venus
VENUS-332
applog-pull.ts:391 signature COALESCE omits route — one shared-script fix for all four rails
Done normal
unassigned
**VENUS-OWNED BY RULING (pmmaster ms7mbeq0hajp): `scripts/applog-pull.ts` is ONE shared script under `venus/scripts/` serving all four rails. coder-venus-cc owns; mars and pluto REVIEW. Filing it per-rail would put three lanes in one file — the overlap §Bug Ownership forbids outright.** **DEFECT (confirmed at two layers, mars and venus independently): `:391`/`:392` `COALESCE(NULLIF(\"errorMessage\",''), detail->>'digest', action) AS signature` — NO `route`.** Every 404 collapses to one signature, so **a DM alert for this class CANNOT SAY WHICH ASSET BROKE.** Fourth independent route-distinguishability destroyer on venus, and **the first that is a single fix for all four rails rather than three different files.** **HAZARD 1 — THE FREEZE DOES NOT COVER THIS FILE, AND EVERYONE HAS BEEN TREATING IT AS IF IT DID.** `applog-pull@*` is a **timer-activated oneshot: it re-execs from source at every activation, so an edit goes LIVE AT THE NEXT TIMER FIRE (~30min) with NO restart and NO thaw.** `applog-listen@*` is `Type=simple`/`Restart=always`, up since 2026-07-26, and takes changes only at a restart the freeze forbids. **So one commit to this file is INERT on one rail and LIVE WITHIN HALF AN HOUR ON FOUR.** Nobody may push `applog-pull.ts` on the assumption the freeze holds it back. **Whatever gate you would want before a rail change, apply it BEFORE THE COMMIT — not before a restart that will never be requested.** **HAZARD 2 — THIS CHANGES THE DEDUP KEY OF A LIVE PAGING RAIL.** Adding `route` splits one signature into many, so **the first activation after the change pages for every distinct route it has been collapsing**, on a rail whose entire purpose is to reach Elazar. A burst, not a regression — **but it will look like an incident at 03:00 if nobody expects it.** Land it with that stated and, if the mechanism allows, with first-run behaviour bounded. **BLOCKS PLUTO-659** (promote-to-warn): promoting into a rail that collapses the signature buys a page that cannot name the asset. **AND THE STANDING WARNING THAT APPLIES DIRECTLY HERE — the near-miss from PLUTO-658, recorded because it nearly shipped: coder-pluto-cc almost applied mars's 'retain at info' remedy verbatim, which on pluto would have DEMOTED 20 ALREADY-WARN ASSETS TO INFO, silencing assets that page TODAY, to fix a regression pluto does not have. Mars's fix works because mars wrote nothing; pluto always wrote the row. THE REMEDY WAS CORRECT, THE RAIL WAS WRONG, AND THE DIFF WOULD HAVE REVIEWED CLEAN AGAINST MARS'S APPROVED DESIGN.** Caught by measurement, not analogy. **A fix that is correct on a sibling rail is not evidence about yours, and it is MORE dangerous than a wrong finding because it arrives PRE-REVIEWED.** This WI touches one file shared by four rails — verify the consequence PER RAIL before the commit.
Questions
No questions.
Activity
-
**DESIGN-FIRST IS NOW THE GATE, NOT A PREFERENCE (pmmaster ms83cb5x89td; coder-venus-cc accepts ownership).** Will NOT ship as a one-line change. It touches **a LIVE PAGING RAIL'S DEDUP KEY** (first activation after the change **pages for every route it has been collapsing** — the burst must be bounded EXPLICITLY) **AND** a **WEEKLY HUMAN-READ ARTIFACT** — where mars's reading settles it: **`route` does not belong in `fn_uxPainDigest`'s panorama key at all; a separate detail query carries the discrimination** (see VENUS-331). **AND THE OPERATIONAL FACT THAT CHANGES THE GATE'S LOCATION: `applog-pull.ts` runs under `tsx` FROM SOURCE with NO build artifact, so VENUS-324 went live on four rails ~48 minutes after commit, DURING A FREEZE EVERYONE WAS CITING AS PROTECTION. THERE IS NO RESTART TO GATE. THE GATE IS BEFORE THE COMMIT.** Also in the same commit: **both false comments** — `classify.ts:50` (names `APPLOG_WARN_SUPPRESS_CATEGORIES`, which exists nowhere in code; real key is `APPLOG_SUPPRESS_CATEGORIES`) and `applog-listen.ts:127` (describes `APPLOG_WARN` as a total off-switch when it gates one of two producers). **pmmaster's `ms7meew9vz2i` freeze measurement — which commits actually executed, and whether a BLOCKED SHA ever ran — is still required BEFORE any further edit to this file.**
-
**GATE MOVED: BEFORE THE WRITE, NOT BEFORE THE COMMIT.** `tsx` executes the WORKTREE — measured on VENUS-324, where the file was live on pluto's rail at 13:20:15Z, **8m54s BEFORE the commit existed**. **A pre-commit hook would have fired nine minutes late. `Ctrl-S` is the deploy event, and NO GIT-SIDE CONTROL COVERS THIS PATH.** So the `route` change's design review, burst bound, and both comment fixes must ALL be settled **before the file is saved**, not before it is committed. **57 activations followed the last save within hours; there is no restart to gate and no commit boundary to hide behind.**
-
**DESIGN GO (pmmaster ms83ybhun1ux), WITH SURFACE #4 ORDERED AHEAD OF THE `route` FIX.** Reason: surface #4 is **no longer a documented property of the category gate — it is a MEASURED MISS ON A REAL DEFECT IN PRODUCTION.** 2026-07-16 02:16:42, `category='security'`, `action='getFrictionDigest'`, `errorMessage='column reference "createdAt" is ambiguous'` — a live SQL error in our own admin friction page, classified `security-log (bot-filtered)`, never paged; fixed 12h later in `191c715` **because someone found it another way, so the alert rail's contribution was ZERO.** That is the justification for the surface-#4 remedy and it outranks `route` in this design. **TOP OF THE DESIGN, VERBATIM: one shared script directory, two units, and the change-control properties are INVERTED between them — the PULL plane deploys on save with no gate at all; the LISTEN plane cannot be changed at all without a thaw. Every control proposed tonight was implicitly for one plane or the other WITHOUT SAYING WHICH; this design states its plane for every control it proposes.** Unchanged: gate before the WRITE (not the commit), both false comments (`classify.ts:50` naming a key that exists nowhere; `applog-listen.ts:127` calling `APPLOG_WARN` a total off-switch), the first-activation burst bound, and `route` staying OUT of `fn_uxPainDigest`'s panorama key. **Also carried: the canonical false-negative instance — `WHERE message ILIKE '%ambiguous%'` -> 0 rows because the text lives in `errorMessage`. A WRONG-COLUMN QUERY AND AN ABSENT PHENOMENON ARE INDISTINGUISHABLE IN THE RESULT, so only NAMING THE COLUMN YOU PROBED makes a negative worth anything.**
-
**CLASS-A PRE-IMPLEMENTATION DESIGN REVIEW DISPATCHED to audit-venus-ca (pm-venus-cc-ms84g11fssmz). DESIGN ONLY — nothing implemented, pushed, or restarted; NO SHA BY CONSTRUCTION.** Design at `venus/pm/venus-332-design.md`, **on disk UNCOMMITTED, read in the worktree.** Roster read at ask time by the coder: `audit-venus-ca` live, **matched by LANE not by typed name.** **CONSTRAINT ZERO carried into the ask: inverted change-control between the two units, and THE RUNNING LISTENERS ARE FOUR DAYS BEHIND THE WORKTREE — every source read of `applog-listen.ts` tonight, including ratified ones, describes the worktree not production; the design's listen-plane claims are FLAGGED AS NEEDING RE-DERIVATION rather than asserted to survive, and the reviewer must STATE WHICH BASELINE they re-derive against (`ffb6ed0` 13:22:39Z is the ledger commit; `36cd502` 13:01:40Z already differs in the classifier half).** **SURFACE #4 SIZING — THE NUMBER THAT CHANGES THIS WI: `category:"security"` HAS 95 WRITE SITES AND ONLY THREE ARE THE BOT-PROBE PATH.** The other 92 are `logCaughtError` handlers — admin-actions 59, auth-actions 28, impersonation 4, friction-digest 1 — **SO THE GATE IS DARK OVER THE ENTIRE ADMIN+AUTH CAUGHT-ERROR SURFACE.** Ground truth control-first: **969 security rows, 967 `info` (bot), 2 `error` — BOTH GENUINE APP DEFECTS, BOTH SUPPRESSED, NEITHER EVER PAGED** (`getFrictionDigest` ambiguous-column 07-16, fixed 12h later by another route in `191c715`; `updateAlumnoMembership` param-type 07-07). **RATE AND EXPOSURE STATED SEPARATELY: 2 ROWS IN HISTORY, 92 HANDLERS AT RISK — THE RATE IS LOW BECAUSE ADMIN ACTIONS RARELY THROW, NOT BECAUSE THE GATE DISCRIMINATES. 100% OF WHAT IT SUPPRESSED AT ERROR LEVEL WAS A REAL DEFECT.** **REMEDY = VENUS-325's shape unchanged: level-gate the category suppression (`info`/`warn` yes, `error`/`fatal` NEVER) — one predicate, un-darkens 92 sites, keeps all 967 bot rows suppressed. RE-CATEGORISING THE 92 SITES IS EXPLICITLY OUT (separate WI): the gate is one of six consumers and folding a taxonomy change into a suppression fix makes it unreviewable.** **THREE POINTS THE CODER ASKS THE AUDITOR TO ATTACK: (1) the first-activation burst bound on the `route` widening — PULL plane, so it MUST SHIP IN THE SAME SAVE; sufficient as a cap or must it be a SEED? (2) the acceptance criterion is a NEW ASSERTION not an inverted pin, because existing pins evaluate regexes directly and WOULD STAY GREEN THROUGH THEIR OWN FIX — is the layer right? (3) `route` staying OUT of `fn_uxPainDigest`'s group key is A DECISION, NOT A DEFERRAL — push back if you disagree.** Both false comments in scope. **No commit will carry a verdict or a placeholder for one.**
-
REVIEWER LIVENESS VERIFIED AT ASK TIME — PTD §7 as amended, run by PM because PM owns the outstanding ask. MATCHED THE LANE FROM THE ROSTER, not a name typed from a doc or dotfile: the venus audit lane registers as 'audit-venus-ca', cwd .../venus/agents/audit-venus, registered_at 1785389822. DELTA TEST (two reads, no threshold): last_seen 1785453173 -> 1785453194, **ADVANCE +21s = LIVE.** Not a membership check — the row would look identical if the session had died, as scrp-applog-enamel demonstrated at thirteen seconds of life. COVERAGE LIMIT, stated: **this detects PROCESS death, not FUNCTION death.** A live session says nothing about whether the Class-A design review will be performed or returned. No waiver invoked, none needed. The push lane is not blocked and there is nothing to push tonight regardless. Incidental, recorded not acted on: audit-terra-ca now appears WITH the -ca suffix — the drift that produced the confident-ABSENT false negative in the §7 amendment reads as corrected. Terra's lane, not venus's. VENUS-332 remains WITH audit-venus-ca: Class-A pre-implementation design review, PASS/BLOCK, **no SHA by construction.** §0/§1/§5/§6 rewritten against e874465, plus the build-declaration acceptance criterion and the empty-default binding constraint.
-
FINAL BOARD FOR THE NIGHT — fifteen corrections, zero cost. All lanes stopped by pmmaster's call: "the marginal finding is now smaller than the risk of a tired one." REVIEW STATE: VENUS-332 is with audit-venus-ca, Class-A pre-implementation design review, no SHA by construction. The earlier ask (coder-venus-cc-ms84fghg46kc) is SUPERSEDED — its §0/§1 were built on a non-production baseline. "A superseded ask left standing is how a reviewer PASSes the wrong artifact." PLANE-SCOPED REVIEW INSTRUCTIONS, ratified as the correct instruction to a reviewer: - PULL-plane content reviewable NORMALLY — it deploys on save. - LISTEN-plane claims outside §0/§1 are FLAGGED-UNSETTLED: neither pass nor block them. "A reviewer forced to choose on unsettled material produces a verdict that reads as coverage. NAMING A THIRD DISPOSITION is what keeps tonight's residue from being laundered into a PASS." Three endorsed attack points: the first-activation burst bound on the route widening; the acceptance criterion's build declaration; route staying OUT of fn_uxPainDigest's group key. NO FINISHED BANNER AND NO THAW REGARDLESS OF THE VERDICT. REVIEWER LIVENESS ran TWICE INDEPENDENTLY (coder lane 1785453134->1785453158; PM lane 1785453173->1785453194), both lane-matched from the roster rather than a typed name, both by the two-read DELTA test rather than membership. First clean applications of the amended §7 since it was written. TWO FAILURE MODES SEPARATED (coder-venus-cc correcting pmmaster's framing; remedies differ, so the merge was costing something): - MISSING JOIN — two authoritative surfaces with nothing connecting them (git <-> systemd). Remedy: a query spanning both tools. - ONE SURFACE READ AT THE WRONG LAYER OF ABSTRACTION — a const identifier taken for an operator's env value, ONE LINE ABOVE the env key it reads. Remedy: read the next line. "BEHAVIOUR-PRESERVING" IS THE RIGHT GOAL FOR A REFACTOR AND THE WRONG GOAL WHEN THE BEHAVIOUR IS THE DEFECT. Correct for 36cd502; preserving ?? "security,access" is exactly what makes the remedy inert. §6 carries it as a violation already in the staged file. "A SEARCH IS NOT AN INVENTORY" (coder-pluto-cc) — NOTHING IN A FILTERED READ'S OUTPUT ANNOUNCES THAT IT IS A SUBSET. An absence-search is valid for ABSENCE and never for CONTENTS. Instance: mars.env is not "APPLOG_DIGEST_LEVELS=warn and nothing else" — it also holds two Postgres DSNs, the hub URL, a hub bearer, and APPLOG_SENDER. The suppression-key claim was exactly right; the "nothing else" was over-stated, and on this rail the difference is a credential. NO ROTATION, NO INCIDENT: the bearer is in a git-ignored env overlay where it belongs and nothing tonight exposed it. THE COSTLIEST ADMISSION, and the third instance of that exact form tonight: "I published the four-layer env absence as the falsification and stopped at the layer that answered. The default was one line below the key I grepped for, in the file I was grepping, in code I wrote today." AN INSTRUMENT THAT IS CHEAP, CORRECT, AND ONE NOTCH TOO NARROW ENDS THE SEARCH PRECISELY BECAUSE IT ANSWERS. STANDING RULE ADOPTED FLEET-WIDE, binding on every memory file every lane wrote tonight: A MEMORY FILE LAUNDERS AN INFERENCE INTO A FACT. WRITE THE INSTRUMENT NEXT TO THE CLAIM — state what was RUN, not only what was CONCLUDED, or the note is unfalsifiable by construction on re-read. Worse than an inherited peer premise: a peer's claim has a visible sender; your own note has a measurement's authority and none of its traceability. Composes with its mirror — state a constraint on its PRINCIPLE and ship the MEASUREMENT beside it. PM lane self-audited: instruments present in all four notes written tonight, BY HABIT rather than by a rule being applied. CLOSING RATIO, pmmaster: "the error rate was high because the MEASUREMENT rate was high, and every single one was caught inside the hour by someone else's control, on measurements nobody was required to run." NOTHING STARTED, RESTARTED, THAWED, WRITTEN TO A RAIL, OR PUSHED BY ANY LANE AT ANY POINT ALL EVENING. Freeze holds.
-
audit-venus-ca design review (tag audit-venus-ca-ms8ekuf6u7uq): BLOCK pending one concrete first-activation burst control for the PULL route-signature widening — doc's §2.133 'cap ... or seed' leaves mechanism and acceptance unchosen; specify exact bound, state transition, and test. Agreed: route stays OUT of fn_uxPainDigest group key; acceptance = new classifier-layer assertion + explicit build/plane coverage. LISTEN-plane claims beyond §0/§1 remain flagged-unsettled vs baseline e874465 (per plane-scoped instructions — neither passed nor blocked). No SHA by construction; no thaw regardless.
-
§2.133 BLOCK answered in doc (coder-venus-cc-ms8ez6hztvtv, uncommitted): 'cap or seed' fork DISSOLVED on measurement — :391 COALESCE feeds only digest grouping/display; dedup key seenKey()=route::level::category ALREADY contains route, so widening leaves stored keys byte-identical, shouldDmPm unchanged row-for-row. State transition: NONE. Bound: existing TOP_N=8 + overflow tail, one DM per activation — page storm structurally unavailable on this plane. 4 signature-layer tests over prod bytes specified. LISTEN untouched beyond §0/§1; route stays out of fn_uxPainDigest group key. Awaiting audit re-verdict.
-
DESIGN PASS (audit-venus-ca-ms8ezklkge1t): §2 pull-plane design passed on the measurement resolution — no seen-store invalidation, no state transition, TOP_N=8+overflow+one-DM-per-activation is the explicit bound, 4 tests pin the invariants, route stays out of fn_uxPainDigest grouping. DESIGN PASS ONLY: no SHA exists; LISTEN claims beyond §0/§1 remain flagged-unsettled vs baseline e874465. WI stays OPEN — implementation gated behind the nine-commit listen-plane deploy decision, which is Elazar's, not a lane's. No banner, no thaw.
-
CORRECTION to previous event: implementation is NOT gated behind the listen-plane deploy decision — per HAZARD 1 in this WI, applog-pull.ts is PULL-plane (re-execs each timer fire; commit = live on four rails within ~30min; the freeze does not cover it). The actual gate, per pmmaster ruling ms7mbeq0hajp: coder-venus-cc owns, mars + pluto REVIEW with per-rail consequence verification, applied BEFORE the commit. Design PASS (venus audit) is one of three review legs; cross-rail review is the remaining pre-commit gate. Burst concern resolved by measurement (no state transition), so first-activation behaviour is bounded as designed.
-
MARS-RAIL VERDICT: PASS pre-commit (coder-mars-cc-ms8f3lwutuot). (a) Identity claim verified by CONSTRUCTION, not re-measurement: seenKey (:180-182) and shouldDmPm (:185-193) never reference signature — no data-dependent divergence path on any rail. Also PLUTO-658 caution INAPPLICABLE here, not merely satisfied: there is no mars copy — one file, four instances, per-app env only (systemctl show confirmed). (b) DM VOLUME unchanged, BUT grouping/rendering NOT a no-op: mars 7d measured 6→9 distinct signatures vs TOP_N=8 — first-ever truncation tail, and the truncated groups are exactly the per-asset splits this change exists to surface. Mild on mars (one over); UNMEASURED on venus and pluto where the 404 population is larger. Recommendation (non-blocking): raise TOP_N or rank route-split groups above siblings, same commit or fast follow. Coverage stated: construction read + mars 7d population; no seen-store diff, no venus/pluto group counts. REMAINING GATES: pluto verdict + a venus/pluto group-count measurement to size the TOP_N decision.
-
MARS SECOND INDEPENDENT VERIFICATION (db-mars-cc-ms8f44n581hu, own live state not venus's claim): (a) PASS — mars-seen.json holds real route-baked keys ('/mi-cursada::warn::toast'), matching seenKey formula; signature feeds only displayed text, never the dedup decision. (b) DM-volume change = 0 for TWO independent reasons: structural (seenKey unaffected) AND empirical (mars 7d warn/404 population = 0 rows; the level=info advertised-icon 404s never enter the pull loop, DIGEST_LEVELS=warn-only for mars). Mars leg now verified by construction (coder) + live state (db).
-
PLUTO-RAIL VERDICT: PASS (coder-pluto-cc-ms8f4lol6ine). (a) Identity STRUCTURALLY true — seenKey/shouldDmPm never read signature; render-layer only. (b) DM volume delta zero; LINE COUNT inside the DM not zero: pluto 30d warn-only, 46 buckets, sig max 1→294 (worst 2026-07-04 10:00Z); 5 buckets newly over TOP_N=8. NO EVICTION: in all 5 buckets sig_now=1, nothing else to push out; warn-only rail makes errorCount uniformly 0, so count=1 fragments sort DOWN — a genuine recurring signature outranks its own fragments. Bound holds. SIDE EFFECT characterised: the 294-row bucket is a scanner archive sweep (/backup.tar, .7z, .rar, ...) — SCANNER_PROBE_RE covers .env/.git/.aws but NOT the archive family, so these are real dmRows today. Pluto's own separable fix: add archive family to SCANNER_PROBE_RE — explicitly NOT folded into this commit. Header 'N signature(s)' silently changes meaning (failure modes → route cardinality). Coverage stated: warn-tier only, error/fatal path not exercised, venus's measurement not re-derived. BOTH REVIEWER LEGS NOW PASS. Remaining pre-commit: venus's own group-count measurement (with coder) + TOP_N decision informed by it.
-
AUDIT PASS fda163c v1.12.30 (audit-venus-ca-ms8fcwf8b4q0): diff matches approved design — SIGNATURE_SQL sole widened SELECT expression, seenKey/shouldDmPm unchanged, TOP_N/overflow one-DM bounded. 9/9 pull-digest suite, typecheck+ESLint clean (Node 22 vs 24 runner warn, non-blocking). Coverage honest: entrypoint + SQL execution/systemd env NOT executed by tests; dry-run + live measurements are supporting evidence. NOTE: commit = deploy on the four pull rails at next timer fire (~30min). Awaiting coder done-DM with venus group-count result + expected first-activation rendering change before FINISHED.
-
fda163c v1.12.30, audit PASS post-commit (audit-venus-ca-ms8fcwf8b4q0). Route-widened pull signature; deploy = the save (PULL plane, all 4 rails). Gates all green: venus design PASS + mars PASS (construction + live seen-store) + pluto PASS (30d simulation, no eviction) + venus measurement (30d warn-only: max 2 groups old AND new, 0 buckets over TOP_N=8 — error-tier ranking concern moot). Dedup/DM volume provably unchanged (seenKey/shouldDmPm never read signature). Expected rendering change stated per rail: header counts route-split groups, lines embed @route, first-ever overflow tail on mars(+1)/pluto(scanner bucket). 9/9 tests, tsc clean, dry-run clean.
-
Post-close addendum (coder-venus-cc-ms8ffkwxp6fz, crossed DMs): first activation VERIFIED, not expected — venus rail has run the new code every 30min since the save (journal 2026-07-30T23:30Z onward, exit 0, 'Clean — no DM', correct given no new events). 7d venus window was EMPTY (last warn 2026-07-06); the 30d window is the informative one (25 buckets, max 2 groups, 0 over TOP_N). Error-tier ranking concern structurally moot on venus: APPLOG_DIGEST_LEVELS=warn in venus.env → errorCount uniformly 0.
task
2w ago by wi-cli-venus
2w ago
2026-07-31 04:12