dev01 colectivo creation failure, request 1a17c253-b32e-496b-8f7e-517fee578a8a

Sub-tickets

Activity

• coder03-mba-l-ca created · 3d ago
• coder03-mba-l-ca statusChanged · 3d ago
  Read-only correlation confirms DEV trigger trg_vehiculos_reject_dominio_no_rutap is enabled; the request's normalized domain is absent from snapshot 21 at incident time. The 23514 matches MOVILBA-306's intentional missing-SSOT rejection. Added a focused user-facing message mapping and tests; no database/app writes or deployment.
• coder03-mba-l-ca assigned · 3d ago
  coder03-mba-l-ca / coder
• audit-mba-l-ca audited · 3d ago
  audit pass: Reviewed commit 877e60a1 action→service→repository path and exact 23514 message guard. Ran test:source (73/73), targeted ESLint, pnpm typecheck, diff-check (all pass). No focused mapping test or DB/HTTP run.
  payload

  {"scope":"Reviewed commit 877e60a1 action→service→repository path and exact 23514 message guard. Ran test:source (73/73), targeted ESLint, pnpm typecheck, diff-check (all pass). No focused mapping test or DB/HTTP run.","outcome":"pass","evidence":"Only pgCode 23514 plus the MOVILBA-306 domain-missing message regex becomes fixed ApiException VALIDATION_FAILED; other 23514s rethrow. Action's mensajeParaUsuario exposes that fixed message. Repository/service/action logs use serializeErrorForLog, omitting bound PG params. No dedicated behavior test covers mapping; DB/action runtime unexercised.","reportRef":null}

• coder03-mba-l-ca commit · 3d ago
  877e60a1 on coder03-mba-l-ca/movilba-793-ssot-error: VehiculoService converts the exact MOVILBA-306 23514 cause into an ApiException displayed by crearColectivo; repository and service log sanitized error metadata. Audit review requested; not deployed.
• audit-mba-l-ca audited · 3d ago
  audit fail: Re-review of user-facing error wording using db04's pinned-workbook measurement. FAIL: 'no figura en el libro RUTAP vigente' conflates installed snapshot with latest workbook; code-path PASS and gates from prior audit unchanged.
  payload

  {"scope":"Re-review of user-facing error wording using db04's pinned-workbook measurement. FAIL: 'no figura en el libro RUTAP vigente' conflates installed snapshot with latest workbook; code-path PASS and gates from prior audit unchanged.","outcome":"fail","evidence":"db04 reports pinned workbook SHA 81874621…bd20 contains AI429SI exactly once (Base row 5572, open ALTA, 2026-10-09), while installed DEV/PROD snapshots omit it; full import is separately blocked by AB139OT/MOVILBA-795. The current text may falsely tell a user the source book lacks the domain and asks for Eugenia to add it. Clarify that it is absent from the currently imported snapshot, not the newest workbook. These workbook/database measurements are db04-reported, not independently re-run by audit.","reportRef":null}

• audit-mba-l-ca audited · 3d ago
  audit pass: Re-reviewed the one-line user-message diff atop 877e60a1. test:source 73/73, targeted ESLint, pnpm typecheck, diff-check passed. No DB/HTTP run. PASS applies to these exact diff bytes; freeze same hunk before release.
  payload

  {"scope":"Re-reviewed the one-line user-message diff atop 877e60a1. test:source 73/73, targeted ESLint, pnpm typecheck, diff-check passed. No DB/HTTP run. PASS applies to these exact diff bytes; freeze same hunk before release.","outcome":"pass","evidence":"Text now says absent from the RUTAP book loaded in the app, and if the domain is already in the approved book, wait for import completion before creating. This distinguishes installed snapshot from approved workbook. db04 workbook/snapshot measurements remain not independently rerun. Prior FAIL on old wording is superseded for this exact correction; no commit/deploy reviewed.","reportRef":null}

• coder03-mba-l-ca progress · 3d ago
  Release v5.6.248: source commit 190d406a includes audited 877e60a1 plus corrected installed-snapshot wording; PROD merge 454722d6. DEV and PROD health both serve patch 248. Pod mirror pushed GCABA develop d099ae6 and EventListener returned 202; pod build/live health and proxy AI429SI UI verification are pending. Shared checkout untouched; separate clean release clone used. No SSOT import or DB write.
• coder03-mba-l-ca progress · 3d ago
  db04 SELECT-only 12:59 ART: pinned workbook 81874621 has open AI429SI Base!5572; installed DEV snapshot 21 and PROD snapshot 11 remain old 2026-10-06 MD5 eb2e2683 with AI429SI=0 in latest RUTAP and public.vehiculos. Thus 23514 guard rejection is correct until separate MOVILBA-794/795 import dependency is resolved. Code release changes user-facing explanation/log safety only; pod and UI final proof pending.
• audit-mba-l-ca audited · 3d ago
  audit pass: Reviewed GCABA develop d099ae6 vs source 190d406a; source hashes match and strip-path/content scan is clean. DB dump contents not inspected; AI429SI UI submission not exercised (no browser surface available).
  payload

  {"scope":"Reviewed GCABA develop d099ae6 vs source 190d406a; source hashes match and strip-path/content scan is clean. DB dump contents not inspected; AI429SI UI submission not exercised (no browser surface available).","outcome":"pass","evidence":"Mirrored source/services/vehiculos.ts and source/repositories/vehiculos.ts hashes exactly match release clone; .env.local, docs, tools, agents and build/cache paths absent; only .env.example remains (credentials placeholders). Credential-pattern scan found no secret literals; one dynamic code false positive. database/movilba_dev.dmp is present (40,172,306 bytes, SHA256 df2eabc9…6b9e), the pod script's intentional default artifact, and was not content-scanned. CUA had no browser; no request was submitted, so no UI message/request ID or create-state claim.","reportRef":null}

• coder03-mba-l-ca progress · 3d ago
  Fleet parity verified 2026-10-13 13:13 ART: PROD app.movilba.com, DEV dev01.movilba.com, and POD permisos-movilba-dev.gcba.gob.ar each returned status=ok serviceId=34887 (patch 248). Audit PASS on pushed GitLab develop d099ae6 source tree; intended default 40,172,306-byte DEV dump present, contents not independently inspected. Proxy browser reproduction/UI error and created/not-created proof still pending before behavioral closure.
• audit-mba-l-ca audited · 3d ago
  audit pass: Independent final source-identity and pushed GitLab develop path/content review; no code/runtime behavioral test in this audit.
  payload

  {"scope":"Independent final source-identity and pushed GitLab develop path/content review; no code/runtime behavioral test in this audit.","outcome":"pass","evidence":"audit-mba-l-ca | 2026-10-13 ART: Verified origin/develop and mirror HEAD=d099ae63205dae37b9109e49e2abcf5c5f47a25f; source hashes match audited 190d406a; 190d406a is an ancestor of PROD merge 454722d6; diff --check 877e60a1..190d406a clean. Forbidden-path scan found no local env files, AGENTS/CLAUDE, node_modules/.next, or secret/private-key-named files; .env.example remains. Intentional 40,172,306-byte database/movilba_dev.dmp exists but contents were not inspected. AI429SI browser submission not exercised; pod health is reported by coder03, not independently measured here.","reportRef":null}

• audit-mba-l-ca audited · 3d ago
  audit pass: Repeat review of pushed GitLab develop d099ae6: tracked-path sweep and heuristic literal-secret scan only; no deployment or application behavior tested.
  payload

  {"scope":"Repeat review of pushed GitLab develop d099ae6: tracked-path sweep and heuristic literal-secret scan only; no deployment or application behavior tested.","outcome":"pass","evidence":"audit-mba-l-ca | 2026-10-13 ART: Fetched origin/develop and confirmed FETCH_HEAD=d099ae63205dae37b9109e49e2abcf5c5f47a25f. Tracked sensitive/internal path scan returned no matches after excluding .env.example and the legitimate source/src/app/logs route; only database/movilba_dev.dmp is a database artifact (40,172,306 bytes, Git blob 17d209e2501c44d295d287321c03392ecf04c828). Heuristic scan of non-vendor text found no private-key/API-token/literal-secret patterns. Dump contents were not inspected, so this is not a claim about secrets or personal data inside the dump. No --no-dump/removal performed.","reportRef":null}

• audit-mba-l-ca progress · 3d ago
  audit-mba-l-ca | 2026-10-13 13:17 ART: Independently GET-checked https://app.movilba.com/api/health, https://dev01.movilba.com/api/health, and https://permisos-movilba-dev.gcba.gob.ar/api/health with curl -fsS --max-time 15; all returned {status:ok,serviceId:34887} (exit 0). This verifies live health on patch 248 only; authenticated AI429SI form submission remains unexercised because this session has no browser surface. Ticket remains open for that behavioral proof.
• coder03-mba-l-ca verified · 3d ago
  Authenticated DEV browser reproduction by proxy-mba-w-ca: AI429SI submitted once 2026-10-13 13:16:41 ART on v5.6.248, request da56ba70-16b8-430d-90b9-8595a211c871. Verbatim modal explains domain absent from app-loaded RUTAP and approved-book import dependency; no generic 'Error al crear el colectivo'. Separate /vehiculos?search=AI429SI&page=1 returned 0 records; no bus created. PROD, DEV, POD health all patch 248. New workbook import remains separate MOVILBA-794/795, not bypassed.
• coder03-mba-l-ca completed · 3d ago
  Generic colectivo creation error fixed and behavior verified on authenticated DEV form. New request da56ba70-16b8-430d-90b9-8595a211c871 shows precise loaded-snapshot explanation, vehicle search remains empty; v5.6.248 healthy on PROD/DEV/POD. AI429SI creation itself awaits separate full-book import MOVILBA-794/795.
• coder03-mba-l-ca statusChanged · 3d ago
  Reopened at Elazar's direction: authenticated AI429SI Alta still fails on v5.6.248. The message-only fix is insufficient; acceptance is successful creation from the approved source data (or a concrete source-faithful blocker), not merely replacing the generic error. Original request 1a17c253-b32e-496b-8f7e-517fee578a8a; reproduction request da56ba70-16b8-430d-90b9-8595a211c871.
• db04-mba-l-ca progress · 3d ago
  DB candidate SHA256 cf755a6276a3ff19d5f267d18ab92b1e12819864eeedfd0a8fba9b5002dad796 at docs/migrations/2026-10-13-movilba-793-ai429si-book-admission-PROD-Y-DEV.sql. Default ROLLBACK rehearsal on exact bytes PROD then DEV rc0. Installed 306 body pre/post 0620bbb9 in both; staged body b5887e97. DEV exact AI429SI+VIN 9BSK4X200T4107784 accepted inside reverted fixture; wrong VIN and unrelated domain rejected by 306; PROD exact target rejected. Post-read: 0 fixture vehicles both bases. Awaiting audit verdict; no apply.
• audit-mba-l-ca audited · 3d ago
  audit fail: Static safety review of pinned SQL cf755a6276a3ff19d5f267d18ab92b1e12819864eeedfd0a8fba9b5002dad796 and supplied default-ROLLBACK rehearsal evidence; I did not execute or apply SQL.
  payload

  {"scope":"Static safety review of pinned SQL cf755a6276a3ff19d5f267d18ab92b1e12819864eeedfd0a8fba9b5002dad796 and supplied default-ROLLBACK rehearsal evidence; I did not execute or apply SQL.","outcome":"fail","evidence":"audit-mba-l-ca | 2026-10-13 13:26 ART: The guard patch is tightly scoped to movilba_dev/app_dev, snapshot 21 + MD5 eb2e2683, normalized AI429SI and VIN 9BSK4X200T4107784; the artifact fails closed on stale body/snapshot/trigger, preserves captured owner/ACL/properties, has exact-anchor and post-body digest checks, plus wrong-VIN/unrelated-domain negatives. db04 reports default ROLLBACK rehearsed on PROD and DEV and post-read old body 0620bbb9 with 0 fixtures; I did not independently execute it. FAIL: the admission branch itself has no runtime NOT EXISTS check for a prior AI429SI/VIN row. Preflight checks absence only once before apply; while snapshot 21 remains current, the exception can admit the same identity again after its first vehicle row is soft-deleted, defeating the stated one-row admission limit. Add a runtime absence guard covering even soft-deleted rows (and re-rehearse both bases) or provide an equally explicit one-shot retirement mechanism before apply. No DB write or apply performed.","reportRef":null}

• audit-mba-l-ca audited · 3d ago
  audit pass: Focused static safety review of frozen SQL SHA256 134eb1d4a706a2963bfe557da9118492e0f1bef1ccb7d3b34eb32a7bb113c383 and independent read-only workbook pin check. No SQL rehearsal, apply, or database write performed by audit.
  payload

  {"scope":"Focused static safety review of frozen SQL SHA256 134eb1d4a706a2963bfe557da9118492e0f1bef1ccb7d3b34eb32a7bb113c383 and independent read-only workbook pin check. No SQL rehearsal, apply, or database write performed by audit.","outcome":"pass","evidence":"audit-mba-l-ca | 2026-10-13 ART: Independently verified pinned workbook SHA256 8187462151f626657c81f53691d0cd82153f92aeb3c565a016c2fff3e2edbd20; Base!E5572/K5572 match the domain/VIN hardcoded in the SQL and AI5572 is blank. SQL retains installed body MD5 0620bbb9, per-base snapshot id/MD5/row-count and enabled-trigger preconditions; exception is only movilba_dev/app_dev/snapshot21+MD5/domain+VIN, expires when max snapshot changes, and now checks NOT EXISTS of normalized domain OR VIN across all vehiculos rows including soft-deleted. MOVILBA-306 remains fallback; positive exact-row control, soft-delete-then-repeat rejection, wrong-VIN and unrelated-domain negatives are structurally rolled back; body digest and owner/ACL/config/security/volatility/parallel/leakproof assertions remain. db04 reports fresh workbook/hash checks and successful default-ROLLBACK rehearsals PROD then DEV, with original body and zero fixtures post-read; not independently executed. PASS applies to artifact safety only; do not apply before the separate live DEV APP_ENV=dev attestation.","reportRef":null}

• audit-mba-l-ca audited · 3d ago
  audit pass: One-time shipped-identity/scope review of DEV source ffa1c099, PROD merge 670ff156, and added SQL; no runtime or pod verification performed.
  payload

  {"scope":"One-time shipped-identity/scope review of DEV source ffa1c099, PROD merge 670ff156, and added SQL; no runtime or pod verification performed.","outcome":"pass","evidence":"audit-mba-l-ca | 2026-10-13 ART: In release clone, ffa1c099c3c7eb3cbc764efb5f6a788c7f40dfe5 is parented by 190d406a and changes only CHANGELOG.md, the reviewed migration SQL, package.json, and package-lock.json. Shipped SQL blob SHA256 is exactly 134eb1d4a706a2963bfe557da9118492e0f1bef1ccb7d3b34eb32a7bb113c383. Package version is 5.6.249. Both dev/dev+origin/dev resolve to ffa1c099; lezama/main+origin/main resolve to 670ff156, which contains ffa1c099 (merge-base ancestor check rc 0). No repeat safety, workbook, health, or secret scan. Pod EventListener/build and live behavior not checked here.","reportRef":null}

• coder03-mba-l-ca completed · 3d ago
  DEV01 v5.6.249: AI429SI Alta succeeded in authenticated UI after guarded DB fix; detail page loaded and refreshed list showed exactly one vehicle. Stakeholder's creation error resolved on DEV01.