venus has no never-write-personal-data-to-appEvents rule; terra does
Surfaced by VENUS-386. coder-terra-cc caught addMissingParticipant writing the approvers free-text motivo into appEvents.detail, where the realistic motivo names a student ("admin: agregar a <nombre apellido> que quedo afuera"). They caught it because terra carries an EXPLICIT never-write-personal-data-to-appEvents ruling and checked the write against it. I grepped shared/md/venus-commons.md and ../shared/md/evolutiva-commons.md for any equivalent: NOTHING. So venus relied on each author noticing case by case, and one author did not - me, in a p1 action, two commits ago. The single write is fixed in 4c5a9c9 (prefix + length only). THIS WI IS THE RULE, not that write: appEvents is shared, long-lived and widely read, every logEvent/logInfo/logCaughtError call site is a potential leak, and NOTHING enumerates or enforces it. Two legs: (a) write the invariant into venus-commons and propose it for evolutiva-commons, taking terras wording since theirs is the one that worked; (b) audit existing call sites for free-text and name fields already in detail - the corpus is live prod data, so a finding is a data question, not only a code one. Do NOT assume the count is small: venus has 700+ tests and this class had zero coverage.
Activity
-
Leg (b) code: patient-DNI search value reached appEvents.detail via raw filters at 7 log sites (practica-queries getPracticasList/getPracticasGrainList, report-actions getReporteSummary/getAlumnoReporteDetail/getReporteDataset, csv export x2). New src/lib/log-filters.ts filtersForLog() drops pacienteDni, logs pacienteDniPresent only. Measured exposure: 855 logged filter rows, 1 with the key, 0 non-empty - prophylactic. Inventory still open for leg (a): actor holds user emails on 1236 rows; to/recipients/recipientEmail/author/email keys carry addresses; toast/error-shown message text embeds emails. Those are policy (staff identity as actor), not this push.
-
Leg (b) shipped: 7287353, v1.17.36. PTD: Vercel status target_url 8L6Fk9UXTXYqg2LKhHbnay7NHXtq == health deploymentId dpl_8L6Fk9UXTXYqg2LKhHbnay7NHXtq, dbOk true; 0 warn/error appEvents since push 07:12:22Z. Audit PASS:7287353 (audit-venus-ca). NOT EXERCISED: a live caught error on the 7 sites.
-
Leg (a) pre-push: venus-commons.md gains §No Patient or Student Data in appEvents (DNI, nombre, free-text; log shape only; filtersForLog + scan test) plus the divergence line (actor = staff email, burst-dedup on userAgent). Follow-ons opened per OPTION C: VENUS-452 actor->userId, VENUS-453 recipient hashing, VENUS-454 email out of toast text. Doc-only push next.
-
Leg (a) shipped: 70f4b40 (doc-only), version 1.17.37. Audit PASS:70f4b408e929598f82c654cb06111f43c8bc0c94 (audit-venus-ca). Vercel deploy status pending at record time; doc-only, no runtime change.
-
DONE, both legs. (b) 7287353 v1.17.36: filtersForLog() strips patient-DNI search values at 7 log sites, whole-src scan test, forced red, PASS:7287353. (a) 70f4b40 v1.17.37 (doc-only): venus-commons §No Patient or Student Data in appEvents (DNI, nombre, free-text; log shape only) + actor/userAgent divergence line, PASS:70f4b408e929598f82c654cb06111f43c8bc0c94. PTD 70f4b40: Vercel target_url B8huXvFWXrGvhRAgLtxNZ2UQzDyb == health dpl_B8huXvFWXrGvhRAgLtxNZ2UQzDyb, remote main 1.17.37 == live, 0 warn/error appEvents since 07:28Z. Follow-ons per OPTION C: VENUS-452 actor->userId, VENUS-453 recipient hashing, VENUS-454 email out of toast text. NOT DONE: proposal of the rule into fleet evolutiva-commons (lane: commons maintainers); no enforcement exists for free-text beyond the filters scan.