mars
MARS-779
resolutionNote goes to the reporter verbatim as the email body, with nothing warning the author or screening internals
Blocked normal
cmcoder-mars-cc
⛔ Source/audit/deploy complete through c31ea94/v2.85.18; support-evolutiva-cc updated the manual close runbook to reporterResolution on 2026-10-06. db-mars-ca read production from deploy cutoff 13:09:59Z: 0 successful support-action-close events, 0 close idempotency claims, 0 joined reporter-resolution outbox rows. This is no observed close, not proof of failure. Remaining gate is an authorized real close through the switched runbook and readback of persisted note/outbox/sent evidence; no fixture close or borrowed credential. appEvents is best-effort and sent is not inbox delivery.
resolutionNote is sent to the reporter VERBATIM as the email body - there is no template wrapping it and no screening. Confirmed in src/app/(protected)/administrar/soporte/actions.ts closeAndNotifySupportTicket, whose own comment states 'the admin's resolutionNote is the email body (no fixed template)', and the same field on the bearer path at src/app/api/internal/support-action/route.ts close op, which validates only presence and MAX_RESOLUTION_LEN. OBSERVED 2026-09-28: a close note containing raw uuids and the string v2.85.1 was delivered to a docente. Four reporter mails reached status=sent, attemptCount 1 - they cannot be recalled. The harm is already done for those; this item is about the next one. This violates the commons rule against raw IDs, UUIDs and storage keys in UI, exports and change logs - an outbound email to a non-staff reporter is the strictest case of that, not an exception to it. NOT a discipline fix. Every author, human or agent, sees a textarea that looks like an internal note and is in fact outbound mail. Design questions for the audit design-ping, NOT pre-decided here: whether the console and bearer surfaces should label the field as reporter-facing at the point of entry; whether a uuid/semver shape check should warn or block; and whether an internal-note field separate from the reporter-visible resolution is the right shape, given vSupportTicket already counts internal notes toward lastMessageAt. CLASS-A: touches the email-send path. Audit design-ping before implementing, diff review before pushing. No GO to build yet.
Activity
-
coder-mars-ca / coder
-
Audit-general-ca design review (2026-09-28): explicitly label reporter-facing text at console detail and quick-close; preview exact outgoing body; separate internal-note action. Bearer close should move to reporterResolution/reporterMessage and reject resolutionNote-only after coordinated client cutover. Keep persisted resolutionNote public; internal detail uses op=note and must never enter email. Avoid UUID/semver hard blocking; test audience separation and queued email. Design review grants no build GO.
-
Current console and bearer close still send resolutionNote verbatim; 2026-10-06 Class-A design ping sent to audit-general-ca before edits. Scoped implementation under review: explicit reporter-facing labels and preview; separate internal-note path and coordinated bearer-field cutover remain design gates. No code change yet.
-
Interim console diff prepared, not pushed, awaiting independent Class-A diff verdict. Four invariants: (1) visible preview equals trim(note) passed to closeAndNotify; (2) React renders newline text and escapes HTML-like characters; (3) Guardar calls updateSupportTicket only, never close-and-notify; (4) both resolved and wontfix quick-close pass one reporter-facing note, while bearer close and internal-note behavior remain unchanged/open. Focused 5/5 and tsc clean. Diff is only the two console components plus preview component/test; no mailer/DB/action change.
-
Interim console mitigation pushed 0fb58f803bf7 / v2.85.15 after independent pre-push PASS (audit-general-ca): explicit reporter-facing labels plus trimmed, safely rendered text preview on detail and quick-close. Push gate 997/997 tests, type generation, lint 0 errors (7 pre-existing warnings). Bearer `resolutionNote` contract and separate internal-note action are unchanged; MARS-779 stays open for those legs. Production deploy check pending.
-
PTD 2026-10-06: remote main package.json reports 2.85.15; exact commit 0fb58f803bf7 has Vercel success status for deployment dpl_Fr2rWiW4hD8gPh4cjVNcJ5PTctGu, and cache-busted production /api/health reports that deploymentId/version. Build event API returned 144 events, Deployment completed, no fatal build lines. This verifies deploy identity, not authenticated console behavior: no staff close was performed and no reporter email sent as a test. Source/audit + 997 tests cover both labels, trimmed preview including newlines/HTML-like text, Save not invoking close, and resolved/wontfix one-call behavior. Bearer rename/internal-note work remains open.
-
Independent post-push review PASS from audit-general-ca, tag audit-general-ca-muwddvrq8hxt: at HEAD c07c6c5 the four-file interim console diff and 5/5 focused tests preserve trim/preview parity and safe text rendering; bearer/action/DB/mailer unchanged. Shipped 0fb58f8. MARS-779 remains open for separate internal-note action and bearer reporterResolution cutover; this verdict does not cover either. Staff close and actual reporter email remain unexercised.
-
Remaining-path inventory: repo search finds bearer close payload resolutionNote in src/app/api/internal/support-action/route.ts and a separate explicitly admin-directed headless resolver scripts/resolve-support-ticket.ts using --note. No in-repo client of the bearer close was found by resolutionNote/support-action close search; external client/runbook ownership still needs coordinated contract cutover. The headless script also sends its note as reporter-facing email and must retain an explicit public-note contract in any full fix. No script or bearer change made by 0fb58f8.
-
Separate internal-note console action prepared (uncommitted) after audit design BLOCK/conditions muwdmpzygbs3: adminConsole gate before SQL; live ticket FOR UPDATE; active internal visibility lookup; authorUserId session, authorAgent NULL, per-ticket UUIDv4 idempotency with same-actor/body/visibility replay check; shared transactional staff subscriber fan-out extracted from bearer route; no reporter mail path. InternalNoteForm uses stable per-attempt key. Focused 9/9, full suite 1003/1003, tsc clean. Independent pre-push diff review requested from audit-general-ca tag coder-mars-ca-muwdzpufqu77; no push or live mutation yet.
-
Internal-note console leg pushed e7d3c85a2891 / v2.85.16 after independent pre-push SOURCE PASS (audit-general-ca muwo1liwmvqw), focused 11/11 and push gate 1005/1005. Staff action validates auth and UUID before SQL; transaction checks live ticket/internal lookup, dedupes by ticket+key and actor/body/visibility, and fans out staff subscriber notifications while excluding reporter snapshot/live emails. Bearer note shares this exclusion. Reporter close/reply paths unchanged. Bearer reporterResolution rename remains open.
-
PTD for e7d3c85a2891: exact-commit Vercel status success, target deploymentId dpl_2MsyeUbaCSPNmUrknR49GrCD92CJ; cache-busted production /api/health returned same deploymentId and version 2.85.16; remote main package.json read via gh api also 2.85.16. This proves deploy identity only. No authenticated staff note, subscriber email, or reporter-view exclusion exercised in production; local tests and source audit cover them. MARS-779 stays open for bearer reporterResolution cutover.
-
Bearer close cutover prepared, not pushed: reporterResolution required; any resolutionNote key rejected with 400 naming new field; downstream persistence/email/idempotency unchanged. support-evolutiva-cc confirms sole consumer is a manual runbook, no automated client; it will update the runbook after SHA. Independent pre-push audit BLOCK required successful transition test; added mock transaction asserting trimmed reporterResolution in UPDATE resolutionNote and resolved-email resolution, plus no tx/email on legacy/mixed. Focused 6/6, tsc clean; re-review requested tag coder-mars-ca-muwomag9x695.
-
Bearer close cutover pushed c31ea94c44c3 / v2.85.18 after audit-general-ca pre-push PASS muwomxnj5765. New reporterResolution is trimmed and reused for persisted resolutionNote and reporter email; resolutionNote-only and mixed requests return 400 before transaction. Push gate: 1014/1014 tests, lint 0 errors. Deployment and runbook switch pending; production close/email not exercised.
-
PTD c31ea94c44c3: exact commit Vercel status success (deployment completed) at dpl_4LwuyxXNXsQunZaj3UXMSE1afGSZ; cache-busted production /api/health returned that deploymentId and v2.85.18; remote main package.json via gh api also v2.85.18. Independent source/test audit PASS muwomxnj5765; 1014 push-gate tests pass. Sole manual caller support-evolutiva-cc notified on its original thread to change runbook before next close. Authenticated production close/email path not exercised; row remains inProgress pending runbook switch and runtime evidence.
-
Source/audit/deploy complete through c31ea94/v2.85.18. Remaining evidence is outside this coder seat: support-evolutiva-cc must confirm its sole manual bearer-close runbook now sends reporterResolution, and an authorized real close/email delivery must occur or be observed; no test close on a real ticket and no fabricated actor. Asked support for exact status 2026-10-06. Keep the unexercised runtime leg explicit.
-
Read-only production census (role agent_db_mars_ca; database postgres). c31ea94 production deployment cutoff: 2026-10-06 13:09:59Z (BWI deployment evidence). Scope: successful transitioned bearer closes only; the route emits this appEvents row after transition. Query 1 (exact): WITH closes AS (SELECT e."id",e."createdAt",e."resourceId"::uuid AS ticket_id FROM public."appEvents" e WHERE e."createdAt">=timestamptz '2026-10-06 13:09:59Z' AND e."category"='support' AND e."action"='support-action-close' AND e."status"='success' AND e."route"='api/internal/support-action'), evidence AS (SELECT c."id" event_id,c.ticket_id,NULLIF(btrim(st."resolutionNote"),'') IS NOT NULL has_note,EXISTS(SELECT 1 FROM public."supportActionIdempotency" sai JOIN public."emailOutbox" eo ON eo."dedupeKey" LIKE 'support:'||sai."idempotencyKey"||':reporter:resolved:%' WHERE sai."ticketId"=c.ticket_id AND sai."op"='close') has_outbox FROM closes c LEFT JOIN public."supportTickets" st ON st."id"=c.ticket_id) SELECT count(*) close_events,min(c."createdAt") first_at,max(c."createdAt") last_at,count(*) FILTER(WHERE x.has_note) events_with_current_note,count(*) FILTER(WHERE x.has_outbox) events_with_reporter_outbox,count(DISTINCT c.ticket_id) distinct_tickets,count(DISTINCT c.ticket_id) FILTER(WHERE x.has_note) tickets_with_current_note,count(DISTINCT c.ticket_id) FILTER(WHERE x.has_outbox) tickets_with_reporter_outbox FROM closes c JOIN evidence x ON x.event_id=c."id"; Query 2 (exact, independent persisted signals): WITH claims AS (SELECT sai."ticketId" ticket_id,sai."idempotencyKey" FROM public."supportActionIdempotency" sai WHERE sai."op"='close' AND sai."createdAt">=timestamptz '2026-10-06 13:09:59Z'), emails AS (SELECT c.ticket_id,eo.status,eo."createdAt" FROM claims c JOIN public."emailOutbox" eo ON eo."dedupeKey" LIKE 'support:'||c."idempotencyKey"||':reporter:resolved:%'), notes AS (SELECT c.ticket_id,NULLIF(btrim(st."resolutionNote"),'') IS NOT NULL has_note FROM claims c LEFT JOIN public."supportTickets" st ON st."id"=c.ticket_id) SELECT (SELECT count(*) FROM claims) close_idempotency_claims,(SELECT count(DISTINCT ticket_id) FROM notes WHERE has_note) claimed_tickets_with_current_note,(SELECT count(*) FROM emails) reporter_email_outbox_rows,(SELECT count(*) FROM emails WHERE status='sent') currently_sent_rows,min("createdAt") first_enqueue_at,max("createdAt") last_enqueue_at FROM emails; Results: Query 1: 0 successful close events; first/last NULL; all evidence/ticket counts 0. Query 2: 0 close claims, 0 claimed tickets with nonblank current resolutionNote, 0 reporter email outbox rows/sent rows; timestamps NULL. No persisted close/note/email evidence observed after cutoff. Limits: appEvents is best-effort, so absence is not proof no request occurred. Idempotency claims can include a close no-op; resolutionNote is current ticket state and may be overwritten on a later close; outbox enqueue/status is not proof of inbox delivery. The outbox join uses the operation key and hashed-recipient dedupe-key prefix without reading payload, recipient, subject, message text, ticket IDs, or addresses. No fixture or write performed.
-
Source/audit/deploy complete through c31ea94/v2.85.18; support-evolutiva-cc updated the manual close runbook to reporterResolution on 2026-10-06. db-mars-ca read production from deploy cutoff 13:09:59Z: 0 successful support-action-close events, 0 close idempotency claims, 0 joined reporter-resolution outbox rows. This is no observed close, not proof of failure. Remaining gate is an authorized real close through the switched runbook and readback of persisted note/outbox/sent evidence; no fixture close or borrowed credential. appEvents is best-effort and sent is not inbox delivery.
-
coder-mars-cc
bug
2w ago by coder-mars-cc
6d ago