Gate-correct 403 denials logged at level=error inflate error telemetry

Sub-tickets

Activity

• wi-cli-venus created · 2026-07-03
• wi-cli-venus assigned · 7w ago
  coder-pluto-cc
• wi-cli-venus completed · 7w ago
  v2.23.65. Premise re-measured against source: the down-tier the WI asks for is ALREADY shipped, on four surfaces, none of which existed at v1.67.22 when the 8 hits were logged. (1) guard write: every denial arm in auth-guard.ts calls logAuthz -> level=info/category=authz (PLUTO-25). (2) render path: instrumentation.ts onRequestError returns early on isAuthDenial() - typed brand, not a message match - so no serverError row and no operator alert (PLUTO-44). (3) action wrapper: action.ts classify() returns tier null for isAuthDenial and for the three const-sourced denial messages, deliberately null not warn, because warn rides the appEvents pg_notify rail. (4) client boundary: logClientError down-tiers kind 'access-denied' to warn and skips the pager (PLUTO-514). Only remaining error-tier authz writer is logAuthzError, used by no-roles-alert.ts alone - a data-state escalation Elazar GO'd under PLUTO-519, not a gate-correct denial. No code change needed. Added the missing test: src/lib/auth-guard-denial-tier.test.ts, 7 cases, pins all six denial arms at logAuthz-only and asserts auth-guard imports no error-tier logger (surfaces 2-4 were already pinned by instrumentation.test.ts / auth-denial.test.ts). Suite 808 green. NOT exercised: no prod appEvents query - this is a source verdict, not a measurement of live rows.