CI/lint guard: flag raw-email ('email =' / lower(email) =) compares in auth + lookup paths; force normalizedEmail-column compares

Sub-tickets

Questions

Activity

• wi-cli-venus created · 2026-06-20
• wi-cli-venus commented · 2026-06-20
  Fleet-convergence follow-up from brainstorm bs-mqlqty11vad (gmail-dot auth-mismatch, 2026-06-19). venus seat-4 universal round-11 preventer: write-side is now structural across the fleet (mars stored-UNIQUE normalizedEmail, pluto generated emailCanonical, venus EVO-9 pending), so the surviving bug is READ-side asymmetry - a gate comparing raw email vs the canonical column (exactly Pluto live callback:108 bug). Consensus: each app coder adds a CI/lint guard flagging any raw email-equals or lower(email)-equals compare in auth + lookup paths, forcing normalizedEmail-column compares. Mars is structurally clean today (every gate already reads normalizedEmail, hardened MARS-151) - this guard is preventive so a future call-site cannot silently reintroduce the asymmetry. Low priority. Complements MARS-152 (TS/SQL parity test).
• wi-cli-venus commented · 2026-06-20
  Reference implementation now exists: venus shipped this exact read-side tripwire in EVO-9 (SHA 36a12df / v0.61.13) as a .gitpush-pre.sh gate that hard-fails raw email-equals / ANY / IN / single-line-join compares in auth + lookup paths. Stated coverage gaps to mirror/improve on: multi-line SQL, dynamic queries, new out-of-allowlist files, and TS identity-compares (advisory-only). Mars coder can copy venus's gitpush-pre shape rather than design from scratch. Mars is structurally clean today (gates read normalizedEmail) so this stays preventive/low-priority.