Solo-agent push-gate lints (WARN-tier): archive-context PRESENCE (flag INSERT/UPDATE/DELETE on an audited table in src/ with no setArchiveContext in the same fn - the real blind spot; today's lint only validates the reason string IF setArchiveContext exists) + soft-delete-filter (flag FROM/JOIN on a soft-deletable table without deletedAt IS NULL / active-view). Both are grep/AST heuristics = high false-positive -> ship WARN-tier with curated audited-table + soft-delete-table maps + allowlist-comment escape; hard-fail only once maps curated. isUuid-guard presence deliberately NOT a static lint (too many query shapes, fragile) - left to auditsolo negative-assertion. Source: 3-lane solo-agent design review 2026-07-02.

Sub-tickets

Questions

Activity

• wi-cli-venus created · 6w ago
• wi-cli-venus commented · 6w ago
  SCOPE NARROWED (coder recon 2026-07-02): MARS-373 = archive-context-PRESENCE migration lint ONLY. (1) reason-PREFIX lint already exists in Mars .gitpush-pre.sh L58-75, richer than pluto (8-vocab vs 6) - no action. (2) archive-presence = the real gap: fire when a migration file has DML against one of the 9 trg_*_archive audited tables (users, studentAssignments, teacherComisionMemberships, practicas, practicaImages, practicaTeeth, practicaToothConductos, periodos, comisiones) lacking SET LOCAL app.user_id + app.archive_reason. Scope by CONTENT not directory -> pure-DDL reverts auto-pass, data-mutating reverts caught; scan applied/ + revert/. WARN-tier first, audit-mars reviews table-list before hard-fail flip. (3) soft-delete-filter lint REMOVED from this WI - pluto has no such lint (relay error), it's false-positive-heavy; coverage is auditsolo negative-assertion + MARS-202 active-view epic. Split to a separate advisory WI.
• wi-cli-venus commented · 6w ago
  SCOPE add-on candidate (audit-mars, 2026-07-02): fold a requireAuthForAction-presence companion check into the same file-class lint. Rationale: view-as verification (MARS-352) confirmed CLEAN — read-only chokepoint at src/lib/require-cap.ts:41-67 throws VIEW_AS_READONLY before any write, attribution = session.realUserId (real admin), NO venus-style persona-attribution gap. BUT the residual risk audit could not exhaustively rule out is a mutating audited-table server-action that silently OMITS the requireAuthForAction prepend (MARS-163-class missing-sibling omission). That omission is statically lintable in the same pass as the archive-context-presence check: a write to an audited table should carry BOTH the SET LOCAL GUCs AND (for server-action paths) the view-as guard. coder+audit to settle same-WI vs split during the MARS-373 diff review.
• wi-cli-venus commented · 6w ago
  SCOPING GUARD (audit-mars, 2026-07-02) for the requireAuthForAction-presence companion check: the two presence-lints target OVERLAPPING-but-NOT-identical sets — do NOT couple them as flat both-required or the view-as check false-positives on legit system writes. Correct rule: archive-context-presence applies to EVERY write to an audited table (server action OR direct psql/MCP repair OR cron/system path). requireAuthForAction-presence applies ONLY to the interactive session-backed server-ACTION mutation path; it must NOT fire on cron / system:-context writes (no user session), tsx repair scripts, or read paths. So: 'audited write ⇒ archive-context always; AND requireAuthForAction IFF it's a session-backed server action.' audit confirms coder scopes it conditionally at diff review.
• wi-cli-venus completed · 6w ago
  Archive-context-presence push-lint shipped WARN-tier (ddacdbf, v2.23.18, PASS): content-scoped, scans applied/+revert/, 9/9 trg_*_archive tables. audit confirmed table-list complete + recommends WARN-permanent (hard-flip's 204195-function-body FP class makes push-lane flap worse than the miss; auditsolo negative-assertion covers). Follow-ups (companion requireAuthForAction lint + hard-flip readiness) split to a new WI.