Friendly retry copy for dropped mobile navigation fetches

MARS-652 mars Done low

Archive triggers RAISE on a missing app.user_id but silently NULL a missing app.archive_reason, so commons promises loud failure it does not deliver

PLUTO-707 pluto Backlog

Four DB functions set app.user_id but never app.archive_reason, so archiveReason falls through to the caller or NULL

PLUTO-705 pluto Canceled

CLAUDE.md cites a 6-prefix archiveReason policy that is defined nowhere in the repo

PLUTO-706 pluto Backlog

db/schema.md omits function bodies, so it cannot answer what is installed for any fn

PLUTO-704 pluto Backlog low

Commons dedup: delete drifted §Tooling-First from venus + pluto role files (terra DONE 8927d8d)

EVO-88 evolutiva Done

Add vUsersFull view

MARS-651 mars Done low

users.lastSignInAt is never written - the adoption instrument is accidentally-always-zero

TERRA-80 terra Backlog

Nav visibility gap: /practicas/nueva + /mi-cursada unreachable via sidebar for non-alumno roles

TERRA-17 terra Blocked high

Retire/reactivate writes archive rows with no actor or reason: RETIRE_SQL runs on a bare pool.query so setArchiveContext cannot reach it, and terra_29 will break the feature outright

TERRA-78 terra Todo high

terra_22 asserts trigger identity by tgname with no tgrelid scoping, so the assertion can match a trigger on another relation

TERRA-79 terra Backlog low

Modulos offer AI-seeded cirugias instead of the catedra list: client-reported, correct mapping supplied, Drive source not yet in hand

TERRA-75 terra Blocked high

Odontogram offers deciduous teeth 51-85 which cannot take implants: terra has an exclude scope row for exactly this and it is not narrowing

TERRA-77 terra Backlog

Implantologia and reconstruccion alveolar need modulo-specific fields (injerto, zona dadora, barrera, marca de implantes): never built, shape undecided

TERRA-76 terra Backlog high

route-dedup.ts: two open unowned defects (windowing collapse, unrecoverable summary)

VENUS-375 venus Done high

applog-listen: catchUp logs route-suppressed-held rows as 'missed event(s)'

VENUS-376 venus Backlog low

Honest copy for server-side image-upload failures (practicas/nueva)

MARS-650 mars Done

Post-deploy PTD check mints one permanent appEvents row per push on a shared 365d-floor table

TERRA-74 terra Backlog low

A probe row in appEvents is indistinguishable from a real user failure and the record is permanent

TERRA-43 terra Blocked high

Blocked-item sweep: measure whether each of the seven stated blockers still holds

TERRA-73 terra Done

Guard suite unexercised on a non-empty population: the writer exists and is owned, but no natural terraPracticas write has been observed

TERRA-46 terra Todo high

Citation gate must state its own bound: shape-checked, not authorization-verified

TERRA-71 terra Backlog

terra_27 cites a GO its own text records as dead: establish disposition of what was applied

TERRA-72 terra Canceled

The citation gate checks tag SHAPE, never tag REALITY: a well-formed invented token passes exactly as a genuine one does, and reads to a human as a real citation

TERRA-69 terra Done high

Reason codes assert the data is wrong and terra has no correct-or-retire path for a cirugia: TERRA-55 risks showing staff a fault they cannot act on

TERRA-56 terra Done high

appEvents is now a HARD DEPENDENCY of two terra user actions: a rejected INSERT rolls back the state change, and the constraints live on a shared table the co-tenant can alter

TERRA-70 terra Backlog

Three shipped comments disagree on whether terraCirugias has rows, and /administrar's stated purpose depends on the answer

TERRA-65 terra Done low

Does the shipped citation gate accept unverifiable prose? TERRA-63 checked presence, TERRA-64 checked reality, nothing has checked the checker

TERRA-67 terra Done

terraModulos has the same zero archive coverage and the same integer-PK wall as terraCirugias, and is the second half of the population TERRA-66 measured

TERRA-68 terra Backlog low

Vocabulary-table archive-on-UPDATE: terraCirugias has an INTEGER PK against a uuid NOT NULL sink, so the generic archive function cannot be reused and the sink assumption itself is in question

TERRA-66 terra Todo high

Citation currency audited across 31 applied migrations: terra_27 CLEAN, terra_16/17 unverifiable-by-construction

TERRA-64 terra Done

Comment notification quotes empty-content comments and fires on aprobado practicas

PLUTO-703 pluto Backlog

Participant-change panel unreachable from the student surface (/mi-cursada/[id])

PLUTO-702 pluto Done

Shared DB eprpywqwzsvrjeaforei has ZERO backup coverage: free plan, backups list empty, PITR off, no dump machinery on either tenant

TERRA-7 terra Blocked urgent

The push gate never sees a new migration unless a human names it in a test: only terra_16 and terra_19 are read

TERRA-63 terra Done low

push-scope-guard write-side recovery tooling (captured-index disentangle)

EVO-87 evolutiva Backlog

Rename portal module to portalPen + give the empty state a next action

ENAMEL-25 enamel Done low

portalPen: staff triage surface (read, answer, assign, resolve tickets)

ENAMEL-20 enamel Done high

soporte-action agent CLI was DEAD: three route/client drifts on the headless support path

VENUS-373 venus Done high

└─ Smoke test: exercise scripts/soporte-action.ts against the live support-action contract

VENUS-374 venus Done low

Admin action: agregar participante omitido a una practica fuera de la ventana de 48h

VENUS-372 venus Backlog

A production import is evidenced in the DB while the tool that performed it exists only on one disk, unversioned

TERRA-62 terra Done

An unconfirm reason routes nowhere: the client states a correctable fact and no terra surface shows it to anyone who can correct it

TERRA-55 terra Done

callback route.ts:270 redirects to /login?error=auth with no finish(): a login rejection landing that writes no signInCompleted row at all

TERRA-61 terra Done

Raise with applog-listen.ts owner: refuse startup when co-tenanted DB has APPLOG_APPKEY unset

TERRA-25 terra Done high

login:no-profile logs a correct denial at warn on every unregistered visitor: per-code severity or a traced benign arm

TERRA-39 terra Done low

Demote trigger-gated content out of terra-commons into a lazy-loaded detail file: auto-loaded footprint measured ~34K against an 8K budget

TERRA-60 terra Done

Failed access request told the user nothing: generic toast invited a futile retry with no sign the request was not registered

TERRA-41 terra Done

A successfully filed access request notifies nobody: COORDINATION_GROUP is null, so the success-path promise has no transport

TERRA-59 terra Blocked

terraCirugias hard-delete ban applied; archive-on-UPDATE ruled NOT TAKEN on redundancy with re-open conditions recorded

TERRA-58 terra Done

Permanent pool-identity read: current_user to appEvents at cold start

TERRA-14 terra Done

TERRA-43's chokepoint coverage claim outlives the chokepoint: TERRA-52 makes logger.ts a non-sole writer

TERRA-54 terra Done

Client cannot confirm a cirugia: isConfirmedByClient has 3 readers and no writer, and it blocks every guard on the empty population

TERRA-52 terra Done high

terraCirugias is deliberately unguarded as 'vocabulary, not clinical record' - TERRA-52 makes it carry a client decision and falsifies that premise

TERRA-57 terra Done

Probe marking is unavailable on non-error rows: markSynthetic needs errorMessage, and detail.synthetic is explicitly not the marker

TERRA-53 terra Backlog low

PKCE exchangeFailed on first sign-in: instrument shipped, population gone, unresolved between two lanes

TERRA-51 terra Backlog

Stale bare-name GUC reference in db/specs/appevents-pruner-design.md, deliberately excluded from a621cb6 to avoid sweeping another lane's uncommitted work

TERRA-49 terra Done low

Login reliability: PKCE exchangeFailed on first sign-in, plus no actionable message on wrong-Google-account

TERRA-18 terra Done

Terra's 45 guard triggers are all tgenabled='O': one SET session_replication_role='replica' disables the entire guard suite

TERRA-47 terra Done

No instrument distinguishes noProfile wrong-account from genuinely-unprovisioned: both carriers falsified

TERRA-50 terra Backlog low

Archive-context GUCs are bare shared-namespace names (app.user_id / app.archive_reason): rename agreed in terra_13, never scheduled

TERRA-33 terra Done

Guard-inside-try scanner skips any actions module with more than four lines above its directive

TERRA-44 terra Done

db/specs/appevents-pruner-design.md:90 still names bare app.user_id GUC, stale since terra_23

TERRA-48 terra Canceled low

Write the accepted service_role/postgres mutation exposure into terra-commons: appEvents append-only and no-hard-delete are CONVENTIONS, not table properties

TERRA-9 terra Done

└─ Watcher on db_schema for eprpywqwzsvrjeaforei: the only control over a fleet-token-writable value gating service_role HTTP reach

TERRA-35 terra Done high

db/export-schema.sh: extend snapshot beyond public schema (13 non-pg_* schemas)

TERRA-12 terra Done

TEMP describe smoke 2

BWI-48 basquetwi Canceled

DELETE/TRUNCATE-class guards stay 'O' (21 triggers, all 12 tables): ENABLE ALWAYS traded away on purpose

TERRA-34 terra Done low

TEMP describe smoke test

BWI-47 basquetwi Canceled

Support-ticket surface fails the agent-operable directive: mutation and thread capabilities are MISSING, not merely auth-unreachable

TERRA-36 terra Blocked high

appEvents context columns exist and terra writes none of them (sessionId, userAgent, ip, requestId, traceId)

TERRA-27 terra Done

TEMP unblock smoke test

BWI-46 basquetwi Canceled

appEvents immutability guard is disarmed by a BARE shared-namespace GUC (app.bypass_appEvents): TERRA-33 does not cover it and closing 33 must not read as closing the class

TERRA-45 terra Done

Lint guard: ban runtime-derived origins in auth paths (never built under TERRA-21)

TERRA-32 terra Done

withAction presence checks read raw text: a comment mentioning withAction excuses a module that never calls it

TERRA-29 terra Done

Terra applog rail: failnotify propagation gap - both shared template units lacked OnFailure=, and the notifier that fixed it was an unbounded emitter with an inert label

TERRA-26 terra Done

appEvents 48h silence is no-traffic, not a broken writer: terra and enamel writers each proven by emitting through the ordinary app path on the current build

TERRA-42 terra Done

signInCompleted's 8 unattributed rows are outcomes with no resolvable users row, not a call-site gap: 13/13 authorized attributed, so TERRA-23 needs no coverage bound

TERRA-30 terra Done

enamel_031's NOT NULL no-default on shared supportTickets broke requestTerraAccess for 9 minutes: zero eligible callers, nobody hit it

TERRA-40 terra Done urgent

sendWelcomeEmail is dead code — a welcome email the product believes it sends and has never sent once

VENUS-335 venus Done

inviteTitular alreadyExisted branch asserts a successful welcome-email send regardless of emailSent

VENUS-334 venus Done

TERRA-19 instrument fires once per bucket from the Server-Component path via console.error, proven by injected unit + build only: Vercel capture NOT established

TERRA-24 terra Done

Support-ticket agent-operability: bearer create op (actorUserId fail-closed)

VENUS-371 venus Done

pnpm test glob was directory-enumerated and depended on authors remembering to widen it: latent, no committed test was ever skipped

TERRA-38 terra Done

Shared support tables have zero DB-side access control: no RLS, owning role, cross-tenant with terra

ENAMEL-28 enamel Backlog high

First terra applog digest triaged: no terra defect - login:no-profile is a separate toast sink, PKCE loss was Supabase JS's own verifier storage

TERRA-37 terra Done

Agent-operable ticket API: REST handlers over /soporte, single auth definition

ENAMEL-27 enamel Blocked high

Session dies mid-session on read-only navigation ~1h after login

TERRA-22 terra Blocked high

db:export silently depends on unset DATABASE_URL, only DATABASE_URL_DIRECT is populated

PLUTO-701 pluto Backlog low

Dead component image-upload-area.tsx + stale provenance comment referencing it

MARS-649 mars Backlog low

Práctica editor: bare file input, students cannot find how to add radiografías

MARS-647 mars Done

applog-pull zero-row path skips writeWatermark — permanent cold-start gap

VENUS-370 venus Backlog

Support-agent registry + atomic assign/list-budget functions for support-API

MARS-648 mars Backlog

applog-pull P0: category vs categoryValue + missing tenant-gate on shared DBs

VENUS-369 venus Done

Práctica edit-quota lock burns a slot on tab-abandon, not just on save

MARS-646 mars Backlog

Solicitar eliminación reads as text, not a button

MARS-645 mars Done

Profile-photo nag: upload starts on file select (27-student required-field friction)

MARS-643 mars Done

Pasart account blocked: no address, no name available

TERRA-6 terra Blocked

Raise coder/coder02/db/db02 auto-compact window to 400k (CLAUDE_CODE_AUTO_COMPACT_WINDOW in each agent's own .claude/settings.json)

MARS-644 mars Done high

Actuator tiers must be per-agent-window: scale absolute gates (HARD_NUDGE_K/HARD_COMPACT_K, quarantine) by each agent's own CLAUDE_CODE_AUTO_COMPACT_WINDOW instead of assuming one fleet window

OPS-128 agent-ops Done high

Support-ticket API parity - create/triage/status ops + list read, no UI-only actions

PLUTO-700 pluto Backlog high

Terra hard-delete guard coverage: archive ledger, 4 clinical detail tables, counter

TERRA-10 terra Done high

terraPacienteImplantologia: patient-clinical table with deletedAt and apparently no archive trigger on any mutation

TERRA-31 terra Done high

Detail-table UPDATEs bypass both archive triggers: clinical content overwritable with zero trace

TERRA-28 terra Done high

Lezama context/token telemetry -> venus canonical store

ONEDB-16 one-db Backlog

TERRA-22 screening instrument: inter-login interval near 60min on signInCompleted

TERRA-23 terra Done

Lint guard: ban runtime-derived origins in auth paths

TERRA-21 terra Done low

server.ts swallows cookie-write failures on a safety condition (middleware) that does not exist in terra

TERRA-19 terra Done

Venus-consolidation: unified service on host venus for Vercel/Supabase background work

EVO-86 evolutiva Backlog high

Mars OAuth redirect_to bypasses resolveSiteOrigin() + 3 uncanonicalized prod hosts (TERRA-20-derived)

MARS-642 mars Backlog high

OAuth redirectTo pinned to validated canonical origin (was window.location.origin)

PLUTO-699 pluto Backlog

Unprotected .vercel.app project alias serves the full production build, and is the PKCE-mismatch mechanism

TERRA-20 terra Done high

roster.client_version empty for 31/46 agents - version drift is unmeasurable fleet-wide

MSG-292 llmmsg-srv Backlog low

AUDIT dropbox-orphan-sweep.sh (registry row 116): what it deletes, how it fails

OPS-127 agent-ops Done high

ACK_OPENER_RE gate and kpi-coach receipt exemption disagree

MSG-288 llmmsg-srv In progress

Disambiguate 'rectificar:pending' vs 'rectificar-nudge' feedbackKeys (observability trap)

MARS-641 mars Backlog low

Load-failed class: capture visibilityState + nav-in-flight at throw time

MARS-640 mars Backlog low

estadisticas: split materia-level stats (Endo I vs Endo II)

MARS-638 mars Canceled

Split Endodoncia I vs Endodoncia II on /estadisticas (materia as reporting dimension)

MARS-637 mars Done

estadisticas: dead outlier-detection rule, never fires (since MARS-193)

MARS-639 mars Backlog low

AI357EF/EG/EH figuran en Alta en la app pero RUTAP cerro todas sus filas el 13/08

MOVILBA-44 movilba Backlog

Interno desactualizado en 2 vehiculos: AB674IP y AF106VS no coinciden con el SSOT de RUTAP

MOVILBA-43 movilba Backlog high

Pulldowns de filtro desde catalogo opciones, no hardcodeados

MOVILBA-41 movilba Done

Refactor: historial de vehiculo pasa a log append-only con workflow (reemplaza el parche de forzar Otro)

MOVILBA-42 movilba Backlog high

└─ vehiculo_historial: no hay columna que diga cual es la fila vigente - borrado_en y creado_en estan sobrecargados

MOVILBA-12 movilba Backlog

Importador RUTAP: el scan de contaminacion cubre solo NBSP (1 de 5 clases) - detectar y reportar, nunca auto-corregir

MOVILBA-40 movilba Backlog

Calidad de dato en expediente / expediente_baja de vehiculo_historial: el campo no esta tipado (5 poblaciones medidas)

MOVILBA-39 movilba Backlog

└─ Cadena de expedientes RUTAP: 152 bajas cuyo expediente no es el alta del tramite siguiente

MOVILBA-38 movilba Backlog low

└─ Tramite duplicado en vehiculo_historial: 7394 y 7400 (AD956UK) misma fecha de alta y de baja

MOVILBA-37 movilba Backlog low

MOVILBA-34 parte 2: llevar expediente_baja a PROD (DDL + vista) y backfillear 2440 filas cerradas desde RUTAP

MOVILBA-36 movilba Done high

Modelo historial: falta columna expediente_baja (el numero de baja no tiene donde ir)

MOVILBA-34 movilba Done

vehiculo_historial: una sola columna expediente - el expte de BAJA no tiene donde ir

MOVILBA-35 movilba Canceled

Catalogo vehiculos_subtipos_transporte con descripciones duplicadas activas

MOVILBA-33 movilba Backlog

PROD debe ser copia del sqlite de RUTAP (v_rutap_latest)

MOVILBA-13 movilba Backlog urgent

└─ CARGAR 6: 131 dominios cerrados en RUTAP nunca importados

MOVILBA-19 movilba Done

└─ REACTIVAR 11: 1 dominio soft-deleted en prod y vigente en RUTAP (PMH988)

MOVILBA-24 movilba Done high

└─ BUG: normalizar_dominio borra minusculas en vez de normalizarlas

MOVILBA-27 movilba Done high

└─ CORREGIR 13: 8 dominios con mas de una fila en vehiculos

MOVILBA-26 movilba Done

└─ CORREGIR 7: 2 celdas ################ visibles en el export de Eugenia

MOVILBA-20 movilba Done high

└─ CORREGIR 8: linea 945 duplicada en prod

MOVILBA-21 movilba Done

└─ HARD DELETE: 20 entidades de prueba + linea 945 id 176

MOVILBA-32 movilba Done high

└─ Reclasificar los 12 pares de operador real que MOVILBA-17 dio por historia legitima sin medirlo

MOVILBA-31 movilba Done

└─ PROD desactualizado: Atlantida asignada a linea 945 cerrada, RUTAP la tiene en linea 0

MOVILBA-29 movilba Canceled high

└─ Relleno '0' textual en id_adas / ip_mdvr / ip_canbus: 2012 celdas, cero NULLs en prod

MOVILBA-30 movilba Backlog

└─ CARGAR: 4 dominios EN SERVICIO ausentes de prod (PMH988 NO entra, va en MOVILBA-24)

MOVILBA-18 movilba Done urgent

└─ DEFECTO: mismo texto de chasis mapeado a dos chasis_id distintos

MOVILBA-28 movilba Canceled high

└─ ASIGNACIONES: diff bidireccional prod <-> sqlite

MOVILBA-17 movilba Canceled high

└─ VEHICULOS: diff bidireccional prod <-> sqlite

MOVILBA-16 movilba Canceled high

└─ LINEAS: diff bidireccional prod <-> sqlite

MOVILBA-15 movilba Canceled high

└─ ENTIDADES: diff bidireccional prod <-> sqlite

MOVILBA-14 movilba Done high

└─ CORREGIR 12: clase F, conflictos reales campo a campo

MOVILBA-25 movilba Backlog high

└─ CORREGIR 9: diff a nivel de campo de los 2260 dominios que matchean

MOVILBA-22 movilba Done high

└─ CORREGIR 10: importador debe ingerir altas recientes y filas cerradas

MOVILBA-23 movilba Backlog high

refs-only verification: parent event body

BWI-45 basquetwi Done

llmmsg-reconcile.sh: populate detail (RECONCILE_NOTE) + name agent in invoked_by

MSG-291 llmmsg-srv Backlog

TEST announce ref 1786684174

BWI-44 basquetwi Done low

Endo I clinical scope restriction (client-approved quote)

MARS-636 mars Done

PKCE callbackExchangeFailed: add benign-vs-attack discriminator (volume-gated, no action yet)

PLUTO-698 pluto Backlog low

Standardize /alumnos filters onto the shared URL-param filter pattern

MARS-635 mars Backlog

Shared D/M/Y date control: digit caps + auto-advance

MARS-634 mars Done

Add rominasseron@gmail.com as Endo I test student (Seron Estudiante Prueba)

MARS-633 mars Done

Load-failed suppress order reverted after audit BLOCK:1462817

MARS-632 mars Done

agent-sleep.sh: bind exit consent to session identity, not just ack freshness

MSG-290 llmmsg-srv In progress

Hub must not return a success that asserts more than it verified (ok:true vs delivered)

MSG-285 llmmsg-srv Done high

└─ Wedged/booting session is electable as PM and can be handed the queue flush (register fakes liveness)

MSG-289 llmmsg-srv Backlog urgent

Copia de datos dev->prod (dev SSOT) - ejecutada, falta purga de archives

MOVILBA-11 movilba In progress

Review-depth pilot infrastructure (classifier + tests)

MARS-631 mars Done

Hub: widen CONTACT_ALIAS to an exact-match alias set for the human (8 senders/7d fail to reach him)

MSG-281 llmmsg-srv Canceled

ACK_OPENER_RE vs kpi-coach receipt exemption: one intent, two definitions, no shared SSOT

MSG-284 llmmsg-srv Canceled low

kpi-coach rubric: Rule 9 to cover lock TAKEN/RELEASED banners + N-separate-DM fanout as a structural-fanout sub-case

MSG-283 llmmsg-srv Canceled

Hub response contract: ok:true must not assert more than was verified (pm_pending_queue unbounded + resolved_pm null on reroute)

MSG-282 llmmsg-srv Canceled high

kpi-coach rubric: cover lock banners + N-separate-DM fanout

MSG-287 llmmsg-srv Backlog

Author CONTACT_ALIAS spec

MSG-286 llmmsg-srv Backlog low

Declare maxDuration on /api/image, then set fetchImage timeout bound from sampled data

PLUTO-697 pluto Backlog

fetchImage needs AbortSignal.timeout, bound picked from Pluto's own latency data

PLUTO-696 pluto Backlog

Pool saturation makes its own telemetry unreliable (partial evidence during incidents)

PLUTO-695 pluto Backlog low

No test script in package.json; vitest unresolvable via pnpm exec

PLUTO-694 pluto Backlog low

Grading-path notification+email both lost on pool timeout (Class-A)

PLUTO-693 pluto Backlog

JTP bell notification lost on práctica-create pool timeout

PLUTO-692 pluto Done low

logCaughtError drops error.cause — every caught fetch failure is un-attributable

PLUTO-691 pluto Backlog

Bound uploadImage/deleteImage timeout (data-driven, not guessed)

MARS-630 mars Backlog someday

image-proxy fetch-failed: capture target host + err.cause/code in catch for attribution

MARS-343 mars Done

User + group administration: no UI exists, every grant is a hand-written DB row

ENAMEL-22 enamel Blocked high

Live schema and db/migrations have drifted: full both-directions inventory needed

ENAMEL-26 enamel Backlog high

App shell: no navigation, no sign-out, single-branch redirector

ENAMEL-23 enamel Done

Access-request form: /solicitar-acceso is a dead end, accessIssueReports never written

ENAMEL-21 enamel Done high

Historia clinica: the stated initial focus, zero app surface, pacientes table empty

ENAMEL-24 enamel Backlog

Widen or stop truncating toast feedbackKey so distinct validation messages don't collide

MARS-629 mars Backlog low

404 classifier: preview-crawler traffic is a third class, decide handling

PLUTO-690 pluto Backlog low

Friction dashboard: scanner 404s at warn tier were 45% of user friction

PLUTO-689 pluto Done

logEvent: internal-probe UA suppression only covers 13/234 call sites, not fleet-wide

MARS-579 mars Done

Opportunistic compliance: rename tipoDocumento/numeroDocumento -> documentoType/documentoNumber (entity-first) on users + accessRequests; confirm stored value stays lowercase 'dni'/'pasaporte' (Mars already correct)

MARS-406 mars Backlog

Standing audit: nextjs/nodejs → Postgres pushdown — find Node-side aggregations/filters that should be DB views/functions, refactor opportunistically

MARS-247 mars Backlog low

claudia-pensanta-com fails lint on pre-existing no-explicit-any errors

WEBSITES-17 websites-tools Backlog low

Four static sites lack a footer version span, blocking gitpush

WEBSITES-16 websites-tools Backlog low

hormigonacero.com.ar ships no analytics tag at all

WEBSITES-11 websites-tools Done

Hub: generalise rail-sender prune exemption from name regex to push-only-producer property (held diff, awaiting audit)

MSG-280 llmmsg-srv Backlog

Decide hosting for the new websites-tools git repo

WEBSITES-2 websites-tools Done high

Most sites have no GA4 property at all (16 of 49 covered)

WEBSITES-8 websites-tools Deferred high

No backup agent exists for the websites lane (backupState=tbd)

WEBSITES-5 websites-tools Done low

Decide whether gsc-reports/ should be git-tracked per site

WEBSITES-15 websites-tools Backlog low

139 restored report files sit uncommitted; 27 folders have no recovery path

WEBSITES-14 websites-tools Backlog

Add venv self-bootstrap to the remaining agent-callable scripts

WEBSITES-13 websites-tools Backlog

Docs reference the pre-reorg tools/ path layout

WEBSITES-7 websites-tools Done low

SA cannot reach the ElazarPimentel GA4 account (accounts/290433681)

WEBSITES-12 websites-tools Done low

Grant service account GA4 Administrator on all three accounts

WEBSITES-10 websites-tools Done high

Three GA4 properties exist for elazarpimentel.com

WEBSITES-9 websites-tools Backlog low

Audit GA4 properties configured in the UI but missing from ga4-property-map.json

WEBSITES-3 websites-tools Done

marcelosblancoycortinas-com-ar holds GSC reports but is not a git repo

WEBSITES-6 websites-tools Backlog low

Maintainer registry rows for admin-websites-cc not yet inserted

WEBSITES-4 websites-tools Backlog

google-ads-report.py fails on Google Ads API v23

WEBSITES-1 websites-tools Backlog

Alert windows that straddle a host reboot are reported as agent faults: no-statusline duration spans downtime the process did not exist for

OPS-126 agent-ops Backlog

Agents running outside tmux are silently uncoverable by the actuator: no statusline to read, no pane to keystroke, no alert (pm-llmmsgsrv-cc at 76.4% uncovered right now)

OPS-125 agent-ops Backlog high

context-monitor.sh reports stale ctx for idle whey agents: frozen transcript pins them at >=180k for hours (OPS-11 residual, action gated but read still wrong)

OPS-124 agent-ops Backlog

cc-context-monitor last_turn() v2.14 residual stale-read: agent force-compacted 'for no reason' every other session. Verified 2026-06-09 nw-whey-cc reported 184k while live /context=63.6k (3x phantom). last_turn (~line 312) reads transcript's last usage block = summarizer's pre-compact cache_read until next real turn; compact_boundary reverse-walk skip has a hole (boundary outside TAIL_BYTES, or pre-compact reading sampled in the gap before boundary written). Fix: gate actuator on LIVE window occupancy, not stale transcript estimate. NOT a cap problem - do NOT bump nw ROLE_CAP (Elazar explicit). Recurring user-facing churn.

OPS-11 agent-ops Done high

CronCreate /compact unreliable in never-idle loop: past-dated one-shots persist as zombies (363-day timer), monitor DM injection prevents REPL idle — path-B prose /compact is inert

MSG-89 llmmsg-srv Done high

PM-liveness watchdog: cc-context-monitor detects a PM-less ARO, DMs Elazar

OPS-55 agent-ops Blocked high ↳ OPS-54

tick.py execute() is sequential: one slow agent blinds the whole roster and delays post-nudge escalation (2.5min measured)

OPS-106 agent-ops Done high

MARS-69 friction digest: id-bearing routes never clear minimum-volume floor

MARS-626 mars Done low

sessionOnce dedup missing on 2 nudge sites (edit-form.tsx:1020, review-form.tsx:305) - remount re-logs same friction key

MARS-625 mars Done low

Pendientes revisión: unit mismatch on /alumnos KPI row (counts prácticas, not alumnos)

MARS-623 mars Done someday

Disposition 13 unproven ayudante-slot holds (SOP-MARS-41 follow-up)

MARS-622 mars Done low

Commanded /compact does not land: 3 agents measured unverified in one pass, root cause unknown

OPS-107 agent-ops Backlog

to:[] multi-DM array path never inherits re= parent origin_aro

MSG-279 llmmsg-srv Done high

Post-compact state is structurally unmeasurable: 0k filter hides landed compacts, so compact_unverified fires on successes

OPS-112 agent-ops Done high

Rule 3 silence-default violations

MSG-278 llmmsg-srv Backlog

Rule 9 dossier-dump-inline detection

MSG-277 llmmsg-srv Backlog

No regression guard on the idle classifier: a ghost-vs-typed inversion caused a silent fleet-wide coverage outage

OPS-123 agent-ops Done high

Stuck-busy alert has no known-wedged latch: re-fires every 6h forever with no escalate-once path

OPS-122 agent-ops Backlog

Stuck-busy agents leave coverage silently: unsubmitted prompt text pins idle=false, 14h measured uncovered, no alert

OPS-116 agent-ops Done high

abr:ss attribution false-negative: fast responders fail the text_in_pane visibility test

OPS-121 agent-ops Done high

nudge_pending_since consumed on decide, not on confirmed exec: an aborted escalation can shut all four triggers

OPS-108 agent-ops Done high

Right-size event_log telemetry retention: 7d raw is ~800MB steady state, gates_evaluated JSON is a third of it

OPS-120 agent-ops Backlog

Decide and execute: context-monitor.sh --drain path + its timer are undocumented, possibly dead

OPS-119 agent-ops Backlog low

Retire-vs-cutover: context-venus-monitor-alert.sh is a dormant duplicate of the live context-monitor-alert.sh

OPS-118 agent-ops Backlog low

cumulative_usage() lacks the id-dedup token-usage-collect.sh has: my cumulative token numbers overcount streamed turns

OPS-117 agent-ops Backlog

Persist-marker latch: PRE-COMPACT PERSIST re-asks an agent that already replied DONE-NO-DELTA (4 confirmations, needs agent_state migration + cross-rail state)

OPS-115 agent-ops Backlog high

Reclassify rectificar:pending nudge-shown (mi-cursada/page.tsx) warn->info, MARS-611 gap

MARS-624 mars Done low

Copia staging->dev de vehiculos: dev arranca de cero con datos reales

MOVILBA-1 movilba Done high

└─ Anuncio en aro:mba-l + modo mantenimiento en dev

MOVILBA-4 movilba Done

└─ Verificacion post-carga

MOVILBA-7 movilba Done

└─ Secuencias (trampa 23505 de archive)

MOVILBA-6 movilba Done

└─ Carga transaccional

MOVILBA-5 movilba Done

└─ Ensayo de rollback

MOVILBA-8 movilba Done

└─ Backup dev-before + checksums

MOVILBA-3 movilba Done

└─ Preflight: probar que los esquemas son identicos

MOVILBA-2 movilba Done

└─ Purga de logs fresh-start (app_logs + audit_log)

MOVILBA-9 movilba Backlog

vehiculo_historial.estado_id sin poblar en prod y dev, poblado en staging

MOVILBA-10 movilba Done low

Admin can create a support ticket on behalf of another user

MARS-609 mars Done

VENUS-367 — telemetry delivery-health: failed friction writes are indistinguishable from zero friction

VENUS-367 venus In progress

VENUS-365 — approveAccessRequestAttach threw on every non-alumno attach: alumnos has no id column

VENUS-365 venus Done

VENUS-366 — schema-contract guard: SQL column references are unchecked, 6 signatures have reached prod since May

VENUS-366 venus Done

Telemetry delivery-health signal (friction-write swallow)

VENUS-368 venus Canceled

VENUS-363 — solicitud padron badge: false no-match on staff requests, collapsed negatives, raw role codes

VENUS-363 venus Done

VENUS-364 — dedup 8 copies of the role-label map onto practica-roles.roleLabel()

VENUS-364 venus Backlog

Operator-alert attempt ceiling (3.5s) sits below the SMTP transport's own connect timeout (10s) — races away connections that would have succeeded

PLUTO-688 pluto Backlog high

Edge-Instrumentation bundle pulls email.ts's node:crypto — operator alert leg cannot run on an edge-runtime 500

PLUTO-685 pluto Done

Comisión-remainder section is read-only but canGradePractica permits grading it — affordance and permission disagree

PLUTO-687 pluto Backlog low

Schema-qualify the six unqualified fn call sites landed in orphan slices C and D

PLUTO-686 pluto Backlog low

P0: fn_insertSupportTicket ambiguous id column broke all support-ticket creation

PLUTO-677 pluto Done high

primaryRoleId column-write invariant: remove direct writes + real enforcement

PLUTO-669 pluto Backlog low

Email drain: kill ~288/day cron no-ops (Tier 0 EXISTS-guard) + DB-native trigger-wake (Tier 1)

EVO-70 evolutiva Done high

Verify auth-actions.ts:1572 .email compare without canonicalizeEmail is not a match gate

VENUS-283 venus Backlog low

isUuid rejects legacy deterministic seed UUIDs (non-RFC version/variant nibbles), false-404s comisión/other routes

PLUTO-578 pluto Done high

Mirror Lean Lane pointer into pluto-commons.md: one-line pointer to evolutiva-pm-commons.md §Lean Lane (canonical SHA 40b1beb, fleet-adopted 2026-06-30); do NOT fork full text (drift risk). Class-S docs (single-file/reversible/security-inert) -> coder --patch. Bundle into next pluto coder push, or standalone if none within ~24h.

PLUTO-460 pluto Done low

crearPracticaFailed INSERT column/value mismatch

VENUS-244 venus Done urgent

fn_notify_applog_err collapses all 404s into one signature bucket

VENUS-243 venus Done high

vOpenSupportTickets hardcoded-status drift risk

VENUS-242 venus Done low

Support ticket short human-readable reference (SOP-###) on /admin/soporte + /[id]. supportTickets has only a uuid today (LEAN schema, no ticketNumber). Add a STABLE, IMMUTABLE short-ref column assigned at insert (NOT row-order-derived — shifts on delete, breaks citability). Scheme TBD by Elazar (rec: SOP-<year>-<per-year seq> e.g. SOP-2026-007; alt: flat SOP-NNN). db: add nullable column (archive-fn to_jsonb expand-only NOT NULL trap — new cols on trigger-archived supportTickets MUST be nullable) + monotonic assignment (sequence or per-year counter) + backfill existing tickets in createdAt order; archive sentinel on the backfill. coder: use the ref as the detail-page title/reference, render as a self-link, add a 'copiar enlace' button copying the full ticket URL (https://evolutiva.pensanta.com/admin/soporte/[id]); also surface the ref as the link text in the /admin/soporte list. GATING: DB schema change -> audit pre-impl design-ping + pre-apply review on the migration + post-push PTD. SEQUENCING: touches support surface shared with PLUTO-444 (uncommitted support-actions.ts) — order to avoid collision. Blocked on Elazar's scheme pick.

PLUTO-449 pluto Done low

Rectificaciones fix: (A) DB sweep 10 stuck-rectificar comA practas to noRevisado, (B) exempt rectificar from review dedup so re-rectificar works, (C) Reenviada-tras-rectificar badge on noRevisado rows, (D) teacher notification email on student resubmit

MARS-316 mars Done high

Solicitudes de acceso: role (student vs teacher) not visually clear — Estudiante tag present but teacher-like fields (Cátedra postgrado, JTP/Ayudante) rendered alongside, confusing reviewer

MARS-315 mars Done high

WI#431 follow-up: cron digest route.ts:57 JOIN on lookupOptions missing AND lo."deletedAt" IS NULL per §Soft-Delete spec (audit flagged in -36761, non-blocking, 1-line fix)

MARS-313 mars Done low

Ayuda y Soporte: in-app support-ticket flow — global FAB + Dialog + supportTickets table + internal-email notify Elazar on creation + Vercel cron hourly digest DM to PM + watchdog open-count poll (per Elazar -36580 + pm-mars-cc design -36593)

MARS-312 mars Done high

SCANNER_PROBE_RE expansion: infra/cloud/backup/profiler probe families (A-F). 07:32 UTC sweep = 98 distinct post-cutover warn paths uncovered by 450/451 (k8s/docker/helm YAML manifests, cloud-cred JSON, terraform state/vars, SQL dumps, archives, profiler/heapdump, cred dotdirs). Audit collision-proven 98/98 coverage, 0 route collision (69 templates), 0 benign false-pos. Down-tier to silent security/info (no page, force-retain). Pluto-canonical; mars/venus inherit. Decisions: ADD families A-F + archives(.zip/.tgz/.tar.gz) + exacts /dump /trace /logfile (whole-path). HOLD /credentials (app-plausible, under-evidenced) + .bak/.backup JSON (under-evidenced). Anchor discipline: cred dotdirs (^|/) any-segment; bare-ext OK ONLY where Pluto serves zero (yaml/sql/tfstate/zip); .json stays filename-anchored (442 ban). Gates: audit pre-push diff + PTD live-probe.

PLUTO-453 pluto Done low

errscan.sh digest mislabels signature-rollup occurrence count as a per-path count -> false per-path warn spikes (e.g. 'page_not_found x42 @/email/sendgrid.env' when that path has 2 rows; 42 = aggregate env-shape warn occurrences across N paths under one message-derived signature). Lane 1 (bin-whey, errscan.sh ~L244/L309): relabel so count reads as signature rollup + path as a SAMPLE ('[42x total] page_not_found e.g. action=/email/sendgrid.env'). Lane 2 (per-project db: vAppAlertsRecent/vAppErrorsRecent): expose distinctPaths so display can render '42x / 7 paths'. Affects all 3 apps (shared errscan + EVO-12 scanner down-tier shape). Triage-noise only, no data/security. Low-pri.

EVO-46 evolutiva Backlog someday

OPTIONAL cosmetic: converge SCANNER_PROBE_RE env alts to the single fleet-canonical literal. Pluto's live v1.95.3 form is two alts (/\.env(?:$|[./~0-9_-])/ + /(^|/)env(?:$|[./~0-9_-])/), audit-proven coverage-EQUIVALENT (in fact a superset) to the published fleet canonical /(^|/)(?:[\w.~-]*\.env|env)(?:$|[./~0-9_-])/. ZERO coverage change — purely so the canonical-owner's code is byte-identical to the SSOT it publishes (cleaner mars/venus cloning + future audits). NOT worth a dedicated deploy: ride-along ONLY on the next touch of not-found-classify.ts. Audit adjudicated 2026-06-29.

PLUTO-452 pluto Backlog someday

SCANNER_PROBE_RE env-file shape gap: dotless env.* + *.env suffix probes leak to warn (PLUTO-450 sibling). 06:22 UTC 2026-06-29 sweep (27 events) = /env.txt /env.old /env.backup (dotless env. prefix) + /<prefix>/sendgrid.env /backend|src|app|email|mailer/sendgrid.env (env SUFFIX). Current /(^|/)\.env(?:.)/ alt requires (^|/) immediately before .env, so it catches .env + nested /.env ONLY — misses env.<ext> (no leading dot) and <name>.env (suffix). All 404 (benign, no creds served). Fix = evidence-driven broadening for the env-credential-file family; coder+audit design the exact alt(s) keeping anchor discipline + real-404-signal (route-collision test; Pluto has no /env.* or *.env route). Classification-only, security-tier. audit pre-push review (regex broadening = real-404 signal risk) + PTD.

PLUTO-451 pluto Done low

SCANNER_PROBE_RE: ROOT-anchored .git (and .aws) alts miss NESTED credential-dir probes -> leak to warn (446-sibling anchor asymmetry). Audit-confirmed: 03:38 UTC 2026-06-29 scanner burst = 26 distinct <prefix>/.git/config probes (/admin /api /app /assets /backend /blog /build ... /www) ALL warn/navigation; only root /.git/config + /wp-content/.git/config caught. Cause: not-found-classify.ts has /^\/\.git(?:$|\/)/ (root-anchored ^\/) while the correct sibling .env alt is (^|\/)\.env. FIX (one-char-class each, mirror .env): (1) /^\/\.git(?:$|\/)/ -> /(^|\/)\.git(?:$|\/)/ ; (2) ALSO /^\/\.aws\b/ -> /(^|\/)\.aws\b/ — structurally identical root-anchor gap on an existing credential alt; same scanner class nests .aws identically, so fix it in the same pass (PM call: structural-consistency, not speculative broadening). The (?:$|\/) boundary keeps .git to the DIRECTORY (still won't match /.gitignore). Collision test (audit pre-verified): zero — no Pluto route has a .git or .aws path segment; leading-dot segment is never an app/api route. Do NOT add .svn/.hg/.bzr (no alts exist, zero data — speculative). Benign-impact, all 404'd, no repo/creds served. Security-tier classification fix. gitpush --patch -> audit PTD (audit will fire a live nested-.git probe to confirm the down-tier).

PLUTO-450 pluto Done low

PLUTO-442 follow-up: SCANNER_PROBE_RE misses /.dev.vars (Cloudflare Workers/Wrangler local-secrets file) -> logs warn instead of the silent info/malicious tier. Confirmed by audit as the ONLY current-regex cred-probe gap (the 08:46 sweep's ~18 other cred shapes — .env+12 variants, .aws/credentials, secrets.json, config.json, .git/config|HEAD — all classify correctly). Add ONE anchored alt to the SCANNER_PROBE_RE array in not-found-classify.ts, mirroring the .env alt shape: /(^|\/)\.dev\.vars(?:$|[./~0-9_-])/ (covers .dev.vars + .dev.vars.production/.local siblings; NO speculative broadening per 442 discipline). Collision-test vs real routes (audit pre-verified zero — leading-dot segment matches no app/api route). Security-tier, benign-impact (all 404'd, zero exposure). Standard push->audit PTD.

PLUTO-446 pluto Done low

Investigate not-found capture-leg bypassing the scanner down-tier: at 06-28 01:28 paths that DO match SCANNER_PROBE_RE (/wp-content, /cgi-bin, /.well-known, /admin/controller/extension, /zup.php73, /randkeyword.PhP7) logged at warn/navigation, while IDENTICAL paths logged info/malicious at 01:40 + in the 08:46 sweep (same deploy, ~12 min apart). tierForNotFound down-tiers these path-only/any-referer BEFORE reason logic, so a warn outcome means those rows did NOT pass the SCANNER_PROBE_RE branch — consistent with a different persist leg (PLUTO-182 not-found capture-on-redirect emitting phantom rows that bypass the classifier). Coder read: does the capture leg run not-found-classify's down-tier, or persist warn directly? Benign-impact (rows retained) but a sliver of scanner hits intermittently page at warn. Relates to the routeResolves discriminator (pluto-notfound-capture-redirect-overfire). Low-pri.

PLUTO-447 pluto Done low

Benign SEO-crawler sitemap-probe 404 noise: a crawler walks sitemap filename variants (/sitemap_index.xml, /sitemap-index.xml, + a random catch-all-200 test token /_rNd9xZ7kL3) — all correctly 404 (Pluto is auth-gated, no public index surface) but log warn/navigation/page_not_found. Two-part: (1) decide the correct SEO posture — Pluto has nothing public to index, so likely robots.txt Disallow + NO sitemap is right (confirm whether /sitemap.xml exists/should); (2) down-tier benign sitemap/SEO-crawler probe 404s to info, mirroring ICON_PROBE_RE (3c10bb0) / SCANNER_PROBE_RE (PLUTO-442) in not-found-classify. EVIDENCE-GATE the down-tier: audit quantifies frequency over the applog digest/7d BEFORE implementing (per PLUTO-442 discipline + WELLKNOWN_BENIGN_RE caution against speculative benign-matcher broadening). Anchor only to exact sitemap filename shapes; the random token is NOT safely down-tierable. Low-pri.

PLUTO-445 pluto Backlog low

Minimize non-actionable PM DMs at the ALERTER (not just app-side rows). Each alert DM = a PM turn = tokens (Elazar 2026-06-29). Scanner-probe silencing cut the warn ROWS fleet-wide (PLUTO-450/453/454 + mars/venus), but the applog/errscan digest still DMs each PM per tick incl non-actionable warn/info lines. RULE: alerter DMs a PM ONLY on level=error/fatal OR a genuinely NEW/unseen signature; NEVER re-DM known silent-tier (info/security) scanner shapes or recurring-benign signatures. Two legs: (1) shared errscan digest (owner bin-whey-cc, ~L244/L309 PM-digest render + the source view predicate) suppress non-error/non-novel; (2) per-project applog-pull digest (each PM's project) same predicate. Fleet-wide; all 3 PMs align in aro:evolutiva-management. Distinct from EVO-46 (count mislabel) though same render path.

EVO-47 evolutiva Backlog high

SCANNER_PROBE_RE canonical addendum: bare /Dockerfile probe shape (no extension) — residual missed by PLUTO-453 A-H (all ext/dotdir/exact-token anchored). In 07:32 cross-app sweep (mars MARS-341 surfaced it), keeps warn-paging all 3 apps. Candidate literal (mars-proposed): /(^|\/)Dockerfile(?:$|[./-])/ — any-segment (scanners nest), boundary-bounded (covers /Dockerfile.prod /Dockerfile-dev /docker/Dockerfile; excludes /Dockerfilefoo). Pluto-canonical; mars/venus byte-align after. Gates: audit confirm Pluto post-cutover warn evidence + collision vs manifest + literal boundary review, then coder --patch ride + PTD live-probe (/Dockerfile -> silent security/info).

PLUTO-454 pluto Done someday

Audit student-facing counts for operador-vs-participacion conflation

VENUS-362 venus Backlog

SOL-VENUS-N human reference for access requests

VENUS-360 venus Done high

Quote SOL-VENUS-N in requester-facing access-request emails

VENUS-361 venus Backlog

weeklyReport es un kind sin fila: el reporte KPI semanal solo existe en vuelo y catchUp() no puede re-barrerlo — perdida silenciosa e indistinguible de una semana tranquila

PLUTO-682 pluto Backlog

resolveFrom honra cualquier SMTP_FROM_* seteado sin validar — Gmail re-estampa el From y el mail sale mal atribuido (ambas vars seteadas en prod)

PLUTO-681 pluto Backlog

setPersonaRoles: replace-the-set sin baseline — dos superficies de admin de roles se pisan silenciosamente y la atribución del archive queda mal

PLUTO-680 pluto Backlog

Mars backup-lane inventory for fleet registry + fix backup-db.sh EXPECTED_REF fallthrough

MARS-621 mars Done

Enumerate legitimate DB principals for Mars (fleet DB-hardening step 2)

MARS-620 mars Done high

venus-db-backup.sh: trash||rm precedence hard-deletes clinical dumps when trash exists and FAILS

VENUS-359 venus Blocked high

venus-db-backup.sh: prune glob spans plaintext+encrypted lanes, sharing one KEEP budget

VENUS-358 venus Blocked high

Enable log_connections (or equivalent) on Mars Supabase DB

MARS-619 mars Done high

Fleet DB-hardening directive — pluto leg (logging/principals/backups)

PLUTO-684 pluto Backlog

Consolidate Evolutiva backups into one performed/monitored/inventoried lane

VENUS-357 venus Backlog high

PostgREST pg_pgrst_no_exposed_schemas error fires every ~32s, drowning the venus postgres log

VENUS-356 venus Backlog

venus-db-backup.sh prune glob crosses lanes — retention 84 total not 84 encrypted; effective 6 days not 7

VENUS-355 venus Backlog

venus-db-backup.sh: trash-fails fallback hard-deletes (rm -f) instead of degrading safely

VENUS-354 venus Backlog

Shared push-tree same-file concurrent-edit handoff protocol

PLUTO-683 pluto Backlog low

OPERATOR_EMAIL || default hardening (email.ts:22)

PLUTO-676 pluto Done

Unattributed full-DB reader on venus Supabase project (~3/day, postgres role, incl. vault.secrets) — attribute or treat as compromise

VENUS-350 venus Blocked urgent

pm-triage-listen: rowless NOTIFY kinds (weeklyReport) silently dropped

VENUS-353 venus Done high

pm-triage daemon silently drops kind=weeklyReport from pluto kpi-report

PLUTO-520 pluto Done

Analyze visitor screen-size/device cohort (Vercel Web Analytics) → optimize Pluto layout/breakpoints to dominant cohort, VERIFIED vs actual distribution (telemetry directive bs-mqmscr4k3wh)

PLUTO-159 pluto Done

Harden práctica create/update/HC-fix actions against silent save failure (uncaught pool.connect + missing client try/catch)

PLUTO-679 pluto Done low

SOP-11: práctica de Maximiliano Otero cargada con nº de ficha incorrecto (real 86416), no le aparece ni puede editarla

PLUTO-678 pluto Done

Sweep for other per-request/standing-condition alerts that should use logEventOnce

MARS-618 mars Backlog low

Dedupe/downgrade users-list-overflow alert before it starts paging on every admin page load

MARS-617 mars Done

Fix /administrar/usuarios throwing past 500 active users - add server-side pagination

MARS-615 mars Done high

Restore column sorting on /administrar/usuarios (server-side, post-MARS-615)

MARS-616 mars Backlog low

Audit: session-trust paths vs isGenuineGoogleSession (auth-bypass check)

VENUS-304 venus Done urgent

Set up período/comisión/materia for Endodoncia I

MARS-613 mars Done

practicaCodigo format: add PRA-MARS- prefix

MARS-614 mars Backlog

Hide non-required fields + require Endodoncia I fields for Endodoncia I students

MARS-612 mars Backlog

Reclassify nudge-shown (MARS-600) from warn to info severity to stop real-time alert paging

MARS-611 mars Done

Reconcile 'principal' JTP checkbox on /docentes vs no-principal-JTP claim

MARS-610 mars Backlog

Add a main-JTP designation to comisiones

MARS-608 mars Backlog

SOP-MARS-39: período endDate silently blocked ALL práctica filing for 2026-1C-Grado cohort since 2026-08-01 (4-day undetected outage)

MARS-607 mars Done high

SMTP_FROM fail-closed (fallback removal)

VENUS-352 venus Done low

Materia-dimension migration 099/100: setActivePeriodo cross-materia blackout + createPeriodo missing materiaOptionId

MARS-606 mars Done high

setRoles() missing self-admin/last-admin lockout guard

MARS-604 mars Done

Make role->capability map DB-owned, or add a cross-layer drift guard (CAPS vs fn_admin_invariant_ok)

MARS-605 mars Backlog low

db-mars-cc: correct setArchiveContext GUC key for manual psql writes (app.user_id, not app.archive_actor_id)

MARS-603 mars Backlog low

users email-guard hygiene: normalizedEmail (app normalizeEmail) vs uq_users_email_ci (SQL canonicalizeEmail) disagree on 3 live rows; + duplicate index users_normalizedemail_unique == uq_users_normalizedEmail

MARS-566 mars Backlog low

login-email-drift-blocked: consider auto-sync email when supabaseAuthId sub already matches

MARS-602 mars Backlog low

SMTP host/port/secure validating resolver — replace the || default on the email-send path

MARS-601 mars Done high

Terra outbound mail: access-request notification (NOT migration terra_13 — that is TERRA-10's deliverable)

TERRA-13 terra Done high

Defense-in-depth: render-path requireCapForAction throw should render graceful acceso-denegado, not 500 + admin error-email storm (generic error-boundary / convert render-path cap checks to redirect variant). Surfaced by PLUTO-43 (dead-fetch was the trigger; this guards the class).

PLUTO-44 pluto Done

Historial de cambios rows appear duplicated (~4x) on practica change history; investigate root cause (view join fan-out / archive double-write / query) and fix at source - data should not be stored 4x

PLUTO-82 pluto Done

hub_send.py marker path was __file__-relative: correct only because the unit names the symlink, and it reported landed registrations as failures

OPS-114 agent-ops Done high

Idle prefetch used the 50% growth floor and compacted agents with 35pt of headroom (coder-pluto-cc at 51.2%)

OPS-113 agent-ops Done high

Foto de perfil obligatoria para alumnos + foto del alumno en la UI de corrección

MARS-600 mars Done high

Idle-path compact runaway: NULL growth baseline made every above-floor agent perpetually eligible (pm-terra-cc 8x in a morning)

OPS-111 agent-ops Done high

deletedAt on the four terra clinical detail tables (ruled 2026-07-31, not delivered by terra_13)

TERRA-15 terra Done high

Scheduled GoTrue config-drift check (cron/applog rail, alerts not blocks)

PLUTO-634 pluto In progress

Portal: accept 'venus' as a portal appKey scope tag + grant Puia client under venus

ENAMEL-17 enamel Done high

Move terra detail-table reads to active views + archive-context on detail soft-delete

TERRA-16 terra Canceled

SEC: portal server actions ungated - unauthenticated read of client queue

ENAMEL-18 enamel Done urgent

Repoint 5 remaining APP_URL fallback sites to resolveSiteOrigin()

MARS-599 mars Done high

cc-context efficiency report - read-only reporting layer on monitor-context.sqlite (week/day/48h)

OPS-60 agent-ops Backlog

context-monitor.sh 180k nudge DM promises a 220k injection that cannot happen under COMPACT_ACTUATOR=0

OPS-110 agent-ops Backlog

scan-context coverage alarm is permanent noise: Codex audit-*-ca panes have no CC statusline to read

OPS-109 agent-ops Backlog

supportTicketCounters has no guard - the instrument used to bound a disclosure incident is itself unprotected

ENAMEL-19 enamel Backlog

Stats glossary: footnote + tooltip explaining stat abbreviations in user-facing text

PLUTO-495 pluto In progress

Extend SCANNER_PROBE_RE with archive-probe family (/backup.tar|.7z|.rar|.zst|...) — 294 unsuppressed scanner 404s in one window

PLUTO-661 pluto Blocked

Remove inactivity-lifecycle source refs (auth/callback reset + poll-security-alerts user email routing) — PLUTO-627 code tail

PLUTO-628 pluto Done high ↳ PLUTO-627

Greenfield transactional email stack: dispatcher chokepoint, admission+egress guards, durable outbox

ENAMEL-16 enamel Backlog high

Add egress deliverability classifier at email-transport chokepoint (distinct from allowedEmailDomains admission gate)

PLUTO-674 pluto Backlog

appEvents has no success row for outbox-path email delivery

PLUTO-675 pluto Backlog

STRUCTURAL: /loop self-/compact over-cap workstream. Proven (Elazar 2026-05-21, ~28-30k ctx): a /loop session self-/compacts via ScheduleWakeup prompt /compact. Replaces cap->park->relaunch with cap->ss->self-/compact->continue. Gated on a ccs.sh launcher decision (ScheduleWakeup exists only in /loop-mode sessions) — needs Elazar GO. Separate from v2.7 over-cap path

OPS-51 agent-ops Canceled

Idle over-budget agents never self-compact: wire host-side actuator (whey/lezama)

MSG-207 llmmsg-srv Backlog high ↳ MSG-149

cc-context-monitor measured role-cap version (floor+EOQ headroom) - successor to #617 seed caps

MSG-217 llmmsg-srv Backlog low ↳ MSG-210

cc-context-monitor zombie-detector false-positives on reactive-idle agents: rule (turns>=2 && tool_calls==0 -> zombie) can't distinguish a self-armed-wakeup zombie from a reactive agent woken by inbound llmmsg DM that acked + stood down with no tools needed. At 05:00 it flagged audit-venus-cc (benign: empty CronList, zero ScheduleWakeup ever, 100% inbound-DM-driven) -> 2 dup alerts + cross-host investigation. Hits EVERY reactive agent (host nw between alerts, audit agents). Fix (nw-whey suggested): a wake is zombie-suspect only if NOT preceded by an inbound message in the window (self-triggered) AND/OR non-empty CronList; if wake correlates with inbound DM + empty CronList -> reactive-idle, suppress. Hub has inbound-msg timestamps to correlate. Related: OPS-11 last_turn stale-read.

OPS-17 agent-ops Backlog

cc-context-monitor over-cap caps are stale — false alarms fleet-wide. THRESH_OPUS=160k/HAIKU=100k/SONNET=135k are ~80% of the OLD ~200k-class windows. Fleet now runs claude-opus-4-7[1m] = 1M-token window; a 268k session is 27% full, not over cap. Transcript model string lacks the [1m] marker so monitor can't auto-detect window size. Fix: bin-whey-cc updates THRESH_* in cc-context-monitor.sh to real values per Elazar's decision (true-window fraction vs. relabelled cost-budget). All of 2026-05-21's over-cap wind-downs were triggered by this false cap.

OPS-53 agent-ops Blocked high

Schema-qualify 62 unqualified references in 24 function bodies (enamel_025)

ENAMEL-15 enamel Done

db/DR.md stale: restore steps assume plaintext .sql.gz from the dead pre-Jun-16 lane

VENUS-351 venus Done

Venus DB backup lane: executor unknown, last local dump 2026-06-16 — identify owner or declare backup-gap incident; fix db/README.md §Backup

VENUS-348 venus Done high

PostgREST empty-exposed-schema sentinel floods postgres log (~2700 ERROR rows/day) — silence or document

VENUS-349 venus Backlog

pg_temp search_path hardening across all enamel functions (A2 + 022 + 023A)

ENAMEL-14 enamel Done

6 userRoles call sites bypass soft-delete check -- role grant/revive + last-admin-guard defeat on deleted users

PLUTO-640 pluto Done high

URGENT: fix quoted search_path in mig 099/102 -- 33 functions broken, prod outage since 13:03 UTC

PLUTO-673 pluto Done urgent

Data API OFF is an unowned config that terra's pg_temp LATENT rating silently depends on

TERRA-11 terra Done high

Split shared app.bypass_immutable GUC per-guard (enamel half)

ENAMEL-13 enamel Done high

app-version route stale self-description — documents a stale-bundle-guard client that doesn't exist

PLUTO-663 pluto Done someday

userRoles_lookupOptionId_fkey accepts non-role lookupOptions (data pollution, not priv-esc)

PLUTO-672 pluto Done low

userRoles last-admin trigger missing ENABLE ALWAYS (replica-mode bypass, same class as mig 101)

PLUTO-671 pluto Done high

Terra function set: no pinned search_path on SECURITY-adjacent functions

TERRA-8 terra Done

Non-owner app role for archive/fraud/audit table write containment (real remedy, migration 100 is hygiene-only)

PLUTO-670 pluto Backlog low

PLUTO-664 follow-up: REVOKE design for archive/fraud/audit table grants

PLUTO-668 pluto Done

8 archive tables: service_role holds UPDATE/DELETE/TRUNCATE, append-only is convention not grant

MARS-597 mars Done

SECURITY DEFINER pg_temp shadowing audit (fleet finding, enamel/terra)

PLUTO-664 pluto Done

getStudentsWithoutAssignment missing ur.deletedAt IS NULL -- 6 of 7 rows on the live student-assignment picker are reclassified docentes/admins, not students

PLUTO-667 pluto Done high

Land PLUTO-641 orphaned app-side refactor (admin fn_* calls)

PLUTO-665 pluto Done high

9 archive tables have zero retention/prune — unbounded growth, fleet-wide pattern (also on venus)

MARS-598 mars Backlog low

Harden append-only surfaces: revoke/guard UPDATE-DELETE-TRUNCATE on appEvents + practicasArchive + practicaParticipationsArchive

VENUS-347 venus In progress

Unpinned authz-scope functions need explicit search_path design (pg_temp fleet finding)

PLUTO-666 pluto Backlog high

fn_notify_pm_triage exception-swallow silently drops PM alerts

MARS-596 mars Backlog

fn_isadmin/fn_istitular gate on JWT app_metadata.role — banned shape, dormant while RLS off

VENUS-346 venus Backlog

Sweep SECURITY DEFINER functions for pg_temp shadowing (fleet finding)

VENUS-345 venus Backlog

Verify coder-enamel-cc Vercel build+runtime-log read before Class-A self-PTD floor is enforceable

ENAMEL-9 enamel Done

TEST probe wi-cancel event-type

MARS-593 mars Canceled someday

edit-form.tsx missing isViewAs dep (view-as correctness) + weekly-kpi.ts unused eslint-disable

MARS-595 mars Backlog low

Disposition MARS-373 archive-context WARN on 2 immutable applied migrations

MARS-594 mars Backlog low

Wire agent-scoped solo push gate for solo-mars-cc (.solo-audit.sh pattern)

MARS-415 mars Canceled

Provision solo-mars Vercel-MCP build+runtime-log read before enforcing solo self-PTD floor (bs-mr8rcwpk2t7 pluto#3)

MARS-405 mars Canceled

P2 codify triage playbook into solo-mars-cc.md (auth-gate first) before any solo alert duty (bs-mr8o7w73qz4)

MARS-403 mars Canceled

P1 solo-router rebind: adopt Class-S -> solo-mars / Class-A -> full-team as default dispatch (bs-mr8o7w73qz4)

MARS-402 mars Canceled

Whole-DB pg_dump insurance for eprpywqwzsvrjeaforei (enamel+terra shared project) does not exist

ENAMEL-12 enamel Blocked high

Solo-lane gate: targeted content-sniff for inline page.tsx authz gates

PLUTO-473 pluto Canceled

Evaluate scoped-hash gate vs sibling-clone for solo-pluto push isolation

PLUTO-489 pluto Canceled someday

feat(soporte): copy mars soporte into venus

VENUS-9 venus Done

Soporte ticket-system — per-app COPY of mars /administrar/soporte (14 files/2023 LOC); venus owns + customizes; improvements broadcast+reimplement per-app; impl queues behind venus 404/skew guard (Elazar owns timing)

VENUS-29 venus Done

Provision solo-venus Vercel build+runtime-log read before its self-PTD floor is enforceable

VENUS-153 venus Canceled low

Adopt clone-isolation for solo-venus-cc (post-VENUS-4) per pluto topology ref pm-pluto-cc-mr4gqnpgg218: own sibling FULL CLONE at evolutiva-pensanta-com/venus-solo/ (worktree ruled out - refuses 2nd checkout of main), origin=same repo so push triggers same Vercel; .env.local copied+gitignored, node_modules pnpm-hardlinked, .solo-verdicts gitignored; LLMMSG_AGENT from .llmmsg-env overlay so gate solo-scope still fires cwd-independent; solo LAUNCHED from agents/solo-venus/ but cd's to clone for all edit+push, git -C pull --rebase origin main before each WI; GitHub is the sync point. Kills the git-add-all cross-agent WIP fold hazard (single-head, no partner-freeze). ALSO reconsider venus memory-lint-in-gate: pluto's gate never lints memory (only git diff HEAD of app tree); may supersede/pair-with VENUS-116

VENUS-117 venus Canceled

Instrument per-task SOLO-METRICS (turn+token baseline) — enamel pilot deliverable

ENAMEL-8 enamel Canceled

P2 triage-codify: auth-gate-first playbook into solo-enamel-cc.md

ENAMEL-7 enamel Canceled low

Fleet CR + client-questions surface (replace Google Sheets/Docs for client change-requests and our questions-to-client)

EVO-83 evolutiva In progress high

└─ Adopt fleet CR + client-questions surface in venus (EVO-83 leg)

VENUS-317 venus Done

└─ Terra leg of EVO-83: CR + client-questions surface

TERRA-1 terra Done high

userAgent ''-vs-NULL: trigger COALESCE + 2 callers leak empty string (diagnosability)

VENUS-344 venus Deferred low

Wire pluto PTD probes to the fleet UA wrapper (--app pluto) — wrapper exists with zero callers, probes ship untagged

PLUTO-662 pluto Done low

CLAUDE.md documents a RETIRED context-warn flag/email ladder — correct the docs (hook is alive, flag mechanism deleted 07-14)

VENUS-339 venus Done

appEvents.path dead column — drop or populate (never-populated query trap)

VENUS-343 venus Backlog low

applog-pull.ts:391 signature COALESCE omits route — one shared-script fix for all four rails

VENUS-332 venus Done

Client feedback: cirugias catalog adds + /informes complicaciones filter fix/split

VENUS-340 venus Done

.gitpush-pre.sh WARN: migrations/applied/ change without schema.md change

VENUS-342 venus Backlog low

Exports (CSV + catedra PDF) ignore /informes taxonomy filter params

VENUS-341 venus Backlog

rule-21 standalone-ack gate misses 'ack <noun>' shape

MSG-276 llmmsg-srv Backlog someday

Measure SCANNER_PROBE_RE for pre-existing over-match against real routes (not admitted-population gate)

MARS-587 mars Done

EVO-86: mars self-addressed error-tier alerts, 07-27/07-29 (FIXED)

MARS-592 mars Done

venus applog-pull rail has emitted nothing for 24 days with every liveness instrument green — process alive, function idle, indistinguishable

VENUS-338 venus Backlog

slow-query notice prints to stdout and writes NO ledger row — classify.ts:133's slowQueryPageMs gate has had nothing to act on

VENUS-337 venus Backlog

applog rails execute a LIVE WORKING TREE — point them at a checkout-of-record; venus/scripts is an unrepresented production surface for mars and pluto

VENUS-336 venus Backlog

Provision lorena.salomone@odontologia.uba.ar as docente + forced welcome-email resend

VENUS-333 venus Done

Does appEvents retention prune page_not_found info rows before they're useful as a regression signal for the ICON_PROBE_RE-demoted class

PLUTO-659 pluto Done someday

users.displayName NOT NULL DEFAULT '' allows silent empty-name insert (siblings CHECK-reject)

MARS-591 mars Backlog low

Split action='404' into 404 vs 404-advertised-asset for digest resolvability

MARS-589 mars Done low

applog-pull.ts:391 signature collapse — mars 404s all collapse to one dedup key

MARS-588 mars Done

Enumerate every gate AND discriminator-mutating transform between an appEvents write and a human — venus leg

VENUS-331 venus Backlog

Over-match check: pluto's 3 shipped pre-probe benign patterns vs real user-facing traffic

PLUTO-658 pluto Done low

Full write-to-human appEvents consumer/gate/transform enumeration for mars

MARS-590 mars Backlog

Venus PTD cannot bind a SHA to a deployment: no githubCommitSha in either vercel inspect form

VENUS-330 venus Backlog

Venus 404 evidence loss at proxy.ts:114 — the middleware matcher excludes static extensions, so an asset 404 is structurally pathless before any writer runs

VENUS-329 venus Backlog

v_appEvents_404 groups by a half-dead key: no venus 404 writer populates appEvents.path (NULL on 100% of 969 rows)

VENUS-328 venus Backlog

Should info/malicious page_not_found bulk (8304 rows) be visible on any digest/surface

PLUTO-660 pluto Backlog someday

applog-listen: a log-only row PERMANENTLY PINS the cursor (classify inside void enqueue) — venus dead 15 days, latent on all 4 rails

VENUS-324 venus Done urgent

Broken admin-detail links: comisiones/usuarios/alumnos 404 on real records

PLUTO-655 pluto Done low

terra_10 follow-up: heal-GUC visibility on appEvents (audit-trail gap WITHDRAWN as false - archive already records it)

TERRA-5 terra Canceled

Percent-encoded fixtures for not-found-classify (MARS-586 prerequisite, 3 pre-probe patterns)

PLUTO-657 pluto Done

Shared applog category-vocabulary mismatch: category-keyed filters inert on pluto

PLUTO-653 pluto Done

Percent-encoded path evasion bypasses SCANNER_PROBE_RE allowlist entirely

MARS-586 mars Backlog

VENUS-327: extend SCANNER_PROBE_RE + pin hold-out fixtures (classifier-coverage only)

MARS-585 mars Done

robots.txt/sitemap.xml missing -- content gap, currently reads as alert noise

PLUTO-656 pluto Done someday

Signed resume-link 404s under malformed /n/ base path (solicitar-acceso/completar)

PLUTO-654 pluto Done

applog rail: 404/probe path CLASSIFIER + 4-outcome taxonomy — must land BEFORE any suppression predicate on any rail (both per-app predicates withdrawn)

VENUS-327 venus Backlog high

error-tier toast/error-shown rows would page despite mig 074 mute (warn-only scope)

MARS-584 mars Backlog

Real 404s hidden in alert-rail noise: /login x19, /practicas/<uuid> x36

MARS-583 mars Backlog

applog-listen category filters assume VENUS literals — both are INERT on pluto (security=0 rows, access=0 rows); four rails, one file, four vocabularies

VENUS-326 venus Backlog high

getFrictionDigest: column reference "createdAt" is ambiguous — real SQL error, invisible 14 days because category='security' is bot-filtered to log-only

VENUS-325 venus Backlog high

applog-listen dedupAllow: route-throttle disposition contract (event-time window + confirmed-delivery settle + per-row identity)

VENUS-321 venus Canceled

applog-listen sends to an ARRAY-of-one and reaches the UNGUARDED hub resolver: scalar to + human-seat recipient validation + regression (EVO-86(e))

VENUS-323 venus Done urgent

applog-listen burst dedup reads the WRONG CLOCK: processing wall-clock instead of event time, and never dedups event IDs

VENUS-319 venus Done

EVO-86: pluto applog rail — real error pages self-addressed to scrp-applog-pluto, never reached pm-pluto-cc

PLUTO-652 pluto Done high

applog alert delivery: pages routed to the emitter script (scrp-applog-*) instead of a human inbox, all rails

VENUS-322 venus Backlog high

ayudarg applog rail: check for same cursor-strand defect as mars/venus

MSG-275 llmmsg-srv Backlog low

Mars measured VENUS-319 burst mispairing: 10 rows stranded

MARS-582 mars Backlog

Venus-side applog rail instrument: DB-to-cursor WORK LAG across all 4 rails + unit-alive assertion

VENUS-320 venus Backlog

Applog rail resume-cursor stall risk (VENUS-318 sibling) — confirm cursor age + adopt fix

MARS-581 mars Done

Consume venus-side applog cursor-age instrument (report pluto's rail age)

PLUTO-651 pluto Backlog low

Applog burst-dedup: duplicate event ID replay within 60s synthesizes x2 burst

PLUTO-650 pluto Backlog low

applog-listen catch-up watermark stalls permanently when every caught-up row is filtered (venus pinned 15d at 2026-07-15)

VENUS-318 venus Backlog

Confirm enamel whole-DB backup coverage for the shared project

TERRA-4 terra Done

PM retirement doesn't clear aros.pm_agent seat

MSG-274 llmmsg-srv Backlog someday

Push staged appEvents-standard + retired-identifiers commons edits once objection window closes (hub 07:58 / 10:58 UTC 2026-07-30)

EVO-85 evolutiva Backlog high

Applog relay daemon conflates DATABASE with TENANT — no per-tenant routing on shared-DB co-tenants

EVO-84 evolutiva Backlog

└─ Terra-side applog/alert-rail coverage

TERRA-3 terra Done

Alert-rail per-app routing for terra errors

TERRA-2 terra Canceled high

Profile photo escalating nag -> hard block on 10th prompt; show photo in practica for teacher identification

MARS-580 mars Backlog

└─ Admin lever to clear a profile-photo block (and handle self-deleted photos re-entering the ladder)

MARS-628 mars Backlog high

└─ Route the profile-photo nag upload through the MARS-567 honest-copy validator before uploadProfileImage

MARS-627 mars Backlog high

No reachable contact channel on /solicitar-acceso or /acceso-denegado

PLUTO-649 pluto Backlog low

users.updatedAt-class trigger gap: 7 more tables with unmaintained updatedAt

VENUS-315 venus Done

b61ee08 retro-audit BLOCK: unhandled 22P02 on malformed ticket/status uuid input

VENUS-316 venus Done

mailer/resume-link/digest/kpi templates: bare || env fallback, not a validating resolveSiteOrigin() — commons violation, unverifiable prod origin

MARS-578 mars Done

Retire solo-pluto-cc/auditsolo-pluto-cc doc + config residue tree-wide

PLUTO-648 pluto Done

auth/callback 42P08: raw bind-placeholder in accessRequestMatchExpr blocks real logins

PLUTO-647 pluto Done high

route.ts: /api/log-error attributes client errors to view-as target instead of real actor

MARS-576 mars Done

Migration loop swallows all errors, not just duplicate-column

MSG-273 llmmsg-srv Backlog low

SILENCE_SKIP_AGENTS hardcoded allowlist has rotted (missing scrp-*/claude-global)

MSG-272 llmmsg-srv Backlog low

3-bucket identityBound invariant check (post-VENUS-305)

VENUS-308 venus Done

users.updatedAt not DB-maintained — raw SQL writes leave it stale

VENUS-309 venus Done

/api/log-error attributes appEvents to a session with no genuine-Google gate

MARS-572 mars Done low

route.ts: /api/log-error outer catch swallows its own failures, no appEvents row

MARS-577 mars Backlog

support-actions.ts stamps persona id instead of realUserId in actor/archive/log fields

PLUTO-645 pluto Done high

Retroactive audit-PASS verification: 21 Class-A commits with uncited self-noted verdicts

PLUTO-646 pluto Backlog high

support-actions.ts stamps persona id instead of realUserId in actor/archive/log fields

PLUTO-644 pluto Canceled high

Resuelto via status dropdown skips resolvedAt + reporter resolution email

PLUTO-643 pluto Done

TEST notify wiring 1785392715

BWI-43 basquetwi Done low

supportTickets: add category+priority (lookup-backed) + vSupportTicketFull view

PLUTO-625 pluto Done

Land or discard dangling postgres-boundary WIP (migrations 089-094)

PLUTO-641 pluto Done high

pm-triage-listen.ts: realtime watermark can permanently skip rows during outage window

VENUS-314 venus Backlog low

pm-triage-listen.ts PMT_APP parameterization (cross-project fix)

VENUS-313 venus Done low

Postgres-boundary WIP: tree calls 4 DB functions that do not exist live; migrations 089-094 unapplied

PLUTO-642 pluto Canceled high

Audit findings from MARS-574 retro review: 4 BLOCKs to fix

MARS-575 mars Done

appEvents.status free-text drift (7739 rows, ~25% coverage of declared union)

VENUS-310 venus Backlog low

IdentityBindTier dbBackfill contract cleanup

VENUS-312 venus Backlog low

VENUS-305 BLOCK fix-forward: incomplete identityBound writer coverage

VENUS-311 venus Done high

getAcademicDropdownData anonymous-callable, same roster-PII leak class as PLUTO-635

PLUTO-638 pluto Done high

Unauthenticated server actions in lookup-actions.ts leak internal roster PII

PLUTO-635 pluto Done

Retro cross-vendor review debt: 5 SHAs owed to audit-mars-ca (harness dark since 2026-07-25)

MARS-574 mars Done

Retro cross-vendor review queue: 10 unreviewed pushes since audit-pluto-ca went dark

PLUTO-636 pluto In progress

Orphaned active userRoles survive user soft-delete (hygiene)

PLUTO-639 pluto Backlog low

Audit: roleless-but-sessionful paths vs genuine-Google gate

VENUS-306 venus Done high

Defense-in-depth: gate getEffectiveUser L3 email-match on genuine-Google (belt-and-braces)

VENUS-305 venus Done

placeholder

PLUTO-637 pluto Canceled someday

audit-venus-ca retro-review queue (reviewer outage since 2026-07-23)

VENUS-307 venus Backlog

Supabase open email/password signup — disable external_email_enabled

VENUS-302 venus Done high

/api/log-error accepts ungated session, attacker-controlled attribution in appEvents

MARS-571 mars Done low

/solicitar-acceso GET not genuine-Google gated (asymmetric with SUBMIT)

MARS-573 mars Done high