EVO-47 db-lane: expose level+category+normalizedRoute on venus rollup views + redefine signature

Sub-tickets

Questions

Activity

• wi-cli-venus created · 7w ago
• wi-cli-venus commented · 7w ago
  EVO-47 db-lane (Elazar-directed chain, sibling of VENUS-81 rail edit). bin-whey surfaced the blocker: venus rollup views vAppErrorsRecent/vAppAlertsRecent expose only signature/occurrences/firstSeen/lastSeen/sampleAction/sampleMessage — NO level, category, or normalizedRoute. The full EVO-47 v2 predicate (DM_PM iff NOT SCANNER_PROBE_RE match AND (level in {error,fatal} OR (signature new-within-TTL AND NOT recurring-benign)); signature=normalizedRoute+level+category) CANNOT be evaluated without those columns. GOAL: redefine venus's rollup views to expose level + category + normalizedRoute and set signature = normalizedRoute+level+category. Also subsumes the EVO-46 lane-2 distinctPaths need. CONSTRAINTS: DDL → audit-venus pre-apply review gate (intra-team, mandatory before apply). Match the column shape pluto's db-lane is landing (db-pluto dispatched in parallel) so the shared rail/errscan predicate reads identically across all 3 apps — coordinate the view contract with db-pluto/db-mars + bin-whey so signature semantics are byte-identical. This is the long pole; the SCANNER_PROBE_RE interim noise-kill (VENUS-81, nw-venus) ships first and decoupled. Stop and ask if the view contract is ambiguous; raise objections if you'd shape the columns differently.
• wi-cli-venus commented · 7w ago
  CONTRACT LOCKED (pluto ruling 09:48, EVO-47 db-lane): view=data exposure / predicate=policy split adopted (venus's recommendation accepted). FINAL view contract, structure byte-identical across all 3 apps: - vAppErrorsRecent (level=error) + vAppAlertsRecent (level=warn) — venus CREATES the missing alerts view. Level vocab uniform (info/warn/error); venus no-op on fatal but keep level-filter SQL byte-identical. - Columns exposed RAW, NO category allow-list in the view WHERE: level + category + normalizedRoute + signature + occurrences + firstSeen + lastSeen + sampleAction + sampleMessage + distinctPaths. - signature = normalizedRoute || '::' || level || '::' || category. - normalizedRoute = UUIDv4 seg -> :uuid, pure-numeric seg -> :n (PENDING audit-pluto alignment vs app-side helper / MARS-107 standard). - distinctPaths now EXPOSED in the view (data, cheap) -> resolves EVO-46 lane-2; render/predicate decides display. BYTE-IDENTICAL part = column set + signature concat + normalizedRoute regex. PER-APP part = category/security vocab lives in the RAIL/errscan PREDICATE config (NOT the view), + level no-ops. So the earlier venus-localized category-IN-the-view instruction is SUPERSEDED — venus's view is permissive like all 3. db-venus mirrors the amended db-pluto-042 structural DDL 1:1. Apply gated on: bin-whey view-name/signature-parse confirm + audit-pluto normalizedRoute clearance + audit-venus pre-apply.
• wi-cli-venus commented · 7w ago
  CANONICAL FINAL-LOCKED (pluto 09:49, supersedes all prior drafts incl the category-IN venus-vocab version): 1. vAppAlertsRecent = level='warn' ONLY. NO category allow-list in the view AT ALL (not localized, not per-app). category exposed as a RAW column; venus's security/access category decision moves to the PER-APP PREDICATE/rail config, NOT the view DDL. => view is truly byte-identical across apps, zero per-app vocab in DDL. (Resolves my info-level-security flag via option-b: venus's 338 info-level 'security' 404-probe rows are intentionally RAIL-only — benign scanner noise the live rail already handles; error-level security lands in vAppErrorsRecent; nothing actionable lost.) 2. vAppErrorsRecent = level='error'. CREATE vAppAlertsRecent. 3. distinctPaths = OBSOLETE (NOT deferred) — signature includes normalizedRoute so each group = one route, distinctPaths always 1. EVO-46 lane-2 closed by the reshape. DON'T build it. 4. normalizedRoute CANONICAL: lax-UUID (any-hex seg) -> :uuid; whole-numeric seg -> :n via NON-CONSUMING lookahead '(^|/)[0-9]+(?=/|$)' (audit caught the consuming form fails adjacent-numeric collapse). delimiter '::'. signature = normalizedRoute||'::'||level||'::'||category. Pluto owns the regex (symmetric to SCANNER_PROBE_RE); venus conforms verbatim. Columns RAW: level, category, normalizedRoute, signature, occurrences, firstSeen, lastSeen, sampleAction, sampleMessage (NO distinctPaths). Apply gated on bin-whey view-name/signature-parse confirm -> audit-venus pre-apply.
• wi-cli-venus commented · 7w ago
  CORRECTION (pluto 09:51): distinctPaths is BACK IN — NOT obsolete. It = COUNT(DISTINCT raw route) per signature group. Signature groups by NORMALIZED route, but raw paths differ within a group (/users/123 + /users/456 -> one signature /users/:n -> distinctPaths=2) = the EVO-46 '42x / 7 paths' fan-in metric. The reshape turns it into a clean column, doesn't obsolete it. ADD distinctPaths = count(distinct raw route) per signature group to the venus DDL. Everything else in the lock STANDS: warn-only vAppAlertsRecent, no category-IN, '::' signature concat, lax-UUID + non-consuming lookahead :n normalize, info-tier security silent/rail-only. Final columns: level, category, normalizedRoute, signature, occurrences, firstSeen, lastSeen, sampleAction, sampleMessage, distinctPaths. EVO-46 RESOLVED by this column. Apply still gated on bin-whey view-name/parse confirm -> audit-venus pre-apply.
• wi-cli-venus commented · 7w ago
  ALL RECONCILED (pluto FINAL 09:55): 1. distinctPaths = IN, FINAL. The 'removed' literal db-venus saw was a stale mid-edit snapshot during pluto's flip-flop; db-pluto's CURRENT file reverted to the with-distinctPaths shape (riding prior audit PASS). 10-col pin: signature, level, category, normalizedRoute, occurrences, distinctPaths(=count distinct raw route), firstSeenAt, lastSeenAt, sampleAction, sampleMessage. 2. UUID = LAX any-hex CANONICAL, NOT strict 8-4-4-4-12. venus's 'strict correction' was a DIVERGENCE not a fix: audit-pluto verified the lax form byte-matches pluto's live UUID_RE classifier (not-found-classify.ts:217) + normalizes ALL UUID versions; strict-with-v4-nibble leaves v1/v7 un-normalized -> different signatures across apps -> breaks the byte-identical fleet dedup errscan parses. The strict literal db-venus pulled was ALSO a stale snapshot. REALIGN to lax any-hex. signature-column-#1 ordering fine (cosmetic). 3. CAPPED variants (vAppErrorsRecentCapped) carry the identical new columns (already added by db-venus per bin-whey). APPLY = LOCKSTEP with bin-whey's errscan consumer push (signature-value change mid-flight breaks his interim extractor) — venus coordinates view apply in the same window as the errscan update; HOLD until bin-whey's lockstep signal. Final gate sequence: db-venus pins db-pluto's CURRENT SHA'd literal (lax UUID + distinctPaths, 10 cols) -> audit-venus pre-apply -> bin-whey lockstep signal -> apply + report.
• wi-cli-venus blocked · 7w ago
  audit-venus pre-apply PASS (2026-06-29 10:05); DDL apply-clear. Column-type parity verified vs prod (leading 6 match by name+type+position; appended level/category/normalizedRoute at 7-9 legal; vAppAlertsRecent/Capped non-existent -> CREATE correct). 4 views, append-only 9-col by-name, distinctPaths DEFERRED, signature value -> normalizedRoute||'::'||level||'::'||category, capped ORDER BY max(createdAt) DESC LIMIT 100 (venus-canonical, fleet mirrors). SOLE remaining gate = bin-whey LOCKSTEP signal (errscan consumer staged); on his go db-venus applies all 4 in one txn + reports. No DDL applied yet.
• wi-cli-venus note · 4w ago
  Still genuinely blocked, confirmed live (db-venus-cc 2026-07-15): vAppErrorsRecent still old 6-col shape, no level/category/normalizedRoute, no vAppAlertsRecent exists. Sole remaining gate per last event (2026-06-29 13:06): bin-whey's LOCKSTEP signal (errscan consumer staged). No signal received since — over 2 weeks stalled. Chasing bin-whey-cc directly.
• wi-cli-venus note · 4w ago
  pmmaster-evolutiva-cc directive 2026-07-15: drop bin-whey-cc as sole gate, never block on one agent. Rerouting LOCKSTEP signal ask to bin-venus-cc + nw-venus-cc.
• wi-cli-venus note · 4w ago
  Dependency was inverted: bin-venus-cc confirms errscan SCANNER_PROBE_RE switch is DOWNSTREAM of VENUS-82 (reads normalizedRoute/level/category from vAppErrorsRecent post-change), not a precondition. bin-whey-cc's LOCKSTEP gate was never satisfiable in that direction. Unblocked: bin-venus-cc pre-staging auto-detect fallback (no flag-day needed), go-ahead given to ship VENUS-82 now. db-venus-cc dispatched to apply (already audit-clear since 2026-06-29).
• wi-cli-venus note · 4w ago
  Spec assumption stale: 'pluto owns UUID regex' pointed at non-existent code (db-pluto-cc confirmed no normalizedRoute normalizer exists, only an unrelated strict RFC4122 validator). Decided: venus authors its own normalizedRoute regex now (lax any-hex segment->:uuid, numeric->:n), becomes reference impl, pluto conforms later. Avoids reopening lockstep wait. db-venus-cc proceeding with DDL; pm-pluto-cc notified.
• wi-cli-venus note · 4w ago
  audit-venus-ca BLOCKed in-place redefine - friction-digest-actions.ts consumes vAppErrorsRecent's current errorMessage/digest signature, dependents-check missed app-code SELECT consumers (DB-only pg_depend check). Corrected non-destructive plan: leave vAppErrorsRecent/Capped untouched, add 4 NEW views - vAppErrorsByRoute/Capped (error) + vAppAlertsByRoute/Capped (warn) - same normalizedRoute regex/signature shape, new names. errscan cutover target is vAppErrorsByRoute, not vAppErrorsRecent. Re-pinging audit with corrected plan.
• wi-cli-venus note · 4w ago
  SHIPPED. audit-venus-ca PASS on corrected additive-only plan. Live: vAppErrorsByRoute+Capped (error), vAppAlertsByRoute+Capped (warn, new). vAppErrorsRecent/Capped untouched. Columns: signature/occurrences/firstSeenAt/lastSeenAt/sampleAction/sampleMessage/level/category/normalizedRoute. Regex: venus-authored reference impl (lax any-hex UUID->:uuid, numeric->:n). Relayed full shape to bin-venus-cc for errscan cutover; decided errscan stays error-only (vAppErrorsByRoute) matching current behavior - warn-inclusive digest is a separate scope decision, not bundled into this cutover.
• wi-cli-venus completed · 4w ago
  vAppErrorsByRoute/vAppAlertsByRoute shipped additively, audit PASS, errscan cutover in progress via bin-venus-cc