From b1a54a2d522412bb461535aee04dace357e50b36 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:22:24 +0800 Subject: [PATCH 1/3] docs: activate universal task ledger --- AGENTS.md | 8 ++ docs/README.md | 1 + docs/branch-review-ledger.md | 2 +- docs/codebase-index.md | 1 + docs/outstanding-issues.md | 170 +++++++++++++++++++++++++++-------- 5 files changed, 143 insertions(+), 39 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 32d9bc6c0..40c50ae21 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -454,6 +454,14 @@ Run the matching planner command in `docs/productivity-workflows.md` without sid **recommendation**, and **issue** for this repo. Chat context resets between sessions; that file does not, so anything worth remembering after a session ends belongs there. +`docs/outstanding-issues.md` is the single universal task ledger. Its recommended execution queue +owns dependency order, acuity, required capability, timing, effort, approvals, success criteria, +verification, and stop rules; its evidence register preserves open claims, guardrails, deferrals, +and resolved history. Keep detailed provider procedures in `docs/operator-backlog.md`, but record +every worthwhile task and its current state in the universal ledger. Update affected queue and +evidence records together when work is completed, dropped, superseded, or materially re-scoped. +Never restore completed, stale, duplicate, speculative, or rejected work to the recommended queue. + - When the user types `/issues`, invoke the `issues` skill (`.claude/skills/issues/SKILL.md`): read `docs/outstanding-issues.md` and state the open items back, grouped by priority. A plain `/issues` is read-only — it mutates and commits nothing. diff --git a/docs/README.md b/docs/README.md index 0b743e80c..ebc56877e 100644 --- a/docs/README.md +++ b/docs/README.md @@ -71,6 +71,7 @@ npm run docs:check-links ## Plans and workstreams (living) +- [outstanding-issues.md](outstanding-issues.md) — universal task ledger, recommended execution queue, evidence register, and resolved archive - [maturity-backlog-workorders.md](maturity-backlog-workorders.md) — actionable work orders tracking the repository-maturity audit backlog - [framework-dependency-modernization-checklist.md](framework-dependency-modernization-checklist.md) — ordered Next.js 16, runtime, dependency, Turbopack, and verification migration program - [search-rag-master-plan.md](search-rag-master-plan.md) / [search-rag-master-context.md](search-rag-master-context.md) — search/RAG roadmap and shared context diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md index b9b2a8b96..3e01fd59b 100644 --- a/docs/branch-review-ledger.md +++ b/docs/branch-review-ledger.md @@ -20,7 +20,7 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD | Date | Branch or ref | Reviewed HEAD | Scope | Outcome | Checks | | ---------- | -------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| 2026-07-24 | `codex/supabase-document-change-trigger` | `9c7d9edf509a51478f5bebbabcca64e3926dc877` + reviewed working diff | Document-change ingestion trigger migration, schema mirror, grants, privacy and fail-safe delivery | APPROVE. No P0-P2 finding. The trigger is update-only, acts solely on a strict JSON boolean false/absent-to-true transition, sends only the receiver's allowlisted owner-scoped fields, fails open for document writes when Vault/GUC/pg_net is unavailable, and revokes execution from public/anon/authenticated. No production URL fallback exists. Highest residual risk is deliberate pg_net at-most-once delivery; the clear-then-flip recovery and data-preserving rollback are documented, and the trigger remains inert until both the Vault secret and environment base-URL GUC are configured. | Disposable `supabase/postgres:17.6.1.127` schema replay and drift-manifest regeneration passed (16s; scratch container removed); focused schema/drift/receiver Vitest 89/89; migration-role, function-grant (30 SECURITY DEFINER functions) and owner-scope guards; production-readiness CI mode READY with expected secretless-worktree warnings; offline RAG 21 suites/307 tests; `verify:cheap` 365 files, 3,241 passed/1 skipped; static trace of receiver payload, authoritative owner-scoped reload and idempotent enqueue path. No live provider mutation or migration apply. | +| 2026-07-24 | `codex/supabase-document-change-trigger` | `9c7d9edf509a51478f5bebbabcca64e3926dc877` + reviewed working diff | Document-change ingestion trigger migration, schema mirror, grants, privacy and fail-safe delivery | APPROVE. No P0-P2 finding. The trigger is update-only, acts solely on a strict JSON boolean false/absent-to-true transition, sends only the receiver's allowlisted owner-scoped fields, fails open for document writes when Vault/GUC/pg_net is unavailable, and revokes execution from public/anon/authenticated. No production URL fallback exists. Highest residual risk is deliberate pg_net at-most-once delivery; the clear-then-flip recovery and data-preserving rollback are documented, and the trigger remains inert until both the Vault secret and environment base-URL GUC are configured. | Disposable Supabase Postgres Docker image version `17.6.1.127` schema replay and drift-manifest regeneration passed (16s; scratch container removed); focused schema/drift/receiver Vitest 89/89; migration-role, function-grant (30 SECURITY DEFINER functions) and owner-scope guards; production-readiness CI mode READY with expected secretless-worktree warnings; offline RAG 21 suites/307 tests; `verify:cheap` 365 files, 3,241 passed/1 skipped; static trace of receiver payload, authoritative owner-scoped reload and idempotent enqueue path. No live provider mutation or migration apply. | | 2026-07-23 | PR #1090 / `cursor/fix-phone-dock-edge-1b1d` | `761de7e9ad623b6bd8d634d849a9eb465d622e48` (merged as `09028ef217209fceb53f1122ac7738b509bce323`) | Phone safe-area and edge-to-edge search-dock UI review | MERGED. No P0-P2 finding. The branch was three commits behind, so current `origin/main` was merged before landing; the actual merge tree matched the reviewed synthetic tree. The dock remains flush to the viewport with safe-area padding inside the form, and the phone shell no longer retains the `dvh` clamp that created the Safari toolbar band. Zero actionable review threads. | `npm run ensure`; focused `ui-tools.spec.ts` phone-home and edge-to-edge scenarios: Chromium 2/2 and WebKit 2/2; refreshed hosted policy, security, unit, build, advisory UI, Production UI and required aggregate checks green; exact-head ancestry and local-main tree equality proved after merge. | | 2026-07-22 | PR #1087 / `codex/reconcile-product-truth` | `edbc2260fef59ca2fa7c6973dffb85e32354bce1` (merged as `05dc52fd8408a65117e22a6236e43252203bea92`) | Product-truth copy, account persistence and unavailable-SSO presentation | MERGED. Cross-device claims now match favourites/preferences persistence; recent searches are identified as browser-session data; the contradictory “never shared” statement is removed. All unavailable setup providers and Apple elsewhere use the connected accessible “coming soon” placeholder pattern. The single review finding was fixed, replied to and resolved. | Red DOM proof; focused 19/19; `verify:cheap` 3,220 passed / 1 skipped; `verify:ui` 265/265; PR-local build/secret scan/offline RAG; final hosted required, Production UI, policy and security checks green. No provider calls or RAG spend. | | 2026-07-22 | PR #1086 / `codex/reconcile-xlsx-budgets` | `5376880a40749b6526fd7e4603a7be9d04bc9624` (merged as `2963fba46eacd644618a588fa283f7597faa2644`) | XLSX resource-boundary review | MERGED. Enforces worksheet, non-empty-row, rendered-cell and UTF-8 output ceilings before result fragments are appended; sparse-column output is preserved. No actionable review threads. | Red 257-sheet reproducer; focused 4/4; `verify:cheap` 3,218 passed / 1 skipped; PR-local build/scan/offline RAG; hosted required/security/policy green. | diff --git a/docs/codebase-index.md b/docs/codebase-index.md index c7d597ed5..aa92ad7ad 100644 --- a/docs/codebase-index.md +++ b/docs/codebase-index.md @@ -334,6 +334,7 @@ One shared composer (`master-search-header.tsx`) serves every mode. Placement: | Full documentation index | `docs/README.md` | | Routes and modes | `docs/site-map.md` | | Search/RAG roadmap | `docs/search-rag-master-plan.md` | +| Universal task ledger | `docs/outstanding-issues.md` | | Reindex operations | `docs/reindex-runbook.md` | | Production readiness | `docs/production-readiness-checklist.md` | | Capacity / scale-up | `docs/capacity-review.md`, `docs/auth-connection-cap-runbook.md` | diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index c4b899e31..02336a5f9 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -1,4 +1,4 @@ -# Outstanding Issues, Recommendations & Tasks +# Universal Task Ledger — Outstanding Issues, Recommendations & Tasks Durable, cross-session memory of everything still outstanding for this repo: open **tasks**, **recommendations** not yet acted on, and **issues** not yet resolved. Chat context is ephemeral @@ -7,6 +7,11 @@ Durable, cross-session memory of everything still outstanding for this repo: ope **Rule of thumb:** if it is worth remembering after this session ends, it belongs here. +This file is the **single universal task ledger** for the repository. Its prioritised queue contains +only work that remains recommended; its evidence register preserves open claims, guardrails, +deferrals, and completed history. It owns task order, acuity, required capability, timing, effort, +dependencies, approvals, success criteria, verification, and stop rules. + ## How this is used - Say `/issues` in Claude Code → the skill reads this file and states the open items back, @@ -27,7 +32,93 @@ Durable, cross-session memory of everything still outstanding for this repo: ope - Resolving an item moves its row to **Resolved / archive** with the date and a one-line outcome — rows are archived, not deleted, so the history stays auditable. - + + +## Reconciliation snapshot + +Last reconciled: **2026-07-24** against local `main` +`1eed39ed2b43509634a8d745d75a6956edb60e83`. No provider state was queried for this reconciliation. + +## How to use this ledger + +- Start the first executable row. A waiting or approval-gated row does not block an independent row + below it. +- Revalidate the cited source against current `main` immediately before starting. +- Update this ledger and the corresponding evidence record together when a task is completed, + rejected, superseded, or materially re-scoped. +- Effort estimates are active engineering or decision time. They exclude provider, CI, schedule, + soak, legal, and review waiting. +- **A2** means important clinical, correctness, reliability, or evaluation-integrity work. **A3** + means worthwhile planned work. **Optional** means act only after its stated trigger. +- **Standard** means an experienced generalist; **High** means senior cross-module reasoning; + **Specialist** means database, RAG, clinical-safety, privacy, evaluation, or performance expertise; + **Operator** means an authorised person with the stated product, clinical, legal, or provider + authority. +- This ledger does not authorise provider access, spend, production changes, commits, pushes, + deployments, or live checks. + +## Prioritised recommended work + +| Order | Source | Retained task and smallest next action | Classification | Acuity / intelligence | When / active effort | Dependencies or approvals | Success criteria, verification, and stopping condition | +| ----: | --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- | -------------------------------------------------------- | --------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| 1 | `#052` | Prevent full/retry reindex from overlapping a fresh agent-enrichment lease. Add failing single and bulk route tests, then reuse `hasActiveAgentEnrichmentJob` in the pre-mutation guard. | Required now | A2 / High ingestion concurrency | Now; 0.5–1 day | Local/offline only. | Fresh leases block destructive work; stale or absent leases and enrichment mode retain current behaviour. Run focused mutation-safety/route tests, `verify:cheap`, and `check:production-readiness`. Stop before any live database check or mutation. | +| 2 | `#053` | Recover aged `queued` documents that have no open ingestion job. First add a controlled orphan fixture and specify an owner-scoped grace period and idempotency rule. | Required now | A2 / Specialist queue reliability | After order 1; 0.5–1.5 days | Local replay if schema or scheduling changes; live deployment requires approval. | One eligible orphan receives exactly one job; fresh queues and open jobs are never duplicated. Run focused autopilot/recovery tests and production-readiness. Stop if ownership or safe age cannot be proven. | +| 3 | `#030` | Decide whether a combined source is allowed to satisfy two expected comparison slots. Add a red shared-title/two-expectation test first; implement unique source assignment only if the owner requires distinct evidence sources. | Requires user/operator decision | A2 / High evaluation semantics | Decision can happen now; 1–3 hours for decision/test, plus 2–4 hours if changed | Evaluation-owner decision; local/offline implementation. | The policy is recorded and the test distinguishes the two interpretations. If distinct sources are required, one identity cannot fill both slots while legitimate cases remain green. Stop without production ranking changes. | +| 4 | `#022` | Define an auditable BMJ published-reference attestation policy, then review only the ten highest-impact local WA documents before deciding whether more work is justified. | Requires user/operator decision | A2 / Operator clinical governance plus Specialist review | Decision-ready; 1–2 hours for policy and 0.5–1 day for the first ten | Clinical authority. Live metadata or canary access requires separate approval. | Reviewer, source, timestamp, evidence, and rationale are recorded without upgrading third-party or unverified provenance implicitly. Stop after ten and remeasure the remaining risk. | +| 5 | `#051` + `#023` | Compare the existing run `30018289898` with the scheduled 2026-07-26 structured canary, browser, and irrelevant-at-10 artifacts. Do not dispatch a replacement run. | Requires provider approval | A2 / Specialist RAG evaluation | Once the scheduled run completes, approximately 2026-07-27 AWST; 1–2 hours | Approval to read hosted artifacts; no spend or rerun. | Record exact run/tree identities, deterministic and provider deltas, latency, browser outcome, and residual dispositions. Stop if the scheduled artifact is absent and request direction rather than spending. | +| 6 | `#019` | Turn the observed admission/discharge fallback into a current-main red test at the fallback layer, using the live source shape while confirming deterministic ranking and packing retain both roles. | Defer until dependency is resolved | A2 / Specialist RAG answer pipeline | After order 6; 0.5–1 day for the reproducer | Any behaviour change needs protected review and an approved canary. | A local fixture reproduces the omission at the correct layer. Scope the smallest candidate correction, but stop if the defect does not reproduce or before provider-backed validation is approved. | +| 7 | `#018` | Diagnose the three remaining answer-quality mechanisms independently: lithium unrelated-table fast path, ADHD chart-heavy extractive budget, and metabolic schedule-free prose selection. | Defer until dependency is resolved | A2 / Specialist clinical RAG | After order 6, one mechanism at a time; 1–2 days diagnosis | Current-main fixtures; protected review and approved canary for fixes. | Each mechanism has its own reproducer, hypothesis, and smallest candidate. Stop a thread if it lacks deterministic proof or if its individual canary regresses. Do not revive the broad `#029` fix. | +| 8 | `#024` | Restore trustworthy WebKit release evidence by creating a discriminating test for Playwright `_rsc` interception failure versus a real Safari navigation defect. | Defer until dependency is resolved | A3 / High Next.js and Playwright | After order 6 provides the next browser datapoint, or on a real Safari repro; 0.5–1 day | Device/provider check only if local evidence remains ambiguous. | The test-only correction preserves access-control/navigation assertions and keeps Chromium green. Stop once the matrix signal is trustworthy; do not label an app defect without reproduction. | +| 9 | `#007` | Choose either `/?mode=tools` or `/tools` as the canonical Tools experience, then align navigation, redirects, sitemap, and reachability to that decision. | Requires user/operator decision | A3 / Operator product plus Standard frontend | At the next Tools change; 15–30 minutes for decision and about 0.5 day implementation | Product-owner decision. | One canonical path exists, any compatibility redirect is intentional, and route/UI tests pass. Stop if standalone-page requirements are still unknown. | +| 10 | `#001` | Keep semantic reranking off. Reconsider it only through an ambiguity-specific local comparison followed by the already-defined provider-backed quality gate. | Requires provider approval | A2 / Specialist retrieval and ranking | After order 6 and explicit rollout approval; 0.5–1 day local work plus canary wait | Provider approval and budget. | Leave the flag false unless retrieval remains 36/36 with recall 1.0, no per-case regression, and a measured ambiguity benefit. Otherwise record “remain off” and stop. | +| 11 | `#025` | Select owned alert destinations for deployment, CI, SLO, and ingestion events; configure and test only the selected channels, with ingestion last. | Requires provider approval | A2 / Operator integrations | Next approved observability window; 1–3 hours per selected channel | Provider approval, secret owner, destination owner; ingestion waits for orders 2–3. | One controlled non-PHI event and recovery signal reaches each owned destination after mocked tests. Stop for any channel without ownership or durable-delivery evidence. | +| 12 | `#011` | Put the Supabase Auth percentage-allocation change on the compute-resize checklist and execute it immediately before the first scale-up, not as present-day configuration churn. | Defer until dependency is resolved | A3 / Operator capacity | Only when a compute scale-up is approved; 30–60 minutes plus soak | Planned scale-up, exact project identity, provider approval, and preferably staging. | Record before/after allocation and a healthy soak/advisor check. Stop if no scale-up is planned or project identity is ambiguous. | +| 13 | `#017` | Capture one reproducible mobile and desktop production Lighthouse/Web-Vitals baseline before proposing payload work. | Requires provider approval | A3 / High web performance | In an approved live-site window; 1–2 hours | Live-site approval and recorded route, build, device, and throttling profile. | Record representative LCP, INP, and CLS and a decision threshold. Stop if results are too noisy; do not create optimisation work without a demonstrated field problem. | +| 14 | `#027` | Decide whether an independent uptime monitor for `/api/health` is worth its vendor and operating cost. Implement only if an alert owner and response path exist. | Optional | Optional / Operator SRE | When independent outage detection is wanted; 1–2 hours | Vendor, cost, privacy, responder ownership, and provider approval. | A controlled non-PHI failure yields one alert and one recovery event. Stop if there is no responder or existing monitoring is accepted. | +| 15 | `#028` | Define the privacy and operating envelope for runtime error tracking: vendor, region, retention, redaction, sampling, source maps, and ownership. | Optional | Optional / Specialist privacy plus Operator | Only after privacy, ownership, dependency, and cost approval; 1–3 days | Privacy review and provider approval. | Redaction tests exclude clinical text, identifiers, and secrets; one approved non-sensitive event arrives. Stop if the envelope is unacceptable or no owner exists. | +| 16 | `#012` + `#013` | Re-measure route payloads and slim only a production route with a demonstrated budget problem; exclude mockup-only code unless it enters a production artifact. | Defer until dependency is resolved | A3 / High bundling and performance | After order 14 or equivalent fresh evidence; 0.5–2 days per proven route | Field/build evidence; UI verification for a change. | Demonstrate a material parsed/gzip or interaction improvement with unchanged behaviour. Run bundle analysis, focused tests, `verify:cheap`, and browser smoke. Stop when gain is small. | +| 17 | `#040` | Establish a small visual-regression baseline for stable, high-value desktop/mobile and accessibility surfaces, with an intentional-update workflow. | Optional | Optional / High visual QA | When a baseline owner and stable browser environment exist; 1–2 days | Owner approval and low-flake browser environment. | Repeated runs are stable, the selected surfaces catch meaningful regressions, and baseline updates are documented. Stop if maintenance churn outweighs detection value. | +| 18 | `#033` | Decide whether governance metadata belongs in the LLM source block and draft wording that distinguishes unknown metadata from adverse status before changing generation. | Defer until dependency is resolved | A3 / Specialist prompt governance | After orders 5–6; about 0.5 day design plus evaluation wait | Better metadata coverage, stable canary, clinical/product review, and provider approval for evaluation. | Prompt and serialization tests pass with no grounded-supported drop or citation failures in the approved eval. Stop on broad over-caveating or quality degradation. | +| 19 | `#037` | Decide whether all routinely supported claims should be capped at medium trust. Keep the flag off until a clinical/product owner accepts the comprehension and confidence trade-off. | Requires user/operator decision | A3 / Operator clinical product plus Standard frontend | Next trust-policy review; 1–2 hours, plus up to 0.5 day if enabled | Clinical/product authority. | Record the decision. If accepted, change only the flag/render expectations and run focused tests; otherwise leave code unchanged and close the decision. | +| 20 | `#038` | Define a shared comparison behaviour contract—selection, row highlighting, sticky attributes, difference-only filtering, mobile controls, and export semantics—before adding another comparison surface. | Recommended | A3 / High product and design-system | Before the next comparison feature; 0.5–1 day | Product/design review; keep domain-specific clinical content separate. | A short contract maps existing DSM, specifier, formulation, medication, and Therapy behaviours and identifies the smallest reusable primitives. Stop before broad component migration without an approved surface. | +| 21 | `#035` | Add conflict-detection coverage only when a concrete missed-conflict fixture exists outside the current ANC/WBC/platelet scope; then implement the narrowest clinically reviewed rule. | Defer until dependency is resolved | A3 / Specialist clinical safety | On a verified missed conflict; 0.5–1 day per conflict class | Clinical review and a real fixture; provider evaluation if generation behaviour changes. | The fixture turns red then green without false warnings in the focused suite. Stop if no current miss exists or false-positive risk cannot be bounded. | +| 22 | `#039` | Define a catalogue-toolbar interaction contract for search, filters, active-filter summary, result count, sort, density, and view selection; apply it only during the next affected redesign. | Recommended | A3 / High product and frontend | Before the next catalogue-heavy redesign; 0.5–1 day for contract | Inventory current domain semantics; no blanket rewrite. | The contract records common order, responsive behaviour, and explicit mode exceptions. Stop after the contract until a real route change supplies implementation scope. | +| 23 | `#054` | Write a product/privacy/persistence brief for a workspace combining saved comparisons, partial formulation work, recent tools, and pinned source sets. Do not build storage or UI yet. | Requires user/operator decision | A3 / High product architecture plus privacy | Before committing to this feature; 0.5–1 day | Product owner, privacy review, retention/ownership policy, and evidence of user demand. | The brief defines users, data classes, lifecycle, cross-device expectations, deletion, failure states, and a smallest testable slice. Stop if demand or safe persistence cannot be established. | + +## Recommended sequence + +1. Protect ingestion first: orders 1–2; do not activate the provider inputs tracked by `#025` until + both safeguards are complete. +2. Resolve evaluation and governance decisions: orders 3–5. +3. Use the next canary evidence to scope RAG and browser work: orders 6–8 and 10. +4. Take product and provider-gated work only in its approved window: orders 9 and 11–15. +5. Undertake measured performance, governance, and design-system work only when its trigger exists: + orders 16–23. + +## Explicitly excluded from recommended work + +- `#029` as a single “12 fallback stubs” composer fix: newer evidence separates the residuals into + different mechanisms covered by `#018` and `#019`. +- `#034`, `#009`, `#014`, `#020`, `#026`, and `#031`: completed, already covered, or superseded. +- `#005` and `#032`: current ranking evidence refutes the proposed changes. +- `#010`, `#021`, `#036`, and `#041`: not worth implementing without a new concrete need; + the current safeguards or existing product model are sufficient. +- `#016`: do not retain a broad structural-performance umbrella; use measured `#012`/`#013` + work only after `#017` evidence. +- Broad release, staging, privacy/legal, seed, provider-configuration, and helper-cleanup packages are + not copied here. They remain runbook/operator concerns or need a concrete release trigger and + explicit authority, rather than standing recommended engineering tasks. + +## Maintenance rule + +When a row changes state, preserve its evidence in `docs/outstanding-issues.md`, remove it from this +recommended-only view if it is no longer worth doing, and renumber the remaining queue. Never turn +an approval gate into implied authority. + +## Evidence register + +The queue above is the execution view. The records below preserve detailed evidence and resolution +history, including items deliberately excluded from recommended work. ## Open items @@ -35,42 +126,33 @@ Durable, cross-session memory of everything still outstanding for this repo: ope > **RAG reconciliation correction (2026-07-23):** fresh current-main live evidence supersedes the broad diagnosis in #018. The three named misses are not one composer defect. Lithium reproduced an unrelated-table retrieval fast-path defect; ADHD still retrieves a relevant chart-heavy CAMHS source but exhausts the extractive route budget; metabolic retrieves the correct AKG source but selects schedule-free prose; #019 remains post-retrieval comparison source selection. A narrow lithium subject-evidence guard improved its targeting result from 0 to 1 with golden recall 1.0 and no reciprocal-rank regressions, but was reverted and rejected because the required full canary failed. Keep #029 open for the remaining fallback-stub cases. Do not combine these residuals or change ranking scores, comparator ordering, aliases, clamps, or semantic reranking without a separate reproducer and passing canary pair. -| ID | Pri | Type | Summary | Detail / next action | Source | Added | -| ---- | --- | ----- | --------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------- | -| #051 | P2 | task | Stabilise the live answer-quality canary before more RAG tuning | Diagnostics landed in PR #1095: structured JSON/Markdown artifacts now record the actual checked-out SHA, run identity and latency context, and the offline trend tool separates content, provider-route and latency outcomes. First validating run `30018289898` recorded the expected tree and cost, with 36/36 retrieval green, but one report cannot establish variability; PR #1097 prevents a single failure being mislabeled as repeated. Next: compare the scheduled 2026-07-26 structured report with this run. Do not spend on an immediate retry or reapply the archived lithium guard before that comparison. | PR #1095; run `30018289898`; PR #1097; archive ref `refs/archive/rejected-rag/20260723/monitoring-subject-gate` | 2026-07-23 | -| #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 | -| #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 | -| #007 | P3 | rec | `/tools` vs `/?mode=tools` parallel Tools entry points | `/tools` (standalone `ApplicationsLauncherPage`) has no inbound in-app link; the sidebar Tools item uses `/?mode=tools`. Decide the canonical entry point and wire nav consistently, or drop the standalone `/tools` page + `/applications` redirect. Currently allowlisted in `tests/route-reachability.test.ts`. | `src/app/tools/page.tsx`; `src/app/applications/route.ts` | 2026-07-21 | -| #009 | P3 | rec | Confirm `/api/jobs` is intentionally server/ops-only | No client `fetch()` reaches `/api/jobs` (only tests import it). Confirm it is a deliberate ops/manual surface; if abandoned, remove it. | `src/app/api/jobs/route.ts` | 2026-07-21 | -| #010 | P3 | task | Un-built "Coming soon" controls across forms/favourites | ~10 disabled placeholders (forms refine/reset, favourites sort/add/new-set, move-to-set, remove-favourite). Correctly flagged (`aria-disabled` + "Coming soon"), not defects — wire when the underlying features land. | `forms-search-results-page.tsx`; `favourites-hub.tsx`; `favourites-command-library-page.tsx` | 2026-07-21 | -| #011 | P3 | task | Auth DB-connection allocation is operator-only | Supabase Auth (GoTrue) is capped at ~10 absolute DB connections (Supabase perf advisor). Switch to **percentage-based** allocation in the Supabase **dashboard** before the first compute scale-up — **not settable via SQL/MCP** (operator-owned). Verify via a staging soak + an approval-gated read-only advisor re-check. | `docs/auth-connection-cap-runbook.md`; `docs/process-hardening.md` (Known follow-up debts) | 2026-07-21 | -| #012 | P3 | rec | Slim the lazy cross-mode differentials chunk | `cross-mode-differentials.ts` is dynamically imported (correctly code-split **out** of the initial/dashboard bundle — verified), but it pulls the full ~860 KB differentials snapshot (~125 KB gzip lazy chunk) just to build a tiny `{slug,title,clinicalHinge}` + presentations + aliases catalog. A precomputed lightweight index (generator + drift check, like the `specifiers-content` split / medications `fields=index`) would cut that lazy chunk ~5–10×. Not a bundle leak — an M-effort slim. | `src/lib/cross-mode-differentials.ts`; `src/components/clinical-dashboard/cross-mode-links.tsx:150`; session 2026-07-21 (build:analyze) | 2026-07-21 | -| #013 | P3 | rec | Route-chunk + mockup catalogue JSON weight | `build:analyze`: `/specifiers` ships `specifiers-search-index.json` (~180 KB parsed), `/forms` ships `forms-catalog.json` (~132 KB), `/formulation` ships `formulation-content.json` (~52 KB, client-side local search — needs index/full split or a search endpoint, architectural). All route-scoped (not initial bundle). Also `*-mockups.tsx` (~100 KB across chunks) build though `/mockups` 404s in prod — exclude from the prod artifact. | session 2026-07-21 (build:analyze) | 2026-07-21 | -| #014 | P3 | rec | Realize the `next/image` win on signed previews | `next.config` `images` (AVIF + `*.supabase.co` `remotePatterns` pinned to the project host, from #1024) is currently inert — signed document/image previews still render as raw ``. Route them through `next/image` to actually get AVIF + lazy optimization. | #1024; `src/components/clinical-dashboard/signed-image.tsx`; session 2026-07-21 | 2026-07-21 | -| #016 | P3 | rec | "Big but not easy" structural + motion perf | Deferred larger levers: (a) nonce-CSP forces every product route to `ƒ Dynamic` (zero static generation) — evaluate Partial Prerendering / static shells for the static clinical catalogues (DSM/differentials/therapy/specifiers/formulation); (b) sidebar expand/collapse animates `grid-template-columns` (biggest smoothness cost, motion-gated — needs a transform-overlay rethink); (c) Therapy Compass fetches 692 KB / 2.5 MB JSON client-side (defer until interaction + confirm brotli); (d) settings/setup/admin dialogs static-imported into the home chunk (`next/dynamic` them). | session 2026-07-21 (build route table + design audit) | 2026-07-21 | -| #017 | P3 | task | Field Web-Vitals baseline via live Lighthouse | In-sandbox runtime vitals were blocked (prod server hard-requires Supabase secrets; dev-mode CLS measured excellent at 0.00–0.04, content-first pages 0.000). Run Lighthouse against `psychiatry.tools` for real LCP/INP/CLS to prioritize #012–#016 by measured impact rather than reasoning. | session 2026-07-21 (measurement pass) | 2026-07-21 | -| #018 | P2 | task | Split the lithium, ADHD and metabolic residuals by mechanism | Revalidated on current main 2026-07-23: these are not one composer defect. Lithium reproduced an unrelated-table retrieval fast-path defect; ADHD retrieves a relevant chart-heavy CAMHS source but exhausts the extractive route budget; metabolic retrieves the correct AKG source but selects schedule-free prose. The narrow lithium subject-evidence guard improved targeting from 0 to 1 with golden recall 1.0 and no reciprocal-rank regressions, but it was reverted because the full canary failed. After #051 stabilises the canary, add independent current-main reproducers and assess each mechanism separately. Do not widen the matcher or combine these into a broad ranking/composer change. | runs `30007833352` and `30009207429`; PR #1093; session 2026-07-23 | 2026-07-21 | -| #019 | P2 | task | Admission doc dropped after deterministic comparison packing | Reconfirmed on merged-main run `30018289898`: golden retrieval remained 36/36 and retrieved `MHSP.AdmissionCommunityPts.pdf`, but the answer's top five sources retained only `MHSP.Discharge.pdf` after `generation_fallback:generation_quality_failed; comparison_source_extractive_fallback`. PR #1096 replays the live score/order shape and proves deterministic answer ranking plus cross-document packing retain both admission and discharge evidence, so retrieval scores, aliases and comparator ordering are not the fix. Next: create a red fallback-layer unit reproducer using the live source shape; any behavior change still needs the existing baseline and a passing post canary. | run `30018289898`; PR #1096; session 2026-07-23 | 2026-07-21 | -| #021 | P3 | rec | E-3d H2 residual: strong/comparison generation discards | approx. 6 generation attempts per full 44-case run still fail the final quality gate and fall to extractive on strong-route comparison/complex shapes (the designed-conservative outcome). PARKED: weakest cost/benefit on the queue — a wave (approx. $2-4 pair + reviewer cycle) to shave seconds off a few hard cases. Revisit only if latency/waste complaints or a cheaper lever appears. | E-3c design record; runs #59-#61 diagnostics | 2026-07-21 | -| #022 | P2 | task | Source-governance metadata refresh (operator) | **Worklist generated 2026-07-22 ($0, read-only): `docs/source-governance-refresh-worklist-2026-07-22.md`.** Reframed - this is NOT 59 clinical reviews. Of the 124 documents surfacing in canary top results, 59 are review-required, and **38 (64 pct) are the BMJ published-reference tier all sitting at `clinical_validation_status: unverified`** - one attestation-policy decision, not 38 reviews. The remaining 21 are genuine local WA health-service reviews (FSH 7, NMHS 4, CAMHS 3, AKG 2, KEMH 2, RPBG 2, RKPG 1), mostly `document_status: review_due`. Burn-down: top-10 documents clear 44 pct of flagged slots, top-20 clear 66 pct. Next: decide the BMJ attestation policy, then attest local docs by visibility (start `Clozapine Management by GP (NMHS)`, 22 slots at rank 1). | runs #61/#57 Source Governance data; `docs/source-governance-refresh-worklist-2026-07-22.md` | 2026-07-21 | -| #023 | P3 | task | Read Sunday 2026-07-26 scheduled-run artifacts | The 18:00 UTC scheduled runs deliver three free datapoints at once: first full-44 weekly canary (validates the #1044 ANSWER_CASE_LIMIT raise), browser-matrix flake second datapoint (webkit ui-route-coverage now reproduced + root-caused 2026-07-22 → see #024; firefox ui-formulation:91 still awaits a datapoint), and the irrelevant@10 labeling-audit artifact (§3.1 human-decision class). Read all three, then disposition. | sessions 2026-07-20/21; branch-review-ledger convergence notes | 2026-07-21 | -| #024 | P3 | issue | WebKit e2e `_rsc`-prefetch access-control-checks errors | verify:release:offline on `main` ce32fe170 (2026-07-22) reproduced #023's webkit clause: **6/6 deterministic** failures in `tests/ui-route-coverage.spec.ts` (Therapy Compass; DSM home/comparison; Specifier comparison/map; Differential stream), each a `pageerror … ?_rsc=… due to access control checks` on Next.js RSC prefetch — Chromium + Firefox clean. Not merge-blocking (required gate `test:e2e:pr` is chromium-only; the full webkit matrix is advisory/release-time). Most likely a Playwright route-interception × WebKit interaction, not a Safari user defect. Next: decide (a) allow/mock the `_rsc` routes for the `webkit` e2e project, or (b) confirm real Safari impact — before trusting the full-matrix webkit gate at release. NB the 2 other webkit fails (`ui-stress:412`, `ui-universal-search:210`) passed on isolated re-run = true flake. | session 2026-07-22 (verify:release:offline, `main` ce32fe170); refines #023 | 2026-07-22 | -| #025 | P2 | task | Activate the three webhooks (operator secrets) | Merged (#968) + deployed but inert — verified live: `POST /api/webhooks/railway` returns `503 webhook_not_configured`. To turn on: (1) Railway → set `RAILWAY_WEBHOOK_SECRET` + add the `?token=…` webhook URL; (2) the chat URLs `SLACK_WEBHOOK_URL`/`DISCORD_WEBHOOK_URL` must be set in BOTH places — the Railway **app/server env** (the receiver forwards deploy alerts via `postChatNotification`, which reads server env, so repo-secret-only leaves the Railway webhook authenticated but returning `delivered:false`) AND as **GitHub repo secrets** (the CI-failure workflow reads `secrets.*`); (3) `SUPABASE_INGESTION_WEBHOOK_SECRET`. Each fails closed until set, so this is pure ops. See docs/webhooks.md. | session 2026-07-22; PR #968; docs/webhooks.md | 2026-07-22 | -| #026 | P2 | task | Wire the Supabase document-change trigger | Implementation is complete on `codex/supabase-document-change-trigger`: forward migration `20260723150000_document_change_ingestion_webhook.sql`, schema mirror, update-only/minimal/fail-safe contract test and rollback docs. On 2026-07-24, `drift:manifest` replayed the full schema successfully in disposable Supabase Postgres 17.6.1.127, regenerated the manifest and removed the container; focused schema/drift tests passed 79/79 plus migration-role, function-grant and owner-scope guards. Next: protected-main PR and hosted migration-chain replay, then apply the committed migration through the normal Supabase path before configuring the Vault secret and base-URL GUC. The trigger remains inert until all three live steps are complete. | local branch/worktree; `docs/webhooks.md` section 3; session 2026-07-24 | 2026-07-22 | -| #027 | P3 | rec | External uptime monitor independent of GitHub/Railway | `live-domain-monitor.yml` runs on GitHub's cron, so it won't run in exactly the outage it should catch (Actions or the deploy itself down). Add an off-platform synthetic monitor (UptimeRobot / Better Stack / Checkly) hitting `/api/health` with a webhook alert. Provider setup, not code. | session 2026-07-22 webhook review | 2026-07-22 | -| #028 | P3 | rec | Runtime error tracking (Sentry or similar) | No error tracking in the repo — production exceptions on `psychiatry.tools`, including how often `RAG_PROVIDER_MODE=auto` silently degrades to source-only, are invisible. Weigh adding `@sentry/nextjs` (dependency + DSN secret + instrumentation) vs cost; alert → chat/issue. Provider-backed; needs explicit sign-off before adding the dependency. | session 2026-07-22 webhook review | 2026-07-22 | -| #029 | P2 | issue | 12 of 30 answer-quality cases return the fallback stub | run #61 --dump-answers: 12/30 quality cases emit the source_backed_review_fallback boilerplate with answer_sections: [], all grounded with 4-6 citations. Some still PASS targeting because the stub echoes query keywords (the contraindication/document_lookup matchers need only a keyword), so the targeting metric MASKS the problem for those intents. Superset of #018 — fix in the extractive composer, validate with the provider-backed answer eval. | run #61 dump artifact; session 2026-07-22 | 2026-07-22 | -| #030 | P3 | issue | Wide-tier alias lets one doc satisfy both comparison slots | In src/lib/eval-document-matching.ts, "Admission to Discharge for Mental Health Inpatients" appears in BOTH the AdmissionCommunityPts and Discharge alias lists, so a single document can satisfy both expectedFiles slots and make allHit true — a latent false-pass on admission-discharge cases. Not firing today (that doc is not in the failing top-5) but it would mask a real miss. Tighten the tables so one doc cannot fill both sides. | src/lib/eval-document-matching.ts:32-65; session 2026-07-22 | 2026-07-22 | -| #032 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three "gaps": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so "unknown" ≠ "bad" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 | -| #033 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same "unknown ≠ bad" hazard as #032 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 | -| #034 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 | -| #035 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 | -| #036 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 | -| #037 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 | -| #038 | P3 | rec | Consolidate shared comparison behavior | Several clinical modes expose comparison workflows with similar selection, empty-state and mobile-dock needs. Define one shared behavioral contract before another comparison surface is added; keep mode-specific clinical content separate. This is a design-system recommendation, not a current defect. | design audit reconciliation; session 2026-07-22 | 2026-07-22 | -| #039 | P3 | rec | Consolidate catalogue toolbar patterns | Catalogue/search pages have independently evolved filter, sort, result-count and mobile toolbar behavior. Inventory the existing implementations and converge only the repeated interaction contract; do not flatten mode-specific search semantics. | design audit reconciliation; session 2026-07-22 | 2026-07-22 | -| #040 | P3 | rec | Add targeted visual-regression baselines | Keep a small approved baseline set for high-value desktop/mobile surfaces and accessibility modes instead of screenshotting every route. Start with account/settings, document viewer, mode homes and bottom-composer interactions; define an intentional-update workflow before enabling blocking comparisons. | design audit reconciliation; session 2026-07-22 | 2026-07-22 | -| #041 | P3 | rec | Extend the existing Factsheets reading model | Do not add a second patient-facing Factsheets mode. Future patient-content work should extend the existing Easy Read/Standard presentation and its accessibility/content contracts. Revisit only with a concrete user need and source-governance plan. | design audit reconciliation; session 2026-07-22 | 2026-07-22 | +| ID | Pri | Type | Summary | Detail / next action | Source | Added | +| ---- | --- | ----- | --------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------- | +| #051 | P2 | task | Stabilise the live answer-quality canary before more RAG tuning | Diagnostics landed in PR #1095: structured JSON/Markdown artifacts now record the actual checked-out SHA, run identity and latency context, and the offline trend tool separates content, provider-route and latency outcomes. First validating run `30018289898` recorded the expected tree and cost, with 36/36 retrieval green, but one report cannot establish variability; PR #1097 prevents a single failure being mislabeled as repeated. Next: compare the scheduled 2026-07-26 structured report with this run. Do not spend on an immediate retry or reapply the archived lithium guard before that comparison. | PR #1095; run `30018289898`; PR #1097; archive ref `refs/archive/rejected-rag/20260723/monitoring-subject-gate` | 2026-07-23 | +| #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 | +| #052 | P2 | issue | Reindex can overlap a fresh agent-enrichment pass | The shared ingestion preflight checks `ingestion_jobs`, but the full/retry reindex routes do not consult the existing `hasActiveAgentEnrichmentJob` guard. A fresh `indexing_v3_agent_jobs.status='processing'` lease can therefore overlap destructive artifact work. Add red single and bulk route tests, then extend the pre-mutation guards; keep stale leases non-blocking and preserve enrichment-mode behaviour. | `src/lib/ingestion-mutation-safety.ts:116-159`; `src/app/api/documents/[id]/reindex/route.ts`; `src/app/api/documents/bulk/reindex/route.ts`; ingestion audit 2026-07-24 | 2026-07-24 | +| #007 | P3 | rec | `/tools` vs `/?mode=tools` parallel Tools entry points | `/tools` (standalone `ApplicationsLauncherPage`) has no inbound in-app link; the sidebar Tools item uses `/?mode=tools`. Decide the canonical entry point and wire nav consistently, or drop the standalone `/tools` page + `/applications` redirect. Currently allowlisted in `tests/route-reachability.test.ts`. | `src/app/tools/page.tsx`; `src/app/applications/route.ts` | 2026-07-21 | +| #011 | P3 | task | Auth DB-connection allocation is operator-only | Supabase Auth (GoTrue) is capped at ~10 absolute DB connections (Supabase perf advisor). Switch to **percentage-based** allocation in the Supabase **dashboard** before the first compute scale-up — **not settable via SQL/MCP** (operator-owned). Verify via a staging soak + an approval-gated read-only advisor re-check. | `docs/auth-connection-cap-runbook.md`; `docs/process-hardening.md` (Known follow-up debts) | 2026-07-21 | +| #012 | P3 | rec | Slim the lazy cross-mode differentials chunk | `cross-mode-differentials.ts` is dynamically imported (correctly code-split **out** of the initial/dashboard bundle — verified), but it pulls the full ~860 KB differentials snapshot (~125 KB gzip lazy chunk) just to build a tiny `{slug,title,clinicalHinge}` + presentations + aliases catalog. A precomputed lightweight index (generator + drift check, like the `specifiers-content` split / medications `fields=index`) would cut that lazy chunk ~5–10×. Not a bundle leak — an M-effort slim. | `src/lib/cross-mode-differentials.ts`; `src/components/clinical-dashboard/cross-mode-links.tsx:150`; session 2026-07-21 (build:analyze) | 2026-07-21 | +| #013 | P3 | rec | Route-chunk + mockup catalogue JSON weight | `build:analyze`: `/specifiers` ships `specifiers-search-index.json` (~180 KB parsed), `/forms` ships `forms-catalog.json` (~132 KB), `/formulation` ships `formulation-content.json` (~52 KB, client-side local search — needs index/full split or a search endpoint, architectural). All route-scoped (not initial bundle). Also `*-mockups.tsx` (~100 KB across chunks) build though `/mockups` 404s in prod — exclude from the prod artifact. | session 2026-07-21 (build:analyze) | 2026-07-21 | +| #017 | P3 | task | Field Web-Vitals baseline via live Lighthouse | In-sandbox runtime vitals were blocked (prod server hard-requires Supabase secrets; dev-mode CLS measured excellent at 0.00–0.04, content-first pages 0.000). Run Lighthouse against `psychiatry.tools` for real LCP/INP/CLS to prioritize #012–#016 by measured impact rather than reasoning. | session 2026-07-21 (measurement pass) | 2026-07-21 | +| #018 | P2 | task | Split the lithium, ADHD and metabolic residuals by mechanism | Revalidated on current main 2026-07-23: these are not one composer defect. Lithium reproduced an unrelated-table retrieval fast-path defect; ADHD retrieves a relevant chart-heavy CAMHS source but exhausts the extractive route budget; metabolic retrieves the correct AKG source but selects schedule-free prose. The narrow lithium subject-evidence guard improved targeting from 0 to 1 with golden recall 1.0 and no reciprocal-rank regressions, but it was reverted because the full canary failed. After #051 stabilises the canary, add independent current-main reproducers and assess each mechanism separately. Do not widen the matcher or combine these into a broad ranking/composer change. | runs `30007833352` and `30009207429`; PR #1093; session 2026-07-23 | 2026-07-21 | +| #019 | P2 | task | Admission doc dropped after deterministic comparison packing | Reconfirmed on merged-main run `30018289898`: golden retrieval remained 36/36 and retrieved `MHSP.AdmissionCommunityPts.pdf`, but the answer's top five sources retained only `MHSP.Discharge.pdf` after `generation_fallback:generation_quality_failed; comparison_source_extractive_fallback`. PR #1096 replays the live score/order shape and proves deterministic answer ranking plus cross-document packing retain both admission and discharge evidence, so retrieval scores, aliases and comparator ordering are not the fix. Next: create a red fallback-layer unit reproducer using the live source shape; any behavior change still needs the existing baseline and a passing post canary. | run `30018289898`; PR #1096; session 2026-07-23 | 2026-07-21 | +| #022 | P2 | task | Source-governance metadata refresh (operator) | **Worklist generated 2026-07-22 ($0, read-only): `docs/source-governance-refresh-worklist-2026-07-22.md`.** Reframed - this is NOT 59 clinical reviews. Of the 124 documents surfacing in canary top results, 59 are review-required, and **38 (64 pct) are the BMJ published-reference tier all sitting at `clinical_validation_status: unverified`** - one attestation-policy decision, not 38 reviews. The remaining 21 are genuine local WA health-service reviews (FSH 7, NMHS 4, CAMHS 3, AKG 2, KEMH 2, RPBG 2, RKPG 1), mostly `document_status: review_due`. Burn-down: top-10 documents clear 44 pct of flagged slots, top-20 clear 66 pct. Next: decide the BMJ attestation policy, then attest local docs by visibility (start `Clozapine Management by GP (NMHS)`, 22 slots at rank 1). | runs #61/#57 Source Governance data; `docs/source-governance-refresh-worklist-2026-07-22.md` | 2026-07-21 | +| #023 | P3 | task | Read Sunday 2026-07-26 scheduled-run artifacts | The 18:00 UTC scheduled runs deliver three free datapoints at once: first full-44 weekly canary (validates the #1044 ANSWER_CASE_LIMIT raise), browser-matrix flake second datapoint (webkit ui-route-coverage now reproduced + root-caused 2026-07-22 → see #024; firefox ui-formulation:91 still awaits a datapoint), and the irrelevant@10 labeling-audit artifact (§3.1 human-decision class). Read all three, then disposition. | sessions 2026-07-20/21; branch-review-ledger convergence notes | 2026-07-21 | +| #024 | P3 | issue | WebKit e2e `_rsc`-prefetch access-control-checks errors | verify:release:offline on `main` ce32fe170 (2026-07-22) reproduced #023's webkit clause: **6/6 deterministic** failures in `tests/ui-route-coverage.spec.ts` (Therapy Compass; DSM home/comparison; Specifier comparison/map; Differential stream), each a `pageerror … ?_rsc=… due to access control checks` on Next.js RSC prefetch — Chromium + Firefox clean. Not merge-blocking (required gate `test:e2e:pr` is chromium-only; the full webkit matrix is advisory/release-time). Most likely a Playwright route-interception × WebKit interaction, not a Safari user defect. Next: decide (a) allow/mock the `_rsc` routes for the `webkit` e2e project, or (b) confirm real Safari impact — before trusting the full-matrix webkit gate at release. NB the 2 other webkit fails (`ui-stress:412`, `ui-universal-search:210`) passed on isolated re-run = true flake. | session 2026-07-22 (verify:release:offline, `main` ce32fe170); refines #023 | 2026-07-22 | +| #025 | P2 | task | Activate the three webhooks (operator secrets) | Merged (#968) + deployed but inert — verified live: `POST /api/webhooks/railway` returns `503 webhook_not_configured`. To turn on: (1) Railway → set `RAILWAY_WEBHOOK_SECRET` + add the `?token=…` webhook URL; (2) the chat URLs `SLACK_WEBHOOK_URL`/`DISCORD_WEBHOOK_URL` must be set in BOTH places — the Railway **app/server env** (the receiver forwards deploy alerts via `postChatNotification`, which reads server env, so repo-secret-only leaves the Railway webhook authenticated but returning `delivered:false`) AND as **GitHub repo secrets** (the CI-failure workflow reads `secrets.*`); (3) `SUPABASE_INGESTION_WEBHOOK_SECRET`. Each fails closed until set, so this is pure ops. See docs/webhooks.md. | session 2026-07-22; PR #968; docs/webhooks.md | 2026-07-22 | +| #027 | P3 | rec | External uptime monitor independent of GitHub/Railway | `live-domain-monitor.yml` runs on GitHub's cron, so it won't run in exactly the outage it should catch (Actions or the deploy itself down). Add an off-platform synthetic monitor (UptimeRobot / Better Stack / Checkly) hitting `/api/health` with a webhook alert. Provider setup, not code. | session 2026-07-22 webhook review | 2026-07-22 | +| #028 | P3 | rec | Runtime error tracking (Sentry or similar) | No error tracking in the repo — production exceptions on `psychiatry.tools`, including how often `RAG_PROVIDER_MODE=auto` silently degrades to source-only, are invisible. Weigh adding `@sentry/nextjs` (dependency + DSN secret + instrumentation) vs cost; alert → chat/issue. Provider-backed; needs explicit sign-off before adding the dependency. | session 2026-07-22 webhook review | 2026-07-22 | +| #030 | P3 | issue | Wide-tier alias lets one doc satisfy both comparison slots | In src/lib/eval-document-matching.ts, "Admission to Discharge for Mental Health Inpatients" appears in BOTH the AdmissionCommunityPts and Discharge alias lists, so a single document can satisfy both expectedFiles slots and make allHit true — a latent false-pass on admission-discharge cases. Not firing today (that doc is not in the failing top-5) but it would mask a real miss. Tighten the tables so one doc cannot fill both sides. | src/lib/eval-document-matching.ts:32-65; session 2026-07-22 | 2026-07-22 | +| #033 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same "unknown ≠ bad" hazard as #032 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 | +| #035 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 | +| #037 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 | +| #038 | P3 | rec | Consolidate shared comparison behavior | Several clinical modes expose comparison workflows with similar selection, empty-state and mobile-dock needs. Define one shared behavioral contract before another comparison surface is added; keep mode-specific clinical content separate. This is a design-system recommendation, not a current defect. | design audit reconciliation; session 2026-07-22 | 2026-07-22 | +| #039 | P3 | rec | Consolidate catalogue toolbar patterns | Catalogue/search pages have independently evolved filter, sort, result-count and mobile toolbar behavior. Inventory the existing implementations and converge only the repeated interaction contract; do not flatten mode-specific search semantics. | design audit reconciliation; session 2026-07-22 | 2026-07-22 | +| #040 | P3 | rec | Add targeted visual-regression baselines | Keep a small approved baseline set for high-value desktop/mobile surfaces and accessibility modes instead of screenshotting every route. Start with account/settings, document viewer, mode homes and bottom-composer interactions; define an intentional-update workflow before enabling blocking comparisons. | design audit reconciliation; session 2026-07-22 | 2026-07-22 | +| #053 | P2 | task | Recover orphaned queued ingestion documents | Detect aged `queued` documents with no open ingestion job and add one idempotent, owner-scoped recovery path with a defined grace period and dry-run visibility. A controlled orphan must receive exactly one job; fresh queues and open jobs must never be duplicated. Complete before configuring the document-trigger delivery inputs. | ingestion reliability reconciliation; session 2026-07-24 | 2026-07-24 | +| #054 | P3 | rec | Define the Current Clinical Work workspace | Before building storage or UI, write a product/privacy/persistence brief for saved comparisons, partial formulation work, recent tools, and pinned source sets. Define users, data classes, lifecycle, cross-device expectations, deletion, failure states, and the smallest testable slice. Stop if user demand or safe persistence cannot be established. | design recommendation reconciliation; session 2026-07-24 | 2026-07-24 | ## Resolved / archive @@ -78,6 +160,18 @@ Move resolved rows here with the resolution date and a one-line outcome. Keep th | ID | Type | Summary | Outcome | Resolved | | ---- | ----- | ---------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | +| #026 | task | Wire the Supabase document-change trigger | PR #1100 merged after disposable PostgreSQL replay and hosted migration replay. Production migration history and read-only catalog proof confirm the enabled metadata trigger, security-definer function, pinned search path and denied anonymous/authenticated execution; `npm run check:drift` reports no unexpected live drift. Delivery remains intentionally inert until the operator inputs tracked in #025 are configured. | 2026-07-24 | +| #005 | rec | `finalScore` saturates at clamp ceiling | No longer recommended: current ordering already uses unbounded `rankScore`, so the confidence clamp does not create the claimed ordering defect. | 2026-07-24 | +| #010 | task | Un-built “Coming soon” controls | No blanket implementation task remains. Existing placeholders are truthful and accessible; open an individual feature only when product scope is selected. | 2026-07-24 | +| #016 | rec | Broad structural and motion performance programme | Superseded by the measured path: obtain `#017` field evidence, then retain only route-specific `#012`/`#013` work that exceeds an agreed budget. | 2026-07-24 | +| #021 | task | Generation-discard cost residual | No longer recommended as a standalone task: current safeguards are adequate and the expected benefit does not justify provider spend and regression risk without new evidence. | 2026-07-24 | +| #029 | issue | Twelve answer-quality fallback stubs | Superseded by current-main evidence separating the residuals into the mechanism-specific `#018` and `#019` tasks. A single composer fix is unsafe. | 2026-07-24 | +| #032 | rec | Governance ranking weighting | Refuted by measured regressions and retained as a guardrail only. Do not add blanket governance boosts or penalties. | 2026-07-24 | +| #036 | rec | Add an explicit `is_public` visibility flag | No longer recommended: existing owner-scoped retrieval and visible unverified-source warnings sufficiently reduce the present risk; the schema/RLS change is disproportionate without a reproduced access defect. | 2026-07-24 | +| #041 | rec | Add another Factsheets reading mode | No longer recommended: extend the existing Easy Read/Standard model only when a concrete patient-content need and governance plan exist. | 2026-07-24 | +| #009 | rec | Confirm `/api/jobs` is intentionally server/ops-only | Archived after current-source verification: repository documentation and reachability tests treat this as an authenticated server/operations surface, and no client calls it. Its lack of an in-app link is intentional rather than abandoned functionality. | 2026-07-24 | +| #034 | issue | Answer cache can serve stale governance metadata | Archived after current-source verification: all known status-mutating routes call a RAG-cache invalidator, and route tests already assert invalidation on document PATCH, source review, label, bulk, and reindex mutation paths. Equivalent direct coverage exists; changing the protected cache key is not recommended. | 2026-07-24 | +| #014 | rec | Realize the `next/image` win on signed previews | Superseded by the privacy-safe implementation: `SignedImage` uses `next/image` for layout and responsive sizing with `unoptimized`, preventing bearer signed URLs from entering the unauthenticated optimizer cache. No optimisation task remains unless private-image delivery changes. | 2026-07-24 | | #031 | issue | Populate canary Source Governance table | The answer-quality step now consumes the preceding `golden-retrieval.json` only for source-governance reporting. Offline replay of run `30018289898` populated 338 top results, including 202 review-required entries, while retaining zero retrieval cases and no additional threshold failures. Retrieval and ranking behavior are unchanged. | 2026-07-24 | | #020 | task | Validate eval:quality cost readout post-fix | Confirmed on merged-main canary run `30018289898`: Answer Metrics reported 9 nonzero-cost cases and an estimated answer cost of `$0.234736`; the structured report retained the same value. The PR #1050 estimator fix is operationally proven. | 2026-07-23 | | #003 | task | Staging tenancy release evidence outstanding | Ran GitHub Action and validated isolation | 2026-07-21 | From b53f61940dfac87b49fb00a354da258a53286e82 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:35:03 +0800 Subject: [PATCH 2/3] docs: correct task ledger dependencies --- docs/branch-review-ledger.md | 1 + docs/outstanding-issues.md | 12 ++++++------ 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md index 3e01fd59b..a34a21139 100644 --- a/docs/branch-review-ledger.md +++ b/docs/branch-review-ledger.md @@ -20,6 +20,7 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD | Date | Branch or ref | Reviewed HEAD | Scope | Outcome | Checks | | ---------- | -------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| 2026-07-24 | PR #1104 / `codex/task-ledger-refresh-4e2b5e` | `d75811f05efa8ec135efd48863804ed7c15c1bf6` | Universal task-ledger documentation and automated review repair | FIXED. Four review threads identified two sequencing defects (one reported twice) plus one archive contradiction: the canary-dependent rows now point to order 5, ingestion activation waits for safeguards 1–2, and the legacy RAG note no longer says archived #029 remains open. No application/runtime behaviour changes. | Focused diff inspection; `npm run docs:check-links`; Prettier; `git diff --check`; SessionStart issues-memory hook. Hosted exact-head checks are required again on the repair commit before merge. | | 2026-07-24 | `codex/supabase-document-change-trigger` | `9c7d9edf509a51478f5bebbabcca64e3926dc877` + reviewed working diff | Document-change ingestion trigger migration, schema mirror, grants, privacy and fail-safe delivery | APPROVE. No P0-P2 finding. The trigger is update-only, acts solely on a strict JSON boolean false/absent-to-true transition, sends only the receiver's allowlisted owner-scoped fields, fails open for document writes when Vault/GUC/pg_net is unavailable, and revokes execution from public/anon/authenticated. No production URL fallback exists. Highest residual risk is deliberate pg_net at-most-once delivery; the clear-then-flip recovery and data-preserving rollback are documented, and the trigger remains inert until both the Vault secret and environment base-URL GUC are configured. | Disposable Supabase Postgres Docker image version `17.6.1.127` schema replay and drift-manifest regeneration passed (16s; scratch container removed); focused schema/drift/receiver Vitest 89/89; migration-role, function-grant (30 SECURITY DEFINER functions) and owner-scope guards; production-readiness CI mode READY with expected secretless-worktree warnings; offline RAG 21 suites/307 tests; `verify:cheap` 365 files, 3,241 passed/1 skipped; static trace of receiver payload, authoritative owner-scoped reload and idempotent enqueue path. No live provider mutation or migration apply. | | 2026-07-23 | PR #1090 / `cursor/fix-phone-dock-edge-1b1d` | `761de7e9ad623b6bd8d634d849a9eb465d622e48` (merged as `09028ef217209fceb53f1122ac7738b509bce323`) | Phone safe-area and edge-to-edge search-dock UI review | MERGED. No P0-P2 finding. The branch was three commits behind, so current `origin/main` was merged before landing; the actual merge tree matched the reviewed synthetic tree. The dock remains flush to the viewport with safe-area padding inside the form, and the phone shell no longer retains the `dvh` clamp that created the Safari toolbar band. Zero actionable review threads. | `npm run ensure`; focused `ui-tools.spec.ts` phone-home and edge-to-edge scenarios: Chromium 2/2 and WebKit 2/2; refreshed hosted policy, security, unit, build, advisory UI, Production UI and required aggregate checks green; exact-head ancestry and local-main tree equality proved after merge. | | 2026-07-22 | PR #1087 / `codex/reconcile-product-truth` | `edbc2260fef59ca2fa7c6973dffb85e32354bce1` (merged as `05dc52fd8408a65117e22a6236e43252203bea92`) | Product-truth copy, account persistence and unavailable-SSO presentation | MERGED. Cross-device claims now match favourites/preferences persistence; recent searches are identified as browser-session data; the contradictory “never shared” statement is removed. All unavailable setup providers and Apple elsewhere use the connected accessible “coming soon” placeholder pattern. The single review finding was fixed, replied to and resolved. | Red DOM proof; focused 19/19; `verify:cheap` 3,220 passed / 1 skipped; `verify:ui` 265/265; PR-local build/secret scan/offline RAG; final hosted required, Production UI, policy and security checks green. No provider calls or RAG spend. | diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index 02336a5f9..4f7fa350a 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -66,12 +66,12 @@ Last reconciled: **2026-07-24** against local `main` | 3 | `#030` | Decide whether a combined source is allowed to satisfy two expected comparison slots. Add a red shared-title/two-expectation test first; implement unique source assignment only if the owner requires distinct evidence sources. | Requires user/operator decision | A2 / High evaluation semantics | Decision can happen now; 1–3 hours for decision/test, plus 2–4 hours if changed | Evaluation-owner decision; local/offline implementation. | The policy is recorded and the test distinguishes the two interpretations. If distinct sources are required, one identity cannot fill both slots while legitimate cases remain green. Stop without production ranking changes. | | 4 | `#022` | Define an auditable BMJ published-reference attestation policy, then review only the ten highest-impact local WA documents before deciding whether more work is justified. | Requires user/operator decision | A2 / Operator clinical governance plus Specialist review | Decision-ready; 1–2 hours for policy and 0.5–1 day for the first ten | Clinical authority. Live metadata or canary access requires separate approval. | Reviewer, source, timestamp, evidence, and rationale are recorded without upgrading third-party or unverified provenance implicitly. Stop after ten and remeasure the remaining risk. | | 5 | `#051` + `#023` | Compare the existing run `30018289898` with the scheduled 2026-07-26 structured canary, browser, and irrelevant-at-10 artifacts. Do not dispatch a replacement run. | Requires provider approval | A2 / Specialist RAG evaluation | Once the scheduled run completes, approximately 2026-07-27 AWST; 1–2 hours | Approval to read hosted artifacts; no spend or rerun. | Record exact run/tree identities, deterministic and provider deltas, latency, browser outcome, and residual dispositions. Stop if the scheduled artifact is absent and request direction rather than spending. | -| 6 | `#019` | Turn the observed admission/discharge fallback into a current-main red test at the fallback layer, using the live source shape while confirming deterministic ranking and packing retain both roles. | Defer until dependency is resolved | A2 / Specialist RAG answer pipeline | After order 6; 0.5–1 day for the reproducer | Any behaviour change needs protected review and an approved canary. | A local fixture reproduces the omission at the correct layer. Scope the smallest candidate correction, but stop if the defect does not reproduce or before provider-backed validation is approved. | -| 7 | `#018` | Diagnose the three remaining answer-quality mechanisms independently: lithium unrelated-table fast path, ADHD chart-heavy extractive budget, and metabolic schedule-free prose selection. | Defer until dependency is resolved | A2 / Specialist clinical RAG | After order 6, one mechanism at a time; 1–2 days diagnosis | Current-main fixtures; protected review and approved canary for fixes. | Each mechanism has its own reproducer, hypothesis, and smallest candidate. Stop a thread if it lacks deterministic proof or if its individual canary regresses. Do not revive the broad `#029` fix. | -| 8 | `#024` | Restore trustworthy WebKit release evidence by creating a discriminating test for Playwright `_rsc` interception failure versus a real Safari navigation defect. | Defer until dependency is resolved | A3 / High Next.js and Playwright | After order 6 provides the next browser datapoint, or on a real Safari repro; 0.5–1 day | Device/provider check only if local evidence remains ambiguous. | The test-only correction preserves access-control/navigation assertions and keeps Chromium green. Stop once the matrix signal is trustworthy; do not label an app defect without reproduction. | +| 6 | `#019` | Turn the observed admission/discharge fallback into a current-main red test at the fallback layer, using the live source shape while confirming deterministic ranking and packing retain both roles. | Defer until dependency is resolved | A2 / Specialist RAG answer pipeline | After order 5; 0.5–1 day for the reproducer | Any behaviour change needs protected review and an approved canary. | A local fixture reproduces the omission at the correct layer. Scope the smallest candidate correction, but stop if the defect does not reproduce or before provider-backed validation is approved. | +| 7 | `#018` | Diagnose the three remaining answer-quality mechanisms independently: lithium unrelated-table fast path, ADHD chart-heavy extractive budget, and metabolic schedule-free prose selection. | Defer until dependency is resolved | A2 / Specialist clinical RAG | After order 5, one mechanism at a time; 1–2 days diagnosis | Current-main fixtures; protected review and approved canary for fixes. | Each mechanism has its own reproducer, hypothesis, and smallest candidate. Stop a thread if it lacks deterministic proof or if its individual canary regresses. Do not revive the broad `#029` fix. | +| 8 | `#024` | Restore trustworthy WebKit release evidence by creating a discriminating test for Playwright `_rsc` interception failure versus a real Safari navigation defect. | Defer until dependency is resolved | A3 / High Next.js and Playwright | After order 5 provides the next browser datapoint, or on a real Safari repro; 0.5–1 day | Device/provider check only if local evidence remains ambiguous. | The test-only correction preserves access-control/navigation assertions and keeps Chromium green. Stop once the matrix signal is trustworthy; do not label an app defect without reproduction. | | 9 | `#007` | Choose either `/?mode=tools` or `/tools` as the canonical Tools experience, then align navigation, redirects, sitemap, and reachability to that decision. | Requires user/operator decision | A3 / Operator product plus Standard frontend | At the next Tools change; 15–30 minutes for decision and about 0.5 day implementation | Product-owner decision. | One canonical path exists, any compatibility redirect is intentional, and route/UI tests pass. Stop if standalone-page requirements are still unknown. | -| 10 | `#001` | Keep semantic reranking off. Reconsider it only through an ambiguity-specific local comparison followed by the already-defined provider-backed quality gate. | Requires provider approval | A2 / Specialist retrieval and ranking | After order 6 and explicit rollout approval; 0.5–1 day local work plus canary wait | Provider approval and budget. | Leave the flag false unless retrieval remains 36/36 with recall 1.0, no per-case regression, and a measured ambiguity benefit. Otherwise record “remain off” and stop. | -| 11 | `#025` | Select owned alert destinations for deployment, CI, SLO, and ingestion events; configure and test only the selected channels, with ingestion last. | Requires provider approval | A2 / Operator integrations | Next approved observability window; 1–3 hours per selected channel | Provider approval, secret owner, destination owner; ingestion waits for orders 2–3. | One controlled non-PHI event and recovery signal reaches each owned destination after mocked tests. Stop for any channel without ownership or durable-delivery evidence. | +| 10 | `#001` | Keep semantic reranking off. Reconsider it only through an ambiguity-specific local comparison followed by the already-defined provider-backed quality gate. | Requires provider approval | A2 / Specialist retrieval and ranking | After order 5 and explicit rollout approval; 0.5–1 day local work plus canary wait | Provider approval and budget. | Leave the flag false unless retrieval remains 36/36 with recall 1.0, no per-case regression, and a measured ambiguity benefit. Otherwise record “remain off” and stop. | +| 11 | `#025` | Select owned alert destinations for deployment, CI, SLO, and ingestion events; configure and test only the selected channels, with ingestion last. | Requires provider approval | A2 / Operator integrations | Next approved observability window; 1–3 hours per selected channel | Provider approval, secret owner, destination owner; ingestion waits for orders 1–2. | One controlled non-PHI event and recovery signal reaches each owned destination after mocked tests. Stop for any channel without ownership or durable-delivery evidence. | | 12 | `#011` | Put the Supabase Auth percentage-allocation change on the compute-resize checklist and execute it immediately before the first scale-up, not as present-day configuration churn. | Defer until dependency is resolved | A3 / Operator capacity | Only when a compute scale-up is approved; 30–60 minutes plus soak | Planned scale-up, exact project identity, provider approval, and preferably staging. | Record before/after allocation and a healthy soak/advisor check. Stop if no scale-up is planned or project identity is ambiguous. | | 13 | `#017` | Capture one reproducible mobile and desktop production Lighthouse/Web-Vitals baseline before proposing payload work. | Requires provider approval | A3 / High web performance | In an approved live-site window; 1–2 hours | Live-site approval and recorded route, build, device, and throttling profile. | Record representative LCP, INP, and CLS and a decision threshold. Stop if results are too noisy; do not create optimisation work without a demonstrated field problem. | | 14 | `#027` | Decide whether an independent uptime monitor for `/api/health` is worth its vendor and operating cost. Implement only if an alert owner and response path exist. | Optional | Optional / Operator SRE | When independent outage detection is wanted; 1–2 hours | Vendor, cost, privacy, responder ownership, and provider approval. | A controlled non-PHI failure yields one alert and one recovery event. Stop if there is no responder or existing monitoring is accepted. | @@ -124,7 +124,7 @@ history, including items deliberately excluded from recommended work. > **Merged-main canary update (2026-07-23, run `30018289898`):** the new structured report correctly recorded evaluated tree `c24f2e8f2d30d0c59fc1eba025d3dcd63478137e`, run/attempt identity and `cross-region-runner` latency context. Golden retrieval remained 36/36 with document/content recall 1.0 and no failed cases. The 44-case answer gate had grounded-supported and unsupported-correct rates of 1.0, but failed because `neuroleptic-side-effect-escalation` again returned one citation where two are required (citation-failure rate 0.0227). `admission-discharge-comparison` again omitted the specific AKG admission document after `comparison_source_extractive_fallback`; `admission-discharge-coverage-paraphrase` was advisory-only at 24,870 ms. Answer cost was reported as `$0.234736`. Do not retry immediately: retain this as the first structured datapoint, compare it with the scheduled 2026-07-26 report, and keep retrieval/ranking unchanged. -> **RAG reconciliation correction (2026-07-23):** fresh current-main live evidence supersedes the broad diagnosis in #018. The three named misses are not one composer defect. Lithium reproduced an unrelated-table retrieval fast-path defect; ADHD still retrieves a relevant chart-heavy CAMHS source but exhausts the extractive route budget; metabolic retrieves the correct AKG source but selects schedule-free prose; #019 remains post-retrieval comparison source selection. A narrow lithium subject-evidence guard improved its targeting result from 0 to 1 with golden recall 1.0 and no reciprocal-rank regressions, but was reverted and rejected because the required full canary failed. Keep #029 open for the remaining fallback-stub cases. Do not combine these residuals or change ranking scores, comparator ordering, aliases, clamps, or semantic reranking without a separate reproducer and passing canary pair. +> **RAG reconciliation correction (2026-07-23):** fresh current-main live evidence supersedes the former broad fallback diagnosis; #018 now tracks the mechanism-specific lithium, ADHD, and metabolic residuals. The three named misses are not one composer defect. Lithium reproduced an unrelated-table retrieval fast-path defect; ADHD still retrieves a relevant chart-heavy CAMHS source but exhausts the extractive route budget; metabolic retrieves the correct AKG source but selects schedule-free prose; #019 remains post-retrieval comparison source selection. A narrow lithium subject-evidence guard improved its targeting result from 0 to 1 with golden recall 1.0 and no reciprocal-rank regressions, but was reverted and rejected because the required full canary failed. The broad #029 umbrella is archived; retain only the mechanism-specific #018 and #019 work. Do not combine these residuals or change ranking scores, comparator ordering, aliases, clamps, or semantic reranking without a separate reproducer and passing canary pair. | ID | Pri | Type | Summary | Detail / next action | Source | Added | | ---- | --- | ----- | --------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------- | From 8d6c7791f8c4fe1dcb0059c45a2398c899beb545 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:44:08 +0800 Subject: [PATCH 3/3] docs: fix performance task dependency --- docs/branch-review-ledger.md | 2 +- docs/outstanding-issues.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md index a34a21139..a307c672f 100644 --- a/docs/branch-review-ledger.md +++ b/docs/branch-review-ledger.md @@ -20,7 +20,7 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD | Date | Branch or ref | Reviewed HEAD | Scope | Outcome | Checks | | ---------- | -------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| 2026-07-24 | PR #1104 / `codex/task-ledger-refresh-4e2b5e` | `d75811f05efa8ec135efd48863804ed7c15c1bf6` | Universal task-ledger documentation and automated review repair | FIXED. Four review threads identified two sequencing defects (one reported twice) plus one archive contradiction: the canary-dependent rows now point to order 5, ingestion activation waits for safeguards 1–2, and the legacy RAG note no longer says archived #029 remains open. No application/runtime behaviour changes. | Focused diff inspection; `npm run docs:check-links`; Prettier; `git diff --check`; SessionStart issues-memory hook. Hosted exact-head checks are required again on the repair commit before merge. | +| 2026-07-24 | PR #1104 / `codex/task-ledger-refresh-4e2b5e` | `d75811f05efa8ec135efd48863804ed7c15c1bf6` | Universal task-ledger documentation and automated review repair | FIXED. Five review threads identified three sequencing defects (one reported twice) plus one archive contradiction: the canary-dependent rows point to order 5, ingestion activation waits for safeguards 1–2, payload slimming waits for performance evidence at order 13, and the legacy RAG note no longer says archived #029 remains open. No application/runtime behaviour changes. | Focused diff inspection; `npm run docs:check-links`; Prettier; `git diff --check`; SessionStart issues-memory hook. Hosted exact-head checks are required again on the repair commit before merge. | | 2026-07-24 | `codex/supabase-document-change-trigger` | `9c7d9edf509a51478f5bebbabcca64e3926dc877` + reviewed working diff | Document-change ingestion trigger migration, schema mirror, grants, privacy and fail-safe delivery | APPROVE. No P0-P2 finding. The trigger is update-only, acts solely on a strict JSON boolean false/absent-to-true transition, sends only the receiver's allowlisted owner-scoped fields, fails open for document writes when Vault/GUC/pg_net is unavailable, and revokes execution from public/anon/authenticated. No production URL fallback exists. Highest residual risk is deliberate pg_net at-most-once delivery; the clear-then-flip recovery and data-preserving rollback are documented, and the trigger remains inert until both the Vault secret and environment base-URL GUC are configured. | Disposable Supabase Postgres Docker image version `17.6.1.127` schema replay and drift-manifest regeneration passed (16s; scratch container removed); focused schema/drift/receiver Vitest 89/89; migration-role, function-grant (30 SECURITY DEFINER functions) and owner-scope guards; production-readiness CI mode READY with expected secretless-worktree warnings; offline RAG 21 suites/307 tests; `verify:cheap` 365 files, 3,241 passed/1 skipped; static trace of receiver payload, authoritative owner-scoped reload and idempotent enqueue path. No live provider mutation or migration apply. | | 2026-07-23 | PR #1090 / `cursor/fix-phone-dock-edge-1b1d` | `761de7e9ad623b6bd8d634d849a9eb465d622e48` (merged as `09028ef217209fceb53f1122ac7738b509bce323`) | Phone safe-area and edge-to-edge search-dock UI review | MERGED. No P0-P2 finding. The branch was three commits behind, so current `origin/main` was merged before landing; the actual merge tree matched the reviewed synthetic tree. The dock remains flush to the viewport with safe-area padding inside the form, and the phone shell no longer retains the `dvh` clamp that created the Safari toolbar band. Zero actionable review threads. | `npm run ensure`; focused `ui-tools.spec.ts` phone-home and edge-to-edge scenarios: Chromium 2/2 and WebKit 2/2; refreshed hosted policy, security, unit, build, advisory UI, Production UI and required aggregate checks green; exact-head ancestry and local-main tree equality proved after merge. | | 2026-07-22 | PR #1087 / `codex/reconcile-product-truth` | `edbc2260fef59ca2fa7c6973dffb85e32354bce1` (merged as `05dc52fd8408a65117e22a6236e43252203bea92`) | Product-truth copy, account persistence and unavailable-SSO presentation | MERGED. Cross-device claims now match favourites/preferences persistence; recent searches are identified as browser-session data; the contradictory “never shared” statement is removed. All unavailable setup providers and Apple elsewhere use the connected accessible “coming soon” placeholder pattern. The single review finding was fixed, replied to and resolved. | Red DOM proof; focused 19/19; `verify:cheap` 3,220 passed / 1 skipped; `verify:ui` 265/265; PR-local build/secret scan/offline RAG; final hosted required, Production UI, policy and security checks green. No provider calls or RAG spend. | diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index 4f7fa350a..bc11518cc 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -76,7 +76,7 @@ Last reconciled: **2026-07-24** against local `main` | 13 | `#017` | Capture one reproducible mobile and desktop production Lighthouse/Web-Vitals baseline before proposing payload work. | Requires provider approval | A3 / High web performance | In an approved live-site window; 1–2 hours | Live-site approval and recorded route, build, device, and throttling profile. | Record representative LCP, INP, and CLS and a decision threshold. Stop if results are too noisy; do not create optimisation work without a demonstrated field problem. | | 14 | `#027` | Decide whether an independent uptime monitor for `/api/health` is worth its vendor and operating cost. Implement only if an alert owner and response path exist. | Optional | Optional / Operator SRE | When independent outage detection is wanted; 1–2 hours | Vendor, cost, privacy, responder ownership, and provider approval. | A controlled non-PHI failure yields one alert and one recovery event. Stop if there is no responder or existing monitoring is accepted. | | 15 | `#028` | Define the privacy and operating envelope for runtime error tracking: vendor, region, retention, redaction, sampling, source maps, and ownership. | Optional | Optional / Specialist privacy plus Operator | Only after privacy, ownership, dependency, and cost approval; 1–3 days | Privacy review and provider approval. | Redaction tests exclude clinical text, identifiers, and secrets; one approved non-sensitive event arrives. Stop if the envelope is unacceptable or no owner exists. | -| 16 | `#012` + `#013` | Re-measure route payloads and slim only a production route with a demonstrated budget problem; exclude mockup-only code unless it enters a production artifact. | Defer until dependency is resolved | A3 / High bundling and performance | After order 14 or equivalent fresh evidence; 0.5–2 days per proven route | Field/build evidence; UI verification for a change. | Demonstrate a material parsed/gzip or interaction improvement with unchanged behaviour. Run bundle analysis, focused tests, `verify:cheap`, and browser smoke. Stop when gain is small. | +| 16 | `#012` + `#013` | Re-measure route payloads and slim only a production route with a demonstrated budget problem; exclude mockup-only code unless it enters a production artifact. | Defer until dependency is resolved | A3 / High bundling and performance | After order 13 or equivalent fresh evidence; 0.5–2 days per proven route | Field/build evidence; UI verification for a change. | Demonstrate a material parsed/gzip or interaction improvement with unchanged behaviour. Run bundle analysis, focused tests, `verify:cheap`, and browser smoke. Stop when gain is small. | | 17 | `#040` | Establish a small visual-regression baseline for stable, high-value desktop/mobile and accessibility surfaces, with an intentional-update workflow. | Optional | Optional / High visual QA | When a baseline owner and stable browser environment exist; 1–2 days | Owner approval and low-flake browser environment. | Repeated runs are stable, the selected surfaces catch meaningful regressions, and baseline updates are documented. Stop if maintenance churn outweighs detection value. | | 18 | `#033` | Decide whether governance metadata belongs in the LLM source block and draft wording that distinguishes unknown metadata from adverse status before changing generation. | Defer until dependency is resolved | A3 / Specialist prompt governance | After orders 5–6; about 0.5 day design plus evaluation wait | Better metadata coverage, stable canary, clinical/product review, and provider approval for evaluation. | Prompt and serialization tests pass with no grounded-supported drop or citation failures in the approved eval. Stop on broad over-caveating or quality degradation. | | 19 | `#037` | Decide whether all routinely supported claims should be capped at medium trust. Keep the flag off until a clinical/product owner accepts the comprehension and confidence trade-off. | Requires user/operator decision | A3 / Operator clinical product plus Standard frontend | Next trust-policy review; 1–2 hours, plus up to 0.5 day if enabled | Clinical/product authority. | Record the decision. If accepted, change only the flag/render expectations and run focused tests; otherwise leave code unchanged and close the decision. |