docs: activate universal repository task ledger#1109
Conversation
…r-security-followup-082afe
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (8)
📝 WalkthroughWalkthroughThe universal task ledger is now the canonical source for recommended work, open-item status, and execution order. The ChangesUniversal task ledger
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant SessionStart
participant issues-surface.sh
participant outstanding-issues.md
SessionStart->>issues-surface.sh: Trigger session-start or context-reset surfacing
issues-surface.sh->>outstanding-issues.md: Read recommended queue and open items
outstanding-issues.md-->>issues-surface.sh: Return ordered tasks and priority counts
issues-surface.sh-->>SessionStart: Print recommendations and universal counts
Possibly related PRs
Suggested labels: ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 3996b86. Configure here.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3996b866ca
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…followup-082afe' into codex/universal-ledger-security-followup-082afe # Conflicts: # .claude/hooks/issues-surface.sh
…r-review-integration-a51f19
…r-security-followup-082afe
…followup-082afe' into codex/universal-ledger-security-followup-082afe
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a57b86a7dd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
CI triageCI failed on this PR. Automated classification of the 2 failed job(s):
Compared with main CI run #4583 (success). Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 52da7d1e47
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| | ---------- | -------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ||
| | 2026-07-24 | PR #1106 / `codex/task-ledger-final-11318f` | `5d128a2844c2298d0da36df64e5e2f7dda11e14b` + reviewed follow-up diff | Universal task-ledger workflow and protected-main merge readiness | APPROVE after follow-up. `docs/outstanding-issues.md` is the single durable task ledger, with retained work carrying order, acuity, timing, capability, effort, dependencies, success criteria, verification and stop rules. Four actionable review findings were fixed: filtered `/issues` reads now apply the filter to open items before rendering queued and non-queued results; the session hook excludes queued IDs from its priority summary; `#030` is consistently P2/A2 in the canonical open table and queue; and the sole A1/P1 blocker is first while `#052` is explicitly the first code task. No other actionable review thread remains in the reviewed scope. | Protected CI at the initial reviewed head passed policy, static, safety/config, unit coverage, Semgrep, Gitleaks, GitGuardian and the required aggregate; UI, build, migration replay and release browser matrix were correctly skipped for the docs/workflow scope. Follow-up proof: scoped Prettier; hook syntax/runtime plus exact ID-deduplication, P2-count and A1-first assertions; docs links (1,136 references); canonical skill catalog (32 skills, 8 aliases); `git diff --check`. Exact-head hosted CI remains required after the follow-up push. No OpenAI, Supabase, Railway, deployment or production-data operation ran. | | ||
| | 2026-07-24 | `codex/supabase-document-change-trigger` | `9c7d9edf509a51478f5bebbabcca64e3926dc877` + reviewed working diff | Document-change ingestion trigger migration, schema mirror, grants, privacy and fail-safe delivery | APPROVE. No P0-P2 finding. The trigger is update-only, acts solely on a strict JSON boolean false/absent-to-true transition, sends only the receiver's allowlisted owner-scoped fields, fails open for document writes when Vault/GUC/pg_net is unavailable, and revokes execution from public/anon/authenticated. No production URL fallback exists. Highest residual risk is deliberate pg_net at-most-once delivery; the clear-then-flip recovery and data-preserving rollback are documented, and the trigger remains inert until both the Vault secret and environment base-URL GUC are configured. | Disposable Supabase Postgres `17.6.1.127` schema replay and drift-manifest regeneration passed (16s; scratch container removed); focused schema/drift/receiver Vitest 89/89; migration-role, function-grant (30 SECURITY DEFINER functions) and owner-scope guards; production-readiness CI mode READY with expected secretless-worktree warnings; offline RAG 21 suites/307 tests; `verify:cheap` 365 files, 3,241 passed/1 skipped; static trace of receiver payload, authoritative owner-scoped reload and idempotent enqueue path. No live provider mutation or migration apply. | | ||
| | 2026-07-24 | PR #1109 / `codex/universal-ledger-security-followup-082afe` | `3996b866ca69fa8dfc171fe51f41832eb269006c` + reviewed working diff | Universal task ledger, `/issues` lifecycle and SessionStart surfacing | READY AFTER FIXES. Two P2 lifecycle defects were confirmed and corrected before merge: the SessionStart hook now preserves a non-empty recommended queue when the wider open table is empty, and every active queue package has a durable open-item ID so `/issues done` can archive it without leaving stale recommendations. The ledger provenance was also advanced to the actual merged `origin/main` base. Highest residual risk is human maintenance drift between the queue and open table; the documented mutation contract and invariant check are the current guardrails. | Bash syntax and live SessionStart execution passed (33 recommended, 45 open); queue order is contiguous and unique; every queue source contains only tracked open IDs; `docs:check-links` passed (1,142 references); `docs:check-index` passed (42 modules/routes plus all schema tables); `docs:check-scripts` passed (334 npm script references); `check:skills` passed (32 canonical skills, 8 aliases); Prettier and `git diff --check` passed. No live application, OpenAI, Supabase, Railway, deployment, or production-data action. | |
There was a problem hiding this comment.
Adding this new PR #1109 record replaced the existing PR #1106 / codex/task-ledger-final-11318f row instead of appending, so a future review request for that already-reviewed branch/head can no longer match the ledger and will be repeated unnecessarily. Keep the old row and append this one as a separate record so the throttle still works for both PRs.
AGENTS.md reference: AGENTS.md:L122-L127
Useful? React with 👍 / 👎.
| | 9 | `#059` | Set a unique 32+ character `OPENAI_SAFETY_IDENTIFIER_SECRET` per environment with `OPENAI_API_KEY`, never in Git/output. | A2 / Standard local + Operator hosted | Local now; hosted approved window | 15–30 min local; 30–60 min/env | Secret manager; hosted approval | Presence-only readiness passes, HMAC pseudonymity remains, secret scans clean. Stop if governance rejects stable identifiers. | | ||
| | 10 | `#060` | Reconcile query-hash, deep-probe, Supabase/OpenAI, project identity, and schedules using read-only presence checks before setting anything. | A2 / Operator platform | Next approved readiness window | 1–2 hours | Provider approval, env owners | Record status, never values; set only confirmed gaps; identity/readiness pass. Stop on target ambiguity or cross-env key reuse. | | ||
| | 11 | `#022` | Decide auditable BMJ reference policy, then review the ten highest-impact local WA documents. | A2 / Operator governance + Specialist | Decision-ready | 1–2 hours policy; 0.5–1 day reviews | Clinical authority; live writes/canary approval | Preserve third-party/unverified provenance; record reviewer/evidence/time/rationale. Stop after ten and remeasure debt. | | ||
| | 12 | `#051` + `#023` | Compare run `30018289898` with the scheduled 2026-07-26 canary/browser/label artifacts; disposition residuals without rerun. | A2 / Specialist evaluation | About 2026-07-27 02:00 AWST plus runtime | 2–4 hours | Approval to read hosted artifacts; no dispatch | Record tree/run, content/provider/latency, browser, and labeling outcomes. Stop without spend or archived lithium changes. | |
There was a problem hiding this comment.
Fresh evidence beyond the prior ID-tracking fix: this active queue row still binds two independent open items in one Source cell. When /issues done #051 is later used after the canary-stabilization task completes, the skill's lifecycle rule removes the recommendation row; that either drops still-open #023 from the active queue or leaves completed #051 surfaced as active work. Use one queue row per closable open item, or create a single durable open item for the combined recommendation.
Useful? React with 👍 / 👎.
1 participant
Summary
docs/outstanding-issues.mdthe repository's single universal task ledger/issuesand the SessionStart hookReview fixes
#058–#065, including separate SLO-alert ownershiporigin/mainSHAValidation
npm run docs:check-links— passed (1,142 references)npm run docs:check-index— passed (42 modules/routes and all schema tables)npm run docs:check-scripts— passed (334 npm script references)npm run check:skills— passed (32 canonical skills, 8 aliases)git diff --check— passedverify:cheap— not repeated: the isolated worktree has no local dependency installation; clean-install hosted checks are required before mergeRisk and rollback
Low risk: documentation and agent-workflow changes only; no application runtime, migrations, provider configuration, secrets, production data, or deployment behavior changes. Roll back by reverting the PR merge commit.
RAG impact: no retrieval behaviour change — documentation and task-tracking only.
Clinical governance preflight: not applicable; no ingestion, answer generation, search/ranking, source rendering, access, privacy implementation, production environment, or clinical output code changes.
Summary by CodeRabbit
New Features
Documentation
/issuesbehavior, task lifecycle, queue ordering, and update rules.