appEvents.actor: write userId, not staff email

Sub-tickets

Activity

• coder-venus-cc created · 1w ago
• coder-venus-cc statusChanged · 1w ago
• coder-venus-cc note · 1w ago
  Pushing: staff keys actor/*By -> *UserId = guard.actorUserId / accountableActorId(effective) (VENUS-111 accountable operator); dropped sentTo/requestEmail at accessRequestInstitutionalNotified; RECIPIENT_KEY += actor|[a-z]+By|sentTo|requestEmail; email-path actor labels annotated recipient-key-ok. No reader of these detail keys in src/scripts/db views (grep). No backfill.
• audit-venus-ca audited · 1w ago
  audit fail: Source review of 847e5c33b1c47707e9637dbe97fcb98f9980f3c4 staff actor email-to-id changes and log-filters scanner
  payload

  {"scope":"Source review of 847e5c33b1c47707e9637dbe97fcb98f9980f3c4 staff actor email-to-id changes and log-filters scanner","outcome":"fail","evidence":"BLOCK: /api/internal/send-email accepts arbitrary request-body actor with only nonempty check and persists it as appEvents.detail.actor at several sites, while recipient-key-ok comments exempt it from new scanner. Bearer caller actor=ana@example.com is a concrete address leak through route log and sendOutboundEmail; require fixed/validated actor and adversarial test. Guard/accountableActorId replacements otherwise appear correct. Static-only; no email or prod event exercised. Verdict sent coder-venus-cc on thread coder-venus-cc-muzs5s1h8i0d.","reportRef":null}

• audit-venus-ca audited · 1w ago
  audit pass: Source re-review of actor-label fixup 8328d095f8cc2348262e5e74d7a2251270d50cbd and 847e5c3 actorUserId replacements
  payload

  {"scope":"Source re-review of actor-label fixup 8328d095f8cc2348262e5e74d7a2251270d50cbd and 847e5c3 actorUserId replacements","outcome":"pass","evidence":"PASS scoped to actor-address removal: send-email route validates actorLabel on both modes before send/log; sendOutboundEmail logs/routes/queues only checked label or fixed invalid-actor; support catch checks label. Staff detail actor replacements use accountableActorId/guard.actorUserId. Static only; no route POST, real email, or prod row exercised. Free-text reason/subject and unrelated address paths not covered. Verdict sent coder-venus-cc on thread coder-venus-cc-muzsdb2ttw20.","reportRef":null}

• coder-venus-cc completed · 1w ago
  Done. SHAs 847e5c3 (1.17.47) + fixup 8328d09 (1.17.49). PTD: live dpl_CgFWesZaqdc5sMY7Fse9yd2zLRxn == Vercel status id for 8328d09; remote package.json 1.17.49. audit-venus-ca BLOCK:847e5c3 (caller-controlled send-email actor) -> PASS:8328d09. Staff keys now <key>UserId = accountable actor id; outbound actor label-checked (route 400s on an address). Not covered: free-text reason/subject; no live route POST or prod row exercised; existing rows not backfilled (no proactive DB edit).