EPIC: read/analysis/consumption surface

Sub-tickets — 2/4 done

Activity

• wi-cli-venus created · 2026-07-17
• wi-cli-venus note · 4w ago
  Broke out the four sub-items the epic description names, one paragraph of scope each, no design: WEBUSAGE-5 read-view schema (the stable query surface over usageEvents + usageDaily, incl. the 90d purge horizon and the WEBUSAGE-4 day-boundary semantics), WEBUSAGE-6 access model (usageEvents is cross-tenant by construction - one table keyed by appKey for every fleet app - so the read surface is a co-tenancy boundary; no RLS per standing ruling, and the ingest's per-app bearer is a WRITE gate that says nothing about reads), WEBUSAGE-7 dashboard UI (for people; blocked on 5 for the query surface and 6 for cross-app visibility), WEBUSAGE-8 per-app consumer hooks (for code; motivating case is PLUTO-40, the route ranking I ran by hand for coder-pluto-cc 2026-07-17). Dependency order is 6 then 5 then 7/8: WEBUSAGE-6 is the only one that cannot be retrofitted. Not started - these are scoped, not designed. Also worth stating on the epic: the telemetry Postgres is STANDALONE on venus, not Supabase, so none of this inherits the enamel/terra auth stack by default.
• wi-cli-venus note · 4w ago
  FLEET STOP parked (pmmaster relaying Elazar, 2026-09-11 23:57 ART). DONE: WEBUSAGE-3 closed and verified at v1.3, telemetry-ingest 0b120ec - both dead alarm branches fixed (curl writes -w on failure so CODE concatenated to 000000 and the UNREACHABLE arm was dead; systemctl show returns property DEFAULTS for a nonexistent unit so the failnotify answered DRILL/close-it for a deleted source unit, now gated on LoadState/Result). Green path re-verified THROUGH the unit after the rewrite - Result=success, ExecMainStatus=0, journal 'healthz ok' - which the six forced-red controls had not covered. jobreg 5 rows pushed sh.git 60a73aa, venus drift 6->2, both remaining outside my lane; three bins DM'd to pull. soportepreguntas 7039608 - Elazar's stray repo-root .agent-name deletion committed and pushed. This epic broken out into WEBUSAGE-5 (read-view schema), -6 (access model), -7 (dashboard UI), -8 (per-app consumer hooks); dependency order 6 -> 5 -> 7/8. NOT DONE: all four children are backlog, unstarted, no design written. Also open and untouched: ENAMEL-16, ENAMEL-1, ENAMEL-38, WEBUSAGE-1, SOPORTEP-2, EVO-80, ENAMEL-41 (needs an account owner, not me). NEXT ACTION on resume: WEBUSAGE-6 (access model) first - usageEvents is one cross-tenant table keyed by appKey, so the read surface IS the co-tenancy boundary and it is the one child that cannot be retrofitted after 5/7/8 are built. Two carried items, both recorded and neither blocking: the failnotify ALARM arm carrying the rollup cause clause is still UNEXERCISED (needs the real rollup to fail - do not manufacture it), and $MONITOR_UNIT/$MONITOR_RESULT (systemd >=251, venus runs 257) is the authoritative OnFailure-edge discriminator, noted in the file header and NOT adopted - verify with a throwaway unit whose OnFailure runs env first. Repos clean: sh.git and telemetry-ingest have no uncommitted work. Not mid-push, not broken. Resume needs Elazar's word.
• coder-enamel-cc statusChanged · 1w ago
  Resumed on pmmaster GO (pmmaster-evolutiva-cc-muw0s4j5r9zz). 5 done, 6 in review, 9 filed to bin-venus-cc, 7/8 still backlog and gated on 6.
• coder-enamel-cc note · 1w ago
  WEBUSAGE-2 increment closed at telemetry-ingest 455cee0 (remote matches HEAD, tree clean). WEBUSAGE-5 and WEBUSAGE-6 done; WEBUSAGE-7 deliberately NOT started per pmmaster GO muw71ozj5w1q. Shipped in this increment: /opt/telemetry-ingest/access-model.md is the contract (four pushes: 4c0cc89 design+README, d37b3e9 audit BLOCK round 1 fixes, 0befb8f residual PASSed, 455cee0 applied state + bin-venus-cc corrections). Plane A is the DB role webusage_read_fleet: NOLOGIN, SELECT on vUsageDaily/vUsageDailyApp/vUsageRawCoverage only, one member coder_enamel_cc. Both readback legs observed from a connected session and again under SET ROLE: 2814/260/1 rows on the views, permission denied for table on usageEvents and usageDaily, with coder_enamel_cc denied on all six objects beforehand so the positive leg is attributable to the grant. No ALTER DEFAULT PRIVILEGES, deliberately. pg_read_all_data falsified (same cluster holds fleet_tokens.events). telemetry_ro left as-is; it never held a privilege on webusage. WEBUSAGE-9 filed to and closed by bin-venus-cc for the CREATEROLE + schema USAGE half. Coverage limits carried forward, not fixed: plane A is unfiltered BY DECISION, so there is no per-app DB boundary to test and its only control is membership - a grant list, a static record, not a live property. Plane B does not exist: no endpoint in server.mjs, no predicate, nothing exercised. No RLS. Next session resumes at WEBUSAGE-7 (dashboard UI) or WEBUSAGE-8 (plane B). WEBUSAGE-8 owns the forced-red with the bearer-resolved predicate REMOVED, and needs a per-app coverage equivalent or no coverage view at all - vUsageRawCoverage aggregates across every app and is off plane B by decision 8.