From 42e9b3ab790ee0e084f96b83df0f0d42b6e13aa7 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:04:15 +0800 Subject: [PATCH 1/8] issues: establish universal recommended task queue --- docs/outstanding-issues.md | 71 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 69 insertions(+), 2 deletions(-) diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index 1d2db23a6..b97e24f01 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -11,6 +11,9 @@ Durable, cross-session memory of everything still outstanding for this repo: ope - Say `/issues` in Claude Code → the skill reads this file and states the open items back, grouped by priority with a one-line summary count. Nothing is mutated on a plain read. +- Use the **Recommended execution queue** below for current order, acuity, intelligence, timing, + estimates, gates, success criteria, verification, and stopping conditions. This file is the single + universal ledger; do not create a parallel task-ledger document. - `/issues add …`, `/issues done `, `/issues capture`, and friends mutate the tables below. The full command surface lives in the skill file. - Every mutation keeps this file committed so the memory survives across sessions and worktrees. @@ -27,7 +30,65 @@ Durable, cross-session memory of everything still outstanding for this repo: ope - Resolving an item moves its row to **Resolved / archive** with the date and a one-line outcome — rows are archived, not deleted, so the history stays auditable. - + + +## Recommended execution queue + +This queue contains only work still recommended after reconciliation against locally cached `main` +at `9c7d9edf509a51478f5bebbabcca64e3926dc877` on 2026-07-24. Provider state was not refreshed. +Re-check the source row and current `main` before starting. Lower available order numbers come first; +heavyweight verification remains serialized. + +- **P1:** close before real-patient clinical use or the next release decision. +- **P2:** material correctness, clinical-quality, accessibility, or ingestion reliability. +- **P3:** conditional work; act only when its trigger or owner decision exists. +- **Sol/xhigh:** clinical, privacy, RAG-safety, or ambiguous cross-system reasoning. +- **Sol/high:** database, ingestion, release, or test-contract implementation. +- **Terra/high:** bounded frontend, documentation, product, or operational implementation. +- Estimates are focused hands-on time and exclude approval, provider, CI, and review waits. + +There is no confirmed P0. `#052` and `#053` are the two P1 items. + +| Order | Source | Recommended outcome | Acuity | Classification/state | Intelligence | When | Hands-on estimate | +| ----: | ------------------------- | ----------------------------------------------------------------------- | ------ | ------------------------------------------------- | ----------------------------------- | ----------------------------------------------------------- | --------------------------------------------------- | +| 1 | #052 | Align the Safety Plan Generator with the no-patient-data contract | P1 | Required now | Sol/xhigh + privacy/clinical review | Now; before real-patient use | 3–5 hours | +| 2 | #053 | Close or explicitly defer the APP 8/DPA/ZDR governance basis | P1 | Requires user/operator/provider decision | Sol/xhigh + counsel + account owner | Start now; complete before real-patient use | 2–4 hours preparation; external elapsed time varies | +| 3 | #054 | Fail closed when answer relevance metadata is absent | P2 | Required now | Sol/xhigh | Next local clinical-safety change | 2–4 hours | +| 4 | #030 | Require distinct documents for distinct comparison slots | P2 | Required now | Sol/high | Before trusting another admission/discharge verdict | 2–4 hours | +| 5 | #055 | Recover `queued` documents that have no open ingestion job | P2 | Required now | Sol/high | Before claiming at-least-once ingestion | 1–2 days | +| 6 | #026 | Complete the approved hosted rollout of the committed document trigger | P2 | Requires provider approval; code merged | Sol/high + DB operator | After explicit Supabase approval | 1–3 hours plus provider review | +| 7 | #056 | Reconcile and verify the preserved browser/contrast patch | P2 | Recommended; preserved | Terra/high | After higher-acuity local fixes; before the release UI gate | 4–8 hours | +| 8 | #051, #023 | Compare the scheduled structured canary with run `30018289898` | P2 | Defer until scheduled artifact; provider approval | Sol/xhigh + RAG reviewer | After 2026-07-26 18:00 UTC | 1–2 hours | +| 9 | #018, #029 | Reproduce and address each remaining RAG residual separately | P2 | Defer until #051/#023 | Sol/xhigh + clinical/RAG review | Only after the comparable canary review | 1–2 days per proven mechanism | +| 10 | #022 | Decide BMJ attestation policy and refresh high-impact source governance | P2 | Requires clinical/operator decision | Sol/xhigh + clinical owner | After an approved current-state read | 1–3 days; review elapsed time varies | +| 11 | #033 | Reconsider governance metadata in the model prompt | P3 | Defer until #022 and a harm reproducer | Sol/xhigh + clinical review | Only after metadata coverage improves | 1–2 days | +| 12 | #057 | Run an exact-SHA release gate, including runtime hash-secret proof | P2 | Requires provider approval | Sol/high + release operator | After release-candidate fixes land | 2–4 hours; hosted elapsed time varies | +| 13 | #011 | Change Supabase Auth allocation before compute scale-up | P3 | Defer until approved scale-up | Sol/high + Supabase operator | Immediately before the first compute resize | 1–2 hours plus soak | +| 14 | #007 | Choose the canonical Tools entry point | P3 | Requires user/product decision | Terra/high + product owner | When navigation ownership is available | 30–60 minutes decision; 2–4 hours implementation | +| 15 | #009 | Decide whether `/api/jobs` remains an ops-only surface | P3 | Requires operator decision | Terra/high + operations owner | Before expanding or documenting job operations | 30–60 minutes; 2–4 hours if removal/docs follow | +| 16 | #025 | Activate only approved webhooks with named owners | P3 | Requires provider/operator decision | Sol/high + DevOps owner | After #026 and secret/alert ownership decisions | 2–4 hours plus provider setup | +| 17 | #037 | Decide the D5 all-claims trust cap | P3 | Requires clinical/product decision | Sol/xhigh + clinical/product owners | Only if owners want a universal trust-policy change | 1–2 hours decision; 0.5–1 day implementation | +| 18 | #010 | Build one specific “Coming soon” feature | P3 | Optional/product-triggered | Terra/high | Only after an approved feature brief | 0.5–3 days per feature | +| 19 | #017 | Measure production Web Vitals | P3 | Optional/provider approval | Terra/high + performance reviewer | Only when performance prioritisation is requested | 2–4 hours | +| 20 | #012, #013 | Reduce only payloads proven material by #017 | P3 | Defer until measurement | Sol/high | Only after a user-visible bottleneck is measured | 0.5–3 days per route | +| 21 | #027 | Add an independently owned uptime monitor | P3 | Optional/provider decision | Terra/high + operations owner | When alert ownership and cost are approved | 1–2 hours | +| 22 | #038, #039 | Consolidate shared comparison or toolbar behavior | P3 | Optional/triggered | Terra/high + design owner | Before adding another genuinely duplicate surface | 1–3 days per contract | +| 23 | #040 | Establish a small visual-regression baseline set | P3 | Optional/team decision | Terra/high + UI owner | After baseline ownership/update policy are accepted | 1–2 days | +| 24 | Operator backlog/runbooks | Perform staging soak or DR reconstitution only for a real rehearsal | P3 | Defer until release/rehearsal trigger | Sol/high + operator | When a real candidate or scheduled rehearsal exists | 0.5–2 days | + +### Execution contract + +- Every retained row's **Detail / next action** below defines its smallest scope. The linked source or + runbook supplies deeper implementation steps. +- Success means the stated outcome is observable, focused verification passes, and required human or + provider evidence is recorded without secrets. +- Local changes use focused tests first, then `verify:cheap` when warranted. UI changes additionally + use identity-verified `ensure` and the appropriate `verify:ui` slice. RAG, ingestion, privacy, + production-environment, and clinical-output changes also run production-readiness. +- Stop when a dependency, approval, reproducer, identity check, migration replay, or safety gate is + absent. Do not broaden scope, spend on live checks, or contact providers to force a task closed. +- On completion, move the source row to **Resolved / archive** and remove it from this queue. New + reproducible evidence may create a new narrower issue; historical claims do not automatically reopen. ## Open items @@ -37,6 +98,12 @@ Durable, cross-session memory of everything still outstanding for this repo: ope | ID | Pri | Type | Summary | Detail / next action | Source | Added | | ---- | --- | ----- | --------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------- | +| #052 | P1 | issue | Safety Plan Generator contradicts the privacy contract | **Outcome:** the tool, privacy notice, PIA, and tests agree on whether patient identifiers may be entered, copied, printed, or saved. `patient-safety-plan.tsx` asks for “Patient (name or initials)” and produces a patient copy, while `/privacy` and the PIA say the product does not ask for patient data. **Next:** obtain a privacy/clinical decision, then default to identifier-free behavior unless transient identifier processing is explicitly approved and documented. **Success:** no contradictory copy; no identifier is persisted or transmitted without an approved basis. **Verify:** focused component/privacy/copy/accessibility tests, browser print/copy smoke, `verify:cheap`, production-readiness. **Stop:** any new storage or provider transmission requires a separate review. | `src/components/patient-safety-plan.tsx:649`; `src/app/privacy/page.tsx:28`; `docs/privacy-impact-assessment.md` | 2026-07-24 | +| #053 | P1 | task | Close or explicitly defer the APP 8/DPA/ZDR governance basis | **Outcome:** counsel/account owners record an executed or explicitly deferred basis for OpenAI and Railway overseas processing, retention, and APP 5 wording. **Next:** execute or disposition both DPAs, ZDR, Australia residency, prompt-cache retention, subprocessors, and legal approval using the existing checklist. **Success:** every status field has dated evidence or explicit risk acceptance; PIA, notice, contracts, and provider configuration agree. **Verify:** counsel sign-off, provider readback, repository record. **Stop:** do not represent real-patient use as governance-cleared while open. | `docs/openai-cross-border-basis.md`; PIA-1/5/6; `docs/operator-backlog.md` | 2026-07-24 | +| #054 | P2 | issue | Missing answer relevance metadata is treated as source-backed | **Outcome:** absent `relevance` metadata renders conservatively. `RagAnswer.relevance` is optional, but `relevance?.isSourceBacked !== false` treats `undefined` as source-backed. **Next:** add the red render-policy test, then make the smallest policy-only fix. **Success:** missing and explicit-false relevance fail closed; explicit source-backed relevance is unchanged. **Verify:** answer-render-policy, provenance, clinical-safety, `verify:cheap`, production-readiness. **Stop:** do not expand into retrieval, ranking, or generation. | `src/lib/types.ts:1029`; `src/lib/answer-render-policy.ts:145` | 2026-07-24 | +| #055 | P2 | issue | Upload crash can strand a queued document without a job | **Outcome:** a crash between document and job creation cannot strand an upload indefinitely. **Next:** add the stranded-row reproducer, then choose the smallest idempotent atomic-enqueue RPC or bounded scheduled sweep consistent with current ownership and rollback contracts. **Success:** exactly one recoverable job is created; existing open jobs do not duplicate; owner scope, retry, audit, and rollback remain intact. **Verify:** focused upload/recovery/schema tests, migration guards, disposable replay, drift, `verify:cheap`, production-readiness. **Stop:** no at-least-once claim until the crash case passes; hosted changes require approval. | `src/app/api/upload/route.ts`; `docs/webhooks.md:168-192` | 2026-07-24 | +| #056 | P2 | task | Reconcile the preserved browser-readiness and contrast patch | **Outcome:** disabled Formulation navigation remains legible and Firefox/WebKit waits prove real React readiness without weakening assertions. **Next:** prove ownership of `agent/formulation-disabled-contrast`, compare its four-file diff with current `main`, retain only reproducing fixes, then run the affected specs in all browsers. **Success:** disabled contrast passes; a missing handler still fails; Chromium, Firefox, and WebKit pass. **Verify:** focused unit/Playwright, `verify:cheap`, identity-verified `ensure`, `verify:ui`. **Stop:** discard stale harness workarounds that no longer reproduce. | preserved worktree `release-browser-contrast-20260723`; session 2026-07-24 | 2026-07-24 | +| #057 | P2 | task | Prove one exact-SHA release candidate end to end | **Outcome:** local and hosted release evidence evaluates the same SHA and safely proves the production `RAG_QUERY_HASH_SECRET` boot requirement. **Next:** after candidate fixes land, obtain approvals, verify SHA/environment identity, confirm secret placement without revealing it, and run the bounded canonical release checks. **Success:** required gates are green and any waiver is explicit/owned. **Verify:** release runbook, golden retrieval, RAG-only quality, production-readiness, deployment/health identity, protected-main merge proof. **Stop:** no unidentified tree, duplicate paid canary, invented staging, or exposed secret. | `docs/operator-backlog.md`; `docs/launch-operator-runbook.md`; PIA-2 | 2026-07-24 | | #051 | P2 | task | Stabilise the live answer-quality canary before more RAG tuning | Diagnostics landed in PR #1095: structured JSON/Markdown artifacts now record the actual checked-out SHA, run identity and latency context, and the offline trend tool separates content, provider-route and latency outcomes. First validating run `30018289898` recorded the expected tree and cost, with 36/36 retrieval green, but one report cannot establish variability; PR #1097 prevents a single failure being mislabeled as repeated. Next: compare the scheduled 2026-07-26 structured report with this run. Do not spend on an immediate retry or reapply the archived lithium guard before that comparison. | PR #1095; run `30018289898`; PR #1097; archive ref `refs/archive/rejected-rag/20260723/monitoring-subject-gate` | 2026-07-23 | | #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 | | #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 | @@ -56,7 +123,7 @@ Durable, cross-session memory of everything still outstanding for this repo: ope | #023 | P3 | task | Read Sunday 2026-07-26 scheduled-run artifacts | The 18:00 UTC scheduled runs deliver three free datapoints at once: first full-44 weekly canary (validates the #1044 ANSWER_CASE_LIMIT raise), browser-matrix flake second datapoint (webkit ui-route-coverage now reproduced + root-caused 2026-07-22 → see #024; firefox ui-formulation:91 still awaits a datapoint), and the irrelevant@10 labeling-audit artifact (§3.1 human-decision class). Read all three, then disposition. | sessions 2026-07-20/21; branch-review-ledger convergence notes | 2026-07-21 | | #024 | P3 | issue | WebKit e2e `_rsc`-prefetch access-control-checks errors | verify:release:offline on `main` ce32fe170 (2026-07-22) reproduced #023's webkit clause: **6/6 deterministic** failures in `tests/ui-route-coverage.spec.ts` (Therapy Compass; DSM home/comparison; Specifier comparison/map; Differential stream), each a `pageerror … ?_rsc=… due to access control checks` on Next.js RSC prefetch — Chromium + Firefox clean. Not merge-blocking (required gate `test:e2e:pr` is chromium-only; the full webkit matrix is advisory/release-time). Most likely a Playwright route-interception × WebKit interaction, not a Safari user defect. Next: decide (a) allow/mock the `_rsc` routes for the `webkit` e2e project, or (b) confirm real Safari impact — before trusting the full-matrix webkit gate at release. NB the 2 other webkit fails (`ui-stress:412`, `ui-universal-search:210`) passed on isolated re-run = true flake. | session 2026-07-22 (verify:release:offline, `main` ce32fe170); refines #023 | 2026-07-22 | | #025 | P2 | task | Activate the three webhooks (operator secrets) | Merged (#968) + deployed but inert — verified live: `POST /api/webhooks/railway` returns `503 webhook_not_configured`. To turn on: (1) Railway → set `RAILWAY_WEBHOOK_SECRET` + add the `?token=…` webhook URL; (2) the chat URLs `SLACK_WEBHOOK_URL`/`DISCORD_WEBHOOK_URL` must be set in BOTH places — the Railway **app/server env** (the receiver forwards deploy alerts via `postChatNotification`, which reads server env, so repo-secret-only leaves the Railway webhook authenticated but returning `delivered:false`) AND as **GitHub repo secrets** (the CI-failure workflow reads `secrets.*`); (3) `SUPABASE_INGESTION_WEBHOOK_SECRET`. Each fails closed until set, so this is pure ops. See docs/webhooks.md. | session 2026-07-22; PR #968; docs/webhooks.md | 2026-07-22 | -| #026 | P2 | task | Wire the Supabase document-change trigger | Locally implemented on `codex/supabase-document-change-trigger` in dedicated worktree `C:\\Users\\joshs\\.codex\\worktrees\\supabase-trigger-20260723\\Database`: forward migration `20260723150000_document_change_ingestion_webhook.sql`, schema mirror, update-only/minimal/fail-safe contract test and rollback docs. Focused schema tests 69/69 plus migration-role, function-grant and owner-scope guards pass. Not committed or applied: disposable replay and `drift:manifest` are blocked because Docker cannot start and `wsl --status` returns `Wsl/0x80070422` (WSL service disabled). Next: enable WSL/Docker, replay and regenerate drift, run broad gates, then use a protected-main PR before configuring the Vault secret/base-URL GUC. Never apply the SQL raw to live. | local branch/worktree; `docs/webhooks.md` section 3; session 2026-07-23 | 2026-07-22 | +| #026 | P2 | task | Complete the Supabase document-change trigger rollout | Implementation and disposable replay are complete and merged through PR #1100: forward migration `20260723150000_document_change_ingestion_webhook.sql`, schema mirror, update-only/minimal/fail-safe tests, drift manifest, and rollback docs. Focused schema/drift tests passed 79/79 plus migration-role, function-grant, and owner-scope guards. **Next:** with explicit Supabase approval, replay the hosted migration chain, apply the committed migration through the normal path, then configure the Vault secret and base-URL GUC and perform a bounded readback/smoke. The trigger remains inert until those hosted steps complete. **Success:** migration history, trigger/function configuration, and one controlled UPDATE event read back correctly without duplicate INSERT jobs. **Stop:** never apply raw SQL or claim full at-least-once ingestion while #055 remains open. | PR #1100; `docs/webhooks.md` section 3; session 2026-07-24 | 2026-07-22 | | #027 | P3 | rec | External uptime monitor independent of GitHub/Railway | `live-domain-monitor.yml` runs on GitHub's cron, so it won't run in exactly the outage it should catch (Actions or the deploy itself down). Add an off-platform synthetic monitor (UptimeRobot / Better Stack / Checkly) hitting `/api/health` with a webhook alert. Provider setup, not code. | session 2026-07-22 webhook review | 2026-07-22 | | #028 | P3 | rec | Runtime error tracking (Sentry or similar) | No error tracking in the repo — production exceptions on `psychiatry.tools`, including how often `RAG_PROVIDER_MODE=auto` silently degrades to source-only, are invisible. Weigh adding `@sentry/nextjs` (dependency + DSN secret + instrumentation) vs cost; alert → chat/issue. Provider-backed; needs explicit sign-off before adding the dependency. | session 2026-07-22 webhook review | 2026-07-22 | | #029 | P2 | issue | 12 of 30 answer-quality cases return the fallback stub | run #61 --dump-answers: 12/30 quality cases emit the source_backed_review_fallback boilerplate with answer_sections: [], all grounded with 4-6 citations. Some still PASS targeting because the stub echoes query keywords (the contraindication/document_lookup matchers need only a keyword), so the targeting metric MASKS the problem for those intents. Superset of #018 — fix in the extractive composer, validate with the provider-backed answer eval. | run #61 dump artifact; session 2026-07-22 | 2026-07-22 | From 7853e328d2e59ef1acb612b8ac2e5e76dd220fe7 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:04:21 +0800 Subject: [PATCH 2/8] docs: link universal task ledger --- docs/codebase-index.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/codebase-index.md b/docs/codebase-index.md index c7d597ed5..7e4d656d9 100644 --- a/docs/codebase-index.md +++ b/docs/codebase-index.md @@ -336,6 +336,7 @@ One shared composer (`master-search-header.tsx`) serves every mode. Placement: | Search/RAG roadmap | `docs/search-rag-master-plan.md` | | Reindex operations | `docs/reindex-runbook.md` | | Production readiness | `docs/production-readiness-checklist.md` | +| Universal task ledger | `docs/outstanding-issues.md` | | Capacity / scale-up | `docs/capacity-review.md`, `docs/auth-connection-cap-runbook.md` | | Frontend architecture | `docs/frontend-architecture.md` | | Repo audit (2026-07-01) | `docs/audit/repo-audit-2026-07-01.md` | From 505b4f68165f8f050e17865981f409150d50cdd3 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:06:01 +0800 Subject: [PATCH 3/8] docs: keep trigger evidence link-safe --- docs/branch-review-ledger.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md index b9b2a8b96..75bf5179d 100644 --- a/docs/branch-review-ledger.md +++ b/docs/branch-review-ledger.md @@ -20,7 +20,7 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD | Date | Branch or ref | Reviewed HEAD | Scope | Outcome | Checks | | ---------- | -------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| 2026-07-24 | `codex/supabase-document-change-trigger` | `9c7d9edf509a51478f5bebbabcca64e3926dc877` + reviewed working diff | Document-change ingestion trigger migration, schema mirror, grants, privacy and fail-safe delivery | APPROVE. No P0-P2 finding. The trigger is update-only, acts solely on a strict JSON boolean false/absent-to-true transition, sends only the receiver's allowlisted owner-scoped fields, fails open for document writes when Vault/GUC/pg_net is unavailable, and revokes execution from public/anon/authenticated. No production URL fallback exists. Highest residual risk is deliberate pg_net at-most-once delivery; the clear-then-flip recovery and data-preserving rollback are documented, and the trigger remains inert until both the Vault secret and environment base-URL GUC are configured. | Disposable `supabase/postgres:17.6.1.127` schema replay and drift-manifest regeneration passed (16s; scratch container removed); focused schema/drift/receiver Vitest 89/89; migration-role, function-grant (30 SECURITY DEFINER functions) and owner-scope guards; production-readiness CI mode READY with expected secretless-worktree warnings; offline RAG 21 suites/307 tests; `verify:cheap` 365 files, 3,241 passed/1 skipped; static trace of receiver payload, authoritative owner-scoped reload and idempotent enqueue path. No live provider mutation or migration apply. | +| 2026-07-24 | `codex/supabase-document-change-trigger` | `9c7d9edf509a51478f5bebbabcca64e3926dc877` + reviewed working diff | Document-change ingestion trigger migration, schema mirror, grants, privacy and fail-safe delivery | APPROVE. No P0-P2 finding. The trigger is update-only, acts solely on a strict JSON boolean false/absent-to-true transition, sends only the receiver's allowlisted owner-scoped fields, fails open for document writes when Vault/GUC/pg_net is unavailable, and revokes execution from public/anon/authenticated. No production URL fallback exists. Highest residual risk is deliberate pg_net at-most-once delivery; the clear-then-flip recovery and data-preserving rollback are documented, and the trigger remains inert until both the Vault secret and environment base-URL GUC are configured. | Disposable Supabase Postgres 17.6.1.127 Docker-image schema replay and drift-manifest regeneration passed (16s; scratch container removed); focused schema/drift/receiver Vitest 89/89; migration-role, function-grant (30 SECURITY DEFINER functions) and owner-scope guards; production-readiness CI mode READY with expected secretless-worktree warnings; offline RAG 21 suites/307 tests; `verify:cheap` 365 files, 3,241 passed/1 skipped; static trace of receiver payload, authoritative owner-scoped reload and idempotent enqueue path. No live provider mutation or migration apply. | | 2026-07-23 | PR #1090 / `cursor/fix-phone-dock-edge-1b1d` | `761de7e9ad623b6bd8d634d849a9eb465d622e48` (merged as `09028ef217209fceb53f1122ac7738b509bce323`) | Phone safe-area and edge-to-edge search-dock UI review | MERGED. No P0-P2 finding. The branch was three commits behind, so current `origin/main` was merged before landing; the actual merge tree matched the reviewed synthetic tree. The dock remains flush to the viewport with safe-area padding inside the form, and the phone shell no longer retains the `dvh` clamp that created the Safari toolbar band. Zero actionable review threads. | `npm run ensure`; focused `ui-tools.spec.ts` phone-home and edge-to-edge scenarios: Chromium 2/2 and WebKit 2/2; refreshed hosted policy, security, unit, build, advisory UI, Production UI and required aggregate checks green; exact-head ancestry and local-main tree equality proved after merge. | | 2026-07-22 | PR #1087 / `codex/reconcile-product-truth` | `edbc2260fef59ca2fa7c6973dffb85e32354bce1` (merged as `05dc52fd8408a65117e22a6236e43252203bea92`) | Product-truth copy, account persistence and unavailable-SSO presentation | MERGED. Cross-device claims now match favourites/preferences persistence; recent searches are identified as browser-session data; the contradictory “never shared” statement is removed. All unavailable setup providers and Apple elsewhere use the connected accessible “coming soon” placeholder pattern. The single review finding was fixed, replied to and resolved. | Red DOM proof; focused 19/19; `verify:cheap` 3,220 passed / 1 skipped; `verify:ui` 265/265; PR-local build/secret scan/offline RAG; final hosted required, Production UI, policy and security checks green. No provider calls or RAG spend. | | 2026-07-22 | PR #1086 / `codex/reconcile-xlsx-budgets` | `5376880a40749b6526fd7e4603a7be9d04bc9624` (merged as `2963fba46eacd644618a588fa283f7597faa2644`) | XLSX resource-boundary review | MERGED. Enforces worksheet, non-empty-row, rendered-cell and UTF-8 output ceilings before result fragments are appended; sparse-column output is preserved. No actionable review threads. | Red 257-sheet reproducer; focused 4/4; `verify:cheap` 3,218 passed / 1 skipped; PR-local build/scan/offline RAG; hosted required/security/policy green. | From ac7fc7344e9bbe2bbf7fb0009a1b6803586e0d77 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:15:11 +0800 Subject: [PATCH 4/8] docs: activate universal task ledger --- .claude/hooks/issues-surface.sh | 47 ++++++++++---------- .claude/skills/issues/SKILL.md | 59 +++++++++++++------------ AGENTS.md | 24 +++++----- docs/README.md | 5 ++- docs/maturity-backlog-workorders.md | 13 +++--- docs/operator-backlog.md | 18 ++++---- docs/outstanding-issues.md | 61 +++++++++++++------------- docs/production-readiness-checklist.md | 7 +-- docs/rag-hybrid-findings-and-todo.md | 10 +++-- 9 files changed, 130 insertions(+), 114 deletions(-) diff --git a/.claude/hooks/issues-surface.sh b/.claude/hooks/issues-surface.sh index dab08f83d..3cc453b24 100755 --- a/.claude/hooks/issues-surface.sh +++ b/.claude/hooks/issues-surface.sh @@ -2,9 +2,9 @@ # SessionStart hook — surface the outstanding-work memory into context. # # Reads docs/outstanding-issues.md (the /issues ledger) and prints a compact, -# glanceable summary of the OPEN items so every session starts already aware of -# what is outstanding. When the trigger is a context reset (compact / resume / -# clear) it also emits a reminder to run `/issues capture` — that is the moment +# glanceable summary of the RECOMMENDED EXECUTION QUEUE so every session starts +# aware of the ordered work still worth doing. When the trigger is a context reset +# (compact / resume / clear), it also emits a reminder to run `/issues capture` — that is the moment # a session's in-flight follow-ups are most likely to be lost. # # Contract: READ-ONLY. Never writes, never commits, never fails a session — it @@ -25,44 +25,43 @@ source_val="$(printf '%s' "$payload" \ | grep -o '"source"[[:space:]]*:[[:space:]]*"[^"]*"' \ | head -n1 | sed -E 's/.*"([^"]*)"$/\1/')" -# --- parse the "Open items" table only --------------------------------------- -# Emit "PRIIDTYPESUMMARY" per open row. Scoped between the -# "## Open items" heading and the next "## " heading so the Resolved/archive -# table (different columns) is never counted. +# --- parse the "Recommended execution queue" table only --------------------- +# Emit "ORDERACUITYSOURCEOUTCOMECLASSIFICATION" per row. rows="$(awk ' - /^## Open items/ { inopen=1; next } - /^## / { if (inopen) inopen=0 } - inopen && /^\| #[0-9]/ { + /^## Recommended execution queue/ { inqueue=1; next } + /^## / { if (inqueue) inqueue=0 } + inqueue && /^\|[[:space:]]*[0-9]+[[:space:]]*\|/ { n=split($0, c, "|") - id=c[2]; pri=c[3]; typ=c[4]; sum=c[5] - gsub(/^[ \t]+|[ \t]+$/, "", id) - gsub(/^[ \t]+|[ \t]+$/, "", pri) - gsub(/^[ \t]+|[ \t]+$/, "", typ) - gsub(/^[ \t]+|[ \t]+$/, "", sum) - printf "%s\t%s\t%s\t%s\n", pri, id, typ, sum + ord=c[2]; src=c[3]; out=c[4]; acu=c[5]; cls=c[6] + gsub(/^[ \t]+|[ \t]+$/, "", ord) + gsub(/^[ \t]+|[ \t]+$/, "", src) + gsub(/^[ \t]+|[ \t]+$/, "", out) + gsub(/^[ \t]+|[ \t]+$/, "", acu) + gsub(/^[ \t]+|[ \t]+$/, "", cls) + printf "%s\t%s\t%s\t%s\t%s\n", ord, acu, src, out, cls } ' "$ledger" 2>/dev/null || true)" total="$(printf '%s' "$rows" | grep -c . || true)" if [ "${total:-0}" -eq 0 ]; then - echo "[issues] Outstanding-work memory (docs/outstanding-issues.md): no open items. Record one with /issues add …" + echo "[issues] Universal task ledger (docs/outstanding-issues.md): no recommended work." exit 0 fi -group() { printf '%s\n' "$rows" | awk -F'\t' -v p="$1" '$1==p'; } +group() { printf '%s\n' "$rows" | awk -F'\t' -v p="$1" '$2==p'; } count() { printf '%s' "$1" | grep -c . || true; } p1="$(group P1)"; p2="$(group P2)"; p3="$(group P3)" c1="$(count "$p1")"; c2="$(count "$p2")"; c3="$(count "$p3")" -echo "[issues] Outstanding-work memory — ${total} open (${c1}×P1, ${c2}×P2, ${c3}×P3). Source of truth: docs/outstanding-issues.md · read the full list back with /issues." +echo "[issues] Universal task ledger — ${total} recommended (${c1}×P1, ${c2}×P2, ${c3}×P3). Source of truth: docs/outstanding-issues.md · read the full queue with /issues." print_group() { # $1=rows $2=max-to-list - local data="$1" limit="$2" shown=0 more=0 pri id typ sum + local data="$1" limit="$2" shown=0 more=0 ord acu src out cls [ -z "$data" ] && return 0 - while IFS=$'\t' read -r pri id typ sum; do - [ -z "$pri" ] && continue + while IFS=$'\t' read -r ord acu src out cls; do + [ -z "$ord" ] && continue if [ "$shown" -lt "$limit" ]; then - echo " ${pri} ${id} ${typ} — ${sum}" + echo " ${ord}. ${acu} ${src} — ${out} (${cls})" shown=$((shown + 1)) else more=$((more + 1)) @@ -74,7 +73,7 @@ EOF return 0 } -# P1 = do-next, list all. P2 = should-do, list up to 8. P3 = collapse to a count. +# Preserve queue order inside each acuity. P1 is listed in full, P2 up to 8, P3 as a count. [ "$c1" -gt 0 ] && print_group "$p1" 999 [ "$c2" -gt 0 ] && print_group "$p2" 8 [ "$c3" -gt 0 ] && echo " ${c3} × P3 (nice-to-have / revisit-when) — see /issues" diff --git a/.claude/skills/issues/SKILL.md b/.claude/skills/issues/SKILL.md index 228433931..7dd52d105 100644 --- a/.claude/skills/issues/SKILL.md +++ b/.claude/skills/issues/SKILL.md @@ -1,13 +1,14 @@ --- name: issues -description: Track and recall all outstanding tasks, recommendations, and issues for this repo as durable cross-session memory. Use when the user types "/issues" (state the open items back), or asks to add/close/update/capture an outstanding task, recommendation, or issue. The memory lives in docs/outstanding-issues.md; a plain "/issues" is read-only. +description: Maintain and recall the repository's single universal recommended task ledger. Use when the user types "/issues" (state the recommended execution queue back), or asks to add, close, update, or capture work. The memory lives in docs/outstanding-issues.md; a plain "/issues" is read-only. --- -# issues — the outstanding-work memory +# issues — universal task-ledger memory -`docs/outstanding-issues.md` is the durable, cross-session memory of everything still outstanding: -open **tasks**, **recommendations** not yet acted on, and **issues** not yet resolved. Chat context -resets; that file does not. This skill reads it back and keeps it current. +`docs/outstanding-issues.md` is the durable, cross-session memory and single universal task ledger. +Its **Recommended execution queue** is the only active repository-wide work order. The Open and +Resolved tables retain source detail and audit history; an open row is not active work unless it is +also represented in the recommended queue. **The ledger is the source of truth, not chat memory.** Never answer `/issues` from conversation recall — always read the file first, so the answer is correct even in a fresh session. @@ -20,53 +21,57 @@ recall — always read the file first, so the answer is correct even in a fresh ## Default: `/issues` (read-only) 1. Read `docs/outstanding-issues.md`. -2. State the **open items** back, grouped by priority (P1 → P3), each as - `#ID · type · summary — next action (source)`. -3. End with a one-line count, e.g. `5 open: 0×P1, 3×P2, 2×P3 · 0 resolved this session`. +2. State the **Recommended execution queue** back in numeric order, each as + `order · source · acuity · outcome — classification; when; estimate`. +3. End with a one-line count by acuity, e.g. `5 recommended: 0×P1, 3×P2, 2×P3`. 4. Do **not** mutate the file or commit on a plain read. -If a filter is given, narrow step 2: `/issues P1` (by priority), `/issues issues` / `/issues recs` -/ `/issues tasks` (by type), `/issues ` (summary/detail substring match). +If a filter is given, narrow step 2 by acuity, source ID, classification, intelligence, timing, or +outcome keyword. Read the matching source row when more detail is requested. ## Mutating subcommands Parse the intent from natural language too — the exact syntax is a convenience, not a requirement. -- **`/issues add `** — append a row to **Open items**. Infer `Pri`/`Type` from the text - (ask only if genuinely ambiguous; default `P2`/`task`). Allocate the ID from the - `` marker, then bump that marker. Fill `Source` with - `session ` unless the user names one; `Added` is today's date. +- **`/issues add `** — verify that the work is current, deduplicated, evidence-supported, and + still recommended. Then append a detailed source row to **Open items**, add its concise ordered row + to the **Recommended execution queue**, and bump ``. Capture outcome, + acuity, classification, intelligence, timing, estimate, dependencies/approvals, success criteria, + verification, and stopping condition. Ask when a high-impact field cannot safely be inferred. - **`/issues done [outcome]`** — move that row from **Open items** to **Resolved / archive** - with today's date and a one-line outcome. Archive, never delete. -- **`/issues update `** — edit an open row's summary or next action in place. + with today's date and a one-line outcome, remove that ID from the recommended queue, and renumber + queue order contiguously. For a grouped queue row, remove only that ID unless none remain. +- **`/issues update `** — edit the source row and synchronize every affected queue field. - **`/issues capture`** — scan the current session for recommendations, follow-ups, deferrals, and - unfixed problems that surfaced but were not recorded. Propose them as a numbered list and add the - confirmed ones (dedupe against existing rows first — do not re-add something already tracked). + unfixed problems. Verify them against current repository evidence, remove completed/stale/ + duplicate/superseded/speculative/uneconomic candidates, and propose only work still recommended. + Add confirmed items to both active and source tables. ## Capture discipline (proactive memory) -When a task in _any_ session ends with unresolved follow-ups — a deferred fix, a "revisit when X" -recommendation, a known risk, a TODO you had to leave — offer to record them here before the context -is lost. That is what makes this a memory rather than a static list. Prefer one crisp row over a -paragraph; put the smallest next action in **Detail / next action**. +When a task ends with a verified follow-up worth doing, offer to record it before context is lost. +Do not capture every suggestion or TODO. Prefer one crisp source row and one ordered queue row over a +paragraph, and state the smallest next action and stop condition. ## Writing rules - Keep the table format and column order exactly as in `docs/outstanding-issues.md`. One row per item. - IDs are monotonic and never reused — always allocate from the `issues:next-id` marker and bump it. +- Queue order is contiguous and dependency-aware. Re-evaluate affected rows after each mutation. +- Keep nonrecommended/refuted/parked claims out of the queue; retain them below only as audit history. - Escape `|` inside cell text (write `\|`) so the markdown table stays intact. - Respect the repo's RAG/clinical/privacy flagging rules if an item _itself_ touches a protected surface — recording it here is fine, but acting on it later still needs the usual gate. -## Persist the memory (commit) +## Persist the memory -After any mutation, stage and commit **only** `docs/outstanding-issues.md` so the memory survives the -ephemeral container and other worktrees: +When the user authorizes a commit or the mutation is already inside an authorized handoff, stage and +commit **only** `docs/outstanding-issues.md` so the memory survives other worktrees: ``` git add docs/outstanding-issues.md git commit -m "issues: " ``` -Do not stage or commit anything else, and do not push unless the user asks (or you are already in a -handoff/upload flow). A plain read-only `/issues` commits nothing. +Otherwise leave the mutation uncommitted and report that state. Do not push unless the user asks (or +you are already in an authorized handoff/upload flow). A plain read-only `/issues` commits nothing. diff --git a/AGENTS.md b/AGENTS.md index 32d9bc6c0..cbef05e80 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -450,19 +450,23 @@ Run the matching planner command in `docs/productivity-workflows.md` without sid ## Outstanding-work memory (`/issues`) -`docs/outstanding-issues.md` is the durable, cross-session memory of every outstanding **task**, -**recommendation**, and **issue** for this repo. Chat context resets between sessions; that file does -not, so anything worth remembering after a session ends belongs there. +`docs/outstanding-issues.md` is this repository's single universal task ledger. Its recommended +execution queue keeps only evidence-supported work still worth doing and records order, acuity, +classification, executor capability, timing, effort, dependencies, approvals, success criteria, +verification, and stopping conditions. Completed, stale, duplicate, superseded, speculative, and +no-longer-recommended claims may remain only in archive/history, never as active work. Do not create +a second task ledger. - When the user types `/issues`, invoke the `issues` skill (`.claude/skills/issues/SKILL.md`): read - `docs/outstanding-issues.md` and state the open items back, grouped by priority. A plain `/issues` - is read-only — it mutates and commits nothing. -- `/issues add|done|update|capture …` mutate the ledger; each mutation commits **only** - `docs/outstanding-issues.md` (no push unless the user asks or you are already handing off). -- Proactively offer to `capture` unresolved follow-ups, deferrals, and known risks into the ledger - before a session's context is lost — that is what keeps it a memory rather than a stale list. + `docs/outstanding-issues.md` and state its recommended queue back in execution order. A plain + `/issues` is read-only — it mutates and commits nothing. +- `/issues add|done|update|capture …` mutate the ledger only when requested and must keep the + recommended queue and source/archive rows synchronized. Committing, pushing, and opening a PR are + separate Git actions requiring the usual authorization. +- Before capture, verify and deduplicate each candidate. Add only work that remains recommended; + archive or omit completed, stale, duplicate, superseded, speculative, or uneconomic suggestions. - A `SessionStart` hook (`.claude/hooks/issues-surface.sh`, wired in `.claude/settings.json`) - auto-surfaces the open items into context at the start of every session and, on a context reset + auto-surfaces the recommended queue into context at the start of every session and, on a context reset (`compact`/`resume`/`clear`), nudges a `/issues capture`. It is read-only — it never writes the ledger. `/issues` is still the way to read the full list or mutate it. diff --git a/docs/README.md b/docs/README.md index 0b743e80c..ee6a75fca 100644 --- a/docs/README.md +++ b/docs/README.md @@ -71,10 +71,11 @@ npm run docs:check-links ## Plans and workstreams (living) -- [maturity-backlog-workorders.md](maturity-backlog-workorders.md) — actionable work orders tracking the repository-maturity audit backlog +- [outstanding-issues.md](outstanding-issues.md) — the single universal task ledger; its recommended queue is the only active repository-wide work order +- [maturity-backlog-workorders.md](maturity-backlog-workorders.md) — historical maturity work-order evidence; not an independent active queue - [framework-dependency-modernization-checklist.md](framework-dependency-modernization-checklist.md) — ordered Next.js 16, runtime, dependency, Turbopack, and verification migration program - [search-rag-master-plan.md](search-rag-master-plan.md) / [search-rag-master-context.md](search-rag-master-context.md) — search/RAG roadmap and shared context -- [rag-hybrid-findings-and-todo.md](rag-hybrid-findings-and-todo.md) — hybrid retrieval findings backlog +- [rag-hybrid-findings-and-todo.md](rag-hybrid-findings-and-todo.md) — hybrid retrieval findings and historical evidence; active work is promoted to the universal ledger - [reindex-shadow-harness-design.md](reindex-shadow-harness-design.md) — designed-only shadow reindex harness (driver not built) - [ingestion-concurrency-fix-workorder.md](ingestion-concurrency-fix-workorder.md) — ingestion concurrency workorder - [redesign/](redesign/) — premium redesign plans, decision log, token adoption diff --git a/docs/maturity-backlog-workorders.md b/docs/maturity-backlog-workorders.md index 2c3a945c9..15248db32 100644 --- a/docs/maturity-backlog-workorders.md +++ b/docs/maturity-backlog-workorders.md @@ -1,11 +1,12 @@ -# Maturity backlog — work orders +# Maturity audit work-order history -Living tracker that turns the deferred backlog from +Supporting history for work orders derived from [`docs/audit/2026-07-20-repository-maturity.md`](audit/2026-07-20-repository-maturity.md) §10 -into actionable, sequenced work orders. Each item states its **outcome**, **approach**, **key -files**, **risk**, **verification**, and **status**. High-risk items are deliberately kept as -their own work order — the audit's rule is one dedicated PR + full-suite verification per -structural change, not a single mixed PR. +with their **outcome**, **approach**, **key files**, **risk**, **verification**, and **status**. +This is not an independent active backlog. A maturity item is current work only when promoted to the +recommended queue in [`outstanding-issues.md`](outstanding-issues.md), the repository's single +universal task ledger. Historical `READY`, `OPEN`, or `PROVIDER-GATED` labels below do not override +that ledger. **Status legend:** `DONE` (landed) · `IN PROGRESS` (partially landed; more PRs remain) · `READY` (scoped, safe to start) · `OPEN` (needs a decision or a dedicated PR) · diff --git a/docs/operator-backlog.md b/docs/operator-backlog.md index eb749675b..a1852059d 100644 --- a/docs/operator-backlog.md +++ b/docs/operator-backlog.md @@ -1,10 +1,12 @@ -# Operator backlog +# Operator runbook index -Single source of truth for **human-only / provider-gated actions** that cannot be done from a coding -session (they touch Supabase, Railway, OpenAI, or GitHub settings, per the AGENTS.md provider boundary). -This exists so that launch-blocking state lives in the repo instead of chat memory. +This file preserves provider-action detail and runbook links. It is **not** an independent task queue: +[`outstanding-issues.md`](outstanding-issues.md) is the repository's single universal ledger, and an +operator row is executable only while a corresponding recommended row exists there. Status here is +supporting evidence that must be reconciled with that ledger and verified live before action. -**How to use:** work top to bottom; each row links to the detailed runbook. `Status` values are +**How to use:** follow the universal ledger order, then use the matching row here for provider detail. +`Status` values are `⏳ pending`, `🔎 verify` (may already be done — confirm before repeating), `✅ done`, `—` (n/a). Update the row (and its runbook) when an action lands. The sequenced flow with exact commands and approval gates is [launch-operator-runbook.md](launch-operator-runbook.md); this table is the index. @@ -12,8 +14,8 @@ Code + ops remediation waves from the 2026-07-14 multi-skill audit live in [audit-remediation-plan-2026-07-14.md](audit-remediation-plan-2026-07-14.md). Findings inventory for handover: [audit-handover-2026-07-14.md](audit-handover-2026-07-14.md). -> Status column is seeded from repo runbooks + session memory and **must be confirmed against live -> state** before acting — do not treat a `🔎 verify` row as authoritative. +> Status is historical/runbook evidence and **must be confirmed against live state** before acting. +> A pending row absent from the recommended universal queue is not authorization or recommended work. ## Launch-gating actions @@ -23,7 +25,7 @@ Findings inventory for handover: [audit-handover-2026-07-14.md](audit-handover-2 | Apply drift-codify forward migration (step 1h) | ✅ done | — | Applied and drift/readiness verified 2026-07-13; verify only unless new reviewed drift is found | [database-drift-detection.md](database-drift-detection.md) | | Apply repo-ahead migrations to live (post-2026-07-13) | ✅ done | — | Zero unsafe title-word rows; `npm run check:drift`; then `eval:retrieval:quality` (36/36) for the corrector | [deploy-corrector-public-titles.md](deploy-corrector-public-titles.md) · [operator-apply-performance-latency-remediation.md](operator-apply-performance-latency-remediation.md) | | Full release gate (bounded OpenAI spend) | ⏳ pending | migrations 1 applied | `npm run verify:release`; `npm run eval:quality -- --rag-only` | [launch-operator-runbook.md §2](launch-operator-runbook.md) | -| Provision staging Supabase project (`Clinical KB Staging`, ap-southeast-2) | ⏳ pending | — | `npm run check:indexing` after `db push` | [staging-setup.md](staging-setup.md) | +| Provision staging Supabase project (`Clinical KB Staging`, ap-southeast-2) | ✅ done | — | Archived run `29795051547` proves the dedicated staging tenancy harness and cleanup; do not reprovision | [staging-setup.md](staging-setup.md) · [archived evidence](archive/staging-tenancy-evidence-29795051547/staging-tenancy-evidence.json) | | Staging soak + rollback rehearsal on Railway | ⏳ pending | staging provisioned | `scripts/soak-test.ts --confirm-staging` (answer p95 ≤ 25 s) | [launch-operator-runbook.md §4](launch-operator-runbook.md) · [capacity-review.md](capacity-review.md) | | Production deploy to Railway | ✅ done | — | App deployment recorded live 2026-07-14; re-verify with `GET /api/health` and deployment readiness | [deployment-architecture.md](deployment-architecture.md) | diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index 81e2adbce..7d9283ff2 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -1,4 +1,4 @@ -# Outstanding Issues, Recommendations & Tasks +# Universal Task Ledger — Outstanding Issues, Recommendations & Tasks Durable, cross-session memory of everything still outstanding for this repo: open **tasks**, **recommendations** not yet acted on, and **issues** not yet resolved. Chat context is ephemeral @@ -30,12 +30,12 @@ Durable, cross-session memory of everything still outstanding for this repo: ope - Resolving an item moves its row to **Resolved / archive** with the date and a one-line outcome — rows are archived, not deleted, so the history stays auditable. - + ## Recommended execution queue This queue contains only work still recommended after reconciliation against locally cached `main` -at `9c7d9edf509a51478f5bebbabcca64e3926dc877` on 2026-07-24. Provider state was not refreshed. +at `6a56a89ae2df14b1dd3c705dc65848b50961f30b` on 2026-07-24. Provider state was not refreshed. Re-check the source row and current `main` before starting. Lower available order numbers come first; heavyweight verification remains serialized. @@ -49,32 +49,32 @@ heavyweight verification remains serialized. There is no confirmed P0. `#052` and `#053` are the two P1 items. -| Order | Source | Recommended outcome | Acuity | Classification/state | Intelligence | When | Hands-on estimate | -| ----: | ------------------------- | ----------------------------------------------------------------------- | ------ | ------------------------------------------------- | ----------------------------------- | ----------------------------------------------------------- | --------------------------------------------------- | -| 1 | #052 | Align the Safety Plan Generator with the no-patient-data contract | P1 | Required now | Sol/xhigh + privacy/clinical review | Now; before real-patient use | 3–5 hours | -| 2 | #053 | Close or explicitly defer the APP 8/DPA/ZDR governance basis | P1 | Requires user/operator/provider decision | Sol/xhigh + counsel + account owner | Start now; complete before real-patient use | 2–4 hours preparation; external elapsed time varies | -| 3 | #054 | Fail closed when answer relevance metadata is absent | P2 | Required now | Sol/xhigh | Next local clinical-safety change | 2–4 hours | -| 4 | #030 | Require distinct documents for distinct comparison slots | P2 | Required now | Sol/high | Before trusting another admission/discharge verdict | 2–4 hours | -| 5 | #055 | Recover `queued` documents that have no open ingestion job | P2 | Required now | Sol/high | Before claiming at-least-once ingestion | 1–2 days | -| 6 | #026 | Complete the approved hosted rollout of the committed document trigger | P2 | Requires provider approval; code merged | Sol/high + DB operator | After explicit Supabase approval | 1–3 hours plus provider review | -| 7 | #056 | Reconcile and verify the preserved browser/contrast patch | P2 | Recommended; preserved | Terra/high | After higher-acuity local fixes; before the release UI gate | 4–8 hours | -| 8 | #051, #023 | Compare the scheduled structured canary with run `30018289898` | P2 | Defer until scheduled artifact; provider approval | Sol/xhigh + RAG reviewer | After 2026-07-26 18:00 UTC | 1–2 hours | -| 9 | #018, #029 | Reproduce and address each remaining RAG residual separately | P2 | Defer until #051/#023 | Sol/xhigh + clinical/RAG review | Only after the comparable canary review | 1–2 days per proven mechanism | -| 10 | #022 | Decide BMJ attestation policy and refresh high-impact source governance | P2 | Requires clinical/operator decision | Sol/xhigh + clinical owner | After an approved current-state read | 1–3 days; review elapsed time varies | -| 11 | #033 | Reconsider governance metadata in the model prompt | P3 | Defer until #022 and a harm reproducer | Sol/xhigh + clinical review | Only after metadata coverage improves | 1–2 days | -| 12 | #057 | Run an exact-SHA release gate, including runtime hash-secret proof | P2 | Requires provider approval | Sol/high + release operator | After release-candidate fixes land | 2–4 hours; hosted elapsed time varies | -| 13 | #011 | Change Supabase Auth allocation before compute scale-up | P3 | Defer until approved scale-up | Sol/high + Supabase operator | Immediately before the first compute resize | 1–2 hours plus soak | -| 14 | #007 | Choose the canonical Tools entry point | P3 | Requires user/product decision | Terra/high + product owner | When navigation ownership is available | 30–60 minutes decision; 2–4 hours implementation | -| 15 | #009 | Decide whether `/api/jobs` remains an ops-only surface | P3 | Requires operator decision | Terra/high + operations owner | Before expanding or documenting job operations | 30–60 minutes; 2–4 hours if removal/docs follow | -| 16 | #025 | Activate only approved webhooks with named owners | P3 | Requires provider/operator decision | Sol/high + DevOps owner | After #026 and secret/alert ownership decisions | 2–4 hours plus provider setup | -| 17 | #037 | Decide the D5 all-claims trust cap | P3 | Requires clinical/product decision | Sol/xhigh + clinical/product owners | Only if owners want a universal trust-policy change | 1–2 hours decision; 0.5–1 day implementation | -| 18 | #010 | Build one specific “Coming soon” feature | P3 | Optional/product-triggered | Terra/high | Only after an approved feature brief | 0.5–3 days per feature | -| 19 | #017 | Measure production Web Vitals | P3 | Optional/provider approval | Terra/high + performance reviewer | Only when performance prioritisation is requested | 2–4 hours | -| 20 | #012, #013 | Reduce only payloads proven material by #017 | P3 | Defer until measurement | Sol/high | Only after a user-visible bottleneck is measured | 0.5–3 days per route | -| 21 | #027 | Add an independently owned uptime monitor | P3 | Optional/provider decision | Terra/high + operations owner | When alert ownership and cost are approved | 1–2 hours | -| 22 | #038, #039 | Consolidate shared comparison or toolbar behavior | P3 | Optional/triggered | Terra/high + design owner | Before adding another genuinely duplicate surface | 1–3 days per contract | -| 23 | #040 | Establish a small visual-regression baseline set | P3 | Optional/team decision | Terra/high + UI owner | After baseline ownership/update policy are accepted | 1–2 days | -| 24 | Operator backlog/runbooks | Perform staging soak or DR reconstitution only for a real rehearsal | P3 | Defer until release/rehearsal trigger | Sol/high + operator | When a real candidate or scheduled rehearsal exists | 0.5–2 days | +| Order | Source | Recommended outcome | Acuity | Classification/state | Intelligence | When | Hands-on estimate | +| ----: | ---------- | ----------------------------------------------------------------------- | ------ | ------------------------------------------------- | ----------------------------------- | ----------------------------------------------------------- | --------------------------------------------------- | +| 1 | #052 | Align the Safety Plan Generator with the no-patient-data contract | P1 | Required now | Sol/xhigh + privacy/clinical review | Now; before real-patient use | 3–5 hours | +| 2 | #053 | Close or explicitly defer the APP 8/DPA/ZDR governance basis | P1 | Requires user/operator/provider decision | Sol/xhigh + counsel + account owner | Start now; complete before real-patient use | 2–4 hours preparation; external elapsed time varies | +| 3 | #054 | Fail closed when answer relevance metadata is absent | P2 | Required now | Sol/xhigh | Next local clinical-safety change | 2–4 hours | +| 4 | #019, #030 | Preserve distinct admission and discharge sources through comparison | P2 | Required now | Sol/high | Before trusting another admission/discharge verdict | 4–8 hours | +| 5 | #055 | Recover `queued` documents that have no open ingestion job | P2 | Required now | Sol/high | Before claiming at-least-once ingestion | 1–2 days | +| 6 | #026 | Activate the merged update-only document-change trigger safely | P2 | Requires provider approval | Sol/high + DB operator | After #055's contract is settled | 2–4 hours plus provider setup | +| 7 | #056 | Reconcile and verify the preserved browser/contrast patch | P2 | Recommended; preserved | Terra/high | After higher-acuity local fixes; before the release UI gate | 4–8 hours | +| 8 | #058 | Complete the compact document source-text accordion handoff | P2 | Defer until the user explicitly resumes it | Terra/high | On explicit return to the paused document-viewer task | 0.5–1.5 days | +| 9 | #051, #023 | Compare the scheduled structured canary with run `30018289898` | P2 | Defer until scheduled artifact; provider approval | Sol/xhigh + RAG reviewer | After 2026-07-26 18:00 UTC | 1–2 hours | +| 10 | #018, #029 | Reproduce and address each remaining RAG residual separately | P2 | Defer until #051/#023 | Sol/xhigh + clinical/RAG review | Only after the comparable canary review | 1–2 days per proven mechanism | +| 11 | #022 | Decide BMJ attestation policy and refresh high-impact source governance | P2 | Requires clinical/operator decision | Sol/xhigh + clinical owner | After an approved current-state read | 1–3 days; review elapsed time varies | +| 12 | #033 | Reconsider governance metadata in the model prompt | P3 | Defer until #022 and a harm reproducer | Sol/xhigh + clinical review | Only after metadata coverage improves | 1–2 days | +| 13 | #057 | Run an exact-SHA release gate, including runtime hash-secret proof | P2 | Requires provider approval | Sol/high + release operator | After release-candidate fixes land | 2–4 hours; hosted elapsed time varies | +| 14 | #011 | Change Supabase Auth allocation before compute scale-up | P3 | Defer until approved scale-up | Sol/high + Supabase operator | Immediately before the first compute resize | 1–2 hours plus soak | +| 15 | #007 | Choose the canonical Tools entry point | P3 | Requires user/product decision | Terra/high + product owner | When navigation ownership is available | 30–60 minutes decision; 2–4 hours implementation | +| 16 | #009 | Decide whether `/api/jobs` remains an ops-only surface | P3 | Requires operator decision | Terra/high + operations owner | Before expanding or documenting job operations | 30–60 minutes; 2–4 hours if removal/docs follow | +| 17 | #025 | Activate only approved webhooks with named owners | P3 | Requires provider/operator decision | Sol/high + DevOps owner | After #026 and secret/alert ownership decisions | 2–4 hours plus provider setup | +| 18 | #037 | Decide the D5 all-claims trust cap | P3 | Requires clinical/product decision | Sol/xhigh + clinical/product owners | Only if owners want a universal trust-policy change | 1–2 hours decision; 0.5–1 day implementation | +| 19 | #010 | Build one specific “Coming soon” feature | P3 | Optional/product-triggered | Terra/high | Only after an approved feature brief | 0.5–3 days per feature | +| 20 | #017 | Measure production Web Vitals | P3 | Optional/provider approval | Terra/high + performance reviewer | Only when performance prioritisation is requested | 2–4 hours | +| 21 | #012, #013 | Reduce only payloads proven material by #017 | P3 | Defer until measurement | Sol/high | Only after a user-visible bottleneck is measured | 0.5–3 days per route | +| 22 | #027 | Add an independently owned uptime monitor | P3 | Optional/provider decision | Terra/high + operations owner | When alert ownership and cost are approved | 1–2 hours | +| 23 | #038, #039 | Consolidate shared comparison or toolbar behavior | P3 | Optional/triggered | Terra/high + design owner | Before adding another genuinely duplicate surface | 1–3 days per contract | +| 24 | #040 | Establish a small visual-regression baseline set | P3 | Optional/team decision | Terra/high + UI owner | After baseline ownership/update policy are accepted | 1–2 days | ### Execution contract @@ -104,6 +104,7 @@ There is no confirmed P0. `#052` and `#053` are the two P1 items. | #055 | P2 | issue | Upload crash can strand a queued document without a job | **Outcome:** a crash between document and job creation cannot strand an upload indefinitely. **Next:** add the stranded-row reproducer, then choose the smallest idempotent atomic-enqueue RPC or bounded scheduled sweep consistent with current ownership and rollback contracts. **Success:** exactly one recoverable job is created; existing open jobs do not duplicate; owner scope, retry, audit, and rollback remain intact. **Verify:** focused upload/recovery/schema tests, migration guards, disposable replay, drift, `verify:cheap`, production-readiness. **Stop:** no at-least-once claim until the crash case passes; hosted changes require approval. | `src/app/api/upload/route.ts`; `docs/webhooks.md:168-192` | 2026-07-24 | | #056 | P2 | task | Reconcile the preserved browser-readiness and contrast patch | **Outcome:** disabled Formulation navigation remains legible and Firefox/WebKit waits prove real React readiness without weakening assertions. **Next:** prove ownership of `agent/formulation-disabled-contrast`, compare its four-file diff with current `main`, retain only reproducing fixes, then run the affected specs in all browsers. **Success:** disabled contrast passes; a missing handler still fails; Chromium, Firefox, and WebKit pass. **Verify:** focused unit/Playwright, `verify:cheap`, identity-verified `ensure`, `verify:ui`. **Stop:** discard stale harness workarounds that no longer reproduce. | preserved worktree `release-browser-contrast-20260723`; session 2026-07-24 | 2026-07-24 | | #057 | P2 | task | Prove one exact-SHA release candidate end to end | **Outcome:** local and hosted release evidence evaluates the same SHA and safely proves the production `RAG_QUERY_HASH_SECRET` boot requirement. **Next:** after candidate fixes land, obtain approvals, verify SHA/environment identity, confirm secret placement without revealing it, and run the bounded canonical release checks. **Success:** required gates are green and any waiver is explicit/owned. **Verify:** release runbook, golden retrieval, RAG-only quality, production-readiness, deployment/health identity, protected-main merge proof. **Stop:** no unidentified tree, duplicate paid canary, invented staging, or exposed secret. | `docs/operator-backlog.md`; `docs/launch-operator-runbook.md`; PIA-2 | 2026-07-24 | +| #058 | P2 | task | Compact document source text accordion is paused | **Outcome:** hand off the completed two-level closed accordion for every canonical `/documents/[id]` viewer without losing deep-link, search-highlight, print, mobile, or composer behavior. **Next:** only when the user explicitly returns to this task, prove the clean preserved branch `codex/chat-document-text-accordion-7cb4`, reconcile its two commits with current `main`, rerun focused document-viewer tests and the required local gates, then use the protected-main PR path. **Success:** Text, full page text, and passages start closed; navigation, citations, and search open the correct disclosure; nested rows are mutually exclusive; print restores state; 320/390/1280 px have no overflow or composer obstruction. **Verify:** focused mocked Playwright, `verify:cheap`, identity-verified `ensure`, `verify:ui`, static production-readiness. **Stop:** do not resume implementation, run its tests/server, or publish it without an explicit return to that paused task. | branch `codex/chat-document-text-accordion-7cb4`; commits `f09857da2`, `62521a86c`; delegation pause 2026-07-24 | 2026-07-24 | | #051 | P2 | task | Stabilise the live answer-quality canary before more RAG tuning | Diagnostics landed in PR #1095: structured JSON/Markdown artifacts now record the actual checked-out SHA, run identity and latency context, and the offline trend tool separates content, provider-route and latency outcomes. First validating run `30018289898` recorded the expected tree and cost, with 36/36 retrieval green, but one report cannot establish variability; PR #1097 prevents a single failure being mislabeled as repeated. Next: compare the scheduled 2026-07-26 structured report with this run. Do not spend on an immediate retry or reapply the archived lithium guard before that comparison. | PR #1095; run `30018289898`; PR #1097; archive ref `refs/archive/rejected-rag/20260723/monitoring-subject-gate` | 2026-07-23 | | #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 | | #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 | @@ -123,7 +124,7 @@ There is no confirmed P0. `#052` and `#053` are the two P1 items. | #023 | P3 | task | Read Sunday 2026-07-26 scheduled-run artifacts | The 18:00 UTC scheduled runs deliver three free datapoints at once: first full-44 weekly canary (validates the #1044 ANSWER_CASE_LIMIT raise), browser-matrix flake second datapoint (webkit ui-route-coverage now reproduced + root-caused 2026-07-22 → see #024; firefox ui-formulation:91 still awaits a datapoint), and the irrelevant@10 labeling-audit artifact (§3.1 human-decision class). Read all three, then disposition. | sessions 2026-07-20/21; branch-review-ledger convergence notes | 2026-07-21 | | #024 | P3 | issue | WebKit e2e `_rsc`-prefetch access-control-checks errors | verify:release:offline on `main` ce32fe170 (2026-07-22) reproduced #023's webkit clause: **6/6 deterministic** failures in `tests/ui-route-coverage.spec.ts` (Therapy Compass; DSM home/comparison; Specifier comparison/map; Differential stream), each a `pageerror … ?_rsc=… due to access control checks` on Next.js RSC prefetch — Chromium + Firefox clean. Not merge-blocking (required gate `test:e2e:pr` is chromium-only; the full webkit matrix is advisory/release-time). Most likely a Playwright route-interception × WebKit interaction, not a Safari user defect. Next: decide (a) allow/mock the `_rsc` routes for the `webkit` e2e project, or (b) confirm real Safari impact — before trusting the full-matrix webkit gate at release. NB the 2 other webkit fails (`ui-stress:412`, `ui-universal-search:210`) passed on isolated re-run = true flake. | session 2026-07-22 (verify:release:offline, `main` ce32fe170); refines #023 | 2026-07-22 | | #025 | P2 | task | Activate the three webhooks (operator secrets) | Merged (#968) + deployed but inert — verified live: `POST /api/webhooks/railway` returns `503 webhook_not_configured`. To turn on: (1) Railway → set `RAILWAY_WEBHOOK_SECRET` + add the `?token=…` webhook URL; (2) the chat URLs `SLACK_WEBHOOK_URL`/`DISCORD_WEBHOOK_URL` must be set in BOTH places — the Railway **app/server env** (the receiver forwards deploy alerts via `postChatNotification`, which reads server env, so repo-secret-only leaves the Railway webhook authenticated but returning `delivered:false`) AND as **GitHub repo secrets** (the CI-failure workflow reads `secrets.*`); (3) `SUPABASE_INGESTION_WEBHOOK_SECRET`. Each fails closed until set, so this is pure ops. See docs/webhooks.md. | session 2026-07-22; PR #968; docs/webhooks.md | 2026-07-22 | -| #026 | P2 | task | Complete the Supabase document-change trigger rollout | Implementation and disposable replay are complete and merged through PR #1100: forward migration `20260723150000_document_change_ingestion_webhook.sql`, schema mirror, update-only/minimal/fail-safe tests, drift manifest, and rollback docs. The full schema replay succeeded in disposable Supabase Postgres 17.6.1.127; focused schema/drift tests passed 79/79 plus migration-role, function-grant, and owner-scope guards. **Next:** with explicit Supabase approval, replay the hosted migration chain, apply the committed migration through the normal path, then configure the Vault secret and base-URL GUC and perform a bounded readback/smoke. The trigger remains inert until those hosted steps complete. **Success:** migration history, trigger/function configuration, and one controlled UPDATE event read back correctly without duplicate INSERT jobs. **Stop:** never apply raw SQL or claim full at-least-once ingestion while #055 remains open. | PR #1100; `docs/webhooks.md` section 3; session 2026-07-24 | 2026-07-22 | +| #026 | P2 | task | Activate the merged Supabase document-change trigger | Implementation and disposable replay are complete and merged to `main` by PR #1100: forward migration `20260723150000_document_change_ingestion_webhook.sql`, schema mirror, update-only/minimal/fail-safe contract test, drift manifest, and rollback docs. The trigger remains inert. Next: after #055 settles the complementary INSERT-recovery contract, obtain explicit Supabase approval, run the hosted migration-chain replay, apply the committed migration through the normal path, configure the Vault secret and base-URL GUC, and verify a controlled update event. Success: eligible false-to-true updates enqueue once, INSERT remains outside this trigger, failures stay fail-safe, and rollback/readback evidence is recorded. Stop: never apply raw SQL live or configure secrets without named ownership and approval. | PR #1100; `docs/webhooks.md` section 3; session 2026-07-24 | 2026-07-22 | | #027 | P3 | rec | External uptime monitor independent of GitHub/Railway | `live-domain-monitor.yml` runs on GitHub's cron, so it won't run in exactly the outage it should catch (Actions or the deploy itself down). Add an off-platform synthetic monitor (UptimeRobot / Better Stack / Checkly) hitting `/api/health` with a webhook alert. Provider setup, not code. | session 2026-07-22 webhook review | 2026-07-22 | | #028 | P3 | rec | Runtime error tracking (Sentry or similar) | No error tracking in the repo — production exceptions on `psychiatry.tools`, including how often `RAG_PROVIDER_MODE=auto` silently degrades to source-only, are invisible. Weigh adding `@sentry/nextjs` (dependency + DSN secret + instrumentation) vs cost; alert → chat/issue. Provider-backed; needs explicit sign-off before adding the dependency. | session 2026-07-22 webhook review | 2026-07-22 | | #029 | P2 | issue | 12 of 30 answer-quality cases return the fallback stub | run #61 --dump-answers: 12/30 quality cases emit the source_backed_review_fallback boilerplate with answer_sections: [], all grounded with 4-6 citations. Some still PASS targeting because the stub echoes query keywords (the contraindication/document_lookup matchers need only a keyword), so the targeting metric MASKS the problem for those intents. Superset of #018 — fix in the extractive composer, validate with the provider-backed answer eval. | run #61 dump artifact; session 2026-07-22 | 2026-07-22 | diff --git a/docs/production-readiness-checklist.md b/docs/production-readiness-checklist.md index 1c1bd835b..d25dd2792 100644 --- a/docs/production-readiness-checklist.md +++ b/docs/production-readiness-checklist.md @@ -1,8 +1,9 @@ # Clinical KB Production Readiness Checklist (Executable Today) -**Status: reusable release-candidate checklist, not an outstanding-task ledger.** Live/provider-gated -actions and their current status are tracked only in [`operator-backlog.md`](operator-backlog.md). -Unchecked boxes below are rerun per release candidate; they do not imply abandoned repository work. +**Status: reusable release-candidate checklist, not an outstanding-task ledger.** Recommended work and +priority live only in [`outstanding-issues.md`](outstanding-issues.md); provider-action detail and +evidence live in [`operator-backlog.md`](operator-backlog.md). Unchecked boxes below are rerun per +release candidate; they do not imply abandoned repository work. This is the runbook to make the app publishable in one focused pass. diff --git a/docs/rag-hybrid-findings-and-todo.md b/docs/rag-hybrid-findings-and-todo.md index 1a780aaf0..723f01d51 100644 --- a/docs/rag-hybrid-findings-and-todo.md +++ b/docs/rag-hybrid-findings-and-todo.md @@ -1,9 +1,11 @@ # RAG Hybrid Retrieval — Findings & To-Do (2026-07-01) -Living list of issues found while fixing the live-only hybrid-RPC schema drift and optimising the -online RAG. Grouped by priority. **Last reconciled: 2026-07-14.** `✅` is complete/closed, `🔶` is -partially complete with an explicit remaining action, and `⏳` is genuinely open. Historical -measurements are evidence, not instructions to repeat provider-backed work without approval. See also the master plan +Historical findings from fixing the live-only hybrid-RPC schema drift and optimising the online RAG. +This is supporting evidence, not an independent active backlog; current recommended work exists only +when promoted to [`outstanding-issues.md`](outstanding-issues.md). **Last reconciled: 2026-07-14.** +`✅` is complete/closed, `🔶` is partially complete, and `⏳` was open at reconciliation time. +Historical measurements are evidence, not instructions to repeat provider-backed work without +approval. See also the master plan (`C:\Users\joshs\.claude\plans\please-review-the-current-synthetic-pinwheel.md`) for RC IDs and `docs/search-rag-master-plan.md`. From 9ff65cf7ffff912ab46bc11f6b73399d08f9a178 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:17:28 +0800 Subject: [PATCH 5/8] issues: activate the universal task queue --- docs/outstanding-issues.md | 48 ++++++++++++++++++-------------------- 1 file changed, 23 insertions(+), 25 deletions(-) diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index 7d9283ff2..1c77e3c7a 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -34,10 +34,10 @@ Durable, cross-session memory of everything still outstanding for this repo: ope ## Recommended execution queue -This queue contains only work still recommended after reconciliation against locally cached `main` -at `6a56a89ae2df14b1dd3c705dc65848b50961f30b` on 2026-07-24. Provider state was not refreshed. -Re-check the source row and current `main` before starting. Lower available order numbers come first; -heavyweight verification remains serialized. +This queue contains only work still recommended after reconciliation against `origin/main` at +`1eed39ed2b43509634a8d745d75a6956edb60e83` on 2026-07-24. Provider state is current only where +merged evidence explicitly records it; re-check live state before provider action. Lower available +order numbers come first; heavyweight verification remains serialized. - **P1:** close before real-patient clinical use or the next release decision. - **P2:** material correctness, clinical-quality, accessibility, or ingestion reliability. @@ -56,25 +56,24 @@ There is no confirmed P0. `#052` and `#053` are the two P1 items. | 3 | #054 | Fail closed when answer relevance metadata is absent | P2 | Required now | Sol/xhigh | Next local clinical-safety change | 2–4 hours | | 4 | #019, #030 | Preserve distinct admission and discharge sources through comparison | P2 | Required now | Sol/high | Before trusting another admission/discharge verdict | 4–8 hours | | 5 | #055 | Recover `queued` documents that have no open ingestion job | P2 | Required now | Sol/high | Before claiming at-least-once ingestion | 1–2 days | -| 6 | #026 | Activate the merged update-only document-change trigger safely | P2 | Requires provider approval | Sol/high + DB operator | After #055's contract is settled | 2–4 hours plus provider setup | -| 7 | #056 | Reconcile and verify the preserved browser/contrast patch | P2 | Recommended; preserved | Terra/high | After higher-acuity local fixes; before the release UI gate | 4–8 hours | -| 8 | #058 | Complete the compact document source-text accordion handoff | P2 | Defer until the user explicitly resumes it | Terra/high | On explicit return to the paused document-viewer task | 0.5–1.5 days | -| 9 | #051, #023 | Compare the scheduled structured canary with run `30018289898` | P2 | Defer until scheduled artifact; provider approval | Sol/xhigh + RAG reviewer | After 2026-07-26 18:00 UTC | 1–2 hours | -| 10 | #018, #029 | Reproduce and address each remaining RAG residual separately | P2 | Defer until #051/#023 | Sol/xhigh + clinical/RAG review | Only after the comparable canary review | 1–2 days per proven mechanism | -| 11 | #022 | Decide BMJ attestation policy and refresh high-impact source governance | P2 | Requires clinical/operator decision | Sol/xhigh + clinical owner | After an approved current-state read | 1–3 days; review elapsed time varies | -| 12 | #033 | Reconsider governance metadata in the model prompt | P3 | Defer until #022 and a harm reproducer | Sol/xhigh + clinical review | Only after metadata coverage improves | 1–2 days | -| 13 | #057 | Run an exact-SHA release gate, including runtime hash-secret proof | P2 | Requires provider approval | Sol/high + release operator | After release-candidate fixes land | 2–4 hours; hosted elapsed time varies | -| 14 | #011 | Change Supabase Auth allocation before compute scale-up | P3 | Defer until approved scale-up | Sol/high + Supabase operator | Immediately before the first compute resize | 1–2 hours plus soak | -| 15 | #007 | Choose the canonical Tools entry point | P3 | Requires user/product decision | Terra/high + product owner | When navigation ownership is available | 30–60 minutes decision; 2–4 hours implementation | -| 16 | #009 | Decide whether `/api/jobs` remains an ops-only surface | P3 | Requires operator decision | Terra/high + operations owner | Before expanding or documenting job operations | 30–60 minutes; 2–4 hours if removal/docs follow | -| 17 | #025 | Activate only approved webhooks with named owners | P3 | Requires provider/operator decision | Sol/high + DevOps owner | After #026 and secret/alert ownership decisions | 2–4 hours plus provider setup | -| 18 | #037 | Decide the D5 all-claims trust cap | P3 | Requires clinical/product decision | Sol/xhigh + clinical/product owners | Only if owners want a universal trust-policy change | 1–2 hours decision; 0.5–1 day implementation | -| 19 | #010 | Build one specific “Coming soon” feature | P3 | Optional/product-triggered | Terra/high | Only after an approved feature brief | 0.5–3 days per feature | -| 20 | #017 | Measure production Web Vitals | P3 | Optional/provider approval | Terra/high + performance reviewer | Only when performance prioritisation is requested | 2–4 hours | -| 21 | #012, #013 | Reduce only payloads proven material by #017 | P3 | Defer until measurement | Sol/high | Only after a user-visible bottleneck is measured | 0.5–3 days per route | -| 22 | #027 | Add an independently owned uptime monitor | P3 | Optional/provider decision | Terra/high + operations owner | When alert ownership and cost are approved | 1–2 hours | -| 23 | #038, #039 | Consolidate shared comparison or toolbar behavior | P3 | Optional/triggered | Terra/high + design owner | Before adding another genuinely duplicate surface | 1–3 days per contract | -| 24 | #040 | Establish a small visual-regression baseline set | P3 | Optional/team decision | Terra/high + UI owner | After baseline ownership/update policy are accepted | 1–2 days | +| 6 | #056 | Reconcile and verify the preserved browser/contrast patch | P2 | Recommended; preserved | Terra/high | After higher-acuity local fixes; before the release UI gate | 4–8 hours | +| 7 | #058 | Complete the compact document source-text accordion handoff | P2 | Defer until the user explicitly resumes it | Terra/high | On explicit return to the paused document-viewer task | 0.5–1.5 days | +| 8 | #051, #023 | Compare the scheduled structured canary with run `30018289898` | P2 | Defer until scheduled artifact; provider approval | Sol/xhigh + RAG reviewer | After 2026-07-26 18:00 UTC | 1–2 hours | +| 9 | #018, #029 | Reproduce and address each remaining RAG residual separately | P2 | Defer until #051/#023 | Sol/xhigh + clinical/RAG review | Only after the comparable canary review | 1–2 days per proven mechanism | +| 10 | #022 | Decide BMJ attestation policy and refresh high-impact source governance | P2 | Requires clinical/operator decision | Sol/xhigh + clinical owner | After an approved current-state read | 1–3 days; review elapsed time varies | +| 11 | #033 | Reconsider governance metadata in the model prompt | P3 | Defer until #022 and a harm reproducer | Sol/xhigh + clinical review | Only after metadata coverage improves | 1–2 days | +| 12 | #057 | Run an exact-SHA release gate, including runtime hash-secret proof | P2 | Requires provider approval | Sol/high + release operator | After release-candidate fixes land | 2–4 hours; hosted elapsed time varies | +| 13 | #011 | Change Supabase Auth allocation before compute scale-up | P3 | Defer until approved scale-up | Sol/high + Supabase operator | Immediately before the first compute resize | 1–2 hours plus soak | +| 14 | #007 | Choose the canonical Tools entry point | P3 | Requires user/product decision | Terra/high + product owner | When navigation ownership is available | 30–60 minutes decision; 2–4 hours implementation | +| 15 | #009 | Decide whether `/api/jobs` remains an ops-only surface | P3 | Requires operator decision | Terra/high + operations owner | Before expanding or documenting job operations | 30–60 minutes; 2–4 hours if removal/docs follow | +| 16 | #025 | Configure only approved webhooks and trigger delivery with named owners | P3 | Requires provider/operator decision | Sol/high + DevOps owner | After secret, endpoint, and alert ownership decisions | 2–4 hours plus provider setup | +| 17 | #037 | Decide the D5 all-claims trust cap | P3 | Requires clinical/product decision | Sol/xhigh + clinical/product owners | Only if owners want a universal trust-policy change | 1–2 hours decision; 0.5–1 day implementation | +| 18 | #010 | Build one specific “Coming soon” feature | P3 | Optional/product-triggered | Terra/high | Only after an approved feature brief | 0.5–3 days per feature | +| 19 | #017 | Measure production Web Vitals | P3 | Optional/provider approval | Terra/high + performance reviewer | Only when performance prioritisation is requested | 2–4 hours | +| 20 | #012, #013 | Reduce only payloads proven material by #017 | P3 | Defer until measurement | Sol/high | Only after a user-visible bottleneck is measured | 0.5–3 days per route | +| 21 | #027 | Add an independently owned uptime monitor | P3 | Optional/provider decision | Terra/high + operations owner | When alert ownership and cost are approved | 1–2 hours | +| 22 | #038, #039 | Consolidate shared comparison or toolbar behavior | P3 | Optional/triggered | Terra/high + design owner | Before adding another genuinely duplicate surface | 1–3 days per contract | +| 23 | #040 | Establish a small visual-regression baseline set | P3 | Optional/team decision | Terra/high + UI owner | After baseline ownership/update policy are accepted | 1–2 days | ### Execution contract @@ -123,8 +122,7 @@ There is no confirmed P0. `#052` and `#053` are the two P1 items. | #022 | P2 | task | Source-governance metadata refresh (operator) | **Worklist generated 2026-07-22 ($0, read-only): `docs/source-governance-refresh-worklist-2026-07-22.md`.** Reframed - this is NOT 59 clinical reviews. Of the 124 documents surfacing in canary top results, 59 are review-required, and **38 (64 pct) are the BMJ published-reference tier all sitting at `clinical_validation_status: unverified`** - one attestation-policy decision, not 38 reviews. The remaining 21 are genuine local WA health-service reviews (FSH 7, NMHS 4, CAMHS 3, AKG 2, KEMH 2, RPBG 2, RKPG 1), mostly `document_status: review_due`. Burn-down: top-10 documents clear 44 pct of flagged slots, top-20 clear 66 pct. Next: decide the BMJ attestation policy, then attest local docs by visibility (start `Clozapine Management by GP (NMHS)`, 22 slots at rank 1). | runs #61/#57 Source Governance data; `docs/source-governance-refresh-worklist-2026-07-22.md` | 2026-07-21 | | #023 | P3 | task | Read Sunday 2026-07-26 scheduled-run artifacts | The 18:00 UTC scheduled runs deliver three free datapoints at once: first full-44 weekly canary (validates the #1044 ANSWER_CASE_LIMIT raise), browser-matrix flake second datapoint (webkit ui-route-coverage now reproduced + root-caused 2026-07-22 → see #024; firefox ui-formulation:91 still awaits a datapoint), and the irrelevant@10 labeling-audit artifact (§3.1 human-decision class). Read all three, then disposition. | sessions 2026-07-20/21; branch-review-ledger convergence notes | 2026-07-21 | | #024 | P3 | issue | WebKit e2e `_rsc`-prefetch access-control-checks errors | verify:release:offline on `main` ce32fe170 (2026-07-22) reproduced #023's webkit clause: **6/6 deterministic** failures in `tests/ui-route-coverage.spec.ts` (Therapy Compass; DSM home/comparison; Specifier comparison/map; Differential stream), each a `pageerror … ?_rsc=… due to access control checks` on Next.js RSC prefetch — Chromium + Firefox clean. Not merge-blocking (required gate `test:e2e:pr` is chromium-only; the full webkit matrix is advisory/release-time). Most likely a Playwright route-interception × WebKit interaction, not a Safari user defect. Next: decide (a) allow/mock the `_rsc` routes for the `webkit` e2e project, or (b) confirm real Safari impact — before trusting the full-matrix webkit gate at release. NB the 2 other webkit fails (`ui-stress:412`, `ui-universal-search:210`) passed on isolated re-run = true flake. | session 2026-07-22 (verify:release:offline, `main` ce32fe170); refines #023 | 2026-07-22 | -| #025 | P2 | task | Activate the three webhooks (operator secrets) | Merged (#968) + deployed but inert — verified live: `POST /api/webhooks/railway` returns `503 webhook_not_configured`. To turn on: (1) Railway → set `RAILWAY_WEBHOOK_SECRET` + add the `?token=…` webhook URL; (2) the chat URLs `SLACK_WEBHOOK_URL`/`DISCORD_WEBHOOK_URL` must be set in BOTH places — the Railway **app/server env** (the receiver forwards deploy alerts via `postChatNotification`, which reads server env, so repo-secret-only leaves the Railway webhook authenticated but returning `delivered:false`) AND as **GitHub repo secrets** (the CI-failure workflow reads `secrets.*`); (3) `SUPABASE_INGESTION_WEBHOOK_SECRET`. Each fails closed until set, so this is pure ops. See docs/webhooks.md. | session 2026-07-22; PR #968; docs/webhooks.md | 2026-07-22 | -| #026 | P2 | task | Activate the merged Supabase document-change trigger | Implementation and disposable replay are complete and merged to `main` by PR #1100: forward migration `20260723150000_document_change_ingestion_webhook.sql`, schema mirror, update-only/minimal/fail-safe contract test, drift manifest, and rollback docs. The trigger remains inert. Next: after #055 settles the complementary INSERT-recovery contract, obtain explicit Supabase approval, run the hosted migration-chain replay, apply the committed migration through the normal path, configure the Vault secret and base-URL GUC, and verify a controlled update event. Success: eligible false-to-true updates enqueue once, INSERT remains outside this trigger, failures stay fail-safe, and rollback/readback evidence is recorded. Stop: never apply raw SQL live or configure secrets without named ownership and approval. | PR #1100; `docs/webhooks.md` section 3; session 2026-07-24 | 2026-07-22 | +| #025 | P2 | task | Configure approved webhook and trigger-delivery secrets | Railway, chat/CI, and Supabase receivers are deployed but intentionally fail closed until configured. PR #1101 confirms the document-change migration is present in production with secure grants and no unexpected drift; delivery remains inert. **Next:** name endpoint, secret, and alert owners; then, with explicit provider approval, configure Railway authentication and callback URL, chat URLs in each required environment, `SUPABASE_INGESTION_WEBHOOK_SECRET`, the matching Supabase Vault secret, and the environment base-URL GUC. **Success:** invalid authentication fails closed, each approved staged event delivers once without sensitive payload leakage, and the document trigger's controlled false-to-true update enqueues once. **Verify:** provider readback plus bounded staged/production smoke. **Stop:** do not configure unowned endpoints, reveal secret values, or claim full at-least-once ingestion while #055 remains open. | PRs #968 and #1101; `docs/webhooks.md`; session 2026-07-24 | 2026-07-22 | | #027 | P3 | rec | External uptime monitor independent of GitHub/Railway | `live-domain-monitor.yml` runs on GitHub's cron, so it won't run in exactly the outage it should catch (Actions or the deploy itself down). Add an off-platform synthetic monitor (UptimeRobot / Better Stack / Checkly) hitting `/api/health` with a webhook alert. Provider setup, not code. | session 2026-07-22 webhook review | 2026-07-22 | | #028 | P3 | rec | Runtime error tracking (Sentry or similar) | No error tracking in the repo — production exceptions on `psychiatry.tools`, including how often `RAG_PROVIDER_MODE=auto` silently degrades to source-only, are invisible. Weigh adding `@sentry/nextjs` (dependency + DSN secret + instrumentation) vs cost; alert → chat/issue. Provider-backed; needs explicit sign-off before adding the dependency. | session 2026-07-22 webhook review | 2026-07-22 | | #029 | P2 | issue | 12 of 30 answer-quality cases return the fallback stub | run #61 --dump-answers: 12/30 quality cases emit the source_backed_review_fallback boilerplate with answer_sections: [], all grounded with 4-6 citations. Some still PASS targeting because the stub echoes query keywords (the contraindication/document_lookup matchers need only a keyword), so the targeting metric MASKS the problem for those intents. Superset of #018 — fix in the extractive composer, validate with the provider-backed answer eval. | run #61 dump artifact; session 2026-07-22 | 2026-07-22 | From 5433003c9b3b08bfc894348cac5612b180f87585 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:34:13 +0800 Subject: [PATCH 6/8] fix: preserve universal ledger queue order --- .claude/hooks/issues-surface.sh | 41 +++++++++++++-------------------- 1 file changed, 16 insertions(+), 25 deletions(-) diff --git a/.claude/hooks/issues-surface.sh b/.claude/hooks/issues-surface.sh index 3cc453b24..118ab1f3f 100755 --- a/.claude/hooks/issues-surface.sh +++ b/.claude/hooks/issues-surface.sh @@ -48,35 +48,26 @@ if [ "${total:-0}" -eq 0 ]; then exit 0 fi -group() { printf '%s\n' "$rows" | awk -F'\t' -v p="$1" '$2==p'; } -count() { printf '%s' "$1" | grep -c . || true; } -p1="$(group P1)"; p2="$(group P2)"; p3="$(group P3)" -c1="$(count "$p1")"; c2="$(count "$p2")"; c3="$(count "$p3")" +c1="$(printf '%s\n' "$rows" | awk -F'\t' '$2=="P1" { count++ } END { print count+0 }')" +c2="$(printf '%s\n' "$rows" | awk -F'\t' '$2=="P2" { count++ } END { print count+0 }')" +c3="$(printf '%s\n' "$rows" | awk -F'\t' '$2=="P3" { count++ } END { print count+0 }')" echo "[issues] Universal task ledger — ${total} recommended (${c1}×P1, ${c2}×P2, ${c3}×P3). Source of truth: docs/outstanding-issues.md · read the full queue with /issues." -print_group() { # $1=rows $2=max-to-list - local data="$1" limit="$2" shown=0 more=0 ord acu src out cls - [ -z "$data" ] && return 0 - while IFS=$'\t' read -r ord acu src out cls; do - [ -z "$ord" ] && continue - if [ "$shown" -lt "$limit" ]; then - echo " ${ord}. ${acu} ${src} — ${out} (${cls})" - shown=$((shown + 1)) - else - more=$((more + 1)) - fi - done < Date: Fri, 24 Jul 2026 08:39:07 +0800 Subject: [PATCH 7/8] docs: keep issues command on recommended queue --- docs/outstanding-issues.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index 0ff9eab11..1ac88a189 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -5,18 +5,19 @@ Durable, cross-session memory of everything still outstanding for this repo: ope (sessions summarise and reset); this file is not — it is the single source of truth the [`/issues` skill](../.claude/skills/issues/SKILL.md) reads back and updates. -**Rule of thumb:** if it is worth remembering after this session ends, it belongs here. +**Rule of thumb:** if current evidence says the work is still worth doing, it belongs in the +recommended queue. Refuted, completed, stale, duplicate, or superseded claims belong only in history. ## How this is used -- Say `/issues` in Claude Code → the skill reads this file and states the open items back, - grouped by priority with a one-line summary count. Nothing is mutated on a plain read. +- Say `/issues` in Claude Code → the skill reads the **Recommended execution queue** back in + numeric order with a one-line acuity count. Nothing is mutated on a plain read. - Use the **Recommended execution queue** below for current order, acuity, intelligence, timing, estimates, gates, success criteria, verification, and stopping conditions. This file is the single universal ledger; do not create a parallel task-ledger document. -- `/issues add …`, `/issues done `, `/issues capture`, and friends mutate the tables below. - The full command surface lives in the skill file. -- Every mutation keeps this file committed so the memory survives across sessions and worktrees. +- `/issues add …`, `/issues done `, `/issues capture`, and friends keep the recommended queue + and source/archive tables synchronized. The full command surface lives in the skill file. +- Committing and pushing ledger mutations follow the repository's normal authorized Git workflow. ## Conventions From 5c1f37486fffd24311073dba55db0d7ba3766e2e Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:42:24 +0800 Subject: [PATCH 8/8] docs: retain credential containment in task ledger --- docs/outstanding-issues.md | 58 ++++++++++++++++++++------------------ 1 file changed, 30 insertions(+), 28 deletions(-) diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index 1ac88a189..1e481f00c 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -31,7 +31,7 @@ recommended queue. Refuted, completed, stale, duplicate, or superseded claims be - Resolving an item moves its row to **Resolved / archive** with the date and a one-line outcome — rows are archived, not deleted, so the history stays auditable. - + ## Recommended execution queue @@ -48,33 +48,34 @@ order numbers come first; heavyweight verification remains serialized. - **Terra/high:** bounded frontend, documentation, product, or operational implementation. - Estimates are focused hands-on time and exclude approval, provider, CI, and review waits. -There is no confirmed P0. `#052` and `#053` are the two P1 items. - -| Order | Source | Recommended outcome | Acuity | Classification/state | Intelligence | When | Hands-on estimate | -| ----: | ---------- | ----------------------------------------------------------------------- | ------ | ------------------------------------------------- | ----------------------------------- | ----------------------------------------------------------- | --------------------------------------------------- | -| 1 | #052 | Align the Safety Plan Generator with the no-patient-data contract | P1 | Required now | Sol/xhigh + privacy/clinical review | Now; before real-patient use | 3–5 hours | -| 2 | #053 | Close or explicitly defer the APP 8/DPA/ZDR governance basis | P1 | Requires user/operator/provider decision | Sol/xhigh + counsel + account owner | Start now; complete before real-patient use | 2–4 hours preparation; external elapsed time varies | -| 3 | #054 | Fail closed when answer relevance metadata is absent | P2 | Required now | Sol/xhigh | Next local clinical-safety change | 2–4 hours | -| 4 | #019, #030 | Preserve distinct admission and discharge sources through comparison | P2 | Required now | Sol/high | Before trusting another admission/discharge verdict | 4–8 hours | -| 5 | #055 | Recover `queued` documents that have no open ingestion job | P2 | Required now | Sol/high | Before claiming at-least-once ingestion | 1–2 days | -| 6 | #056 | Reconcile and verify the preserved browser/contrast patch | P2 | Recommended; preserved | Terra/high | After higher-acuity local fixes; before the release UI gate | 4–8 hours | -| 7 | #058 | Complete the compact document source-text accordion handoff | P2 | Defer until the user explicitly resumes it | Terra/high | On explicit return to the paused document-viewer task | 0.5–1.5 days | -| 8 | #051, #023 | Compare the scheduled structured canary with run `30018289898` | P2 | Defer until scheduled artifact; provider approval | Sol/xhigh + RAG reviewer | After 2026-07-26 18:00 UTC | 1–2 hours | -| 9 | #018, #029 | Reproduce and address each remaining RAG residual separately | P2 | Defer until #051/#023 | Sol/xhigh + clinical/RAG review | Only after the comparable canary review | 1–2 days per proven mechanism | -| 10 | #022 | Decide BMJ attestation policy and refresh high-impact source governance | P2 | Requires clinical/operator decision | Sol/xhigh + clinical owner | After an approved current-state read | 1–3 days; review elapsed time varies | -| 11 | #033 | Reconsider governance metadata in the model prompt | P3 | Defer until #022 and a harm reproducer | Sol/xhigh + clinical review | Only after metadata coverage improves | 1–2 days | -| 12 | #057 | Run an exact-SHA release gate, including runtime hash-secret proof | P2 | Requires provider approval | Sol/high + release operator | After release-candidate fixes land | 2–4 hours; hosted elapsed time varies | -| 13 | #011 | Change Supabase Auth allocation before compute scale-up | P3 | Defer until approved scale-up | Sol/high + Supabase operator | Immediately before the first compute resize | 1–2 hours plus soak | -| 14 | #007 | Choose the canonical Tools entry point | P3 | Requires user/product decision | Terra/high + product owner | When navigation ownership is available | 30–60 minutes decision; 2–4 hours implementation | -| 15 | #009 | Decide whether `/api/jobs` remains an ops-only surface | P3 | Requires operator decision | Terra/high + operations owner | Before expanding or documenting job operations | 30–60 minutes; 2–4 hours if removal/docs follow | -| 16 | #025 | Configure only approved webhooks and trigger delivery with named owners | P3 | Requires provider/operator decision | Sol/high + DevOps owner | After secret, endpoint, and alert ownership decisions | 2–4 hours plus provider setup | -| 17 | #037 | Decide the D5 all-claims trust cap | P3 | Requires clinical/product decision | Sol/xhigh + clinical/product owners | Only if owners want a universal trust-policy change | 1–2 hours decision; 0.5–1 day implementation | -| 18 | #010 | Build one specific “Coming soon” feature | P3 | Optional/product-triggered | Terra/high | Only after an approved feature brief | 0.5–3 days per feature | -| 19 | #017 | Measure production Web Vitals | P3 | Optional/provider approval | Terra/high + performance reviewer | Only when performance prioritisation is requested | 2–4 hours | -| 20 | #012, #013 | Reduce only payloads proven material by #017 | P3 | Defer until measurement | Sol/high | Only after a user-visible bottleneck is measured | 0.5–3 days per route | -| 21 | #027 | Add an independently owned uptime monitor | P3 | Optional/provider decision | Terra/high + operations owner | When alert ownership and cost are approved | 1–2 hours | -| 22 | #038, #039 | Consolidate shared comparison or toolbar behavior | P3 | Optional/triggered | Terra/high + design owner | Before adding another genuinely duplicate surface | 1–3 days per contract | -| 23 | #040 | Establish a small visual-regression baseline set | P3 | Optional/team decision | Terra/high + UI owner | After baseline ownership/update policy are accepted | 1–2 days | +There is no confirmed P0. `#059`, `#052`, and `#053` are the three P1 items. + +| Order | Source | Recommended outcome | Acuity | Classification/state | Intelligence | When | Hands-on estimate | +| ----: | ---------- | ----------------------------------------------------------------------- | ------ | ------------------------------------------------- | ------------------------------------ | ----------------------------------------------------------- | --------------------------------------------------- | +| 1 | #059 | Verify provider-side containment of previously exposed credentials | P1 | Required now; requires provider approval | Sol/xhigh + security/operator review | Immediate approved security window | 1–3 hours | +| 2 | #052 | Align the Safety Plan Generator with the no-patient-data contract | P1 | Required now | Sol/xhigh + privacy/clinical review | Now; before real-patient use | 3–5 hours | +| 3 | #053 | Close or explicitly defer the APP 8/DPA/ZDR governance basis | P1 | Requires user/operator/provider decision | Sol/xhigh + counsel + account owner | Start now; complete before real-patient use | 2–4 hours preparation; external elapsed time varies | +| 4 | #054 | Fail closed when answer relevance metadata is absent | P2 | Required now | Sol/xhigh | Next local clinical-safety change | 2–4 hours | +| 5 | #019, #030 | Preserve distinct admission and discharge sources through comparison | P2 | Required now | Sol/high | Before trusting another admission/discharge verdict | 4–8 hours | +| 6 | #055 | Recover `queued` documents that have no open ingestion job | P2 | Required now | Sol/high | Before claiming at-least-once ingestion | 1–2 days | +| 7 | #056 | Reconcile and verify the preserved browser/contrast patch | P2 | Recommended; preserved | Terra/high | After higher-acuity local fixes; before the release UI gate | 4–8 hours | +| 8 | #058 | Complete the compact document source-text accordion handoff | P2 | Defer until the user explicitly resumes it | Terra/high | On explicit return to the paused document-viewer task | 0.5–1.5 days | +| 9 | #051, #023 | Compare the scheduled structured canary with run `30018289898` | P2 | Defer until scheduled artifact; provider approval | Sol/xhigh + RAG reviewer | After 2026-07-26 18:00 UTC | 1–2 hours | +| 10 | #018, #029 | Reproduce and address each remaining RAG residual separately | P2 | Defer until #051/#023 | Sol/xhigh + clinical/RAG review | Only after the comparable canary review | 1–2 days per proven mechanism | +| 11 | #022 | Decide BMJ attestation policy and refresh high-impact source governance | P2 | Requires clinical/operator decision | Sol/xhigh + clinical owner | After an approved current-state read | 1–3 days; review elapsed time varies | +| 12 | #033 | Reconsider governance metadata in the model prompt | P3 | Defer until #022 and a harm reproducer | Sol/xhigh + clinical review | Only after metadata coverage improves | 1–2 days | +| 13 | #057 | Run an exact-SHA release gate, including runtime hash-secret proof | P2 | Requires provider approval | Sol/high + release operator | After release-candidate fixes land | 2–4 hours; hosted elapsed time varies | +| 14 | #011 | Change Supabase Auth allocation before compute scale-up | P3 | Defer until approved scale-up | Sol/high + Supabase operator | Immediately before the first compute resize | 1–2 hours plus soak | +| 15 | #007 | Choose the canonical Tools entry point | P3 | Requires user/product decision | Terra/high + product owner | When navigation ownership is available | 30–60 minutes decision; 2–4 hours implementation | +| 16 | #009 | Decide whether `/api/jobs` remains an ops-only surface | P3 | Requires operator decision | Terra/high + operations owner | Before expanding or documenting job operations | 30–60 minutes; 2–4 hours if removal/docs follow | +| 17 | #025 | Configure only approved webhooks and trigger delivery with named owners | P3 | Requires provider/operator decision | Sol/high + DevOps owner | After secret, endpoint, and alert ownership decisions | 2–4 hours plus provider setup | +| 18 | #037 | Decide the D5 all-claims trust cap | P3 | Requires clinical/product decision | Sol/xhigh + clinical/product owners | Only if owners want a universal trust-policy change | 1–2 hours decision; 0.5–1 day implementation | +| 19 | #010 | Build one specific “Coming soon” feature | P3 | Optional/product-triggered | Terra/high | Only after an approved feature brief | 0.5–3 days per feature | +| 20 | #017 | Measure production Web Vitals | P3 | Optional/provider approval | Terra/high + performance reviewer | Only when performance prioritisation is requested | 2–4 hours | +| 21 | #012, #013 | Reduce only payloads proven material by #017 | P3 | Defer until measurement | Sol/high | Only after a user-visible bottleneck is measured | 0.5–3 days per route | +| 22 | #027 | Add an independently owned uptime monitor | P3 | Optional/provider decision | Terra/high + operations owner | When alert ownership and cost are approved | 1–2 hours | +| 23 | #038, #039 | Consolidate shared comparison or toolbar behavior | P3 | Optional/triggered | Terra/high + design owner | Before adding another genuinely duplicate surface | 1–3 days per contract | +| 24 | #040 | Establish a small visual-regression baseline set | P3 | Optional/team decision | Terra/high + UI owner | After baseline ownership/update policy are accepted | 1–2 days | ### Execution contract @@ -98,6 +99,7 @@ There is no confirmed P0. `#052` and `#053` are the two P1 items. | ID | Pri | Type | Summary | Detail / next action | Source | Added | | ---- | --- | ----- | --------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------- | +| #059 | P1 | task | Verify containment of previously exposed credentials | **Outcome:** credentials previously exposed outside authorised stores can no longer authenticate. **Next:** in an approved security window, use provider-native evidence to identify and revoke or rotate any still-valid OpenAI, Supabase service-role/database, and E2E credentials; update only intended secret stores and record status without values. **Success:** every old credential is rejected or retired, replacements are scoped to intended environments, and presence/readiness checks pass. **Verify:** provider audit or rotation evidence, presence-only checks, and secret scans that never print values. **Stop:** take no provider or secret-store action without explicit approval; never paste values into Git, logs, issues, or chat, and do not rewrite history without separate evidence. | session 2026-07-24 security reconciliation | 2026-07-24 | | #052 | P1 | issue | Safety Plan Generator contradicts the privacy contract | **Outcome:** the tool, privacy notice, PIA, and tests agree on whether patient identifiers may be entered, copied, printed, or saved. `patient-safety-plan.tsx` asks for “Patient (name or initials)” and produces a patient copy, while `/privacy` and the PIA say the product does not ask for patient data. **Next:** obtain a privacy/clinical decision, then default to identifier-free behavior unless transient identifier processing is explicitly approved and documented. **Success:** no contradictory copy; no identifier is persisted or transmitted without an approved basis. **Verify:** focused component/privacy/copy/accessibility tests, browser print/copy smoke, `verify:cheap`, production-readiness. **Stop:** any new storage or provider transmission requires a separate review. | `src/components/patient-safety-plan.tsx:649`; `src/app/privacy/page.tsx:28`; `docs/privacy-impact-assessment.md` | 2026-07-24 | | #053 | P1 | task | Close or explicitly defer the APP 8/DPA/ZDR governance basis | **Outcome:** counsel/account owners record an executed or explicitly deferred basis for OpenAI and Railway overseas processing, retention, and APP 5 wording. **Next:** execute or disposition both DPAs, ZDR, Australia residency, prompt-cache retention, subprocessors, and legal approval using the existing checklist. **Success:** every status field has dated evidence or explicit risk acceptance; PIA, notice, contracts, and provider configuration agree. **Verify:** counsel sign-off, provider readback, repository record. **Stop:** do not represent real-patient use as governance-cleared while open. | `docs/openai-cross-border-basis.md`; PIA-1/5/6; `docs/operator-backlog.md` | 2026-07-24 | | #054 | P2 | issue | Missing answer relevance metadata is treated as source-backed | **Outcome:** absent `relevance` metadata renders conservatively. `RagAnswer.relevance` is optional, but `relevance?.isSourceBacked !== false` treats `undefined` as source-backed. **Next:** add the red render-policy test, then make the smallest policy-only fix. **Success:** missing and explicit-false relevance fail closed; explicit source-backed relevance is unchanged. **Verify:** answer-render-policy, provenance, clinical-safety, `verify:cheap`, production-readiness. **Stop:** do not expand into retrieval, ranking, or generation. | `src/lib/types.ts:1029`; `src/lib/answer-render-policy.ts:145` | 2026-07-24 |