors on venus PATH - maintainers named, none mine

KPI-33 kpi Backlog

└─ Negative results: 5 traffic predicates + 2 dead fields that look like KPI data and are not

KPI-19 kpi Backlog

└─ 61 analysis views already live in llmmsg-srv v2.sqlite - dedup candidate, maintainer pm-llmmsgsrv-cc

KPI-11 kpi Backlog

└─ Avoidable-traffic audit lane (monitor-llmmsgsrv-cc) - 6h cut over llmmsg-srv v2.sqlite

KPI-3 kpi Backlog

└─ maintainer-agents.sqlite - the ownership registry this epic depends on

KPI-37 kpi Backlog

└─ sys-check.sh (whey)

KPI-40 kpi Backlog

└─ sh.git cannot attribute maintainership - one git identity for all agents; 12 of 15 whey telemetry scripts declare no owner, so these rows are recollections not records

KPI-39 kpi Backlog

└─ OPS-137 orphan/scratch sweeper - owner resolution measured, design note delivered

KPI-38 kpi Backlog

└─ jobreg v1.7 - fleet scheduled-job registry, drift-check + heartbeat watchdog

KPI-36 kpi Backlog

└─ hub-db-backup.sh v1.2 - verified daily backup of the llmmsg-srv hub DB

KPI-35 kpi Backlog

└─ memory-budget-sweep.sh v2.3 - daily auto-load footprint sweep

KPI-30 kpi Backlog

└─ 13 of 15 telemetry scripts present on whey are armed nowhere on it - presence != collection (sh.git checkout artifact)

KPI-25 kpi Backlog

└─ cdwlogs.sqlite: cdw SSE/send/notify telemetry (13.4k events, Jun-Aug 2026)

KPI-17 kpi Backlog

└─ chat-duo-web (cdw): llmmsg-srv browser client, venus :9704

KPI-16 kpi Backlog

└─ ctxscan — transcript token/reclaim scanner (per-agent, venus CC only)

KPI-6 kpi Backlog

└─ MSG-330 traffic breaker (hub.mjs) — held, not applied

KPI-5 kpi Backlog

└─ chat-duo (GTK client, DORMANT): logger-chat-duo.sqlite diagnostic logger

KPI-18 kpi Backlog low

EPIC: turn diet for the PM lane - coach the coder<->pm DM habit, PM-off-by-default topology, lock primitive + git branches instead of lock DMs

MSG-309 llmmsg-srv Backlog high

└─ Protocol: PM-off-by-default - coder is the working lead in project AROs, talks to db/audit directly, PM receives only handoff/result/blocked; write into llmmsg-protocol.md + project commons + hub guide rule

MSG-312 llmmsg-srv Backlog high

└─ kpi-coach rule: name agents whose coder->pm / pm->coder daily DM count exceeds budget (default 15/day) or inert share >50%; coach line cites the numbers

MSG-311 llmmsg-srv Backlog high

EPIC: is native SendMessage faster and cheaper (tokens/turns) than the hub?

SENDMESS-1 sendmessage Backlog high

└─ Decision: adopt / shim-side dual-delivery / reject - written with the numbers

SENDMESS-6 sendmessage Backlog high

ccs bare-name fix: LIVE-VERIFY on lezama + guard the latent ~/.bash_profile condition

MSG-293 llmmsg-srv Backlog high

one-db: 5 telemetry sqlite -> Postgres17 consolidation (umbrella)

ONEDB-1 one-db Backlog high

Account access-state (Activa/Desactivada), no-soft-delete-for-inactivity

EVO-81 evolutiva Backlog high

Supabase supautils force-grants PUBLIC EXECUTE on new public objects: fleet REVOKE-explicit standing pattern + live-exposure sweep

EVO-71 evolutiva Backlog high

SOP support-ticket API: full CRUD + private stakeholder comments + notify-list, per app

EVO-52 evolutiva Backlog high

pruneStale wipes aro memberships of sleeping-host agents; make membership sticky across stale-prune

MSG-270 llmmsg-srv Backlog high

Harden status-ping reroute: catch leading-*** ceremony banners to Elazar

MSG-269 llmmsg-srv Backlog high

hourly LLM concision sampler for agent-to-agent messages

VENUS-224 venus Backlog high

Route hub-originated alerts (silence-detector/pmidle/dormant-PM) OFF HUMAN_AGENT to a PM/ops lane

MSG-265 llmmsg-srv Backlog high

Hub: brainstorm-brief to an aro with an open session silently DISCARDS the brief body (hub.mjs:2585) — make deflect non-destructive

MSG-261 llmmsg-srv Backlog high

Transport reliability + observability program (whey/venus/lezama)

MSG-149 llmmsg-srv Backlog high

└─ Fleet context-cost rollout: send-keys /compact watchdog + aro_leave-on-idle

MSG-210 llmmsg-srv Backlog high

└─ WI592 nag: drop CronCreate /compact from emit_context_budget_nag interactive branch once send-keys watchdog verified fleet-wide

MSG-214 llmmsg-srv Backlog

└─ cc-context-monitor safety-net: flag/extend nag for agents that miss self-leave (seq AFTER rule lands)

MSG-213 llmmsg-srv Backlog

└─ path-B UserPromptSubmit injection copy: reframe CronCreate as automatic-fallback not manual action (avoid conflict w/ v2.13 over-cap DM)

MSG-218 llmmsg-srv Backlog low

└─ chat-duo-web 9704 to lezama: move off whey-initiated -R (VPN-dependent) to lezama-initiated -L over public route

MSG-208 llmmsg-srv Backlog

└─ Shim transport prefer-list: loopback -> ZT -> public DNS (defer until W3+W4 prove design)

MSG-158 llmmsg-srv Backlog low

backup-whey.service: NOPASSWD sudo for cryptsetup+mount in /etc/sudoers.d/backup-whey (failing since run #23 2026-05-08T14:22 - sudo prompts for rob pw under systemd no-tty); owner: os-whey-cc-w

OPS-32 agent-ops Backlog high

Admin: delete data (different from self-erasure CR-290)

AYUD-81 ayudarg Backlog high

UX app-wide: diferenciar visualmente botones vs badges vs tarjetas

AYUD-85 ayudarg Backlog high

memory-budget over-budget warning: route shared-file footprint breaches to project PM with escalation chain

OPS-57 agent-ops Backlog high

Agent-hygiene: automated CLAUDE.md/memory bloat detection + LLM compression (fleet-wide)

MSG-160 llmmsg-srv Backlog high

Agent name parsing: forbid dashes inside role/project (single-token parts only)

OPS-72 agent-ops Backlog high

ARO topology v3 fleet-wide rollout (epic)

MSG-174 llmmsg-srv Backlog high

└─ Phase 6: llmmsg-protocol.md §ARO Membership + §Routing rewrite

MSG-178 llmmsg-srv Backlog

Memory-discipline policy: make enforcement discoverable fleet-wide (whey/venus/lezama)

MSG-179 llmmsg-srv Backlog high

└─ Consolidate evolutiva-memory-discipline.md into fleet-neutral canonical + scrub project/agent names for public sh.git

MSG-180 llmmsg-srv Backlog high

└─ Land canonical memory-discipline.md in sh.git (docs/md), commit+push; nw-* pull propagates to 3 hosts

MSG-181 llmmsg-srv Backlog high

└─ Per-host global CLAUDE.md: add memory-discipline.md to Lazy-loaded + 2-line enforcement pointer (whey/venus/lezama, one commit each)

MSG-183 llmmsg-srv Backlog high

└─ Stub evolutiva-memory-discipline.md -> sh.git canonical; update maintainer-agents.md pointer

MSG-182 llmmsg-srv Backlog

└─ Acceptance gate: fresh agent on each host must cite the policy+thresholds when asked is-there-a-md-policy

MSG-184 llmmsg-srv Backlog

└─ memory-discipline.md threshold divergence: prose (§10/§13/§15 ~4k tok/150-200 lines/8000 budget) != enforced memlint-cron.sh (600 warn/1200 trim); make doc reference script as threshold SSOT, drop duplicated numbers

MSG-185 llmmsg-srv Backlog

Land reviewed ca.sh in sh.git (after PM draft review); commit+push

MSG-188 llmmsg-srv Backlog high ↳ MSG-186

dbcaba backup gaps: dev backup targets wrong db + gdrive backup-mirror broke 2026-05-16 (dbcaba has no auto-backup today)

OPS-76 agent-ops Backlog high

lezama split-brain: island-b hub (llmmsg-srv.service) auto-started, isolated lezama agents from whey hub

MSG-194 llmmsg-srv Backlog high

Global PreToolUse enforcement hook: deny non-llmmsg-srv-team agents Edit/Write to /opt/llmmsg-srv/{hub,bridge,scripts/lib}/** + deny Bash curl/http to hub privileged endpoints (extend existing PATH-script-block hook). Elazar approved ship - recurring: agents edit hub code/curl API instead of MCP tools.

OPS-79 agent-ops Backlog high

lezama host-dark recurrence: root-cause + harden against full-dark (2nd occurrence; died 2026-06-01 18:03 ART, clean cliff)

OPS-80 agent-ops Backlog high

└─ Reboot forensics: journalctl -b -1 -k (panic trace=crash / empty=power loss) + full -b -1 (OOM?), dmesg|tail-50, df -h, last -x reboot, smartctl -a

OPS-81 agent-ops Backlog high

└─ Validate the installed recovery software (failed twice): identify unit, check prior-boot status+journal (fired/tried/failed?), confirm dead-kernel/power is below userland scope; validate reverse-tunnel health EXTERNALLY from whey, never trust the ssh_r_active self-report flag

OPS-82 agent-ops Backlog high

└─ lezama host-dark alert: watchdog fires notify-elazar+eq after 3 consecutive 'unreachable' skips (~15min), instead of silently skipping forever

MSG-204 llmmsg-srv Backlog

└─ lezama single-path fragility: all 5435 probes since May23 are public-dns with zt_whey_visible=0 (ZeroTier fallback never worked); make ZT a real 2nd route + fix phantom ssh_r_active self-report

MSG-205 llmmsg-srv Backlog

└─ lezama out-of-band reset: a dead kernel cannot self-recover; scope IPMI/iDRAC vs smart-PDU for remote host-dark power-cycle (blocked on Elazar: does box have IPMI?)

MSG-206 llmmsg-srv Backlog low

Design + LIVE-TEST ca.sh: reads ca= from .agent-name, codex --dangerously-bypass-approvals-and-sandbox, injects -c mcp_servers.llmmsg-srv.env.LLMMSG_AGENT_NAME + LLMMSG_HUB_URL; PROVE shim auto-registers under ca name (roster check) before calling done

MSG-187 llmmsg-srv Backlog high ↳ MSG-186

Close aro_config auth gap: token-gate POST /aro_config + other privileged hub writes so a forged caller=elazar fails (coder-applog-cc exploited it to flip aro:applog PM). Elazar approved ship.

MSG-201 llmmsg-srv Backlog high

Alert when a CC session is blocked on interactive prompt (AskUserQuestion menu / permission approval / ExitPlanMode): wire CC Notification hook (or transcript-watcher fallback) to DM elazar via llmmsg-srv naming the blocked agent+host. Solves operator having to hunt tmux windows. Research dispatched to claude-code-guide.

MSG-202 llmmsg-srv Backlog high

init-db.sh drift: stale messages schema (generated tag + phantom cols) contradicts hub.mjs self-create / live DB - reconcile or demote

MSG-32 llmmsg-srv Backlog high

Spurious unread-poke loop: read_unread cursor-ack is fire-and-forget (race) + drain-on-other-tools acks only on next poll + poker lacks debounce/idle-gate

MSG-35 llmmsg-srv Backlog high

Real-time error tee: appEvents AFTER-INSERT pg_notify trigger on Pluto Supabase (error→PM DM, warn stays in digest). GATED on nw-venus's exact spec (channel name, WHEN-clause, payload — byte-identical channel+payload across 3 apps; host listener LISTENs + DMs PM). Pluto level vocab = error|warn|info (NO fatal) so WHEN-clause = level='error'. Pre-apply audit review per DDL discipline. Additive/reversible. Do NOT start until spec lands + 112 done.

PLUTO-116 pluto Backlog high

E1: Audit & Standardize

CLEDGER-1 cledger Backlog high

Post-/compact re-register reliability: hook-fire blind spot + hook-independent shim re-register net

MSG-5 llmmsg-srv Backlog high

Hub leaks direct DMs into sender's home ARO: kind=dm fanned to origin_aro roster (cc-context-monitor-venus DMs reaching nw-venus-cc)

MSG-13 llmmsg-srv Backlog high

POST /unregister route: deregister permanence for VENUSINF waves - {agent,caller,[bearer]}; txn validate->capture-PM-AROs->deleteAroByAgent->electPm-each->deleteRosterRow; PRESERVE cursors (optional purge_cursor:true default false); idempotent 200 already_absent; auth self-dereg ungated + admin-dereg edge-bearer interim soft-dep #599; HTTP-only (no MCP tool). Replaces hand-SQL roster DELETE dereg-at-cutover.

MSG-38 llmmsg-srv Backlog high

KPI Track A: ADD pg views (usage.v_kpi_tokens_7d + context.v_kpi_compact_7d) + extend scrp-kpiweekly-whey (email + snapshot/live-read)

MSG-54 llmmsg-srv Backlog high

DECISION (Elazar): kpi.pensanta.com exposure - Tailscale-only (team rec: bind whey tailnet IP, no TLS/cert ops, no public attack surface) vs public-TLS

ONEDB-6 one-db Backlog high ↳ ONEDB-5

Codex receive-bridge: sidecar tmux-poke so Codex agents auto-drain llmmsg unread (no live push)

MSG-10 llmmsg-srv Backlog high

└─ HARD PREREQ: derive + test a Codex-specific ready-prompt regex for idle-gating (CC matcher will NOT transfer; wrong matcher = corrupted-buffer poke). No send-keys goes live until validated.

MSG-11 llmmsg-srv Backlog high

Make context-budget nag idempotent: stop re-nagging every turn + stop stacking /compact crons after compact

MSG-12 llmmsg-srv Backlog high

cc-context-monitor path-B/wind-down DM mis-targeting: db-mars-cc remediation delivered to nw-venus-cc

OPS-9 agent-ops Backlog high

attach-tmux.sh nests tmux/stacks extra login shell on switch-client path (recurring, 'fixed 5x')

OPS-10 agent-ops Backlog high

GATE#1 step i: add reporter-set pg views to schema.sql (network v_history/v_report/v_by_wifi; kpi 3-day window) — distinct from coder's dashboard views; back the 5 sqlite readers

ONEDB-8 one-db Backlog high ↳ ONEDB-2

GATE#1 step ii: repoint 5 sqlite readers to pg telemetry_ro — netreport.sh, testnetwork --report, ccusage-daily-kpi.sh, llmmsg-kpi-report.sh, memory-lint.sh

ONEDB-9 one-db Backlog high ↳ ONEDB-2

Migrate bwi authoritative writer from whey to venus (wi-http.service + bwi-venus-tunnel) — prerequisite for whey backup-only retirement

MSG-92 llmmsg-srv Backlog high

Epic: General — cross-fleet token reduction (message size, batching, routing)

SAVETOKE-1 saveTokenz Backlog high

└─ Measure resident cost of the connector deferred name-list (~250 tools, per-account)

SAVETOKE-38 saveTokenz Backlog

└─ Audit per-agent memory-dir resident cost (~15k/agent on coder-venus-cc)

SAVETOKE-37 saveTokenz Backlog

└─ Trim 13 always-resident-unused claude.ai-sync skills (~1.8k tok/agent)

SAVETOKE-36 saveTokenz Backlog

└─ Codification-arrow discipline: graduate stable per-agent memory facts into ROLE-scoped commons, prune the memory copy. evolutiva-memory-discipline.md §4 already defines memory->commons graduation; make it routine so durable role-shared knowledge lives once in role-commons (shared, deduped) instead of being re-derived in each agent's memory. Pairs with the two structural WIs above; ongoing per-PM hygiene, not a one-shot. Cross-fleet discipline.

SAVETOKE-32 saveTokenz Backlog

└─ Role/agent-scope the eager MEMORY.md index — needs ccs.sh launcher change. MEMORY.md index is the ONE memory file eager-loaded every turn; today it's keyed per-PROJECT (by cwd), so e.g. db-mars-cc's eager index carries coder-only entries it never uses. Re-key the index per-AGENT so each agent eager-loads only its own index lines (individual fact files stay lazy as today). Launcher/sh.git change (ccs.sh memory-path derivation). Owner: bin-whey-cc + pm-llmmsgsrv-cc coordinate (sh.git). Resolves Elazar's per-agent-memory premise at the eager layer where it actually costs tokens.

SAVETOKE-31 saveTokenz Backlog

└─ Fleet: never-multi-recipient audit — audit-mars-cc (394 msgs all 1-to-1), audit-mba-l-cc, db-basquetwi-cc never use array sends; coach + verify adoption

SAVETOKE-24 saveTokenz Backlog

Epic: Venus — venus ARO token reduction

SAVETOKE-2 saveTokenz Backlog high

└─ audit-venus checkpoint batching: 3+ audit checkpoints within 2hr collapse to one batched post; PASS/BLOCK verdicts stay single-line. Baseline audit-venus 90 deliveries/24h, burst-flagged.

SAVETOKE-18 saveTokenz Backlog

└─ coder+audit-venus large-ARO trim: design-justifications/audit findings post HEADLINE+3-bullet to ARO, full detail DM to PM/counterpart. Baseline coder avg 888 chars, audit 1100+ chars/msg; design-ping 4281-char samples.

SAVETOKE-17 saveTokenz Backlog

└─ Worker coordination OFF aro:venus: intra-team coder<->audit back-and-forth via DM; reserve ARO for PM summary + brainstorm turns only. Baseline aro:venus = fleet top-cost ARO, 77k tokens/416 msgs/24h.

SAVETOKE-16 saveTokenz Backlog

└─ pm-venus-cc send consolidation: collapse sequential status/decision within a 30-min window into one post; eliminate ack-only/phatic sends. Baseline 185 deliveries/50-per-hr peak/16 rapid Elazar exchanges. Target 185->140 deliveries.

SAVETOKE-15 saveTokenz Backlog

Epic: Mars — mars ARO token reduction

SAVETOKE-3 saveTokenz Backlog high

└─ coder-mars-cc/audit-mars-cc oversized ARO design-pings: 4400-char 'never-directive' mandates to ARO; headline+summary in ARO, full detail DM-to-PM/assignee

SAVETOKE-12 saveTokenz Backlog

└─ pm-mars-cc <-> db-mars-cc ping-pong: 27 rapid exchanges/24h (~6,315 tokens); batch dispatch+result into fewer round-trips, drop sub-30s over-checking

SAVETOKE-11 saveTokenz Backlog

└─ audit-mars-cc: adopt array multi-DM (to:[...]) for shared findings — 394 msgs/24h ALL 1-to-1, same finding sent separately to pm+coder; ~10,600 tokens/day (biggest single Mars lever)

SAVETOKE-9 saveTokenz Backlog

└─ db-mars-cc tiny-send batching: 14 sub-52-char status acks/24h; fold working:/done: into fewer messages per task

SAVETOKE-13 saveTokenz Backlog

Epic: Pluto — pluto ARO token reduction

SAVETOKE-4 saveTokenz Backlog high

└─ aro:pluto tiny-send batching (low ROI): db-pluto-cc (+ others) emit separate 'working:'/'done:' status acks (31-247 chars). Batch into single first+last-action message per task. Minor per-send tag/overhead savings; flag-only, not urgent.

SAVETOKE-29 saveTokenz Backlog

└─ aro:pluto reframe worker->PM mandate posts (KPI Finding 8): coder-pluto-cc 'never-directive' (4590 chars) + audit-pluto-cc 'do-not' (4465 chars) one-way mandates to pm-pluto-cc. Pattern: worker PROPOSES (concise) in ARO/DM, PM decides+announces. Removes 4k-char one-way mandate posts + clarifies accountability.

SAVETOKE-28 saveTokenz Backlog

└─ aro:pluto worker post-size: coder-pluto-cc (avg 1137 chars/delivery) & audit-pluto-cc (avg 1118) post full design-pings/audit-findings to the room. Move to headline+summary in ARO, full detail (file paths, gate criteria, evidence) DM to PM/assignee. Target ~400 chars/ARO post. Saves ~700 chars x ~150 posts/day.

SAVETOKE-27 saveTokenz Backlog

Epic: llmmsg-srv — hub/MCP/infra token reduction

SAVETOKE-5 saveTokenz Backlog high

└─ Haiku KPI: add fixed v_large_aro_content_24h + re-run coaching after view fix to get accurate per-agent attribution

SAVETOKE-21 saveTokenz Backlog

└─ Hub: implement /breaker auto-reset after N hours if tripped by legitimate traffic (today required manual reset, blocking Elazar DMs)

SAVETOKE-20 saveTokenz Backlog

└─ Fix v_large_aro_content_24h view: add recipient LIKE 'aro:%' filter (currently over-counts DMs with origin_aro carry-through as ARO fan-outs — inflates coaching false positives)

SAVETOKE-19 saveTokenz Backlog

Epic: Movilba — mba-l ARO token reduction

SAVETOKE-6 saveTokenz Backlog high

Epic: NightWatch — night-watch processes token reduction

SAVETOKE-7 saveTokenz Backlog high

Infra cleanup phase 1: canonical URL migration to hub-t.pensanta.com fleet-wide + kill-list execution post Elazar GO (tracked in /gdrive/systemd-audit-*/)

MSG-93 llmmsg-srv Backlog high

Epic: AlertsAndStatusMessages — alerts, status, scraper messages token reduction

SAVETOKE-8 saveTokenz Backlog high

└─ KPI scraper: fan-out to 5 recipients on each send — switch to single DM to pm-llmmsgsrv-cc only; PM decides if fleet needs it

SAVETOKE-23 saveTokenz Backlog

GATE#1 step v: remote-monitor ingestion — venus/lezama write whey-pg DIRECTLY per-host (NO ssh-pull). Transport: venus=ZeroTier 172.27.178.27 or Tailscale; lezama=ssh -w L3 tunnel only (GCABA blocks ZT+TS), pg client→172.30.0.1. whey: listen_addresses + pg_hba for both + telemetry_rw role. nw co-owns

ONEDB-12 one-db Backlog high ↳ ONEDB-2

Hub SIGTERM handler hangs on shutdown — ~90s blackout per restart

MSG-83 llmmsg-srv Backlog high

scrp- convention migration: fleet-wide rename + aro:hosts-status creation (coordinated pass, bin-whey-cc coordinates)

OPS-21 agent-ops Backlog high

Sensitive-files backup to backupYes LUKS USB (whey-state-backup.sh) — maintainer nw-whey-cc. DONE: restarted timer (dead since 06-17 reboot, 9d gap) + added ~/.local/bin/.llmmsg-env+.agent-name coverage (v1.1.0, verified). OPEN/Elazar: exclude ltm.md from gdrive leg (holds creds); mars.env NOPASSWD read-rule; off-whey LUKS keyfile+passphrase (SPOF).

OPS-25 agent-ops Backlog high

OPS-25: rkhunter-scan.sh email malformed — wrong From (envelope=elazar.pimentel vs body=evolutiva), raw HTML renders (dup header block before <html>), WARNING COUNT='0\n0' (stray newline). Fix all three, re-verify rendered output.

MSG-79 llmmsg-srv Backlog high

OPS-24: notify-nw.sh ORIGIN_ARO env support — script must read ORIGIN_ARO from env and pass origin_aro to hub send; without it DM routes without origin_aro regardless of EnvironmentFile

MSG-78 llmmsg-srv Backlog high

EPIC: llmmsg hub + runtime DB → venus

VENUSINF-2 venusinfra Backlog high

└─ Stand up llmmsg hub service on venus (v2-hub.mjs, port 9703, systemd)

VENUSINF-11 venusinfra Backlog

└─ Migrate runtime DB v2.sqlite whey→venus (quiesce, copy, integrity-check)

VENUSINF-12 venusinfra Backlog

└─ Point llmmsg-hub.pensanta.com (DNS) at venus public IP

VENUSINF-14 venusinfra Backlog

└─ Repoint whey + lezama MCP shim + bootstrap to venus hub endpoint

VENUSINF-13 venusinfra Backlog

└─ Burn-in then decommission whey hub

VENUSINF-15 venusinfra Backlog low

EPIC: venus hardening (public-IP attack surface) — GATES service exposure

VENUSINF-4 venusinfra Backlog high

└─ nftables/ufw default-deny + per-service allow rules

VENUSINF-19 venusinfra Backlog

└─ ssh lockdown (key-only, no root login) + fail2ban

VENUSINF-20 venusinfra Backlog

└─ Per-service bind/least-exposure audit (pg/hub/smtp listen only where needed)

VENUSINF-21 venusinfra Backlog

└─ unattended-upgrades + basic intrusion/monitoring on venus

VENUSINF-22 venusinfra Backlog low

Recover lost 2026-05-26 evolutiva-commons patch: §Shared MD Flow + §Versioning + §Boundaries B1/B4/B5 — check llmmsg message DB for original content

OPS-12 agent-ops Backlog high

Normalización de Ambiente de Correos

ADRIANAP-3 adriana-pavon Backlog high

└─ Audit all accounts/devices: map which client (iPhone, Mac, old PC) has which account and protocol (POP vs IMAP)

ADRIANAP-4 adriana-pavon Backlog

└─ Disable POP3 on prensa@ and hola@ in DonWeb cPanel

ADRIANAP-5 adriana-pavon Backlog

└─ Fix Cloudflare DNS: merge duplicate SPF records, add DKIM key from DonWeb, add DMARC record

ADRIANAP-6 adriana-pavon Backlog

└─ Write IMAP config guide for all 6 accounts (prensa@, hola@, 3x Gmail, iCloud) for iPhone + Mac

ADRIANAP-7 adriana-pavon Backlog

└─ Coordinate handoff to IT tech who will apply IMAP config on devices

ADRIANAP-8 adriana-pavon Backlog

EPIC: ASI-compliant MovilBA release handoff and production readiness

MOVILBA-821 movilba Backlog

└─ Run formal ASI QA to HML to production release and capture acceptance

MOVILBA-825 movilba Backlog

└─ Document and verify OpenShift configuration, secrets and health probes

MOVILBA-824 movilba Backlog

└─ Deliver architecture, operations and user documentation through ASI channels

MOVILBA-830 movilba Backlog

└─ Collect ASI CI, test, security and QA assessment evidence

MOVILBA-827 movilba Backlog

└─ Resolve ASI homologation of the actual MovilBA runtime stack

MOVILBA-829 movilba Backlog

└─ Verify ASI application integrations by environment

MOVILBA-831 movilba Backlog

Clarify AE922FE in stakeholder draft

MOVILBA-820 movilba Backlog ↳ MOVILBA-727

Clarify same-day period for AI357IV

MOVILBA-818 movilba Backlog ↳ MOVILBA-727

Clarify same-day period for AH850FS

MOVILBA-812 movilba Backlog ↳ MOVILBA-727

Clarify same-day period for AG358KX

MOVILBA-811 movilba Backlog ↳ MOVILBA-727

Clarify same-day period for AE971FF

MOVILBA-810 movilba Backlog ↳ MOVILBA-727

Clarify same-day period for AE971FE

MOVILBA-809 movilba Backlog ↳ MOVILBA-727

Clarify same-day period for AE922FX

MOVILBA-808 movilba Backlog ↳ MOVILBA-727

Clarify same-day period for AE352LD

MOVILBA-807 movilba Backlog ↳ MOVILBA-727

Clarify same-day period for AD919PL

MOVILBA-806 movilba Backlog ↳ MOVILBA-727

Clarify same-day period for AB259JY

MOVILBA-805 movilba Backlog ↳ MOVILBA-727

Pre-launch operational-log retention decision and safeguards

MOVILBA-799 movilba Backlog

Terra needs a request-needs-info email mechanism (no equivalent exists); use it for Matias/ceda0a10

TERRA-296 terra Backlog

vPracticaHistorial planning-cost fix for get_practica_detail_bundle, split from MARS-752

MARS-809 mars Backlog ↳ MARS-752

EVO-123: convert 11 UPDATE OF invariant guards to AFTER/no-column-list

MARS-801 mars Backlog

SOP-MARS-65: which email should Camila Mamani Cardozo use (blocks SOL-MARS-59)

MARS-760 mars Backlog ↳ MARS-746

proyectar_snapshot(): followups de la revision de db03

MOVILBA-340 movilba Backlog

EVO-123: convert 4 UPDATE OF invariant guards to AFTER/no-column-list

PLUTO-780 pluto Backlog

DB audit pass 2026-10-08: appEvents PII census + RLS/migrations/advisors/drift

VENUS-485 venus Backlog

└─ Advisor: pg_trgm/unaccent in public schema - relocation not attempted

VENUS-488 venus Backlog someday

Repair the source attendance data before trusting the counts

WEBCERTI-20 webcertify Backlog

Epic: webcertify production launch

WEBCERTI-9 webcertify Backlog

└─ End-to-end prod ingest test: upload a real Zoom .xlsx on webcertify.pensanta.com, confirm preview, commit, KPIs

WEBCERTI-7 webcertify Backlog

└─ Bind sign-in identity to the Google sub, not the claim email

WEBCERTI-14 webcertify Backlog low

└─ Migration history: supabase_migrations.schema_migrations absent - CLI db push would re-apply all 5 migrations

WEBCERTI-4 webcertify Backlog low

└─ Vercel MCP: integration grant lacks webcertify-pensanta-com

WEBCERTI-11 webcertify Backlog someday

Memory sweep: split project_enamel_shipped_surface_state.md, re-verify stale memory files

ENAMEL-93 enamel Backlog

Resolve provenance/allowed-set for applog_reader EXECUTE on fn_dbperf_statements_top50

MARS-804 mars Backlog

Vercel MCP connection lost project scope - Class-A PTD build/runtime log reads are unavailable fleet-wide

OPS-293 agent-ops Backlog

Does pluto's .gitpush-pre.sh read ONLY_PATHS? The v5.6 producer shipped fleet-wide; the consumer is per-repo and unchecked

OPS-290 agent-ops Backlog

Generalise terra's atomic migration-stem claim engine into sh.git with per-repo config

OPS-289 agent-ops Backlog

Restore soft-deleted users with explicit role regrant decision

PLUTO-783 pluto Backlog ↳ PLUTO-639

EVO-123: convert 10 UPDATE OF invariant guards to AFTER/no-column-list

ENAMEL-87 enamel Backlog

EVO-123: convert 11 UPDATE OF invariant guards to AFTER/no-column-list

TERRA-289 terra Backlog

Applied Pluto migrations missing from registry can be skipped by registry-driven rebuild

PLUTO-779 pluto Backlog

api-images: off-box backup of uploads/ with a REHEARSED restore - 2.64GB exists in exactly one place, and it is the precondition for the first ?purge=1 caller

EVO-121 evolutiva Backlog

Enamel has exactly one live admin grant with zero headroom - decide whether a second is provisioned

ENAMEL-84 enamel Backlog

file-history minting is only stoppable host-wide: no per-path exclusion exists, and a file's FIRST snapshot is exempt from eviction forever

OPS-283 agent-ops Backlog

The fleet live-version PTD check is degenerate on venus: package.json has not bumped for three consecutive pushes, so version-match cannot distinguish a deploy from its two predecessors

VENUS-467 venus Backlog

CLIENT QUESTION BUNDLE: eleven venus rows are parked on one unasked set of client questions (Sebastian/Puia)

VENUS-466 venus Backlog

applog-listen@terra and @enamel LISTEN on a channel their database never signals - the shared enamel/terra DB has no notify trigger on appEvents, so those two apps have no real-time rail and are covered only by the digest default that was never rolled back

VENUS-465 venus Backlog

sqlite-safe-backup row-count bracket cannot bound a non-monotonic table - a transient lock row deleted the hub backup

VENUS-463 venus Backlog

Class-A migration artifacts live in untracked db/migrations dirs

ENAMEL-80 enamel Backlog

Archive-reason content rule: ban call expressions inside a reason interpolation (shape validator cannot reach it)

PLUTO-771 pluto Backlog

groups.value is editable with no immutability constraint - the stable-code convention that every lookup-backed gate rests on is unenforced, and a rename silently changes which rows match

ENAMEL-78 enamel Backlog

Audit Terra clinical mutation authority separately from authorship

TERRA-280 terra Backlog ↳ TERRA-277

mig 130 primaryRoleId guard is advisory: app.allow_primaryroleid_write is caller-settable, and the wording calls it enforcement

PLUTO-765 pluto Backlog

VENUS-350(b) ELAZAR: purge 36 plaintext June pg_dumps from gdrive trash (eq#52) - destructive, staged, recommend yes

VENUS-443 venus Backlog ↳ VENUS-350

Correction-rail attribution unobserved: terra_234/235 INSERT arms and terra_236 pure-delete actor never read back

TERRA-273 terra Backlog

blockedAt: persist and return the block's start time, so a blocked row's age is readable without a per-row event read

BWI-74 basquetwi Backlog

groupNotPermitted telemetry cannot say which group was refused - report the resolved group identity from SQL

ENAMEL-74 enamel Backlog ↳ ENAMEL-69

Flip NOTFOUND_PAGING_ENABLED once fleet gates clear (mirrors VENUS-27)

PLUTO-762 pluto Backlog

Two systemd user units execute scripts from /home/rob/scripts/, which is NOT the sh.git checkout - dbperf.py is a byte-identical duplicate, three other live scripts are untracked

VENUS-424 venus Backlog

Replace MARS-691's daily reminder with event-triggered alerts (ECHECKOUTTIMEOUT+pool counters, non-stall statement_timeout kill, checkpoint write) - retire the timer only in the same change

MARS-729 mars Backlog

EVO-91 retired /api/app-version fleet-wide but never registered it, and probe-curl.sh still documents it as the usage example

EVO-105 evolutiva Backlog

bwi hub posts omit x-llmmsg-client, tripping the hub client-outdated backstop

BWI-73 basquetwi Backlog

Vercel MCP read path is dead for this lane: list_projects returns zero for a team that demonstrably holds projects, so every env-var question is unanswerable

EVO-104 evolutiva Backlog

Paciente queue depends on 7 bound accounts out of 28 reviewer grants, and 2 requests have aged 2 days

TERRA-267 terra Backlog

El tunel VPN de whey hacia GCABA se cae a mitad de sesion y la ruta a ASI vuelve silenciosamente al gateway local, asi que el espejo falla de una forma indistinguible de la regla de IP de origen

MOVILBA-644 movilba Backlog

Safari-only opaque 'Script error.' hides 30% of Safari's unhandled errors: 33 events / 20 users since June, zero stack on every one

MARS-782 mars Backlog

MARS-84 UX-pain digest can never reach its pattern threshold for parameterised toasts: feedbackKey embeds the entity id, so one problem fragments into 11 keys

MARS-780 mars Backlog

Un pedido rechazado guarda el motivo y nadie se lo dice nunca a la persona que escribio

TERRA-245 terra Backlog

Cuanto tiempo se guardan los datos personales de un pedido de registro de paciente RECHAZADO - hoy para siempre, y nadie lo decidio

TERRA-235 terra Backlog

authenticator lost supautils from session_preload_libraries - dashboard-only fix, blocked on Elazar

MARS-775 mars Backlog

Runtime-role DML smoke test: exercise each affected verb through the real code path AS mars_app_runtime, not an information_schema grants assert

MARS-771 mars Backlog

Add retention/pruning to backup-gdrive-to-hdd (backupYes disk)

OPS-276 agent-ops Backlog

Hold inbound messages older than 1 hour; deliver a count plus a held_messages fetch tool

MSG-436 llmmsg-srv Backlog

Rename the MCP server key to llmmsg_srv so Codex and Claude Code emit the same tool names

MSG-435 llmmsg-srv Backlog

One identity file per agent folder, and that file is AGENTS.md

MSG-432 llmmsg-srv Backlog

Support API: record acting agent on every write (traceability) + per-agent API keys

EVO-102 evolutiva Backlog

EPIC: Full-payload push delivery for Claude Code and Codex agents

MSG-421 llmmsg-srv Backlog

└─ Codex queue full-payload delivery contract and rollout

MSG-422 llmmsg-srv Backlog

Email rail lacks cross-rail dedup of one render's alerts

PLUTO-749 pluto Backlog

BREAKER_PM points at a mailbox nobody drains

MSG-415 llmmsg-srv Backlog

Codex push: codex queue + hub ack replaces send-keys nudge (scr-agent-inbox-nudge.py v1.4)

MSG-412 llmmsg-srv Backlog

Retire hub-t.pensanta.com (-t = temp) and make hub.pensanta.com the canonical hub hostname - reverses MSG-93's hub-t target

MSG-406 llmmsg-srv Backlog

Codex AGENTS.md lacks the no-ack/no-phatic rule, so daily coaching of -ca agents cannot land

KPI-73 kpi Backlog

Restore Mars error->email-to-Elazar loop (bs-mqn8g0rhso5 fleet decision): B ESOCKET operator-email hotfix (after->emailOutbox enqueue) + C instant-error-email onRequestError->enqueue direct-to-Elazar, throttled

MARS-161 mars Backlog

The weekly-kpi DATABASE_URL_DIRECT pool may share mars_app_runtime and silently inherit its 10s statement_timeout, which would kill a long KPI batch

MARS-714 mars Backlog

Full write-to-human appEvents consumer/gate/transform enumeration for mars

MARS-590 mars Backlog

usuarios: DB-backed regression tests for updateAlumno/tier authz matrix

MARS-556 mars Backlog

Opportunistic compliance: rename tipoDocumento/numeroDocumento -> documentoType/documentoNumber (entity-first) on users + accessRequests; confirm stored value stays lowercase 'dni'/'pasaporte' (Mars already correct)

MARS-406 mars Backlog

Refactor DataTable onto shared Pluto sort core (vendored)

MARS-394 mars Backlog

Mars logging structural hardening (R1 follow-up): middleware-injected requestId correlation + actor de-anon in onRequestError (F-3/F-4), isCritical sync-write for auth/authz/security cats (F-5), log-error 5min digest dedup (F-6) — audit design-review first (middleware is auth-adjacent)

MARS-116 mars Backlog

Vercel runtime-log API billing-capped (ExceedsBillingLimitError) — blinds PTD runtime-log gate until cap reset/raised

MARS-141 mars Backlog

Reconcile 'principal' JTP checkbox on /docentes vs no-principal-JTP claim

MARS-610 mars Backlog

Práctica-create uploads to api-images before the transaction commits: pre-row orphans, no sweeper

MARS-693 mars Backlog

instrumentation.ts pulls pg (node driver) into the Edge middleware graph — move error-capture behind an Edge-safe boundary

MARS-452 mars Backlog

Percent-encoded path evasion bypasses SCANNER_PROBE_RE allowlist entirely

MARS-586 mars Backlog

practicaCodigo format: add PRA-MARS- prefix

MARS-614 mars Backlog

Adopt Pluto admin-list/detail reference pattern (5 principles) on Mars

MARS-482 mars Backlog

EPIC mobile-first refactor (Elazar directive, all 3 apps): Mars is desktop-CSS-with-patches, not mobile-first. Staged base-up rework. Stage0 foundation (44px tap floor + search/form fixes, mobile-only media blocks, desktop density unchanged); Stage1 DataTable mobile card mode (fixes /practicas + /docentes); Stage2 /mi-cursada; Stage3 /practicas/nueva form (+tooth-selector tap targets, +undefined .conducto-* classes latent bug); Stage4 filter-bar accordion; Stage5 practica detail (/practicas/[id]+/mi-cursada/[id]: info-bar, changelog, comentarios, review-form, image-viewer pinch-zoom currently broken on mobile); Stage6 secondary (soporte thread, notificaciones, perfil, postgrado-progression). Order 0>1>2>3>5>4>6. Owners: coder-mars-cc 0/3/5, coder02-mars-cc 1/6. Held on proxy-mars BEFORE baseline (Elazar launching). Admin wide-tables=P3 tail/defer.

MARS-97 mars Backlog

Adjunto oversight/governability landing: adjunto logs in -> lands on a page showing comisión health, which JTPs need help, pending workload (Elazar 06-06, q3). NEEDS DESIGN/BRAINSTORM - distinct surface from /practicas

MARS-35 mars Backlog

PM DB-fed triage loop: support-ticket + access-request events DM PM; PM reads DB + triages (bs-mqotdmmk6b5)

MARS-174 mars Backlog

Custom 404: add LLM-copy block to not-found page + enrich routing/not-found event (referrer, appVersion, requestId) + rate-limiter

MARS-330 mars Backlog

jtp_roster (?jtp= query, MARS-474 P2): join-order defect fires review LATERAL 1.6M times instead of ~3K

MARS-685 mars Backlog

get_practica_detail_bundle unexplained exec-time regression (up to 46.7s max)

MARS-680 mars Backlog

Mobile practica-create failures are undiagnosable: client 'Failed to fetch' leaves no server-side row

MARS-679 mars Backlog

Verify restored-Mars object completeness after bin-whey-cc's rail patch

MARS-675 mars Backlog

Práctica edit-quota lock burns a slot on tab-abandon, not just on save

MARS-646 mars Backlog

Standardize /alumnos filters onto the shared URL-param filter pattern

MARS-635 mars Backlog

Profile photo escalating nag -> hard block on 10th prompt; show photo in practica for teacher identification

MARS-580 mars Backlog

restoreUser must regrant roles after MARS-382 soft-delete cascade (role-less restore gap)

MARS-479 mars Backlog ↳ MARS-382

/practicas dashboard: pending-queue rows repeat in the flat table — dedup UX (Elazar option pick pending)

MARS-478 mars Backlog

CI guard: static logEvent call-site scan vs checked-in action-classification manifest (MARS-465 follow-up)

MARS-466 mars Backlog

Admin landing: pinned-first sidebar + numbered emoji card grid (fleet-uniform pattern, bs-mrlnhbp0y3n)

MARS-458 mars Backlog

Middleware session-refresh (createServerClient) -- edge-bundle-safe design needed

MARS-454 mars Backlog

MARS-145 follow-up: daytime-peak 53300 re-scan of the txn-pooler runtime pool

MARS-383 mars Backlog

EVO-47 db-lane: redefine vAppErrorsRecent + vAppAlertsRecent to expose level + category + normalizedRoute; rollup signature = normalizedRoute+level+category (subsumes EVO-46 lane-2 distinctPaths). Enables the level/category-aware alert-suppression predicate. Class-A review pre-apply (reversible CREATE OR REPLACE VIEW).

MARS-344 mars Backlog

Support-agent registry + atomic assign/list-budget functions for support-API

MARS-648 mars Backlog

Add a main-JTP designation to comisiones

MARS-608 mars Backlog

backup-whey-to-ssd.sh: ledger success field does not cover teardown/release_mount outcome

OPS-259 agent-ops Backlog

in-place edits to the live PATH checkout: rule violated twice in a day by its own author - needs a mechanism, not stronger wording

OPS-256 agent-ops Backlog

jobreg: 15 rows fleet-wide are sense=review, so 15 timers are unmonitored - lezama is 9 of 23

OPS-255 agent-ops Backlog

└─ interval_min is the wrong model for a calendar-restricted timer

OPS-263 agent-ops Backlog

└─ OPS-255 sub-item: whey 8 jobreg drift items (6 unregistered, 2 orphaned)

OPS-260 agent-ops Backlog low

whey-seat guard checks that a grant exists, never that it covers the row - existence is not scope

OPS-251 agent-ops Backlog

Add venv self-bootstrap to the remaining agent-callable scripts

WEBSITES-13 websites-tools Backlog

Maintainer registry rows for admin-websites-cc not yet inserted

WEBSITES-4 websites-tools Backlog

google-ads-report.py fails on Google Ads API v23

WEBSITES-1 websites-tools Backlog

Rule 3 silence-default violations

MSG-278 llmmsg-srv Backlog

Rule 9 dossier-dump-inline detection

MSG-277 llmmsg-srv Backlog

wi close writes TWO completed events per invocation, and closing an already-done row appends a third - OPS-221 has 3

OPS-243 agent-ops Backlog

A relaunched cc session can come up BLOCKED on the dev-channels picker - a wave verified by session count reports success on a dead pane

OPS-242 agent-ops Backlog

cc.sh /exit kills tmux session outright, not just the claude process

OPS-237 agent-ops Backlog

statusline 'shim vX' reads package.json on disk, not the running shim, so every agent displays current while 22 of 26 run stale code

OPS-235 agent-ops Backlog

jobreg-registry-reconcile adjudications file degrades to zero suppression silently, so previously-ruled items return as fresh findings

OPS-230 agent-ops Backlog

Retro cross-vendor review queue: 10 unreviewed pushes since audit-pluto-ca went dark

PLUTO-636 pluto Backlog

Email-identity SSOT campaign: users.emailCanonical generated key + getUserByCanonicalEmail chokepoint (absorbs PLUTO-61 display-write fix + PLUTO-36 JS/DB parity fix as acceptance criteria)

PLUTO-154 pluto Backlog

Scheduled GoTrue config-drift check (cron/applog rail, alerts not blocks)

PLUTO-634 pluto Backlog

Stats glossary: footnote + tooltip explaining stat abbreviations in user-facing text

PLUTO-495 pluto Backlog

applog log plane has no external liveness prober - a clean Stopped is invisible to OnFailure and hid a 16.8-day relay outage

VENUS-378 venus Backlog

Fleet appEvents schema standardization (mirror MARS-411) — DESIGN-HOLD

PLUTO-533 pluto Backlog

Existing duplicate-account reconciliation: detect + merge users with >1 account already in prod (Elazar still finding dupes) — mars+venus+pluto

EVO-74 evolutiva Backlog

└─ EVO-74 prevention: access-request flow must link-to-existing, not spawn a duplicate account (mars/pluto/venus)

EVO-79 evolutiva Backlog

└─ Soft-deleted-user restore + identity-attach explicit two-step design

PLUTO-620 pluto Backlog

└─ User-facing self-suggestion surface (is-this-you link-to-existing)

PLUTO-622 pluto Backlog low

└─ Document as durable person key (DNI/legajo/passport/CUIT); email+googleSub are rotatable credentials; build email-change re-link flow

EVO-82 evolutiva Backlog

Venus carries 95 open rows and ZERO live agents on a project Elazar considers finished - triage the 85 backlog rows, close or cancel what is not work

VENUS-405 venus Backlog

Codex usage feed is STALE, not missing - repair the collector cadence so codex is tracked alongside claude

OPS-225 agent-ops Backlog

jobreg per-host split: confirm v2.0 check output on venus + lezama, then delete jobreg.tsv from sh.git with a read-back on all three

OPS-220 agent-ops Backlog

Fleet sweep: authz gate on a side-effecting function call in a FROM clause is not a gate - the function's INSERT fires before the enclosing WHERE

EVO-99 evolutiva Backlog

WEBUSAGE-2b dashboard UI: the surface that replaces the manual SQL pull

WEBUSAGE-7 webusage Backlog ↳ WEBUSAGE-2

Historia clinica: statutory HC-copy export (Ley 26.529) vs no-export scope boundary - needs a ruling

ENAMEL-51 enamel Backlog ↳ ENAMEL-24

Read-only git history primitive for sh.git (git-history-deleted.sh)

OPS-219 agent-ops Backlog

Venus Postgres records the failure side of a credential change and nothing of the change itself: log_statement=none, log_connections=off, track_commit_timestamp=off

OPS-217 agent-ops Backlog

long-lived cc session authenticates with a pre-rotation telemetry credential and spools silently

OPS-216 agent-ops Backlog

/setpm flush target is not reading-gated: hold uses isReading, drain uses roster-exists (leg 1 shipped)

MSG-289 llmmsg-srv Backlog ↳ MSG-285

5653 metrics-spool rows from 2026-07-02/03 are unwritable under the per-agent role - needs a grant-or-discard decision, and nobody owns it

OPS-215 agent-ops Backlog

Blackboard straggler nudge reaches only the silent agent, never the opener who can unblock it

MSG-378 llmmsg-srv Backlog

agent-sleep.sh: bind exit consent to session identity, not just ack freshness

MSG-290 llmmsg-srv Backlog

wi rename is last-writer-wins AND does not log the old title: removing a dangerous instruction from an item destroys the evidence of it

OPS-212 agent-ops Backlog

route.ts: /api/log-error outer catch swallows its own failures, no appEvents row

MARS-577 mars Backlog

PM auto-failover elects parked and out-of-scope agents: election has no eligibility predicate

MSG-399 llmmsg-srv Backlog

Vocabulary guard mirror hole: a piezasDentarias row deleted out from under a scope member

ENAMEL-45 enamel Backlog

EVO-72 driver: approval emails are not coalesced against burst grading (median 55min for 8 emails) - decide the coalescing policy

MARS-719 mars Backlog ↳ MARS-525

COORDINATION_GROUP has nowhere correct to go: the seam accepts only a userGroups authorization value, so filling it overloads the table every route gate reads

TERRA-239 terra Backlog

drop agent_forward from the shim (1135 bytes, 0 active forwards) and surface an active forward on register instead

MSG-395 llmmsg-srv Backlog

lock() has no waiting queue - the release DM says 'Call lock() now', so the tool itself instructs the race that loses the fleet's ordering

MSG-392 llmmsg-srv Backlog

gitpush.sh: an aborted AHEAD_ACK gate leaves the version bump COMMITTED, so a burned version becomes a real commit that publishes nothing

OPS-208 agent-ops Backlog

eq_answer denies pmmaster-* - role allowlist predates the pmmaster seat

MSG-389 llmmsg-srv Backlog

Registry capability claims live in prose, so nothing can query or age them

OPS-206 agent-ops Backlog

Is this app's cron bearer recoverable at all? Vercel sensitive-only env vars are unreadable and the state is invisible until first call

VENUS-400 venus Backlog

push-scope-guard write-side recovery tooling (captured-index disentangle)

EVO-87 evolutiva Backlog

Friction-telemetry action/category labeling hygiene (fleet)

EVO-63 evolutiva Backlog

Friction-log-driven UI fix campaign (fleet)

EVO-62 evolutiva Backlog

Adopt PMs-24/7 + spawn-workers-on-demand RAM-reduction model (brainstorm bs-mqor18api1w)

EVO-26 evolutiva Backlog

PM DB-fed triage loop (bs-mqotdmmk6b5): PMs run a DB-fed ticket/triage queue + dispatch fixes in each app's own aro. Elazar greenlit per pm-venus relay 2026-06-22. Per-app legs tracked as children.

EVO-29 evolutiva Backlog

└─ Triage-loop leg: PLUTO — ACTIVE. Tickets (net-new surface) + access; live app. pm-pluto dispatching in aro:pluto.

EVO-32 evolutiva Backlog high

└─ Triage-loop leg: MARS — per its own (mars already has both surfaces: tickets + access).

EVO-31 evolutiva Backlog

└─ Triage-loop leg: VENUS — DEFERRED (authorized by Elazar 'venus can wait'). On un-defer, carries prereqs: canonicalizeEmail + createAuthUserSafe.

EVO-30 evolutiva Backlog

Vercel + Supabase optimization — reduce Fluid Active CPU bill creep, eliminate dashboard misconfig, lower latency

EVO-36 evolutiva Backlog

Admin pending-items digest email (open support tickets + pending access requests + pending correcciones) to admin — mars+venus+pluto

EVO-75 evolutiva Backlog

Inactive / never-used user cleanup: identify users who never logged in or never used the app, decide disposition (archive vs exclude-from-comms) — mars+venus+pluto

EVO-73 evolutiva Backlog

applog-listen venus rail: burst-dedup for opaque client errors (Script error. / Failed to fetch) — N same-UA+session within 60s → 1 alert+count; isolated 1-offs → log-only. pm-venus amend 2026-06-22 (mars cross-app: Samsung Internet crash-loop found in this class). Supersedes blanket log-only.

EVO-27 evolutiva Backlog

remove single-active-role constraint — support multi-role per user

VENUS-166 venus Backlog

feat(monitoring): venus EVO-12 email-ENABLE flip — light the dormant own-route-404 email leg (today: capture+classify+LEG-2-DM live, email gated dormant). Gates ALL of: (1) surgical deploy-skew guard audited PASS, (2) Elazar Q3 paging-policy ratify, (3) Q4 alerts@ send-as ruling if migrating off soporte-evolutiva-venus@. Per fleet error-alerting standard + deploy-skew guard.

VENUS-27 venus Backlog

Optimize Venus mobile-first for its own most-used viewport (data-driven)

VENUS-192 venus Backlog

ux-pain-digest retune + per-field granularity after feedback-category unification

VENUS-190 venus Backlog

Promote feedback mechanism from jsonb blob to first-class column on appLog tables (fleet)

VENUS-193 venus Backlog

appEvents schema standardization (fleet, mirror of MARS-411)

VENUS-183 venus Backlog

feat(identity): email-change changelog — one email per account + history

VENUS-156 venus Backlog

Patient-registry name correction path (pacientes.nombreCompleto)

VENUS-148 venus Backlog

A cleanly Stopped applog-listen unit is invisible: OnFailure= cannot fire, so an app can lose its error rail for weeks with nothing reporting it

VENUS-380 venus Backlog

venus applog-pull rail has emitted nothing for 24 days with every liveness instrument green — process alive, function idle, indistinguishable

VENUS-338 venus Backlog

slow-query notice prints to stdout and writes NO ledger row — classify.ts:133's slowQueryPageMs gate has had nothing to act on

VENUS-337 venus Backlog

applog rails execute a LIVE WORKING TREE — point them at a checkout-of-record; venus/scripts is an unrepresented production surface for mars and pluto

VENUS-336 venus Backlog

Enumerate every gate AND discriminator-mutating transform between an appEvents write and a human — venus leg

VENUS-331 venus Backlog

Venus 404 evidence loss at proxy.ts:114 — the middleware matcher excludes static extensions, so an asset 404 is structurally pathless before any writer runs

VENUS-329 venus Backlog

Teachers can claim out-of-scope students as theirs (JTP/ayudante takeover)

MARS-553 mars Backlog

Sidebar/navbar per-role regroup (Stage A): execute the holistic restructure the /sidebars-preview diagnostic (75ad66f, 2026-06-04) was built to inform. Per-role nav still cluttered/inconsistent. Use the preview tool (renders real sidebar per role side-by-side) to design grouping, then regroup. Only piecemeal edits landed since (MARS-33/34, WI#327, WI#214); holistic cleanup dropped + untracked until now (Elazar 06-09).

MARS-77 mars Backlog

Central patient DB + shared identity/auth hub in enamel (mars/pluto/venus consume) - item f

EVO-80 evolutiva Backlog

└─ Formalize numeroHistoriaClinica as validated patient DNI (governance-gated)

MARS-534 mars Backlog

Weekly KPI/report email quality: stop noisy+wrong sends (recipients with no practicas or all-zero KPIs; some users get 4+ emails) — mars+venus+pluto

EVO-72 evolutiva Backlog

Migration 042 (pluto applog-view-reshape) is designed + audit-PASS'd but HELD for fleet-lockstep GO — do NOT apply solo

EVO-49 evolutiva Backlog

general-pm role + mgmt-aro topology decision (bs-mqolw0w7gcg/bs-mqom01jn5ww): keep general-pm THIN (cross-project convener + EVO-* umbrella owner + router/scribe + authoritative bwi writer); NO bulk .md; depth=pull-on-demand; tiny PM-owned routing map ~1-2k/app (kill-on-drift); pm-mars=fleet-pattern-lead w/ pluto per-app-divergence carve-out; api-image per-topic invite; single-app incidents stay in project aro. FORK resolved CONDITIONALLY on hub non-quorum capability: YES->one-aro non-quorum lurker / NO->two-aro fallback. GATES: (1) Elazar nod on routing-map + mars pattern-lead + lurker model; (2) pm-llmmsgsrv feasibility verdict on member-non-quorum (Q sent). Nothing structural moves until both clear.

EVO-25 evolutiva Backlog

Pluto fly-solo-kill execution brief (bs-mqpzo3ly470 / EVO-26) — execute on next Elazar-launched team session, do NOT act between sessions. (A) COMMONS/DOC: delete fly-solo/autonomy doctrine + flip log-review=work-order to report-only-Elazar-decides + add Agent-Boundary PM-never-spawns-hands-brief. Pluto-repo files (pluto-commons.md, pm-pluto-role.md) = Pluto coder; shared evolutiva-commons/evolutiva-pm-commons deletes route via bin-whey-cc (whey-canonical, mem shared-commons-edit-routing), NOT Pluto coder. (B) PROBE NOISE (Pluto app code, coder): port venus X-Audit-Probe demotion + internal-probe UA marker so scanner/probe traffic self-classifies to security/info and emits NO page_not_found warn row (source = not-found.tsx capture, mem pluto-notfound-capture-redirect-overfire); + downstream expected-signal allowlist: /wp-* & CMS-scanner paths, apple-touch-icon* 404s, pm-triage NOTIFY probe, gate-correct login-unknown, mobile fetch-abort. (C) RAIL RE-POINT (nw-owned venus daemons = Elazar-launched nw edit, NOT Pluto coder): applog-listen/pull@pluto + pluto-pm-triage-listen.service (EVO-32) -> REAL-severity DM Elazar only, everything else log/queue row no PM DM. (D) DEFERRED per decision pt7: headless sendWelcomeEmail(userId) path (the Agustina exhibit) - policy stands, conversion not scheduled yet.

PLUTO-201 pluto Backlog

LEG-2 aro-retarget: applog-listen alert DM pm-pluto-cc -> POST aro:pluto (aro tag) so Elazar sees in-room + PM runs error-incident troubleshoot IN aro:pluto. DEPS: nw-venus daemon target change + keepalive restart 60cf5e6; pm-llmmsgsrv re-enable fan-out aro:pluto. Pluto verified Elazar in aro:pluto.

PLUTO-167 pluto Backlog

Real-time error reporting + auto-heal — Pluto leg (ratified protocol bs-mqn2ze006f7)

PLUTO-164 pluto Backlog

Verify applog error→aro:pluto live-PM routing survives EVO-5 rail rename (kpi-n-optimization migration bs-mqmr47bwkk4)

PLUTO-157 pluto Backlog

KPI-rework /informes (gathering inputs, do NOT implement yet): teacher-scoped report quality pass. Inputs so far: (a) wrap bare CohortAndProcedureCards grid (teacher-report.tsx:818) in titled ReportSection; (b) Moda operador/asistente cards mislabeled (modal per-student count, not most-frequent person) + redundant beside Promedio -> cut or relabel; (c) EPI RE-WEIGHT: Puia wants MORE epidemiology on pluto+venus -> KEEP/EXPAND porSexo/porProvincia/etc (REVERSES earlier generic-remove rec; do NOT cut epi buckets). Grounding: judge on ACTUAL teacher-scoped values via audit-venus KPI->source-view map + db-pluto value pull, NOT admin-proxy shape. Awaiting full KPI->view map (~20-30min from audit-venus) + Elazar per-item rulings before WI splits into coder/db work.

PLUTO-121 pluto Backlog

Duplicate practicas: operador + asistente each create the SAME clinical event picking each other as counterpart -> 2 mirror practica rows for 1 real práctica. Need duplicate-detection + canonical-record rule (natural key candidates: fecha+comision+paciente/tratamiento+the operador/asistente pair). Design WITH Elazar; covers (a) prevent new dupes at create, (b) reconcile existing dupes in prod. Cross-team lessons-learned for mars/venus.

PLUTO-78 pluto Backlog

Vercel log-drain setup: Elazar greenlit (2026-06-12) true 24h+ runtime-log retention (currently logs are point-in-time only via Vercel MCP). Scope: pick drain destination (log service/endpoint), configure Vercel log-drain, implementer is infra (nw-whey/nw-venus) not coder. PM owes Elazar the concrete scoped plan before dispatch.

PLUTO-46 pluto Backlog

Fleet deliverable: draft BACKTEST SPEC + TRIAGE-CODIFICATION CHECKLIST template (Pluto-owned)

PLUTO-524 pluto Backlog

cc.sh silent when no bearer resolves; shim comment wrongly exempts loopback

MSG-384 llmmsg-srv Backlog

pmOnline uses STALE_TTL_S 600 while live map uses 300; aros_pm has two sources

MSG-383 llmmsg-srv Backlog

Blackboard straggler opener summary omits declines

MSG-382 llmmsg-srv Backlog

/blackboard_read post-close: any registered agent holding an entry_id reads every body - no membership check

MSG-381 llmmsg-srv Backlog

[stuck-agent] alerts route to the PM regardless of the stuck agent's host - every off-host alert is pure relay

MSG-379 llmmsg-srv Backlog

gpc_secret_gate matches only KEYWORD=value, so a plaintext password inside a scheme://user:pass@host URI is invisible to it

OPS-205 agent-ops Backlog

gitpush.sh Markdown-Only test scopes to the commit it creates, not to the range it publishes

OPS-204 agent-ops Backlog

Verify client sign-in end to end once the consent screen is published

SOPORTEP-2 soportepreguntas Backlog

Add a timestamp to the automated -ca inbox nudge text (both pokers)

OPS-202 agent-ops Backlog

Upgrade whey (HP 240 G8) hardware: RAM to 2x16GB, SATA SSD to NVMe, WLAN/BT card if compatible

OPS-200 agent-ops Backlog

Idle -cc agents have no wake path: both nudges gate on -ca

OPS-198 agent-ops Backlog

Serialization belongs in post-receive, not the deploy client

MOVILBA-347 movilba Backlog

Retune the KPI large-ARO drift flag: it fires on normal traffic

OPS-199 agent-ops Backlog

flock -n guards exit silently on a stale holder: no detector, no failing unit

OPS-197 agent-ops Backlog

maintainer registry: 47 active seats name agents with no hub presence

OPS-196 agent-ops Backlog

maintainer-registry: registry_writer attributes writes to the wrong agent

OPS-195 agent-ops Backlog

blackboard: drop an unwritten respondent, completion keys on pending-empty

MSG-357 llmmsg-srv Backlog

roster registered:true outlives the process; gate blackboard_open on poll freshness

MSG-356 llmmsg-srv Backlog

KPI-58 backfill usage_daily into usage_events: 52 days x 61 agents of fleet history no leg has ever read

KPI-65 kpi Backlog ↳ KPI-58

blackboard_write: make status-open check atomic with the response insert

MSG-343 llmmsg-srv Backlog ↳ MSG-332

blackboard invite DM is not actionable - no endpoint, no deadline

MSG-340 llmmsg-srv Backlog ↳ MSG-332

tlms enforcement for hub-triggered llmmsg-srv replies

MSG-325 llmmsg-srv Backlog

ga4_report_generator.py: add custom-events section (draandreaesparza.com)

WEBSITES-19 websites-tools Backlog

draandreaesparza.com: why no visibility on divorce queries (SERP research)

WEBSITES-18 websites-tools Backlog

shared-write: ~/.codex/config.toml has no isolation, one confirmed collision this session

OPS-163 agent-ops Backlog ↳ OPS-159

Sweep: exit codes and status values that are documented and consumed but never emitted (found via hub-db-backup exit 7)

OPS-162 agent-ops Backlog

agent_telemetry (unresolved) bucket: roster is a presence table, so 16827 codex rows / 2.08e9 tok cannot be attributed at all

KPI-51 kpi Backlog ↳ KPI-45

Retire nw-lezama-cc identity

OPS-155 agent-ops Backlog ↳ KPI-45

bin-lezama canonical naming decision

OPS-154 agent-ops Backlog ↳ KPI-45

back up /usr/local/share/doc/whey/*.md (timer audit + ccs-log-rotate removal docs) - not covered by any existing backup job

OPS-151 agent-ops Backlog

whey cron/systemd timer audit: review all not-yet-analyzed jobs

OPS-141 agent-ops Backlog

└─ Audit evolutiva-restore-drill@{mars,pluto,venus,enamel}.timer

OPS-145 agent-ops Backlog

└─ Audit gdrive-mount-health.timer + backup-gdrive-to-hdd.timer interaction

OPS-143 agent-ops Backlog

└─ Audit backup family: backup-whey, whey-state-backup(-weekly), backup-gdrive-to-hdd, api-images-backup, evolutiva-backup@{mars,pluto,venus,enamel}, venus-backup-pull-(daily|weekly)

OPS-142 agent-ops Backlog

└─ Audit sys-check.timer + context-monitor-whey.timer output/value

OPS-148 agent-ops Backlog low

└─ Audit ccusage-daily-kpi.timer + claude-usage-watch.timer resource cost vs value

OPS-147 agent-ops Backlog low

└─ Audit rkhunter-scan-whey.timer output + purge dead stock rkhunter cron files

OPS-146 agent-ops Backlog low

└─ Audit fwupd-refresh.timer vs system-update.sh firmware step

OPS-144 agent-ops Backlog low

└─ Decide on cosmetic rkhunter cron.daily/weekly cleanup + apt-daily mask follow-through

OPS-150 agent-ops Backlog someday

└─ Verify e2scrub_all.timer, fstrim.timer, plocate-updatedb.timer, dpkg-db-backup.timer, logrotate.timer are actually succeeding

OPS-149 agent-ops Backlog someday

Log PPID+argv on refused register (agent_identity_conflict), alongside PID already shipped ed2902d

MSG-323 llmmsg-srv Backlog ↳ MSG-1

Agent subprocess spawning: harness paths closed, OS/detached paths still open on venus

OPS-140 agent-ops Backlog

venus telemetry PG: no owned schema convention — role/table/view per host (lezama/venus/whey), unify + add prune mechanism

KPI-44 kpi Backlog

llmmsg-kpi-report.sh: large-ARO flag is base-rate noise + stale-corpus decoy risk (v1.15/v1.16 fixes)

KPI-43 kpi Backlog

EVO-12 deploy-skew guard leg (b): daemon-side skew suppression (nw-venus + audit-pluto)

PLUTO-722 pluto Backlog

PLUTO D8 compute-placement remediation (self-scan)

PLUTO-98 pluto Backlog

Hub: reject ack-only replies at /send (re= parent not action_required AND body matches v_ack_only_messages predicate) - return 400 ack_rejected with the rule text, instead of hand-coaching

MSG-316 llmmsg-srv Backlog

Dual-lane dirs: .llmmsg-env LLMMSG_AGENT is a cc-lane runtime artifact (ccs.sh rewrites it) read as identity by 17+ scripts; CA identity has no on-disk existence

MSG-315 llmmsg-srv Backlog

Hub: departed agents keep ARO memberships forever (MSG-270 sticky by design) - add PM-forced aro removal route + auto-expiry for members absent from roster AND silent > N days

MSG-308 llmmsg-srv Backlog

Hub: identity-conflict notice fires per message, not per boot (1180 msgs/665KB per 11d) - dedupe per agent per boot

MSG-306 llmmsg-srv Backlog

Hub: parked PM seat auto-resume emits no announcement (fails open on observability)

MSG-304 llmmsg-srv Backlog

context-monitor: confirm compacts from the jsonl compact_boundary, not from send-keys rc

OPS-135 agent-ops Backlog

ccs bare-name fix: end-to-end fresh-spawn proof still unrun on lezama

OPS-132 agent-ops Backlog

venus Tier-0 drain guard predicate does not byte-match worker claim eligibility

EVO-89 evolutiva Backlog

Lezama context/token telemetry -> venus canonical store

ONEDB-16 one-db Backlog

llmmsg-reconcile.sh: populate detail (RECONCILE_NOTE) + name agent in invoked_by

MSG-291 llmmsg-srv Backlog

kpi-coach rubric: cover lock banners + N-separate-DM fanout

MSG-287 llmmsg-srv Backlog

Hub: generalise rail-sender prune exemption from name regex to push-only-producer property (held diff, awaiting audit)

MSG-280 llmmsg-srv Backlog

139 restored report files sit uncommitted; 27 folders have no recovery path

WEBSITES-14 websites-tools Backlog

cumulative_usage() lacks the id-dedup token-usage-collect.sh has: my cumulative token numbers overcount streamed turns

OPS-117 agent-ops Backlog

Venus-side applog rail instrument: DB-to-cursor WORK LAG across all 4 rails + unit-alive assertion

VENUS-320 venus Backlog

Applog relay daemon conflates DATABASE with TENANT — no per-tenant routing on shared-DB co-tenants

EVO-84 evolutiva Backlog

Fleet audit: createdBy/At + deletedBy/At + changelog/archive coverage on every table

EVO-55 evolutiva Backlog ↳ EVO-57

Per-agent Postgres login roles for DB-layer attribution (Mars/Pluto/Venus)

EVO-56 evolutiva Backlog

Minimize demo-data technical debt fleet-wide

EVO-54 evolutiva Backlog

cc-* noncanon-sender catcher: verify in-wild, then migrate cc-context-monitor-* to canonical scrp-<name>-<host>

MSG-271 llmmsg-srv Backlog

to:[] array /send path skips rule-1a origin_aro membership check

VENUS-223 venus Backlog

KPI report defects surfaced by coaching run-1: v_ack_heavy_7d header/threshold mismatch + v_cli_drift_7d lifetime column

VENUS-211 venus Backlog

Fleet-wide per-agent auth: hub identity is self-asserted on the shared edge bearer

MSG-263 llmmsg-srv Backlog

Scheduled security-scan ownership (rkhunter/clamav) + fleet-wide systemd/cron job registry with heartbeat monitoring on venus

OPS-97 agent-ops Backlog

Track AR data-protection reform bill + ReNaPDiS registration procedure

ENAMEL-3 enamel Backlog

Confirm if LOINC + DICOM are mandated (not just recommended) for HCE interop

ENAMEL-2 enamel Backlog

CR26 — role-function guide for Belén (client deliverable)

AYUD-115 ayudarg Backlog

bwi git-sync dead since 2026-05-06: decide whey-only policy vs resume DB commits+pushes to GitHub; venus agents routing through whey meanwhile

OPS-65 agent-ops Backlog

Plan beneficiary DNI storage/sharing — autocomplete-suggest, duplicate-DNI warning (same DNI registered under a different name), and statistics

AYUD-92 ayudarg Backlog

Recordatorio visita 24hs si no hay eventos

AYUD-41 ayudarg Backlog

Criterios cierre/apertura/alerta para eventos/acciones/necesidades

AYUD-40 ayudarg Backlog

Emails de alerta + todos criterios timers

AYUD-39 ayudarg Backlog

Bubble de notificación

AYUD-38 ayudarg Backlog

Create dailyErrorDigest DB view for daily PM error review (aggregate logs table errors per day)

AYUD-94 ayudarg Backlog

Íconos en mapa llevan a acción

AYUD-37 ayudarg Backlog

Recursero toggle mapa

AYUD-36 ayudarg Backlog

Bienvenido bring back

AYUD-35 ayudarg Backlog

Mapa: ver legales

AYUD-34 ayudarg Backlog

Agregar necesidades a la acción al crearla

AYUD-45 ayudarg Backlog

cc-context-monitor compact half - wire host-side tmux send-keys auto-compact for idle over-cap sessions, after the one-session verification test

MSG-122 llmmsg-srv Backlog

Review evolutiva backup policy + space (2h/30d/gdrive, ~1.75GB steady-state; context: WI #509)

OPS-69 agent-ops Backlog

memlint-cron.sh: replace email escalation with llmmsg DM to host maintainer (nw-{host}-cc)

OPS-70 agent-ops Backlog

Crear usuario a Flor

AYUD-44 ayudarg Backlog

pull cc-memory-sweep.sh v1.2 (sh.git 20ce2fe) onto whey + lezama

OPS-71 agent-ops Backlog

Server-side userId in createEventoOnExistingAccion (do not trust client payload)

AYUD-57 ayudarg Backlog

GDPR erasure: fire-and-forget admin email is silent on failure — add error log + retry/queue so the hard-delete loop doesn't stall

AYUD-75 ayudarg Backlog

Localize Supabase password-reset email template (default English → Spanish + AyudArg branding) via Supabase dashboard

AYUD-74 ayudarg Backlog

Fix verify-deploy.sh: --format json + project-name positional incompatibility

AYUD-72 ayudarg Backlog

Vercel MCP token expired — auditor falling back to curl for deploy audit

AYUD-67 ayudarg Backlog

Fleet audit: every agent's cwd has local .agent-name matching registered name

OPS-73 agent-ops Backlog

bisync watchdog: alert when gdrive-bisync.service fails > 2 consecutive runs

OPS-74 agent-ops Backlog

Enriquecer mapa: colores e íconos por acción/evento/necesidad

AYUD-33 ayudarg Backlog

Deploy/verify ca.sh on venus (sh.git pull); confirm a codex test session registers + hub URL resolves remote

MSG-189 llmmsg-srv Backlog ↳ MSG-186

Geolocalización del voluntario

AYUD-42 ayudarg Backlog

Fix static ~/.codex/config.toml footgun: wrong key LLMMSG_AGENT->LLMMSG_AGENT_NAME + LLMMSG_SRV_HOST 127.0.0.1->public; bare codex (not via ca.sh) currently falls back to cc= in /opt/llmmsg-srv = registers as pm-llmmsgsrv-cc on loopback. Non-blocking; ca.sh -c overrides already bypass it

MSG-191 llmmsg-srv Backlog ↳ MSG-186

Normalize agent names + folder/.aro/.agent-name layout: fix hyphenated project-names in cc-names, KEEP host suffix -w/-v/-l (it identifies cross-host agents, e.g. proxy-<proj>-cc-w); rename coder->coder01/coderhelp->coder02/db->db01/db2->db02 via claude-mv per-project (agent-driven, not manual); build drift-normalizer script. whey+venus now, lezama later.

OPS-86 agent-ops Backlog

/loop skill self-exports LLMMSG_AUTONOMOUS=1 on entry (so L1 hook branches correctly inside /loop)

MSG-196 llmmsg-srv Backlog

Push llmmsg protocol mechanics into MCP send tool + hub (shrink model-held context)

MSG-209 llmmsg-srv Backlog

Next.js chat client to supersede chat-duo GTK + chat-duo-web (brainstorm item 4): node service on whey, Tailscale-only, native Pending tabs. Needs design brainstorm->spec->plan.

MSG-127 llmmsg-srv Backlog

Pregunta: ¿Hay algo que no puedas comer?

AYUD-47 ayudarg Backlog

Alta y reseteo de claves

AYUD-32 ayudarg Backlog

UX /personas/(id): agregar campo Comentarios/Notas debajo de Persona

AYUD-88 ayudarg Backlog

UX nav: pulldown muestra guión en círculo — reemplazar con ícono usuario + menú estándar

AYUD-87 ayudarg Backlog

Aplicar diseño de Flor (diseñadora)

AYUD-51 ayudarg Backlog

memory-lint compute_footprint over-walks CLAUDE.md chain - ignores claudeMdExcludes

OPS-61 agent-ops Backlog

Necesidad de salud: notificar admin de Brigada

AYUD-49 ayudarg Backlog

aro_config caller field unauthenticated - light-scope hardening

MSG-145 llmmsg-srv Backlog

DNI obligatorio en preguntas

AYUD-48 ayudarg Backlog

memory-lint scope bug: gitpush pre-hook runs memory-lint.sh with no arg → scans ALL ~/.claude/projects/*/memory dirs → one project's memory hygiene blocks every other project's pushes. Cross-project DoS. Fix: scope to current-project memory dir only (resolve from PWD or .agent-name). Surfaced 2026-05-17 by coder-mars-cc-29923 blocked on llmmsg-srv-cc's dirty memory dir.

OPS-40 agent-ops Backlog

└─ memory-lint A/B/D/E: gitpush-pre.sh per-project scope (arg, not glob) + non-blocking warn-only + drop §11 heading-dup from per-push + never touch CLAUDE.md. Mars+pluto+venus .gitpush-pre.sh mirror. Ratified by Elazar -30088.

OPS-42 agent-ops Backlog high

hub-resident cross-project WI board: add cross_wi table + MCP wi_add/wi_close/wi_ls/wi_show/wi_event tools. Replaces per-host bwi for cross-project items (mars/pluto/venus/evolutiva). 3-PM consensus pm-mars-29395 / pluto-29405 / venus-29411; Elazar greenlight elazar-…-29506 Q2. Owner: llmmsg-srv-cc-w.

MSG-120 llmmsg-srv Backlog

Brainstorm: connect lezama agents to whey's llmmsg-srv hub

MSG-112 llmmsg-srv Backlog

EPIC active-view-by-default (Elazar directive 2026-06-26): every soft-deletable table (deletedAt column) must have a canonical active-view filtering deletedAt IS NULL; the app reads the view BY DEFAULT and the raw table only for admin/restore access. Root structural fix for the practica-link-dead class (soft-deleted prácticas still rendering as clickable links to teachers) and any future see-the-deleted-row bug. Scope: (1) db inventory tables-with-deletedAt vs existing active-views + the gap + ONE canonical naming convention (existing views fork camelCase vStudentAssignments vs proposed v_<table>); (2) coder map app read-paths hitting raw tables that must switch to the view, and the admin/restore paths that keep raw access; (3) create missing views; (4) migrate app reads; (5) audit each read-path swap. Staged, reversible per-view+per-path. Cross-project pattern candidate (mirror to pluto/venus). Plan-first; do not build until Elazar sees scope.

MARS-202 mars Backlog

Fleet model audit: many agents still pinned Opus 4.7; move to default-tracks-latest (verify default=Opus 4.8 + future models) or pin Opus 4.8; review model choice per agent by role

OPS-8 agent-ops Backlog

db-size-monitor blind to /var/lib: add to scan roots (currently /home/rob /opt /srv /rtshared). The llmmsg-srv hub DB (/var/lib/llmmsg-srv/v2.sqlite 38M live + llmmsg.sqlite 30M dead-v1) never appears in size snapshots - exactly the DB Elazar worries about. Also surfaces probe-table growth (host_probes 32k rows) for retention review.

OPS-1 agent-ops Backlog

attach-tmux.sh: list OFFLINE agents too; selecting one launches its ccs session and attaches you to it

OPS-7 agent-ops Backlog

venus /opt/llmmsg-srv is NOT a git checkout - no sync path for maintainer pushes (forces manual /gdrive/temp hops; v1.16 bootstrap had to be hand-installed). Make it a proper git checkout of origin/main like lezama (project_lezama_code_drift) so future pushes land via git pull. Care: venus dir has live local files (.agent-name, service config) - clone-in-place or backup+clone, don't clobber runtime config.

MSG-9 llmmsg-srv Backlog

Unknown /command errors back to sender (not silent-send); usage-error on malformed known verb

MSG-49 llmmsg-srv Backlog

Triage edge LLMMSG_HUB_BEARER rotation: exposed on GitHub via api-images repo (NOT llmmsg-only exposure, so no-rotate rule does not apply)

MSG-51 llmmsg-srv Backlog

Verify: re-run PageSpeed mobile+desktop (target 90+ mobile), visual-parity check vs current live, confirm all internal links + sitemap resolve under cleanUrls

HOAC-11 ha Backlog ↳ HOAC-1

Accessibility pass (DEFERRED per Elazar 2026-06-08): fix viewport user-scalable=0, footer contrast, heading-order, add main landmark

HOAC-12 ha Backlog ↳ HOAC-1

EPIC: Self-hosted SMTP on venus

VENUSINF-3 venusinfra Backlog

└─ Repoint notify-elazar.sh to venus SMTP; verify delivery to Elazar inbox

VENUSINF-18 venusinfra Backlog

EPIC: whey + lezama thin-client cutover

VENUSINF-5 venusinfra Backlog

└─ whey → thin client (hub/pg/smtp point to venus)

VENUSINF-23 venusinfra Backlog

└─ lezama → thin client via public venus (simplify the whey-VPN dependency)

VENUSINF-24 venusinfra Backlog

└─ Define what stays local on whey vs moves to venus (role redefinition)

VENUSINF-25 venusinfra Backlog

└─ Per-cutover rollback plan + burn-in verification gates

VENUSINF-26 venusinfra Backlog

Asesoramiento en SEO

ADRIANAP-2 adriana-pavon Backlog

└─ Configurar accesos: Google Search Console, verificar sitemap.xml, revisar robots.txt

ADRIANAP-14 adriana-pavon Backlog

└─ Auditoría técnica: Core Web Vitals, canonicals, errores 404, velocidad, mobile

ADRIANAP-15 adriana-pavon Backlog

└─ Keyword research y análisis de competencia para flamenco Buenos Aires

ADRIANAP-16 adriana-pavon Backlog

└─ Revisión on-page: title tags, H1 (homepage no tiene), meta descriptions, alt text de imágenes

ADRIANAP-17 adriana-pavon Backlog

└─ Recomendaciones de contenido: fix Cartelera (2024 events visible in 2026), expandir páginas de academias, proponer 3 landing pages SEO

ADRIANAP-18 adriana-pavon Backlog

└─ Recomendaciones Schema.org: Organization, Event, DanceSchool/LocalBusiness por página

ADRIANAP-19 adriana-pavon Backlog

└─ Informe escrito con plan de acción priorizado + llamada de presentación

ADRIANAP-20 adriana-pavon Backlog

EPIC: shift /users /estudiantes /docentes from admin-dashboard mgmt to self-managed roster (JTP/Ayudante/Adjunto/students self-pick relationships + self-confirmation workflow)

MARS-87 mars Backlog

hub.mjs latent SQLITE_ERROR: 'no such column: ""' at Database.prepare (seen 00:47:15 pre-restart). Route interpolates empty string into query as = "" (SQLite parses "" as column id). Find the unparameterized query, convert to bound params. Route-triggered, not fixed by restart. Also tidy hub.mjs:1007 error string to match widened regex.

MSG-23 llmmsg-srv Backlog

Observability: add success-path logging (login success, key page loads) — currently only error branches log

AYUD-3 ayudarg Backlog

CR62: agregar 'ver todas' a pulldown comunas en /recursos

AYUD-106 ayudarg Backlog

CR24-full: remove photo DISPLAY code (listEventPhotosQuery, EventPhotoRow, any /personas/[id] photo render) — Elazar confirmed full erasure

AYUD-4 ayudarg Backlog

Real-life-as-SSOT JTP attribution analysis: quantify divergence between start-of-year studentAssignments (error-prone excel import) and actual student JTP picks (práctica.jtpUserId). Two mismatch classes: (1) JTP students picked but aren't assigned to; (2) students assigned to a JTP who picked a different one. Analysis only first (no writes); evidence base for evidence-based reassignment (NOT admin-pick UI). Links MARS-43 + live-vs-snapshot rule. (Elazar 2026-06-14)

MARS-126 mars Backlog

CR63: /personas/(id) mostrar estado/necesidad con link a detalle de necesidad

AYUD-107 ayudarg Backlog

whey↔lezama global ~/.claude/CLAUDE.md §-level reconcile: lezama missing entire sections whey has (was missing ## Collaborate — added 2026-06-14; also lacks Permission, Communication, others). Audit all 3 hosts' global CLAUDE.md section sets, decide canonical fleet-neutral set, mirror missing sections per-host. Surfaced during the log-review-autonomy global-line rollout.

OPS-14 agent-ops Backlog

CR64: /personas/(id) eventos debe mostrar info del evento (iniciado/no iniciado), no necesidades

AYUD-108 ayudarg Backlog

Measure per-turn injected token overhead per agent; rank remaining cuts by real savings

TOKENDIE-1 token-diet Backlog

cc-context-monitor.timer on venus stalls intermittently (Trigger: n/a, no next fire scheduled) after normal runs — causes ~45min gaps in scrp-context_monitor-venus heartbeat, false DOWN alerts from whey. Observed 4x on 2026-06-21. Root cause unknown (systemd timer drift? service runtime overrun? OnCalendar+Persistent interaction?). Needs bin-whey-cc investigation.

OPS-23 agent-ops Backlog

Soak applog dual-write logs↔appEvents 7d/50-event then retire logs table

AYUD-14 ayudarg Backlog

Hub: detect + block redundant per-member DMs when ARO fan-out should be used (same/similar body to N ARO members in short window → coach to use aro:X fan-out)

MSG-104 llmmsg-srv Backlog

EVO-12 ayudarg leg: server-side 404 capture, error-tier on own-route (DM+email), bot-probe carve-out to warn/digest only

AYUD-16 ayudarg Backlog

venus: align scrp- units to bs-mqmr47bwkk4 naming convention

OPS-22 agent-ops Backlog

authz: /datos gate mismatch vs sibling /admin/* pages — logged-in-only vs isAdmin

AYUD-110 ayudarg Backlog

Migrate all whey-hosted maintenance/monitoring to venus: systemd timers, cron jobs, push/pull scripts, and any monitoring that currently runs on whey (bin-whey-cc / nw-whey-cc lanes) must move to venus equivalents. Whey is not 24/7 and must not be depended on for scheduled or continuous ops. Audit all whey services, identify venus gaps, migrate lane by lane. bin-whey-cc becomes contributor/reviewer only; venus agents own runtime.

OPS-94 agent-ops Backlog

db-mba-l/CLAUDE.md: live PROD svc_nextjs password in tracked git file. No rotation (Elazar 2026-06-29). When revisited: git history rewrite or rotation. Also de-bloat 23.6k schema doc → move to docs/ read-on-demand.

OPS-95 agent-ops Backlog

Rename whey monitor units to bs-mqmr47bwkk4 convention: ctx-monitor-whey.{timer,service}, sender scrp-ctx_monitor-whey, target aro:hosts-status

OPS-24 agent-ops Backlog

auto-commit guard: reject staged *.llmmsg-env / bearer-shaped blobs in git add -A paths (systemic root-cause fix)

MSG-110 llmmsg-srv Backlog

Stale /compact cron jobs: agents leave CronCreate one-shots from prior sessions (shows as 361d scheduled task on exit). Investigate root cause and implement reliable cleanup — auto-purge stale crons on session start or prevent duplicate creation. Reported repeatedly; needs durable fix.

OPS-93 agent-ops Backlog

v_large_aro_content_24h view: add recipient LIKE 'aro:%' filter so DMs with origin_aro carry-through are not counted as ARO fan-outs

MSG-228 llmmsg-srv Backlog

Audit odaia agent roster — 15 cwds under ~/Documents/personal/odaia looks too many; consolidate, then properly scope google-workspace MCP per surviving agent (currently re-added to all 15 per-project as a stopgap 2026-06-05).

OPS-90 agent-ops Backlog

Fleet google-workspace real-usage sweep on venus+lezama: grep each host's transcripts for actual mcp__google-workspace__ tool_use (not installs/mentions); add per-project where used. whey done: odaia(heavy), pluto-pm(light), nw-whey(1 gmail).

OPS-91 agent-ops Backlog

Proactive unreviewed-práctica backlog outreach: identify top 3-4 teachers (JTPs) by sin-revisión backlog, the active JTP in each's comisión, the adjunto + titular; draft email to adjunto/titular asking how to address the backlog before it's insurmountable. Real-audience outbound — held for Elazar approval before send. (Elazar 2026-06-14)

MARS-125 mars Backlog

Post-commit student notification is fire-and-forget: a transient INSERT timeout loses the in-app notice permanently, and its only redundancy is a sibling best-effort email

MARS-793 mars Backlog low

WATCH: post-MARS-799 connection phase evidence

MARS-787 mars Backlog low

Deferred physical DROP of dead columns on the rutap.vehiculo_historial_normalizado view graph (carroceria_modelo first)

MOVILBA-789 movilba Backlog low

supautils force-grant census: public functions holding EXECUTE outside their allowed set (R6 forbidden-set read, inventory only)

PLUTO-785 pluto Backlog low

no demo/seed exclusion mechanism exists - vPracticaParticipantFacts cannot exclude demo prácticas from scoped teacher stats

PLUTO-103 pluto Backlog low

Add value/codigo machine-key column to lookupOptions

PLUTO-551 pluto Backlog low

Audit + sync prod public-fn DDL drift to checked-in migrations (search_path pins) — pluto mirror of venus EVO-8

PLUTO-153 pluto Backlog low

PLUTO-139 outcome: add 6 scope-join FK indexes, drop 2 zero-scan indexes, retire the dead isUserRowSafeToSupersede fn

PLUTO-724 pluto Backlog low

GitHub to Vercel did not trigger a deployment for commit b8dd248

WEBCERTI-17 webcertify Backlog low

applog-listen tsx units keep stale in-memory code after source push

VENUS-479 venus Backlog low

pre-push hook's committed-violation language overclaims: diff-scoped findings cannot see a clean committed violation outside --only

VENUS-478 venus Backlog low

venus pre-push invariant lints cannot see a committed violation, and defer one as soon as its file is dirtied

VENUS-477 venus Backlog low

Census enamel's functions against the EVO-114 R6 forbidden-set shape (report only, no REVOKE authority)

ENAMEL-92 enamel Backlog low

supautils force-grant census: public functions holding EXECUTE outside their allowed set (R6 forbidden-set read, inventory only)

ENAMEL-91 enamel Backlog low

Add LoginCard render coverage for untrusted error query values

TERRA-293 terra Backlog low ↳ TERRA-291

Scoped gitpush proceeds unserialised when hub identity is missing in shared checkout

TERRA-290 terra Backlog low

venus has no live schema-drift watcher, so every schema-contract test reads a snapshot that can lag prod

VENUS-470 venus Backlog low

Weekly api-images storage read + surface storage.warning (schedule half of EVO-58)

EVO-116 evolutiva Backlog low ↳ EVO-58

An inline SMTP failure leaves no appEvents row: every producer on the email failure path is downstream of the queue

VENUS-451 venus Backlog low

Port Terra's participant-dispute mechanism to Pluto (replaces building a removal kind)

PLUTO-763 pluto Backlog low ↳ PLUTO-744

Possible MISBINDING: Terra profile bound to an auth account whose display name does not match it, while a failed-noMatch account does (Case B, carved from TERRA-274)

TERRA-275 terra Backlog low

VENUS-350(c) ELAZAR: pay for a managed restore path (pitr off, backups empty) - sequence behind the VENUS-442 restore-drill answer

VENUS-444 venus Backlog low ↳ VENUS-350

infra: policy-grade attribution separation for identity-mutating DB writes - archive owner role, limited non-owner app role, distinct human credentials

EVO-113 evolutiva Backlog low

page_not_found records no requester on enamel: ip, userAgent and actor are all NULL, so every 404 needs a DM to the lane to attribute

ENAMEL-68 enamel Backlog low

applog digest has no self-probe suppression: a correctly stamped probe pages support 26 minutes after the real-time rail suppressed it

VENUS-427 venus Backlog low

Redact sent emailOutbox bodies in terra's own drain - enamel's ENAMEL-16 pass is scoped to enamel rows only

TERRA-269 terra Backlog low

MARS-790 step 5: SCANNER_PROBE_RE must be assertable directly - tail vectors are green lines in 4 of 5 apps

MARS-791 mars Backlog low ↳ MARS-790

Client fetch drop on /practicas/nueva: 48 events, 29 students, and 19 of the 48 show no practica within 24h

MARS-789 mars Backlog low

Google has been fetching /.well-known/assetlinks.json 1275 times over three months and getting a 404 every time: an Android App Links association is declared against pluto and has never verified

PLUTO-757 pluto Backlog low

applog digest re-delivers event ids the real-time and suppressed paths already sent

MARS-786 mars Backlog low

Decision de la catedra: entra tipoBarrera al desglose de /informes? Si entra, agrupa por campo - eso ya esta decidido

TERRA-237 terra Backlog low

Staff ticket-notification email has no outbox retry (immediate:true bypass)

MARS-757 mars Backlog low

Alert email bodies show 12-hour clock without AM/PM

PLUTO-750 pluto Backlog low

Blackboard: +1 an existing answer instead of writing a body

MSG-410 llmmsg-srv Backlog low

Blackboard: multiple append-only writes per respondent

MSG-408 llmmsg-srv Backlog low

Blackboard: native round 2 on the same entry

MSG-407 llmmsg-srv Backlog low

scrp-monitor-agent-idle.sh: why= is the shell's own re-derivation, not the classifier's reason - emit the upstream reason as an additional field

OPS-274 agent-ops Backlog low

CLAUDE.md credits scrp-monitor-agent-idle.sh --verbose with a cap meter it does not have: the value is the host statusline, absent on whey

OPS-273 agent-ops Backlog low

A .agent-name declares cc=scrp-journal-digest-venus - the harness KEY says agent while the NAME says script; the file has two consumers with opposite subjects

OPS-271 agent-ops Backlog low

DECISION FOR ELAZAR: adopt unlock(successor:@next) for the push gate, or keep the plain release

OPS-269 agent-ops Backlog low

Retro independent review of MARS-562 / SHA 872495a (migration 091...)

MARS-563 mars Backlog low

Notifications never clear on resolution: 93% of unread access-request pings and 78% of unread practicaToReview pings point at already-decided work

MARS-726 mars Backlog low

login-email-drift-blocked: consider auto-sync email when supabaseAuthId sub already matches

MARS-602 mars Backlog low

Standing audit: nextjs/nodejs → Postgres pushdown — find Node-side aggregations/filters that should be DB views/functions, refactor opportunistically

MARS-247 mars Backlog low

student-assignment-tcm.ts peer-inference fallback (L188-234) seeds a NULL SA from OTHER students' practicas.jtpUserId/ayudanteUserId snapshot; TCM-gated (deletedAt IS NULL + role-matched) so stale teachers rejected — NOT a rule-(b) violation, low risk. Tighten to prefer live peer SA over práctica snapshot.

MARS-22 mars Backlog low ↳ MARS-21

Friendlier landing for a soft-deleted práctica link (vs generic 404)

MARS-706 mars Backlog low ↳ MARS-583

vUsuariosDirectory: lateral aggregates compute for all 758 users before LIMIT

MARS-681 mars Backlog low

Load-failed class: capture visibilityState + nav-in-flight at throw time

MARS-640 mars Backlog low

Apply MARS-507 #2 decorate pattern to mi-cursada/[id]/editar form

MARS-510 mars Backlog low

MARS-419: browser-mode integration test for native-validation coalescing

MARS-421 mars Backlog low

gitpush-pre lint: block value exports in use-server modules (PLUTO-491/492 class)

MARS-397 mars Backlog low

Consolidate vFrictionEvents 6-way view duplication onto canonical wrapper pattern

MARS-489 mars Backlog low

ALTER DEFAULT PRIVILEGES: decide whether to narrow the agent roles too, after the MARS-707 fence has proven itself on mars_app_runtime

MARS-708 mars Backlog low

Tech-debt sweep: catalog unused DB objects (tables/columns/views, e.g. 0-row #395/#396, redundant text cols #394) + dead app-code fields/exports; file one deletion WI per finding (Elazar 06-05: stop brushing off 'legacy field we dont use')

MARS-13 mars Backlog low

PARKED until measured: consolidate serial write paths into set-based SQL (practica create/edit, perfil, memberships)

MARS-690 mars Backlog low

vPracticaHistorial repeats lookupOptions Seq Scans across its 4 archive branches

MARS-674 mars Backlog low

usuarios: replace per-user correlated roles/comisiones subplans with set-based CTEs

MARS-555 mars Backlog low

Verify toast/backend-diagnostic dedup pairing on Mars

MARS-464 mars Backlog low

Pruning strategy for append-only growing tables: appEvents (2334 rows), notifications (5202 rows), imageUploadAnalysisEvents (4327 rows) — no TTL/rotation defined; design retention policy + purge job

MARS-294 mars Backlog low

Transient fetch failure on practica /editar has no retry or draft; user remedy is delete

MARS-730 mars Backlog low

Fix two stale hub.mjs lock_events comments: the 317-rows figure and the :930 KPI-view claim

OPS-258 agent-ops Backlog low

gdrive REMOTE backup lane has no object-count instrument - 85 on Drive vs "kept 86-1" on the mount, and nothing ever asserts the remote count

VENUS-409 venus Backlog low

Three GA4 properties exist for elazarpimentel.com

WEBSITES-9 websites-tools Backlog low

marcelosblancoycortinas-com-ar holds GSC reports but is not a git repo

WEBSITES-6 websites-tools Backlog low

wi event has no 'correction' eventType, so corrections land under whatever type each author picks

OPS-248 agent-ops Backlog low

Document to=pm:X send target + hub PM election/pending-queue in README.md protocol section (shipped in 5741b17, README not yet updated)

MSG-128 llmmsg-srv Backlog low

llmmsg-srv notify path: drop to= from the notification meta object (~20.4 chars/msg) - decide on reversibility, there is no in-band render check

OPS-232 agent-ops Backlog low ↳ OPS-228

llmmsg-srv drain/register path carries no redelivery marker although priorNotifiedId is in-process at drain time - a re-served message reads as fresh traffic

OPS-236 agent-ops Backlog low ↳ OPS-228

hub: no drained_at timestamp, so stub-to-drain latency is unmeasurable - add one column to cursors

OPS-233 agent-ops Backlog low ↳ OPS-228

scrp-pane-tail.sh - one trimmed pane-read primitive, because the grep everyone reaches for saves nothing and the borders are the payload

OPS-231 agent-ops Backlog low

WEBUSAGE-2c per-app consumer hooks: how an app reads its own usage back

WEBUSAGE-8 webusage Backlog low ↳ WEBUSAGE-2

Historia clinica: 10-year retention floor has no enforcement mechanism

ENAMEL-55 enamel Backlog low ↳ ENAMEL-24

Historia clinica: mental-health RBAC tier + daily-recording requirement (Ley 26.657)

ENAMEL-54 enamel Backlog low ↳ ENAMEL-24

Historia clinica: FHIR R4 + SNOMED CT AR interop (Ley 27.706)

ENAMEL-53 enamel Backlog low ↳ ENAMEL-24

Historia clinica: firma digital + versioned consent + minors' consent banding (CCyC art.26)

ENAMEL-52 enamel Backlog low ↳ ENAMEL-24

kickCheckInterval not cleared in shutdown()

MSG-338 llmmsg-srv Backlog low

collector races DNS at boot: one psql name-resolution failure for venus.pensanta.com

ONEDB-18 one-db Backlog low

Refactor session-reading src/lib modules to take an explicit actor param instead of calling getSession() internally

MARS-721 mars Backlog low ↳ MARS-118

hub: bbNotifyWritersAtClose DM carries no payload, only go-call-blackboard_read

MSG-396 llmmsg-srv Backlog low

practicas.numeroHistoriaClinica non-blank + trimmed CHECK, and clean the one untrimmed row

PLUTO-738 pluto Backlog low

A NUL byte in a .ts source passes every gate and breaks every text tool

TERRA-229 terra Backlog low

Solicitudes: evaluate+fold net-new features into Pluto from mars/venus (brainstorm bs-mr4h5azsk3g)

PLUTO-477 pluto Backlog low

Adopt curated repo-visible knowledge .md for Pluto agent team (bs-mr3bt2c0vgy consensus)

PLUTO-470 pluto Backlog low

Investigate stray uncommitted .agent-name change in solo-pluto team tree

PLUTO-562 pluto Backlog low

Proxy viewport tooling: chrome-devtools-mcp (CDP) for Pluto needs an auth path — Pluto is OAuth-only

PLUTO-51 pluto Backlog low

Advisory (low pri): enable auth_leaked_password_protection (HaveIBeenPwned check) in Supabase auth — currently disabled. Low value for Pluto (allowlist-only, no open signup) but a free defense-in-depth toggle. From PLUTO-123 security sweep.

PLUTO-125 pluto Backlog low

Shared push-tree same-file concurrent-edit handoff protocol

PLUTO-683 pluto Backlog low

Consume venus-side applog cursor-age instrument (report pluto's rail age)

PLUTO-651 pluto Backlog low

Applog burst-dedup: duplicate event ID replay within 60s synthesizes x2 burst

PLUTO-650 pluto Backlog low

Pluto Historial change-history panels: audit gap + build (HOLD for Elazar go)

PLUTO-531 pluto Backlog low

Logging-hardening: clientError:global-error rows persist with EMPTY detail (no digest/errorName/message/route) — un-diagnosable from appEvents alone. Capture digest+message+route at the global-error boundary so future global-error volume is triageable. Low-pri; only escalate if global-error volume rises (currently sparse/benign: 2-4/day transient).

PLUTO-221 pluto Backlog low

Stuck-agent alert silently discards an unresolvable-host case

MSG-385 llmmsg-srv Backlog low

404 digest count inflation: error-digest reports 11 /mi-cursada 404s but appEvents shows only 2 — reconcile digest aggregation vs raw appEvents rows (possible double-count, window mismatch, or path-glob over-match). Source: audit /mi-cursada triage, de2e960 window. mem: appevents double-render dedupe (not-found-log.ts isDuplicateRender) is one suspect.

MARS-164 mars Backlog low

Build re-runnable orphan-image reference counter before any sweeper (api-images)

MARS-697 mars Backlog low

GET /online?aro=X returns unfiltered membership as if it were liveness

MSG-360 llmmsg-srv Backlog low

blackboard: notify writers at close, default 900s, fix gate wording

MSG-359 llmmsg-srv Backlog low

blackboard: decline as a third outcome, decliner stays withheld forever

MSG-358 llmmsg-srv Backlog low

blackboard: extend timeout, better length error, 8000-char question cap

MSG-355 llmmsg-srv Backlog low

blackboard: opener-only amend, append a CORRECTION block

MSG-354 llmmsg-srv Backlog low

estadisticas: dead outlier-detection rule, never fires (since MARS-193)

MARS-639 mars Backlog low

same shared-checkout shape as sh.git exists at /opt/llmmsg-srv, but already mitigated (strict+hunk-gate) — evidence for OPS-157/158

OPS-165 agent-ops Backlog low ↳ OPS-159

shared-write: maintainer-agents.sqlite has convention-only write protection, no OS/app-level gate

OPS-164 agent-ops Backlog low ↳ OPS-159