Access-request PM-triage loop (DB-fed) — adopted bs-mqotdmmk6b5 2026-06-22, Pluto access-leg only (no support-ticket surface exists in Pluto). GOAL: on access-request submit, app DMs pm-pluto-cc in aro:pluto a DB row-summary so PM triages from the DB (never the URL) before Elazar sees a cold email. BUILD (piece 1, coder + applog lane): on accessRequests INSERT (createdVia=access_request, via /solicitar-acceso → access-request-status-sql.ts / auth-actions.ts / admin-actions.ts), emit a PM-addressed aro:pluto DM carrying {requestId, requester name, email, requested role/context, institutional domain} — REUSE the applog NOTIFY→listener→hub-DM rail just extended for EVO-28 (new category/action, e.g. category=user/action=accessRequestSubmitted; per-app COPY). OPERATIONAL workflow (PM behavior, no code): PM reads the accessRequests row → runs canonicalizeEmail/emailCanonical dedup (NEW vs DUPLICATE-of-existing-user Z under gmail-dot/+tag/googlemail/institutional variant — capability already BUILT via PLUTO-152) → checks isAllowlistedEmail domain → hands Elazar a verdict: 'requester/email / NEW vs DUPLICATE-of-Z / domain ok? / recommend APPROVE|REJECT|MERGE — go?'. GATES: approveRequest GRANT (users/userRoles INSERT + sendAccessRequestApproved email) = Elazar-gated (hits both auth/allowlist-grant + real-audience email; Pluto=LIVE clinical users since 2026-06-09, erroneous grant/denial hits a real person). reject/requestMissingInfo (real-audience email) → PM drafts, sends if routine, escalates exact text if material. Upstream read/dedup/classify = PM-autonomous, visible in aro:pluto (show-work-in-aro). DEPS: applog rail (EVO-28 piece-1 ebb593b live). Pre-implementation audit ping (touches accessRequests trigger-archived table + auth-adjacent path) before coder builds.

Sub-tickets

Questions

Activity

• wi-cli-venus created · 2026-06-22
• wi-cli-venus commented · 2026-06-22
  ELAZAR GO 2026-06-22 03:45 (relayed pm-venus-cc), SCOPE EXPANDED: Pluto gets BOTH legs (tickets + access) since it's LIVE; venus deferred. POST-COMPACT PLAN: (1) keep PLUTO-191 = access-leg triage loop (app-push DM→PM reads DB→classify/dedup via canonicalizeEmail→GRANT Elazar-gated). (2) FILE SIBLING WI = NET-NEW support-ticket surface: pluto has none today; clone source = mars's /administrar/soporte module (per-app COPY, coder picks path) + the ticket triage leg (app-push DM on ticket create→PM reads DB→classify/fix/draft, visible in aro:pluto; routine solicited replies PM sends; material outbound Elazar-gated). Execution in aro:pluto per descend rule; generalpm holds the umbrella. THEN dispatch coder/db (T1/T2 per on-demand model; pre-impl audit ping — touches new schema + accessRequests trigger-archived + auth/email paths).
• wi-cli-venus commented · 2026-06-22
  ADVANCED (pm 2026-06-22): sibling ticket-surface WI filed = PLUTO-193 (net-new supportTickets table + mars /administrar/soporte clone + ticket triage leg). Pre-impl DESIGN ping sent to audit-pluto-cc for BOTH legs (4 questions: applog-rail-reuse-vs-business-event-carrier concern re appEvents-no-business-CREATE rule; accessRequests trigger-archived INSERT NOTIFY hazard; supportTickets schema conventions transplant; operator-gate choice). HOLDING coder/db dispatch until audit returns shape feedback (pre-impl gate, commons: schema+auth+email WIs get audit design-ping BEFORE implement). GRANT + material outbound stay Elazar-gated.
• wi-cli-venus commented · 2026-06-22
  AUDIT DESIGN GREEN (audit-pluto-cc 2026-06-22, 1 blocking change adopted). Q1: business CREATE must NOT route through appEvents/fn_notify_applog_err — use a SEPARATE pg_notify channel 'pm_triage' from a dedicated AFTER INSERT trigger on accessRequests; reuse ONLY the transport leg (applog-listen → hub-DM, extended to LISTEN on 'pm_triage', applog-pluto-cc lane). Q2: keep fn_archive_accessRequests byte-untouched (separate notify fn/trigger = zero archive-sentinel perturbation; pg_notify is txn-scoped so no DM on rollback). DB lane DISPATCHED to db-pluto-cc PREPARE-ONLY (write .sql → audit pre-apply review → Elazar apply gate). Coder workflow-emit + listener 'pm_triage' extension HELD on schema review. GRANT stays Elazar-gated.
• wi-cli-venus statusChanged · 2026-06-22
  DB lane prepare-only dispatched; design audit-blessed.
• wi-cli-venus statusChanged · 2026-06-22
  DB lane prepare-only dispatched; design audit-blessed.
• wi-cli-venus commented · 2026-06-22
  AUDIT PRE-APPLY = CHANGES (1 blocking, rest PASS). Defect: fn_notify_pm_triage accessRequests branch referenced non-existent col 'requesterRole' → silent NULL via to_jsonb (PM loses role signal). FIXED mapping (PM-decided, structured fields not collapsed): requesterName(nombre+apellido), email, domain(split_part), esEstudiante, legajo, titular, adjunto, jtp, anio, catedra, comision, solicitud(capped), requestSource — all real schema.md cols. Confirmed PASS by audit: no-appEvents-path (Q1), fn_archive_accessRequests byte-untouched (Q2), sentinel/GUC correct for lookupOptions seed, to_jsonb null-safety, archive-fn fidelity, camelCase, BEGIN/COMMIT. db patching → audit final confirm → Elazar live-apply gate.
• wi-cli-venus commented · 2026-06-22
  Migration AUDIT PASS (20260622084450). Silent-NULL col defect fixed + byte-confirmed. Escalated live-apply to Elazar (DDL gate, Pluto=LIVE) 2026-06-22. db prepare-only until his go.
• wi-cli-venus blocked · 2026-06-22
  Elazar live-apply DDL gate — migration audit-PASS, db prepare-only, awaiting Elazar go to apply to live prod.
• wi-cli-venus blocked · 2026-06-22
  Elazar CONDITIONAL GO 2026-06-22 05:59: db+audit must AGREE on a revert-to-working backup BEFORE apply. db writing full revert/down script (fast-unbreak = DROP trg_notify_pm_triage_accessRequests, the only hot-path-touching change) + labelled pre-change pg_dump backup; audit confirms backup valid + revert script complete. On AGREE → backup → apply via direct DSN. Migration is additive (new tables/fn/triggers + lookupOptions seed; no existing-table mutation).
• wi-cli-venus commented · 2026-06-22
  Migration APPLIED 2026-06-22 06:10 (Elazar conditional GO satisfied: db+audit AGREE + backup 1.7M captured). SHA 72a3f14/v1.76.8. 8 objects confirmed; abort-probe (BEGIN/INSERT accessRequests/ROLLBACK) PASS. Awaiting audit binding-checks + PTD on 72a3f14.
• wi-cli-venus statusChanged · 2026-06-22
  Migration applied; access-leg DB layer live. Awaiting audit verify, then app-side surface/listener lanes.
• wi-cli-venus commented · 2026-06-22
  audit PASS:72a3f14 — DB binding (fns live, 3 triggers bound, patched payload NO requesterRole confirmed live, 14 payload cols resolve) + deploy PTD (build READY, 0 runtime err, cache-bust v1.76.8 MISS, alias deploymentId dpl_FW68SCs9 match). Caveats: seed rows db-attested (audit read-only perm gap); NOTIFY/live-submit not organically exercised. Reported applied+verified to Elazar. DB layer LIVE.
• wi-cli-venus commented · 2026-06-22
  App-side DISPATCHED to coder-pluto-cc 2026-06-22: Piece A = extend applog-listen daemon (venus) to LISTEN 'pm_triage' channel + DM pm-pluto-cc the formatted triage summary (accessRequest 15-field + supportTicket payloads). DB layer live. DoD=triage DMs reaching PM.
• wi-cli-venus completed · 2026-06-22
  PM DB-fed triage loop access-leg + pm_triage rail LIVE. fn_notify_pm_triage trigger (accessRequests+supportTickets INSERT)→pm-triage-listen daemon on venus→hub-DM to PM. Daemon active+enabled (reboot-survival)+watermark catch-up. Probe NOTIFY verified end-to-end. Daemon SOLE notify path (no app-side DM; grep-confirmed none existed). pm_triage_reader least-priv role (LISTEN+SELECT accessRequests/supportTickets). DB 72a3f14/v1.76.8 + 03ce218/v1.76.9; daemon code venus/scripts/pm-triage-listen.ts. audit PASS.