feat(ptd): authed-route PTD tooling — PTD render-GET can't exercise authed routes (302/login); authed pages + authed-only behavior (toast/error-shown producer, práctica gates) never runtime-verified. Fix: in-process self-check route (preferred) or least-priv stored session for manual authed pass. Sibling: MARS-118.

Sub-tickets

Activity

• wi-cli-whey created · 2026-06-15
• wi-cli-whey commented · 2026-06-15
  VENUS-10 two-sided verification note (toast/error-shown, authed-browser required): see VENUS-10 comment — invalid práctica submit → FieldErrors + one toast/error-shown row; valid create → zero toast rows. Baseline pre-traffic = 0. This WI is the tooling fix that would let PTD drive that check automatically post-go-live.
• wi-cli-venus note · 2026-07-31
  DESIGN CONSTRAINT from probe-contamination measurement (coder02-venus-cc-ms8fdfq3u55b, 2026-07-31): today venus's telemetry recorder is unreachable from probes ONLY via the session gate — template.tsx sits at APP ROOT (no (protected) group; venus's mechanism differs from pluto's, coincident conclusion), and logRouteUsage's if(user) is the load-bearing gate. THE MOMENT this WI gives a probe a session, that gate passes, /api/* exclusion stops applying (target is a page), and the UA filter at usage-telemetry.ts:105 becomes the SOLE remaining defence. So: any authed-PTD implementation MUST carry UA evolutiva-internal-probe/venus-ptd (probe-curl.sh v2.0 --app venus) as an acceptance criterion, or authed PTD will pollute usage telemetry as real pageviews from day one.
• wi-cli-venus note · 2026-07-31
  CONSTRAINT UPGRADED (coder02-venus-cc-ms8fh8ikvfkc + coder-pluto-cc-ms8fh9ca8iuc): the authed-untagged-probe contamination class is UNCORRECTABLE once landed — webusage.usageEvents stores no UA/IP/header column, so post-hoc separation from real pageviews is impossible, not hard. Therefore the UA discipline must hold BEFORE this WI ships, not alongside: it is a PRECONDITION, the only control that exists. Benign instance of the exact shape: venus /admin/health n=2 2026-07-12 (real admin pageview, structurally identical to a contaminating probe). OPEN DESIGN QUESTION FOR ELAZAR (do not build): recording a UA-derived is-probe flag at emit would create the only possible post-hoc discriminator, but it is a privacy/telemetry-scope decision (what the logger auto-stamps), not a coder's call. Asked via DM 2026-07-31.
• wi-cli-venus assigned · 5w ago
  coder-venus-cc
• coder-venus-cc blocked · 1w ago
  Awaiting ELAZAR on the open design question the row itself marks 'do not build' (asked by DM 2026-07-31): whether the logger auto-stamps a UA-derived is-probe flag at emit. That flag is the ONLY possible post-hoc discriminator, and it is a privacy/telemetry-scope decision, not a coder's call. Not blocked on data or on another coder - the measurement and the design constraint are both already on the row. Hard precondition if it ever unblocks: any authed-PTD implementation MUST carry UA evolutiva-internal-probe/venus-ptd, because webusage.usageEvents stores no UA/IP/header column, so probe contamination of real pageviews is UNCORRECTABLE once landed. Moved out of backlog because backlog read as actionable: coder-venus-cc picked it up under a 2026-10-05 push-it-to-done GO and had to stop at the row's own do-not-build marker.
• pmmaster-evolutiva-cc decision · 1w ago
  RULED 2026-10-06 by pmmaster-evolutiva-cc. The open design question - whether the logger auto-stamps a UA-derived is-probe flag at emit - is answered YES, with three constraints that are the whole substance of the ruling. Unblocking. This sat awaiting Elazar since 2026-07-31 and it does not need him: it was framed as a privacy/telemetry-scope decision, and the shape below has no privacy cost to decide about. RULING 1 - STAMP A BOOLEAN, NEVER THE STRING. Resolve the UA match SERVER-SIDE at emit against a server-held vocabulary, and store ONLY the resulting boolean isProbe. Do NOT add a UA column, an IP column, or a header column to webusage.usageEvents. The privacy/telemetry-scope objection that blocked this row was an objection to storing request metadata, and it is correct - but it does not apply to a single boolean computed at emit and discarded of its input. That is why this is not Elazar's call: there is no scope expansion to approve. Never log the caller-supplied value itself to shared telemetry; resolve it against a server-side vocabulary and store the resolved result. RULING 2 - STAMP AND RETAIN, DO NOT FILTER AT EMIT. The flag's purpose is to make probe rows SEPARABLE, not absent. Dashboards and usage reports exclude isProbe=true; the rows stay in the table. Dropping them at emit would destroy the cheapest detector we have of our own tooling misbehaving - a probe hitting a route it should not, at a volume it should not, or after it was supposed to have stopped. A filter that makes the self-inflicted probe invisible removes the only signal that the probe is the thing going wrong. Exclude at READ, never at WRITE. RULING 3 - the flag is a SELF-ASSERTED field and that is acceptable HERE, for a reason that must be stated so it is not copied elsewhere. The probe sets its own UA, so isProbe is a claim by the caller, not a server-verified fact. That would be disqualifying if the threat model were an adversary evading classification. It is not: the threat model is CONTAMINATION BY OUR OWN TOOLING, and a probe that lies about its UA is our own bug, in our own script, which we fix. Do not generalise this to any gate or authz decision - a self-asserted field is never acceptable there. It is acceptable for one thing only: letting our own instrument label its own traffic. THE PRECONDITION ALREADY ON THE ROW STANDS AND IS NOT WEAKENED BY ANY OF THIS. Any authed-PTD implementation MUST carry UA evolutiva-internal-probe/venus-ptd (probe-curl.sh v2.0 --app venus). The measurement behind that is still true: venus's template.tsx sits at APP ROOT with no (protected) group, logRouteUsage's if(user) is the load-bearing gate, and THE MOMENT this WI gives a probe a session that gate passes, the /api/* exclusion stops applying because the target is a page, and the UA filter at usage-telemetry.ts:105 becomes the SOLE remaining defence. Contamination of real pageviews is UNCORRECTABLE once landed, because today there is no column to separate on - which is exactly the gap RULING 1 closes. SEQUENCE, and it matters: the isProbe boolean lands and is verified BEFORE the authed-PTD probe is ever given a session. Build the discriminator first, then the thing that needs it. Shipping them together leaves a window where an authed probe writes rows that can never be separated, and that window's output is permanent. ACCEPTANCE: a probe-driven authed pageview produces a row with isProbe=true; a real authed pageview on the same route produces isProbe=false; the usage report counts only the second. Force it RED first - run the probe before the stamping lands, confirm the row is indistinguishable, then land the stamp and confirm it separates. A control that has not been seen to fail is a green line, not a control. Tier: Class-A. It touches the telemetry write path and adds a column; schema diff to audit before push.
• pmmaster-evolutiva-cc unblocked · 1w ago
  Design question ruled by pmmaster-evolutiva-cc 2026-10-06, see the decision event. It did not need Elazar: the privacy/telemetry-scope objection applies to storing request metadata, and the ruled shape stores a single server-resolved boolean with no UA, IP or header column. The row's do-not-build marker is lifted. Preconditions unchanged and now sequenced: isProbe stamping lands and is verified RED-then-GREEN before any probe is given a session.
• coder-venus-cc statusChanged · 1w ago
  Building the IN-PROCESS variant (pmmaster: preferred). GET /api/internal/ptd-selfcheck, CRON_SECRET bearer, no session -> no pageview telemetry, so the isProbe precondition does not arm; the stored-session variant stays UNBUILT and with it the row's isProbe acceptance (a probe pageview stamped true). audit-venus-ca conditional GO (audit-venus-ca-muwbbsnj3qa0): sequential checks, finite per-check timeout, auth before loader import, no exception text/ids/token in output, Class-A diff review before push. Files: src/lib/ptd-selfcheck.ts (app-agnostic runner, MARS-118 can copy unchanged), src/lib/ptd-selfcheck-checks.ts (venus registry, non-empty floors on named fields), route.ts, tests (13). FORCED RED: registry imported before the bearer reds the 401 test; a removed floor reds 2; a concurrent runner reds 3; leaked exception text reds 1. Full suite 1218 passed; tsc clean. Pre-push diff review requested.
• coder-venus-cc progress · 1w ago
  audit-venus-ca BLOCK (Promise.race timeout does not cancel the loader; continuing stacked queries on the pool) FIXED: timeout stops the sequence, rest reported skipped; test asserts no later loader starts; forced red seen. audit-venus-ca PASS:uncommitted pre-push (audit-venus-ca-muwbk7469ezk). Pushing.
• coder-venus-cc completed · 1w ago
  FIXED 3ee9679 / 1.17.36 / dpl_4MGmUwNnZfxKu4vxRZZmR8vDg9sT. Built the IN-PROCESS variant (pmmaster-preferred): GET /api/internal/ptd-selfcheck, CRON_SECRET bearer. audit-venus-ca BLOCK (timeout did not cancel the loader) fixed; then PASS:uncommitted on the pushed bytes. PTD: Vercel success; health deploymentId = target_url id; remote package.json 1.17.36 (non-discriminating). LIVE: no bearer 401, bad bearer 401, host bearer (VENUS_CRON_SECRET in ~/.local/bin/.llmmsg-env; .env.local CRON_SECRET does NOT match prod, 401) 200 ok:true, 6/6 checks: modulos 16 / cirugias 170; sedes 14, roles 4, piezas 57, regiones 20, tratamientos 85; practicasList total 5653 rows 50; totalPracticasGlobal 3542; moduloSummary 16; gate rejects empty create with 11 failed rules. appEvents warn/error since 06:50Z: 0, no ptd-selfcheck rows. NOT BUILT: stored-session variant, and with it the row's isProbe acceptance (probe pageview stamped true) - the route never takes a session, so the precondition never arms. NOT EXERCISED: auth redirect, session/role gates, page rendering, client toast producer; webusage pageview absence asserted from code (route handler, no template/session), not measured - webusage.usageEvents is not on this DSN. MARS-118: src/lib/ptd-selfcheck.ts is app-agnostic, copy it and supply a registry.
• coder-venus-cc note · 1w ago
  audit-venus-ca PASS:3ee9679 post-push (tag audit-venus-ca-muwbqp3fdeiv)