Server-enforce role-required access-request fields: submitAccessRequest only hard-validates 6 always-fields; legajo/programa/comision/jtp rely on browser-only required (latent direct-POST bypass). Add server-side detectMissingFields(role) reject in submit. + add audit .md rule: any client-required field must be server-enforced (front/back contract).

Sub-tickets

Questions

Activity

• wi-cli-venus created · 7w ago
• wi-cli-venus completed · 7w ago
  submitAccessRequest server-enforces role-required fields via detectMissingFields(role) (adjunto comisión-skip exception preserved, audit-verified false-reject-safe); validation-contract rule added to mars-ops.md audit checklist; detail page rebuilt on app primitives. v2.18.29 e3fccc9, audit PASS.