venus99: advisor hygiene - duplicate authId index, evaluadoresExternos FK cover, applog_notify_error pin

Sub-tickets

Activity

• db-venus-cc created · 1w ago
  parent=#4553
• db-venus-cc statusChanged · 1w ago
  harness 11 pass / 0 fail; awaiting audit PASS on digest before apply
• db-venus-cc note · 1w ago
  audit ask to audit-venus-ca tag db-venus-cc-muztd5gkwbk7; digest sha256 bc052207a9996e52ee2435c24c48280cc7078d4edb6cea917512aa2d1b8c2b7d (5546 B).
• audit-venus-ca audited · 1w ago
  audit fail: Pre-apply source and SELECT-only live catalog review of uncommitted venus99-advisor-hygiene.sql 5546B sha256 bc052207a9996e52ee2435c24c48280cc7078d4edb6cea917512aa2d1b8c2b7d; harness sha256 114beacd923b500b7f04511d34b788e8207282b34d56a79c826ad34b57cee236
  payload

  {"scope":"Pre-apply source and SELECT-only live catalog review of uncommitted venus99-advisor-hygiene.sql 5546B sha256 bc052207a9996e52ee2435c24c48280cc7078d4edb6cea917512aa2d1b8c2b7d; harness sha256 114beacd923b500b7f04511d34b788e8207282b34d56a79c826ad34b57cee236","outcome":"fail","evidence":"BLOCK: FK-cover postflight accepts any valid index whose first indkey=userId, including partial/wrong-shape and not necessarily named ix_evaluadoresExternos_userId; CREATE INDEX IF NOT EXISTS can silently skip wrong same-name object. Require target-name absence preflight, plain CREATE, exact OID/shape/full coverage postflight and forced-red wrong-shape arm. Independent read-only live catalog: two authId indexes byte-identical unique/valid, scans 42965 vs 0; FK-cover index absent; applog_notify_error SECURITY INVOKER/proconfig NULL; trigger enabled O/tgtype 5. No prod writes or DDL by audit. File and harness uncommitted; no apply until committed/pushed blob rehashed and exact-byte PM GO. Verdict DM db-venus-cc re db-venus-cc-muztd5gkwbk7.","reportRef":null}

• db-venus-cc audit-finding · 1w ago
  audit-venus-ca BLOCK:bc052207 (tag audit-venus-ca-muzterhdo2ts): FK-cover postflight accepted any index leading on userId; IF NOT EXISTS skipped same-name objects. Fixed: named-index preflight, no IF NOT EXISTS, exact-shape OID-bound postflight, 5 new red arms; harness 21/0. New sha256 5cccbd64a8325146cc664e61d910aa510c362a1ec3f5a96fb59018cbbe43e4d8. Handoff commit 3648fc06 sent for push + re-review (tag db-venus-cc-muztjk5sjzhq). Apply waits for audit PASS on the pushed blob + PM exact-byte GO.
• db-venus-cc note · 1w ago
  audit-venus-ca SOURCE PASS:5cccbd64a8325146cc664e61d910aa510c362a1ec3f5a96fb59018cbbe43e4d8 at 3648fc06 (tag audit-venus-ca-muztkghc16j4). Not apply GO: needs pushed-blob rehash + PM exact-byte GO.
• audit-venus-ca audited · 1w ago
  audit pass: Source-only review of local committed SQL blob 3648fc066c5d8fa96a092f416bcfb747e1191bad sha256 5cccbd64a8325146cc664e61d910aa510c362a1ec3f5a96fb59018cbbe43e4d8 6181B and harness sha256 c1708d95c63632544e02267569b3eb75b5acd7d49f24b32ea8e8a1ae03571c83 5385B; not pushed at audit read
  payload

  {"scope":"Source-only review of local committed SQL blob 3648fc066c5d8fa96a092f416bcfb747e1191bad sha256 5cccbd64a8325146cc664e61d910aa510c362a1ec3f5a96fb59018cbbe43e4d8 6181B and harness sha256 c1708d95c63632544e02267569b3eb75b5acd7d49f24b32ea8e8a1ae03571c83 5385B; not pushed at audit read","outcome":"pass","evidence":"SOURCE PASS: corrected preflight rejects target name; unconditional CREATE; exact named-index postflight pins rel/btree/one userId key/nonunique/valid/ready/no predicate/no expression. Harness source has same-name and partial/expression/extra-key/unique red arms with rollback checks; 21/0 is db-venus-cc report, not audit execution. Prior independent SELECT-only prod read matched duplicate indexes, absent FK cover and unpinned function/trigger state. origin/main still 379015c at read; NOT pushed-blob verification, NOT APPLY GO. Rehash pushed blob and obtain PM exact-byte apply GO; no audit DDL/writes or production behavioral arm. Verdict DM db-venus-cc re db-venus-cc-muztjk5sjzhq-audit-venus-ca.","reportRef":null}

• db-venus-cc note · 1w ago
  3648fc0 pushed (coder-venus-cc tag coder-venus-cc-muztmoz9v2nn). origin/main blobs rehashed by db-venus-cc: sql 5cccbd64...43e4d8, harness c1708d95...571c83 - match. PM GO conditional on audit-venus-ca PASS for the pushed blob; awaiting.
• audit-venus-ca audited · 1w ago
  audit pass: Pushed-blob confirmation of prior source PASS: origin/main=46efe2a contains db handoff 3648fc066c5d8fa96a092f416bcfb747e1191bad
  payload

  {"scope":"Pushed-blob confirmation of prior source PASS: origin/main=46efe2a contains db handoff 3648fc066c5d8fa96a092f416bcfb747e1191bad","outcome":"pass","evidence":"Verified `git show origin/main` SQL sha256 5cccbd64a8325146cc664e61d910aa510c362a1ec3f5a96fb59018cbbe43e4d8 and harness c1708d95c63632544e02267569b3eb75b5acd7d49f24b32ea8e8a1ae03571c83, same committed bytes previously source-passed. NOT APPLY GO. No audit DDL/prod writes; db lane still needs PM exact-byte authorization and post-apply catalog readback. Confirmation sent db-venus-cc re db-venus-cc-muztjk5sjzhq-audit-venus-ca.","reportRef":null}

• db-venus-cc note · 1w ago
  APPLIED 2026-10-08 ~17:40Z via DATABASE_URL_DIRECT, bytes sha256 5cccbd64...43e4d8 (audit-venus-ca pushed-blob PASS tag audit-venus-ca-muztner6azh2 + coder-venus-cc conditional GO tag coder-venus-cc-muztmoz9v2nn). In-txn postflight passed, COMMIT. Readback: users_authId_unique absent, users_authId_idx intact, ix_evaluadoresExternos_userId btree(userId), applog_notify_error proconfig {search_path=pg_catalog, public, pg_temp}, trigger tgtype 5/O, appEvents inserts after apply OK. Advisors re-run: the 3 targeted lints cleared (security 19->18, performance 88->87; unused_index +1 = the new index, expected). NOT exercised: pg_notify delivery to the applog listener after the pin (harness proved it on pg-harness only). Handoff commit aeadbfe (pending->applied + schema.md) sent for push. Log: scratchpad venus99-apply-20261008T174006Z.log.
• db-venus-cc completed · 1w ago
  venus99 applied + verified; aeadbfe handed to coder-venus-cc for push.
• db-venus-cc note · 1w ago
  Repo record landed: aeadbfe pushed to origin/main (coder-venus-cc tag coder-venus-cc-muztqskra2sb); applied blob sha256 f9a8fa1c...3f3fbb = 5cccbd64 bytes + APPLIED header line.