Repository navigation
Phase 3 (audit) of #3702 — alert-throat contract statement, seam check + dispositions #3703
Description
Phase 3 of design #3702 — closing audit + contract statement (aggregator alert throat)
Parent design: #3702 ("delivered means delivered — one truth contract for the aggregator alert throat"). Design doc: files/designs/code-aggregator-alert-throat-contract.md in the keep-the-four-repos-healthy goal workspace. Audit baseline: origin/main a3acf3b0.
Gated on Phases 1–2 of #3702: Phase 1 = #3693 (subscriptions GET removed), Phase 2 = #3686 (quiet prefs validated as clock values). Do not start the audit before both land. (Rule 1 of the design — delivered only on a successful send — already landed via #3685 / PR #3690 and is verified as-built under (d), not re-implemented.)
Scope
(a) Contract statement: write the design's contract (truthful state transitions; subscription key material never leaves the server; prefs validated as values with per-field default fallback) into the pm-stack/aggregator/src/alerts.ts module header, beside the existing #3676 design notes.
(b) Seam check: verify AlertsStore.listSubscriptions() still returns full rows to the in-process engine only, and that no HTTP route in pm-stack/aggregator/src/server.ts returns a store row verbatim — subscriptions (post-#3693) or incidents (incident rows carry no secrets today; record that as checked, with the fields reviewed).
(c) Required dispositions — each recorded on #3702 with its reason, and either fixed under this issue (if small and inside the throat) or filed as a named follow-up:
- Already-stored quiet rows carrying out-of-range times (heal-by-remerge on read / one-time cleanup / leave, decided against feat(aggregator): notification engine — class triggers, dedupe, quiet hours, escalation (#1254 slice c) #3317's consumer shape).
- The unauthenticated DELETE
/api/push/subscriptions+ incident ack/close posture (aggregator-wide tailnet stance — accept explicitly, or file the intake-style auth follow-up; the GET removal in Phase 1 already closed endpoint enumeration). mergeQuiettz acceptance: any non-empty string is stored today andinQuietHoursfails open (catch→ do-not-suppress) on an unknown zone — validate viaIntlat merge, or record deliberately-local with reason.mergeClassesunbounded class keys: any key is stored — disposition against feat(aggregator): notification engine — class triggers, dedupe, quiet hours, escalation (#1254 slice c) #3317's actual class set.
(d) Closing evidence on #3702: Rule 1 verified as-built (PR #3690's sent >= 1 gate for both markDelivered and markEscalated, the PushSender seam, the all-failed warning trace); Rules 2–3 landed (Phases 1–2); and a note posted to #3317 and #3319 that quiet semantics and delivery state are now contractual, so their builds inherit truthful delivered_at / sends data.
Acceptance criteria
- The contract statement is in the
alerts.tsmodule header and matches Design: delivered means delivered — one truth contract for the aggregator alert throat #3702's wording. - The seam check (b) is reported on Design: delivered means delivered — one truth contract for the aggregator alert throat #3702 with the routes/fields reviewed.
- All four dispositions in (c) are recorded on Design: delivered means delivered — one truth contract for the aggregator alert throat #3702 with reasons; any follow-up fixes are filed as named issues, not left as comments-only.
- Closing evidence (d) is posted on Design: delivered means delivered — one truth contract for the aggregator alert throat #3702, and the feat(aggregator): notification engine — class triggers, dedupe, quiet hours, escalation (#1254 slice c) #3317/feat(aggregator): notification measurement — weekly sent-vs-acted-on roll-up (#1254 slice e) #3319 note is posted.
- Existing aggregator alerts tests still pass (CI); no behaviour changes beyond the dispositions taken in (c).
🤖 Filed by the design architect (pass 32, 2026-11-01) as Phase 3 of #3702.
Activity
developing-today commentedon Nov 1, 2026
CODE-1507
dezren39 commentedon Nov 1, 2026
🤖 Agent note · filed as Phase 3 of design #3702
status/blocked— gated on Phase 1 (aggregator(alerts): GET /api/push/subscriptions returns every subscription's p256dh + auth secret — unauthenticated, unused by any client, and the /alerts page for the same data redacts them #3693) and Phase 2 (aggregator(alerts): mergeQuiet accepts out-of-range times (99:99, 24:60) — a malformed quiet window is silently reinterpreted instead of falling back to the default #3686) landing; triage packet enqueued to repo-health-code-pilot in this same pass. Do not start the inventory before the gates clear.163 remaining items
dezren39 commentedon Nov 3, 2026
🤖 Agent note · handed off
dezren39 commentedon Nov 3, 2026
agent-note:v1
dezren39 commentedon Nov 3, 2026
🤖 Agent note · picked up
~/git/fleet/5613, branchqueue/5613-3703-alert-throat-contractalerts.tsheader (comment-only), seam check + four dispositions on Design: delivered means delivered — one truth contract for the aggregator alert throat #3702, closing evidence, notes to feat(aggregator): notification engine — class triggers, dedupe, quiet hours, escalation (#1254 slice c) #3317/feat(aggregator): notification measurement — weekly sent-vs-acted-on roll-up (#1254 slice e) #3319. No behaviour changes.Merge pull request #4977 from developing-today/queue/5613-3703-alert-…
dezren39 commentedon Nov 3, 2026
🤖 Agent note · done
Phase 3 complete, all outcomes first-verbed then recorded:
alerts.tsheader → PR docs(aggregator): state the alert throat's truth contract in alerts.ts (#3703) #4977 MERGED (mergeb9e2eaf2, required checks green).sent>0gates atalerts.ts:604–631, PushSender seam, all-failed warning), Rules 2–3 landed, testsbun test pm-stack/aggregator/test/alerts.test.ts34 pass; feat(aggregator): notification engine — class triggers, dedupe, quiet hours, escalation (#1254 slice c) #3317/feat(aggregator): notification measurement — weekly sent-vs-acted-on roll-up (#1254 slice e) #3319 notified.developing-today commentedon Nov 3, 2026
agent-note:v1
state: reviewed (coverage loop-back)
Coverage pass 2026-11-03, loop-back review: this issue was re-reviewed (drift / overlap / already-handled / stale / blockers / ordering) so every open issue in the four repos is reviewed and in the system. Verdict: still live; in the system as task 8534 (triage, queued, priority 30) in repo-health-code-pilot. Labels audited and synced. If it is already handled at current main, its triage closes it with evidence; if oversized, the triage files the split; blockers belong on this issue.
Found via: coverage loop-back 2026-11-03
dezren39 commentedon Nov 3, 2026
🤖 Agent note · done (triage, already_done)
repo-worker-code), OpenChamber scheduled lane262eb403-3347-4a7c-ba6b-e7bc263ca853repo-health-code-pilot), loop-back coverage re-queueb9e2eaf2737c74add67a3733b04d4b53f8716beb, merged 2026-11-03T15:07:40Z).already_done— no branch, worktree, or edits created; no competing PR. Removed the stalequeue/queuedlabel so the closed issue no longer looks in-flight.