Shadow-mode 404 skew telemetry (Q3 evidence): log skewSuspected flag-independently on every 404 appEvents row

Sub-tickets

Questions

Activity

• wi-cli-venus created · 2026-06-21
• wi-cli-venus statusChanged · 2026-06-21
  Prep stage (push HELD on predicate). §4/§5 amendment: SPLIT lift — field-spec/detail-block LIFT-NOW-stable, signal-3 predicate (matchesSkewPredicate) HOLD 1 cycle for coder-mars's x-deployment-id-mismatch re-drop (reference 8ee06e6 currently carries the MARS_BUILD_AT TIMER belt, NOT build-id; build-id swap in-flight/dormant/unlanded — coder-mars catch). Pluto holds the predicate; NO timer-semantics skewSuspected collected (non-comparable to build-id-era rows). Coder sizing field-shape-now-standalone vs bundle-with-predicate by diff size on top of existing PLUTO-165 tiering. Guardrail: skewSuspected/skewDowngraded stay null until real predicate lands; classifier fields (classifiedReason/tierLevel/tierCategory/alert/softNav) computable now. NOT verbatim lift: @/db/pool.query, canViewPractica->canGradePractica+canAccessComision (semantic view-gate adapt, audit design-ping on that branch), NO awaited in-page email (PLUTO-165 removed it, log alert:bool daemon-side only). route-manifest.ts doubles as 169 full-path oracle. Read-site x-deployment-id-via-headers UNCONFIRMED (was a misattribution; server VERCEL_DEPLOYMENT_ID present != inbound client id surfaces in headones()).
• wi-cli-venus statusChanged · 2026-06-21
  Prep stage, push HELD on predicate (mars build-id swap pending)
• wi-cli-venus commented · 2026-06-21
  SPLIT per §4/§5 amendment: field-spec/detail-block LIFT-NOW-stable, signal-3 predicate (matchesSkewPredicate 3rd conjunct) HOLD 1 cycle for coder-mars x-deployment-id-mismatch re-drop. Reference 8ee06e6 carries MARS_BUILD_AT TIMER, NOT build-id (build-id swap in-flight/dormant). Pluto holds predicate, NO timer-semantics skewSuspected (non-comparable). Building stable ~90% now: route-manifest.ts (doubles as 169 full-path oracle), classify resolvesToCurrentRoute+tierForNotFound, RESOURCE_ROUTES from real tree, PLUTO_ROUTE_MANIFEST+PLUTO_BUILD_AT env+next.config walk, pool.query, canViewPractica->canGradePractica+canAccessComision view-gate (semantic adapt, audit design-ping that branch), not-found.tsx rewire INSIDE existing cache() (no double-capture). Email: lift tier/alert classification + alert:bool in detail, NO synchronous sender (PLUTO-165 removed in-page 404 email, daemon-side only). PROBE moot: Pluto cannot prove 16.1.6 read-site (no deploymentId/Skew-Protection sender -> null non-discriminating); mars is canonical prover. Pre-push diff to audit-pluto.
• wi-cli-venus commented · 2026-06-21
  DECISION (PM ruling, audit-verified): DROP the resource-DB-query/auth-denied classifier branch from the lift. audit-pluto verified it's UNREACHABLE in Pluto's architecture — missing practica=PLUTO-24 200+practica-link-dead INFO; denied=PLUTO-25 307 redirect+accessDenied authz; only practica 404 = non-uuid id (isUuid->notFound, no row to query). Porting = dead DB round-trip per practica 404 + duplicates richer existing PLUTO-24/25 telemetry. KEEP classifiedReason 5-enum (field-shape parity) + generic 404 classifier (stale-bookmark/unknown-top-level/manifest-oracle); drop only the resource-lookup path. This also removes the canViewPractica->canGradePractica+canAccessComision view-gate adaptation entirely (no resource branch = no gate). would-page readout (genuine-bad-route) unaffected.
• wi-cli-venus commented · 2026-06-21
  PM BLESSED drop + 2-push plan. PUSH 1 (now): manifest oracle + simplified classify (generic deletedAt branch, RESOURCE_ROUTES=users+accessRequests routes only) + not-found-log (skew fields forced null/false, zero sender) + not-found.tsx rewire inside PLUTO-165 cache(); downgrade OFF paging OFF; diff to audit. PUSH 2 (mars re-drop): matchesSkewPredicate 3-AND graft + next.config deploymentId:VERCEL_DEPLOYMENT_ID — NOT auto-greenlit, gated on separate canary+deploy-window-UX-review (next.config deploymentId couples Next native hard-reload-on-mismatch = app-wide UX change, PLUTO-169/170).
• wi-cli-venus commented · 2026-06-21
  PM RULING (audit 2nd finding): DROP auth-denied classify ARM too. Pluto denials always redirect 307 never 404 -> arm inert on 5 resource routes, WRONG on alumnos/[id] (allowed viewer+null periodo-summary -> live-row 404 mislabeled auth-denied, actually data gap). Classify arms reduce to {no-row->stale-bookmark, deletedAt->soft-deleted-resource}; live-row-404 -> classifiedReason=unknown (correct anomaly bucket). KEEP auth-denied enum VALUE defined (field-shape parity). RESOURCE_ROUTES now drives only no-row-vs-deletedAt. Audit verifies cut in pre-push PTD.
• wi-cli-venus commented · 2026-06-21
  PM PICK: OPT-2 — classifyNotFound fully SYNC + DB-FREE, classify by manifest-shape (resource-shaped path+valid uuid that 404'd->stale-bookmark; resolves-to-template non-resource->unknown; no template->genuine-bad-route). Drops the deletedAt DB query + route->table whitelist entirely. Rationale: no DB round-trip on degraded 404 render path (pool max:2 contention), matches audit's 'only stale-bookmark reliably correct', blast radius=shadow label precision only, would-page readout (genuine-bad-route) unaffected. All enum values stay defined for future genuine-deny-notFound route. PUSH 1 = sync DB-free.
• wi-cli-venus commented · 2026-06-21
  audit-mars empirical (mars v2.18.1): (1) READ-SITE PASS x-deployment-id readable via headers().get() in not-found.tsx SC render — closes 16.1.6 mars+pluto. (2) SOFT-NAV INERT: rsc in Next FLIGHT_HEADERS, getHeaders() strips it in every SC -> headers().get('rsc') always null -> isSoftNav always false -> skewSuspected false-zero structurally. ADJUSTMENTS: PUSH 1 sets softNav=NULL (not computed off rsc; PUSH 2 rsc->sec-fetch-dest changes semantics = non-comparable, same trap as predicate hold) — PUSH 1 stays soft-nav-INDEPENDENT (manifest oracle/PLUTO-169 + sync DB-free classifier + cache() rewire), no guard shipped. PUSH 2 now bundles: build-id predicate + next.config deploymentId + CANONICAL soft-nav fix (rsc->sec-fetch-dest:empty+next-url) from coder-mars re-drop (NOT hand-rolled). PUSH 2 gated: read-site PASS[done] + soft-nav empirically fires + coder-mars re-drop sha256 + Pluto canary/UX review. Coder verifying Pluto's actual soft-nav header == rsc.
• wi-cli-venus commented · 2026-06-21
  PUSH 1 CUT: deploy SHA 8a08d0a (content 3ab5e3c), v1.75.0 minor. Hard requirement MET: coarse routeResolvesInTable/KNOWN_SEGMENTS gone (not-found-tier.ts trashed), full-path matchesAnyRouteTemplate oracle sole resolve gate. File set(7): +route-manifest.ts +not-found-classify.ts(sync DB-free option-a) +not-found-log.ts(skew+softNav all null, alert shadow-only, zero sync email) ~next.config.ts(fs-walk codegen PLUTO_ROUTE_MANIFEST, closes PLUTO-169) ~not-found.tsx(logNotFound in PLUTO-165 cache(), rsc read DELETED) -not-found-tier.ts ~package.json. Dispatched audit PTD on 8a08d0a (build+runtime logs + live /api/app-version==1.75.0 + 7 asserts + consistency assert + A-F/INV-1/INV-3 + soft-nav RSC probe + cache dedup). FINISHED held on PASS:8a08d0a + live-version verify.
• wi-cli-venus commented · 2026-06-21
  PUSH 2 input LANDED: coder-mars EVO-12 bundle to /gdrive/temp/evo12-reference (Mars live de2e960/v2.18.2, audit-PASS), 4/4 sha256 match. Signal-3 SETTLED (build-id x-deployment-id mismatch, no lossy timer); soft-nav fix verified (sec-fetch-dest:empty NOT rsc). PUSH 2 = wholesale bundle lift, HELD on 2 PM gates: (1) PUSH 1 audit PASS:8a08d0a [in flight], (2) UX-review ruling on next.config deploymentId:VERCEL_DEPLOYMENT_ID (bwi#284) — required for build-id leg but arms Next native hard-reload-on-skew = app-wide UX change (PLUTO-169/170 hold). Pulling form-draft-persistence fact from coder to size hard-reload blast radius -> then rule myself (negligible) or escalate Elazar (real). PUSH 2 bundle notes: next-url stripped by Vercel edge=corroboration-only + raw next-url NEVER logged (PII); guard ships DORMANT (NOTFOUND_SKEW_GUARD_ENABLED off, skewSuspected shadow flag-independent), flip ON only jointly with alert-email.
• wi-cli-venus commented · 2026-06-21
  PUSH 1 PASS:8a08d0a — audit green, live v1.75.0, deploymentId populated, row-writes confirm serving (READY-equivalent; audit verified live behavior, did not pull Vercel build logs separately). 3 hard gates green: cache() dedup (1 row each hard+RSC-soft), manifest oracle 12/12 incl INV-1 case-C + INV-3 drift, consistency (coarse routeResolvesInTable GONE/0 imports, full-path oracle sole gate). KEY: rsc-removal owed-at-PTD proof DISCHARGED Pluto-side empirically (RSC:1 probe -> softNav+4 skew fields NULL not false) — no longer shared-runtime inference. (c) negative assert held (no =false/COALESCE, applog-pull untouched, exclude-on-null owed PUSH 2). WI STAYS inProgress — PUSH 2 still gated on form-persistence facts -> PM UX ruling on next.config deploymentId. 2 non-blocking PUSH-2 notes from audit: (a) would-page gate must explicitly pick one malformed-id resolve predicate; (b) unauth RSC->protected /practicas/<non-uuid> 500s never reaching not-found — coder to confirm pre-existing vs introduced.
• wi-cli-venus commented · 2026-06-21
  GATE 2 (next.config deploymentId UX review, PLUTO-169/170 hold) RULED: CLEARED by PM on coder data-pull. Facts: zero draft persistence app-wide BUT the only long high-stakes form practica-form.tsx is triple-guarded by useUnsavedChangesGuard(WI#381) whose beforeunload layer fires on a Next skew hard-reload itself (user warned before loss); all other state page-level (lost on ANY nav, skew adds zero); NO cross-nav provider/layout accumulation (the only thing a hard nav uniquely discards — none found); app already accepts hard-reload as recovery (stale-action-reload-guard). Negligible blast radius + reversible config line → PM call, no Elazar escalation, no gating canary (will observe first post-PUSH-2 deploy window instead). PUSH 2 AUTHORIZED to lift coder-mars EVO-12 bundle wholesale incl deploymentId. Conditions: guard ships DORMANT (NOTFOUND_SKEW_GUARD_ENABLED off, only Next-native hard-reload arms); next-url corroboration-only+never-logged(PII); would-page gate keys explicitly on resolvesToCurrentRoute(uuid-gated); exclude-on-null in readout. FINISHED+wi close come AFTER PUSH 2 PASSes. Pre-existing unauth-RSC-500 split to PLUTO-177.
• wi-cli-venus commented · 2026-06-21
  PUSH 2 CUT: deploy SHA b4c4d40, v1.76.0 (8a08d0a..b4c4d40), 4 files clean tree, gitpush-pre green. Lifts coder-mars EVO-12 bundle: not-found-log.ts (4 skew signals populated, matchesSkewPredicate=3-AND isSoftNav&&build-id-MISMATCH&&resolvesToCurrentRoute uuid-gated named in-code, skewSuspected flag-independent shadow, downgrade gated skewSuspected&&NOTFOUND_SKEW_GUARD_ENABLED[OFF]) + not-found.tsx (sec-fetch-dest/x-deployment-id/next-url reads into cache() capture) + next.config.ts (deploymentId=VERCEL_DEPLOYMENT_ID) + package.json. Pluto divergences preserved, mars-only bits (sendAppLogAlertEmail/module-TTL/security cat) NOT lifted. ?dpl confirm: emits ?dpl+x-deployment-id header; benign cache-key on Hobby (no pin-404), per 16.1.6 fleet ratification (reload BUILD_ID-keyed off flightResponse.b, deploymentId never feeds reload; Mars-Hobby-live zero-regression). Dispatched audit PTD on b4c4d40: gate1 ?dpl Pluto-own probe (confirm-and-note, block only on pin-404), gate2 read-site WIRED+coverage (across-boundary empirical owed at first post-PUSH-2 deploy, non-blocking), carry-forward asserts. FINISHED+close held on PASS:b4c4d40+live-version verify.
• wi-cli-venus completed · 2026-06-21
  FINISHED FEAT PLUTO-171. PUSH 1 (8a08d0a/v1.75.0) + PUSH 2 (b4c4d40/v1.76.0) both audit-PASS + live-version verified (live 1.76.0==pushed, deploymentId dpl_9hVzBk). Shipped: 404-capture classifier (sync DB-free, full-path matchesAnyRouteTemplate oracle = also PLUTO-169 close) + build-id skew telemetry (matchesSkewPredicate 3-AND isSoftNav&&build-id-MISMATCH&&resolvesToCurrentRoute uuid-gated) DORMANT (NOTFOUND_SKEW_GUARD_ENABLED off, downgrade never arms) + sec-fetch-dest soft-nav fix (replaced inert rsc read) + next.config deploymentId transport. KEY empirical closes Pluto-OWN on 16.1.6: (1) rsc-removal soft-nav-inert proof (PUSH 1 RSC:1 probe -> softNav+4 skew NULL); (2) READ-SITE PROVEN WIRED (PUSH 2 audit injected x-deployment-id -> surfaced into SC render as clientBuildId) -- the leg that was mars-inferred is now Pluto-confirmed; (3) ?dpl-Hobby clean-200 (correct/bogus/no-query all 200 = cache-key not route-pin, 0 new _next/* 404s). Carry-forward green: exclude-on-null partition (19 null PUSH1 / 3 non-null PUSH2), next-url BOOLEAN-only no PII, would-page=resolvesToCurrentRoute live-verified, cache() 1-row dedup, no generateBuildId pin. OWED non-blocking: across-boundary skewSuspected=TRUE end-to-end fire (structurally unreproducible in-window, pre-PUSH-2 clients emit no x-deployment-id) at first organic post-PUSH-2 deploy. UX Gate-2 (deploymentId hard-reload) PM-cleared on negligible-blast-radius. Pre-existing unauth-RSC-500 split to PLUTO-177. Decomposition holds: transport shipped, DOWNGRADE-enable stays organic-rate-gated. Folds into fleet Q3 verdict (pm-llmmsgsrv), not standalone-Elazar.