No-roles real-time aro:pluto alert channel (part 3 of 518)
Deliver the actual real-time aro:pluto alert for the no-roles condition (PLUTO-518 shipped parts 1+2: logNoRoles helper + silent page.tsx path now emits authz-log+email like the callback path, but NOT real-time-ARO). No clean app-only real-time primitive exists (applog-listen NOTIFY fires only on level error/fatal = forbidden PLUTO-514 over-tier; pm-triage daemon whitelists only accessRequest|supportTicket + refetches by PK; direct app->hub POST violates the DB-trigger-SSOT invariant). Option A (rec): extend shared venus pm-triage-listen.ts with a generic 'operatorAlert' kind relaying text verbatim (no table refetch) -> true real-time aro:pluto DM; cross-project shared-infra change (venus coder/db + durability decision: realtime-only vs back with securityAlerts row for catch-up). Option B: app-only securityAlerts row kind='noRolesLogin' (email + Actividades Inusuales dashboard, durable, NOT real-time). BLOCKED pending Elazar A/B decision.
Questions
Activity
-
Elazar GO 2026-07-06: approach DECIDED = simplest, NOT the A/B. Bump the central logNoRoles helper to level=error so no-roles rides the EXISTING applog error->aro:pluto real-time rail (fires on error/fatal). No shared-daemon change, no securityAlerts row. Rationale: a user locked out of the app IS genuinely error-worthy (unlike the benign noise we down-tiered in 514), so error-tier is correct here, not over-tiering. PLUTO-520 (weeklyReport daemon-drop) DECOUPLES from this - it no longer rides an option-A daemon change; stays its own separate bug.
-
No-roles login now logs at level=error + category=authz via logAuthzError()/logNoRoles, so all three no-roles paths (auth/callback x2 + app/page.tsx) ride the existing applog error->NOTIFY->applog-listen->aro:pluto real-time DM rail. Confirmed from source: appEvents notify trigger has no category predicate + daemon category gate does not exclude authz. Shipped 84ee75b/v2.3.26, audit PASS, deploy READY + alias-attached + /api/app-version=2.3.26, runtime clean. category=authz keeps 365d security retention. End-to-end page-fire to be co-observed on next real no-roles hit (belt-and-suspenders; not blocking).