Docente roster -> assignable evaluation dropdown

Sub-tickets

Activity

• coder-venus-cc created · 1w ago
• coder-venus-cc blocked · 1w ago
  Depends on db-venus-cc matching the 37-name roster against venus's own users/docente population before assignable-list work starts. Asked 2026-10-07.
• coder-venus-cc parentChanged · 1w ago
  parent=VENUS-480
• coder-venus-cc parentChanged · 1w ago
  parent cleared
• coder-venus-cc note · 1w ago
  Sibling: VENUS-480 (sede toggle), VENUS-482 (delegated authorship).
• coder-venus-cc note · 1w ago
  db-venus-cc match (SELECT only, no INSERT): venus users has NO dni column fleet-wide (dni lives on alumnos/pacientes only) — name-only match. FOUND 2/37 (Puia Sebastian, 2 dup accounts; Stolbizer Federico). MISSING 35/37. venus has NO 'docente' userRoles value at all (active: administrador=1, alumno_postgrado=33, bedelia=1, titular=3) — Puia/Stolbizer are both non-alumno existing users, not a 'docente' role. Dropdown design must decide: are the 35 missing names new user rows (onboarding), or a non-user-linked lookup table? Feeds VENUS-482's ruling too — 'docente' is not an existing role concept in this app.
• coder-venus-cc note · 1w ago
  Elazar confirmed 2026-10-07: roster client-confirmed, venus scope confirmed. Design choice (real user accounts vs standalone lookup for the 35 missing names) still open - awaiting pmmaster/Elazar ruling.
• coder-venus-cc note · 1w ago
  Second client paste (WhatsApp list w/ Dr./Dra. titles) matches the 37-name roster already filed byte-for-byte on names+DNI — no new names, confirms it's the same source doc.
• coder-venus-cc note · 1w ago
  Client sent a second paste 2026-10-08 with emails for 29/37 roster names (saved: terra/pm/client-provided-docs/2026-10-08-docentes-maxilofacial-roster-with-email.md, gitignored). Elazar flagged: do not use hotmail addresses - venus login gates on genuine Google identity (see auth rules), a hotmail address gives no assurance the docente signs in via Google with it. Re-match needed against venus users by email (not just name) where a gmail/non-hotmail address exists; hotmail-only entries still need the design ruling (481/482) before any account path.
• coder-venus-cc note · 1w ago
  Elazar ruling 2026-10-08: keep only gmail/.edu-class emails from the roster (odontologia.uba.ar counts as edu-class); hotmail/yahoo/other free-mail dropped as unusable against venus's genuine-Google-identity login gate. Kept 15/29 with-email names (file updated in place). Still blocked on pmmaster/Elazar design ruling (real accounts vs standalone lookup) before any account path.
• coder-venus-cc note · 1w ago
  Elazar ruling (relayed via pmmaster, tag muyy3pghd63v) 2026-10-07 23:56: do NOT exclude the 22 no-email names from the dropdown - build it to support lookup-only entries with no backing userId. Separately: send each of the 22 a real outbound email asking them to request access via /solicitar-acceso with a gmail address (Elazar approved the send directly per this instruction) - once completed+gmail-matched they upgrade to a real docente account like the 15. Design now 3 parts: (1) docente userRoles value + pre-create 15 real accounts, (2) dropdown supports user-row-backed AND lookup-only entries, (3) outbound campaign to the 22. Class-A (auth role enum + DB writes + email-send path) - audit design-ping required before implementing.
• coder-venus-cc note · 1w ago
  Pushed back before implementing (tag muyy5rzeyllw): venus already has 'titular' labeled 'Docente titular' (practica-roles.ts:91), in STAFF_ROLES (global read, correction-approval, práctica-create, impersonation-adjacent - lines 9,20,40,53,57), with a full working admin flow (/admin/docentes, inviteTitular, auth.users+role+welcome email). Adding a new 'docente' value duplicates this and risks granting 15-22 external people full staff access to real clinical/student data for an attribution-display-only ask. Asked pmmaster: reuse titular as-is (accept full staff perms) vs a no-permission lookup-table evaluador entry (matches lookup-table convention, no account urgency for the 22). HOLDING role-add/dropdown/email until answered.
• coder-venus-cc note · 1w ago
  pmmaster ruling received (tag muyyamujhvs5): option (b) - no new userRoles value, no titular/STAFF_ROLES grant. Build lookup table (coder picks name), optional userId link, no permission. 15-with-gmail and 22-without-email both get lookup rows only, no account requirement. Outbound 'request access with gmail' email to the 22 still goes ahead regardless (Elazar approved directly) - separate from this role-mechanism fix. VENUS-482 unchanged, still blocked, orthogonal. Scoped my share: table+seed is db-venus-cc's lane (DDL), asked them for 'evaluadoresExternos' (id,nombre,userId null FK,isActive,createdAt), seeded with all 37 names (no DNI), userId set for the 2 existing matches. I build getEvaluadoresList()+dropdown once applied. Explicitly NOT wiring into practicaEvaluaciones/evaluadorUserId or PDF attribution display - that's 482's semantics, still blocked, so the dropdown ships unconsumed until 482 rules. Outbound email to the 22 is a separate sub-task, not started yet.
• coder-venus-cc note · 1w ago
  Migration file pushed to db/migrations/pending/venus98-evaluadores-externos.sql (sha 1226f6e, Local-Author: db-venus-cc). Reviewed before push: all 37 names match the client roster verbatim, PK/FK/seed/postflight shape sound, Puia linked by usage (868 appEvents/4 evaluaciones vs dormant dup's 5), Stolbizer unambiguous. Asked db-venus-cc to apply to prod via DATABASE_URL_DIRECT and move pending->applied; I push that follow-up commit. Once applied: build getEvaluadoresList() + dropdown component (unwired, pending 482).
• coder-venus-cc note · 1w ago
  Applied-migration handoff pushed: sha 5a2922e (moved pending->applied, Local-Author db-venus-cc). Prod live: 37 rows, 2 linked, FK intact. HOLDING dropdown/getEvaluadoresList work - audit-venus-ca's pre-push review of this DDL is still in progress (retrospective, applied before PASS per pmmaster note). Will build once PASS:5a2922e lands.
• audit-venus-ca audited · 1w ago
  audit pass: Retrospective exact-byte source review of 1226f6e (sha256 a128e3b9c724fa840fbf8b3c4ad9b340523bc4d49f1af3b482181da2dbb29264) plus SELECT-only post-apply catalog/data readback; NOT a pre-apply authorization
  payload

  {"scope":"Retrospective exact-byte source review of 1226f6e (sha256 a128e3b9c724fa840fbf8b3c4ad9b340523bc4d49f1af3b482181da2dbb29264) plus SELECT-only post-apply catalog/data readback; NOT a pre-apply authorization","outcome":"pass","evidence":"Migration creates display-only evaluadoresExternos with int4 identity PK, nullable users FK, isActive/createdAt, and 37 client-roster names without DNI. Live readback: 37 rows, 37 distinct names, 2 linked; both linked user names correspond and are active. PK/FK present. Owner postgres, RLS false, exact relacl equals sedes; anon/authenticated have no table SELECT, service_role can SELECT/INSERT, agent_ro SELECT, agent_rw INSERT. Identity sequence gives service_role and agent_rw USAGE, anon none. The requested review arrived 00:08 ART; db-venus-cc applied ~00:11 ART and committed applied move 5a2922e before this verdict. This PASS does not retroactively gate or authorize that apply. No live write by audit; no downstream dropdown/PDF behavior exercised.","reportRef":null}

• audit-venus-ca audited · 1w ago
  audit pass: Retrospective post-apply SELECT-only catalog/data review of applied move commit 5a2922e; no apply authorization or live write by audit
  payload

  {"scope":"Retrospective post-apply SELECT-only catalog/data review of applied move commit 5a2922e; no apply authorization or live write by audit","outcome":"pass","evidence":"5a2922e is a 98% rename pending->applied plus two-line applied header; stripping header yields sha256 a128e3b9c724fa840fbf8b3c4ad9b340523bc4d49f1af3b482181da2dbb29264, exact reviewed source. Live pg_attribute: id integer identity-by-default PK, nombre text NOT NULL, userId nullable uuid, isActive boolean NOT NULL DEFAULT true, createdAt timestamptz NOT NULL DEFAULT now(). PK and userId->users FK present; 0 column ACLs, 0 policies, RLS/force-RLS false; relacl/owner equal sedes (postgres, service_role all, agent_ro SELECT, agent_rw CRUD), anon/auth SELECT false. Sequence service_role/agent_rw USAGE true, anon false. Live 37/37 active, 37 distinct names, 2 linked, linked user names correspond to Puia/Stolbizer and active. This validates live structural state but not downstream dropdown/PDF behavior nor exact executed SQL transcript. Apply occurred before audit verdict; retrospective only.","reportRef":null}

• coder-venus-cc note · 1w ago
  Shipped getEvaluadoresList()+EvaluadorSelect standalone, unwired (src/lib/evaluadores-actions.ts, src/components/evaluador-select.tsx). sha 23a9900, v1.17.42, PTD pass (deploymentId dpl_GKNxVCMAYKrunnvLza3mrim5D2du). pmmaster confirmed 482 still open - do not wire into evaluarPractica/practicaEvaluaciones/PDF attribution until 482 rules. Audit ask sent to audit-venus-ca.
• audit-venus-ca audited · 1w ago
  audit fail: Source review of commit 23a9900c19d7bafe0ad94d3a69c48aae66fca461, standalone evaluator lookup and selector
  payload

  {"scope":"Source review of commit 23a9900c19d7bafe0ad94d3a69c48aae66fca461, standalone evaluator lookup and selector","outcome":"fail","evidence":"BLOCK: src/lib/evaluadores-actions.ts:16 exports getEvaluadoresList as a server action without self-auth/authz gate; privileged pool can return 37-name roster once action is referenced. Add authorized-role check inside action. Selector is unwired to evaluation and PDF at reviewed SHA. Static-only; no live action/UI exercised. Verdict sent to coder-venus-cc on thread coder-venus-cc-muyyyt8u9jji.","reportRef":null}

• coder-venus-cc note · 1w ago
  audit-venus-ca BLOCKed 23a9900 (no self-gate on getEvaluadoresList). Fixed: self-gate via getEffectiveUser+isStaffRole, sha 37f70d1, v1.17.42, PTD pass (deploymentId dpl_5CJbXsjTDcKatD9mdRrupYgqDzMi). Re-asked audit-venus-ca.
• audit-venus-ca audited · 1w ago
  audit fail: Source re-review of auth-gate fixup 37f70d1c4eed592882618a3da37a2c859afb63e8
  payload

  {"scope":"Source re-review of auth-gate fixup 37f70d1c4eed592882618a3da37a2c859afb63e8","outcome":"fail","evidence":"BLOCK: getEvaluadoresList self-gates with isStaffRole, which includes bedelia, while claimed evaluator audience and evaluarPractica permit only titular/administrador. Require exact evaluator-role gate or explicit approval/documentation of broader staff access. Selector remains unwired. Static review only; no live action/UI exercised. Verdict sent coder-venus-cc on thread coder-venus-cc-muyz4ycpfmir.","reportRef":null}

• coder-venus-cc note · 1w ago
  audit-venus-ca BLOCKed 37f70d1 (isStaffRole wrongly admits bedelia). Fixed: gate now pickEvaluadorRole (titular/administrador only), sha 52ea655, v1.17.42, PTD pass (deploymentId dpl_9YYhpDKz9DfaQ6zLj9Dwp3v6SEvr). Re-asked audit-venus-ca.
• coder-venus-cc note · 1w ago
  audit-venus-ca PASS:52ea655. getEvaluadoresList()+EvaluadorSelect standalone, gated to EVALUADOR_ROLES (titular/administrador), unwired. Remaining under 481: outbound access-request email to the 22 no-usable-email roster names (Elazar-approved, not started). 482 attribution wiring stays blocked.
• audit-venus-ca audited · 1w ago
  audit pass: Source re-review of fixup 52ea6554090a8996ac80c62a9fbeeae6fc0fa7d5
  payload

  {"scope":"Source re-review of fixup 52ea6554090a8996ac80c62a9fbeeae6fc0fa7d5","outcome":"pass","evidence":"PASS: getEvaluadoresList self-gates with pickEvaluadorRole, same titular/administrador helper as evaluarPractica; bedelia excluded. git grep at SHA shows lookup and selector have no call sites; VENUS-482 evaluation/PDF attribution remains untouched. Static source review only; no live action/UI exercised. Class-S deploymentId PTD reported by coder, not independently read by audit. Verdict sent coder-venus-cc on thread coder-venus-cc-muyz8sza00cu.","reportRef":null}

• coder-venus-cc note · 1w ago
  Unblocked by VENUS-482 ruling (Elazar, 2026-10-09). Wiring EvaluadorSelect into practica-evaluacion.tsx submit form now, optional field.
• coder-venus-cc unblocked · 1w ago
  Unblocked by VENUS-482 ruling; wiring EvaluadorSelect into submit form.
• coder-venus-cc note · 1w ago
  Wired: EvaluadorSelect mounted in evaluación submit form (practica-evaluacion.tsx), optional delegate -> evaluarPractica's displayedEvaluadorExternoId. Audit PASS:410fcab (design + 2 post-PASS fixes). SHA 8c0f011 (v1.18.0) + 410fcab (v1.18.1).
• coder-venus-cc completed · 1w ago
  Wired: EvaluadorSelect in evaluación form -> evaluarPractica displayedEvaluadorExternoId. SHA 8c0f011/410fcab, v1.18.1. Audit PASS:410fcab.