diff --git a/.claude/hooks/issues-surface.sh b/.claude/hooks/issues-surface.sh index dab08f83d..6b418ca12 100755 --- a/.claude/hooks/issues-surface.sh +++ b/.claude/hooks/issues-surface.sh @@ -26,58 +26,41 @@ source_val="$(printf '%s' "$payload" \ | head -n1 | sed -E 's/.*"([^"]*)"$/\1/')" # --- parse the "Open items" table only --------------------------------------- -# Emit "PRIIDTYPESUMMARY" per open row. Scoped between the +# Emit "ORDERPRIIDTYPESUMMARY" per open row. Scoped between the # "## Open items" heading and the next "## " heading so the Resolved/archive # table (different columns) is never counted. rows="$(awk ' /^## Open items/ { inopen=1; next } /^## / { if (inopen) inopen=0 } - inopen && /^\| #[0-9]/ { + inopen && /^\|[[:space:]]*[0-9]+[[:space:]]*\|[[:space:]]*#[0-9]/ { n=split($0, c, "|") - id=c[2]; pri=c[3]; typ=c[4]; sum=c[5] + ord=c[2]; id=c[3]; priacuity=c[4]; typ=c[5]; sum=c[6] + split(priacuity, p, " "); pri=p[1] + gsub(/^[ \t]+|[ \t]+$/, "", ord) gsub(/^[ \t]+|[ \t]+$/, "", id) gsub(/^[ \t]+|[ \t]+$/, "", pri) gsub(/^[ \t]+|[ \t]+$/, "", typ) gsub(/^[ \t]+|[ \t]+$/, "", sum) - printf "%s\t%s\t%s\t%s\n", pri, id, typ, sum + printf "%s\t%s\t%s\t%s\t%s\n", ord, pri, id, typ, sum } ' "$ledger" 2>/dev/null || true)" total="$(printf '%s' "$rows" | grep -c . || true)" if [ "${total:-0}" -eq 0 ]; then - echo "[issues] Outstanding-work memory (docs/outstanding-issues.md): no open items. Record one with /issues add …" + echo "[issues] Universal task ledger (docs/outstanding-issues.md): no open items. Record one with /issues add …" exit 0 fi -group() { printf '%s\n' "$rows" | awk -F'\t' -v p="$1" '$1==p'; } -count() { printf '%s' "$1" | grep -c . || true; } -p1="$(group P1)"; p2="$(group P2)"; p3="$(group P3)" -c1="$(count "$p1")"; c2="$(count "$p2")"; c3="$(count "$p3")" +count_priority() { printf '%s\n' "$rows" | awk -F'\t' -v p="$1" '$2==p { n++ } END { print n+0 }'; } +c1="$(count_priority P1)"; c2="$(count_priority P2)"; c3="$(count_priority P3)" -echo "[issues] Outstanding-work memory — ${total} open (${c1}×P1, ${c2}×P2, ${c3}×P3). Source of truth: docs/outstanding-issues.md · read the full list back with /issues." +echo "[issues] Universal task ledger — ${total} open (${c1}×P1, ${c2}×P2, ${c3}×P3). Source of truth: docs/outstanding-issues.md · read the full ordered list with /issues." -print_group() { # $1=rows $2=max-to-list - local data="$1" limit="$2" shown=0 more=0 pri id typ sum - [ -z "$data" ] && return 0 - while IFS=$'\t' read -r pri id typ sum; do - [ -z "$pri" ] && continue - if [ "$shown" -lt "$limit" ]; then - echo " ${pri} ${id} ${typ} — ${sum}" - shown=$((shown + 1)) - else - more=$((more + 1)) - fi - done < 10) printf " … +%d more in ledger order (see /issues)\n", NR - 10 } +' # --- capture reminder --------------------------------------------------------- case "$source_val" in diff --git a/.claude/skills/issues/SKILL.md b/.claude/skills/issues/SKILL.md index 228433931..b6df0f1a5 100644 --- a/.claude/skills/issues/SKILL.md +++ b/.claude/skills/issues/SKILL.md @@ -3,11 +3,11 @@ name: issues description: Track and recall all outstanding tasks, recommendations, and issues for this repo as durable cross-session memory. Use when the user types "/issues" (state the open items back), or asks to add/close/update/capture an outstanding task, recommendation, or issue. The memory lives in docs/outstanding-issues.md; a plain "/issues" is read-only. --- -# issues — the outstanding-work memory +# issues — the universal task ledger -`docs/outstanding-issues.md` is the durable, cross-session memory of everything still outstanding: -open **tasks**, **recommendations** not yet acted on, and **issues** not yet resolved. Chat context -resets; that file does not. This skill reads it back and keeps it current. +`docs/outstanding-issues.md` is the single durable, cross-session task ledger. Its ordered **Open +items** table is the only active queue. Legacy evidence and resolved sections are history, not work. +Chat context resets; that file does not. This skill reads it back and keeps it current. **The ledger is the source of truth, not chat memory.** Never answer `/issues` from conversation recall — always read the file first, so the answer is correct even in a fresh session. @@ -20,8 +20,8 @@ recall — always read the file first, so the answer is correct even in a fresh ## Default: `/issues` (read-only) 1. Read `docs/outstanding-issues.md`. -2. State the **open items** back, grouped by priority (P1 → P3), each as - `#ID · type · summary — next action (source)`. +2. State the **open items** back in the table's recommended **Order**, each as + `Order · #ID · priority/acuity · type · task — when; next action`. 3. End with a one-line count, e.g. `5 open: 0×P1, 3×P2, 2×P3 · 0 resolved this session`. 4. Do **not** mutate the file or commit on a plain read. @@ -32,16 +32,16 @@ If a filter is given, narrow step 2: `/issues P1` (by priority), `/issues issues Parse the intent from natural language too — the exact syntax is a convenience, not a requirement. -- **`/issues add `** — append a row to **Open items**. Infer `Pri`/`Type` from the text - (ask only if genuinely ambiguous; default `P2`/`task`). Allocate the ID from the - `` marker, then bump that marker. Fill `Source` with - `session ` unless the user names one; `Added` is today's date. +- **`/issues add `** — append a row to **Open items** at the next order. Infer + `Pri`/`Acuity`/`Type` (ask only if genuinely ambiguous; default `P2`/`A2`/`task`). Allocate the ID + from the `` marker, then bump it. Fill every execution field; use + `session ` as the source unless the user names one. - **`/issues done [outcome]`** — move that row from **Open items** to **Resolved / archive** with today's date and a one-line outcome. Archive, never delete. - **`/issues update `** — edit an open row's summary or next action in place. - **`/issues capture`** — scan the current session for recommendations, follow-ups, deferrals, and unfixed problems that surfaced but were not recorded. Propose them as a numbered list and add the - confirmed ones (dedupe against existing rows first — do not re-add something already tracked). + confirmed ones. Dedupe against the whole file, including legacy evidence and resolved history. ## Capture discipline (proactive memory) @@ -52,9 +52,12 @@ paragraph; put the smallest next action in **Detail / next action**. ## Writing rules -- Keep the table format and column order exactly as in `docs/outstanding-issues.md`. One row per item. +- Keep the Open items table format and column order exactly as in `docs/outstanding-issues.md`. One + row per item; keep Order contiguous after any mutation. - IDs are monotonic and never reused — always allocate from the `issues:next-id` marker and bump it. - Escape `|` inside cell text (write `\|`) so the markdown table stays intact. +- Fill acuity, intelligence, timing, effort, dependencies/approvals, success/verification, stop rule, + and source/update fields. Do not put a claim into Open items unless it remains recommended. - Respect the repo's RAG/clinical/privacy flagging rules if an item _itself_ touches a protected surface — recording it here is fine, but acting on it later still needs the usual gate. diff --git a/AGENTS.md b/AGENTS.md index 32d9bc6c0..ea466d47b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -454,8 +454,14 @@ Run the matching planner command in `docs/productivity-workflows.md` without sid **recommendation**, and **issue** for this repo. Chat context resets between sessions; that file does not, so anything worth remembering after a session ends belongs there. +`docs/outstanding-issues.md` is the single universal task ledger. Its ordered **Open items** table is +the only active queue and records acuity, capability, timing, effort, approvals, success criteria, +verification, and stop rules. The legacy evidence and resolved sections preserve history but are not +active work. Keep detailed provider procedures in `docs/operator-backlog.md`, update affected records +together, and never restore completed, stale, duplicate, speculative, or rejected work to Open items. + - When the user types `/issues`, invoke the `issues` skill (`.claude/skills/issues/SKILL.md`): read - `docs/outstanding-issues.md` and state the open items back, grouped by priority. A plain `/issues` + `docs/outstanding-issues.md` and state the open items back in recommended order. A plain `/issues` is read-only — it mutates and commits nothing. - `/issues add|done|update|capture …` mutate the ledger; each mutation commits **only** `docs/outstanding-issues.md` (no push unless the user asks or you are already handing off). diff --git a/docs/README.md b/docs/README.md index 0b743e80c..00ccf5598 100644 --- a/docs/README.md +++ b/docs/README.md @@ -71,6 +71,7 @@ npm run docs:check-links ## Plans and workstreams (living) +- [outstanding-issues.md](outstanding-issues.md) — universal ordered task ledger and durable repository memory - [maturity-backlog-workorders.md](maturity-backlog-workorders.md) — actionable work orders tracking the repository-maturity audit backlog - [framework-dependency-modernization-checklist.md](framework-dependency-modernization-checklist.md) — ordered Next.js 16, runtime, dependency, Turbopack, and verification migration program - [search-rag-master-plan.md](search-rag-master-plan.md) / [search-rag-master-context.md](search-rag-master-context.md) — search/RAG roadmap and shared context diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md index b9b2a8b96..c25d58fd6 100644 --- a/docs/branch-review-ledger.md +++ b/docs/branch-review-ledger.md @@ -20,7 +20,7 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD | Date | Branch or ref | Reviewed HEAD | Scope | Outcome | Checks | | ---------- | -------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| 2026-07-24 | `codex/supabase-document-change-trigger` | `9c7d9edf509a51478f5bebbabcca64e3926dc877` + reviewed working diff | Document-change ingestion trigger migration, schema mirror, grants, privacy and fail-safe delivery | APPROVE. No P0-P2 finding. The trigger is update-only, acts solely on a strict JSON boolean false/absent-to-true transition, sends only the receiver's allowlisted owner-scoped fields, fails open for document writes when Vault/GUC/pg_net is unavailable, and revokes execution from public/anon/authenticated. No production URL fallback exists. Highest residual risk is deliberate pg_net at-most-once delivery; the clear-then-flip recovery and data-preserving rollback are documented, and the trigger remains inert until both the Vault secret and environment base-URL GUC are configured. | Disposable `supabase/postgres:17.6.1.127` schema replay and drift-manifest regeneration passed (16s; scratch container removed); focused schema/drift/receiver Vitest 89/89; migration-role, function-grant (30 SECURITY DEFINER functions) and owner-scope guards; production-readiness CI mode READY with expected secretless-worktree warnings; offline RAG 21 suites/307 tests; `verify:cheap` 365 files, 3,241 passed/1 skipped; static trace of receiver payload, authoritative owner-scoped reload and idempotent enqueue path. No live provider mutation or migration apply. | +| 2026-07-24 | `codex/supabase-document-change-trigger` | `9c7d9edf509a51478f5bebbabcca64e3926dc877` + reviewed working diff | Document-change ingestion trigger migration, schema mirror, grants, privacy and fail-safe delivery | APPROVE. No P0-P2 finding. The trigger is update-only, acts solely on a strict JSON boolean false/absent-to-true transition, sends only the receiver's allowlisted owner-scoped fields, fails open for document writes when Vault/GUC/pg_net is unavailable, and revokes execution from public/anon/authenticated. No production URL fallback exists. Highest residual risk is deliberate pg_net at-most-once delivery; the clear-then-flip recovery and data-preserving rollback are documented, and the trigger remains inert until both the Vault secret and environment base-URL GUC are configured. | Disposable Supabase Postgres 17.6.1.127 schema replay and drift-manifest regeneration passed (16s; scratch container removed); focused schema/drift/receiver Vitest 89/89; migration-role, function-grant (30 SECURITY DEFINER functions) and owner-scope guards; production-readiness CI mode READY with expected secretless-worktree warnings; offline RAG 21 suites/307 tests; `verify:cheap` 365 files, 3,241 passed/1 skipped; static trace of receiver payload, authoritative owner-scoped reload and idempotent enqueue path. No live provider mutation or migration apply. | | 2026-07-23 | PR #1090 / `cursor/fix-phone-dock-edge-1b1d` | `761de7e9ad623b6bd8d634d849a9eb465d622e48` (merged as `09028ef217209fceb53f1122ac7738b509bce323`) | Phone safe-area and edge-to-edge search-dock UI review | MERGED. No P0-P2 finding. The branch was three commits behind, so current `origin/main` was merged before landing; the actual merge tree matched the reviewed synthetic tree. The dock remains flush to the viewport with safe-area padding inside the form, and the phone shell no longer retains the `dvh` clamp that created the Safari toolbar band. Zero actionable review threads. | `npm run ensure`; focused `ui-tools.spec.ts` phone-home and edge-to-edge scenarios: Chromium 2/2 and WebKit 2/2; refreshed hosted policy, security, unit, build, advisory UI, Production UI and required aggregate checks green; exact-head ancestry and local-main tree equality proved after merge. | | 2026-07-22 | PR #1087 / `codex/reconcile-product-truth` | `edbc2260fef59ca2fa7c6973dffb85e32354bce1` (merged as `05dc52fd8408a65117e22a6236e43252203bea92`) | Product-truth copy, account persistence and unavailable-SSO presentation | MERGED. Cross-device claims now match favourites/preferences persistence; recent searches are identified as browser-session data; the contradictory “never shared” statement is removed. All unavailable setup providers and Apple elsewhere use the connected accessible “coming soon” placeholder pattern. The single review finding was fixed, replied to and resolved. | Red DOM proof; focused 19/19; `verify:cheap` 3,220 passed / 1 skipped; `verify:ui` 265/265; PR-local build/secret scan/offline RAG; final hosted required, Production UI, policy and security checks green. No provider calls or RAG spend. | | 2026-07-22 | PR #1086 / `codex/reconcile-xlsx-budgets` | `5376880a40749b6526fd7e4603a7be9d04bc9624` (merged as `2963fba46eacd644618a588fa283f7597faa2644`) | XLSX resource-boundary review | MERGED. Enforces worksheet, non-empty-row, rendered-cell and UTF-8 output ceilings before result fragments are appended; sparse-column output is preserved. No actionable review threads. | Red 257-sheet reproducer; focused 4/4; `verify:cheap` 3,218 passed / 1 skipped; PR-local build/scan/offline RAG; hosted required/security/policy green. | diff --git a/docs/codebase-index.md b/docs/codebase-index.md index c7d597ed5..aa92ad7ad 100644 --- a/docs/codebase-index.md +++ b/docs/codebase-index.md @@ -334,6 +334,7 @@ One shared composer (`master-search-header.tsx`) serves every mode. Placement: | Full documentation index | `docs/README.md` | | Routes and modes | `docs/site-map.md` | | Search/RAG roadmap | `docs/search-rag-master-plan.md` | +| Universal task ledger | `docs/outstanding-issues.md` | | Reindex operations | `docs/reindex-runbook.md` | | Production readiness | `docs/production-readiness-checklist.md` | | Capacity / scale-up | `docs/capacity-review.md`, `docs/auth-connection-cap-runbook.md` | diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index e31b22152..c929f0e3d 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -1,36 +1,71 @@ -# Outstanding Issues, Recommendations & Tasks +# Universal Task Ledger -Durable, cross-session memory of everything still outstanding for this repo: open **tasks**, -**recommendations** not yet acted on, and **issues** not yet resolved. Chat context is ephemeral -(sessions summarise and reset); this file is not — it is the single source of truth the -[`/issues` skill](../.claude/skills/issues/SKILL.md) reads back and updates. +This file is the repository's single, durable, cross-session task ledger and source of truth. Chat +context is ephemeral; this file is repository memory. The [`/issues` +skill](../.claude/skills/issues/SKILL.md) and session-start hook read the ordered **Open items** table +below. No other file owns an active task queue. **Rule of thumb:** if it is worth remembering after this session ends, it belongs here. ## How this is used -- Say `/issues` in Claude Code → the skill reads this file and states the open items back, - grouped by priority with a one-line summary count. Nothing is mutated on a plain read. +- Say `/issues` in Claude Code → the skill reads this file and states the open items back in + recommended order with a one-line summary count. Nothing is mutated on a plain read. - `/issues add …`, `/issues done `, `/issues capture`, and friends mutate the tables below. The full command surface lives in the skill file. - Every mutation keeps this file committed so the memory survives across sessions and worktrees. ## Conventions -- **ID** is a monotonic `#NNN`, never reused. Allocate the next number above the current max - across _both_ tables (open + resolved). +- **Order** is the current recommended execution sequence. Dependencies and approval gates still + control when a later row may start. +- **ID** is a monotonic `#NNN`, never reused. Allocate the next number above the current max across + every section. - **Pri**: `P1` (do next / blocking), `P2` (should do), `P3` (nice-to-have / revisit-when). +- **Acuity**: `A1` (urgent), `A2` (important), `A3` (planned), or `Optional`. There is currently no + active P0/P1 or A1 incident. - **Type**: `task` (a concrete unit of work), `rec` (a recommendation to weigh), or `issue` (a defect / risk / gap). -- **Detail / next action** is the smallest thing that would move the item forward. -- **Source** points at where it came from: a doc, a PR (`#123`), a file:line, or `session YYYY-MM-DD`. +- **Intelligence** states the capability needed: `Standard`, `High`, `Specialist`, or `Operator`. +- **Effort** is active work and excludes approval, CI, provider, scheduled-run, soak, and review + waiting time. - Resolving an item moves its row to **Resolved / archive** with the date and a one-line outcome — rows are archived, not deleted, so the history stays auditable. - + ## Open items +Only this table is active work. It contains recommended tasks only; its order is not authorization +to call providers, spend money, change production, commit, push, or deploy. + +| Order | ID | Pri / acuity | Type | Task / smallest next action | Intelligence | When | Effort | Dependencies / approvals | Success, verification, and stop condition | Source / updated | +| ----: | ---- | ------------- | ----- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------ | ------------------------------------------------------------------ | --------------------------------------------- | ----------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------- | +| 1 | #052 | P2 / A2 | issue | Block destructive bulk reindex while agent enrichment is active. Add `hasActiveAgentEnrichmentJob` to both reindex routes with denial and idle-path tests. | High — ingestion concurrency | **Ready; do first.** | 0.5–1 day | Local/offline; no provider action. | Both routes reject during an active job and preserve idle behavior. Run focused route tests, typecheck, and production-readiness. Stop before queue-semantic changes. | Ingestion audit F1; 2026-07-24 | +| 2 | #053 | P2 / A2 | issue | Detect aged `queued` documents with no open ingestion job and add one idempotent, owner-scoped recovery path with a grace period and dry-run visibility. | Specialist — queue/database reliability | **After #052; before ingestion webhook activation.** | 0.5–1 day | Local replay if schema/scheduling changes; approval only for later deployment. | A controlled orphan receives exactly one job and active jobs are never duplicated. Run focused recovery/autopilot tests and production-readiness. Stop before live mutation. | Ingestion audit prerequisite; 2026-07-24 | +| 3 | #030 | P2 / A2 | issue | Require distinct source identities for distinct expected comparison slots; first add a red shared-title/two-expectation test. | High — evaluation semantics | **Ready; may run alongside #052.** | 2–4 hours | Local/offline. | One source cannot satisfy both slots and valid cases remain green. Run focused eval tests, typecheck, and `verify:cheap`. Stop without changing aliases, retrieval, or ranking. | Current-source review; 2026-07-24 | +| 4 | #022 | P2 / A2 | task | Decide an auditable BMJ published-reference policy, then review the ten highest-impact local WA documents. | Operator — clinical governance, with specialist review | **Decision-ready; operator lane.** | 1–2 hours policy; 0.5–1 day review | Clinical decision; approval for live metadata writes or follow-up canary. | Record reviewer, evidence, timestamp, and rationale without erasing third-party/unverified provenance. Stop after ten and remeasure before continuing. | Governance review; 2026-07-24 | +| 5 | #051 | P2 / A2 | task | Compare run `30018289898` with the scheduled structured canary, browser, and irrelevant-at-10 artifacts; absorb former duplicate #023 and decide if RAG work may resume. | Specialist — RAG diagnostics/evaluation | **After scheduled run, about 2026-07-27 02:00 AWST.** | 2–4 hours | Approval to read hosted GitHub artifacts; do not dispatch or rerun. | Record run identity, content/provider/latency deltas, browser outcomes, and labeling decisions; close or rewrite source items. Stop without spending or restoring archived code. | PRs #1095/#1097; 2026-07-24 | +| 6 | #019 | P2 / A2 | task | Prove the admission source is lost in the comparison fallback layer using PR #1096's pinned source shape, then scope the smallest correction. | Specialist — RAG answer pipeline | **After #051.** | 0.5–1 day reproducer | Stable canary decision; protected review and approved post-change canary for behavior. | A unit reproducer fails for the omission while deterministic packing retains both sources. Any fix preserves roles without recall, rank, or safety regression. Stop if not reproducible. | PR #1096; 2026-07-24 | +| 7 | #018 | P2 / A2 | task | Diagnose lithium, ADHD, and metabolic residuals separately: unrelated-table fast path, extractive budget exhaustion, and schedule-free prose selection. | Specialist — clinical RAG/retrieval | **After #051; one mechanism at a time.** | 1–2 days diagnosis; fixes separate | Stable canary; protected review and approval for behavior canaries. | Each mechanism gets its own current-main failing fixture and scoped candidate. Stop without a deterministic reproducer or on individual canary regression. | Runs `30007833352`/`30009207429`; 2026-07-24 | +| 8 | #029 | P2 / A2 | issue | Re-enumerate current fallback-stub cases and improve one demonstrated causal cluster at a time without weakening fail-closed behavior. | Specialist — RAG quality/clinical safety | **After #051, #019, and #018 clarify overlap.** | 0.5–1 day inventory; 1–3 days per fix | Provider-backed answer validation needs approval. | Retain grounding/citation gates; do not reuse the historical 12/30 count or keyword-only targeting. Stop after each validated cluster or if a change only makes the metric easier. | Current-source review; 2026-07-24 | +| 9 | #024 | P3 / A3 | issue | Distinguish Playwright `_rsc` interception failure from a real Safari defect so the WebKit release matrix is trustworthy. | High — Next.js/Playwright/WebKit | **After #051's matrix datapoint, or on real Safari reproduction.** | 0.5–1 day | Real-device/provider check only if local evidence stays ambiguous. | Apply a test-only correction only with a discriminating reproducer; keep access/navigation assertions meaningful and Chromium green. Stop when the matrix signal is trustworthy. | Browser matrix review; 2026-07-24 | +| 10 | #007 | P3 / A3 | rec | Choose one canonical Tools experience and align navigation, redirects, sitemap, and reachability coverage. | Operator product decision, then Standard frontend | **When the owner chooses dashboard or standalone mode.** | 15–30 minute decision; 0.5 day implementation | Product decision. | One canonical path, one intentional compatibility redirect, and green route/navigation tests. Stop if the standalone page has an unresolved requirement. | Route review; 2026-07-24 | +| 11 | #001 | P2 / A2 | task | Reassess semantic reranking without changing the default; enable only after an accepted ambiguity-specific comparison. | Specialist — retrieval/ranking | **After #051 and only with explicit rollout approval.** | 0.5–1 day local analysis plus review | Provider approval and budget for hosted comparison. | Keep `RAG_SEMANTIC_RERANK_ENABLED=false` unless retrieval stays 36/36, recall stays 1.0, no case regresses, and a measured gain exists. Otherwise record “remain off” and stop. | PR #901; 2026-07-24 | +| 12 | #025 | P2 / A2 | task | Select and activate only the wanted webhooks. For document-change delivery after #052 and #053, configure matching Railway/Vault secrets and the environment base-URL GUC. | Operator — Railway/GitHub/chat/Supabase | **Decision/provider-gated; ingestion waits for #052 and #053.** | 1–3 hours per selected channel | Provider approval, environment secrets, destination owner, and verified project identity. | One controlled event reaches each selected destination without secret or clinical-payload disclosure. Mock first, then one approved provider test. Stop on unsafe delivery. | `docs/webhooks.md`; PR #1101; 2026-07-24 | +| 13 | #011 | P3 / A3 | task | Change Supabase Auth from an absolute DB-connection cap to percentage allocation immediately before the first compute scale-up. | Operator — Supabase capacity | **Trigger-gated; add to resize checklist, not now.** | 30–60 minutes plus soak | Planned scale-up and provider approval. | Record before/after settings, a healthy soak, and approved advisor recheck. Stop if no scale-up is planned. | Auth cap runbook; 2026-07-24 | +| 14 | #017 | P3 / A3 | task | Capture one reproducible mobile and desktop production Lighthouse/Web-Vitals baseline before creating payload work. | High — web performance/browser | **Provider-gated; before #012.** | 1–2 hours | Approval for live-site access; record route, build, throttling, and raw report. | Record representative LCP/INP/CLS and decide if payload work is justified. Stop if metrics are acceptable or the run is too noisy. | Performance review; 2026-07-24 | +| 15 | #027 | P3 / Optional | rec | Decide whether independent uptime monitoring justifies vendor and operating cost; if yes, monitor `/api/health` outside GitHub/Railway. | Operator — SRE/provider | **When an owned external outage-alert path is wanted.** | 1–2 hours | Vendor, cost, privacy, alert owner, and provider approval. | A controlled failure yields one non-PHI alert and recovery notice. Stop if nobody will respond or existing monitoring is accepted. | Operations review; 2026-07-24 | +| 16 | #028 | P3 / Optional | rec | Define vendor, region, retention, redaction, sampling, source-map, and alert-ownership boundaries before runtime error tracking. | Specialist — privacy/observability, plus Operator | **Only after privacy, ownership, dependency, and cost approval.** | 1–3 days | Privacy review and provider approval. | Tests prove clinical text, identifiers, and secrets stay out; one approved non-sensitive event arrives. Stop before SDK work if the envelope is unacceptable. | Privacy review; 2026-07-24 | +| 17 | #012 | P3 / A3 | rec | Remeasure route payloads and slim only a production route with a demonstrated problem; consolidate former duplicate #013 and ignore mockup-only code. | High — bundling/performance | **After #017 or equivalent fresh evidence.** | 0.5–2 days per measured route | Field/build evidence first; UI verification for user-facing changes. | Achieve a material parsed/gzip or interaction reduction with unchanged behavior. Run analysis, focused tests, `verify:cheap`, and browser smoke. Stop if gain is small. | Build analysis; 2026-07-24 | +| 18 | #040 | P3 / Optional | rec | Add a small approved visual-regression baseline set for stable, high-value desktop/mobile and accessibility surfaces. | High — visual QA/accessibility | **When an owner and intentional-update process exist.** | 1–2 days | Baseline owner, CI budget, stable environment, and hosted-storage approval if used. | Baselines are deterministic, documented, and catch a controlled change without flaky churn. Stop if stable screenshots cannot be produced. | Design audit; 2026-07-24 | + +## Legacy evidence register + +Frozen source claims retained for audit history. These rows are **not active tasks** and are not +read by `/issues` or the session-start hook. The active table above reflects their current retained, +consolidated, deferred, completed, or rejected disposition. + > **Merged-main canary update (2026-07-23, run `30018289898`):** the new structured report correctly recorded evaluated tree `c24f2e8f2d30d0c59fc1eba025d3dcd63478137e`, run/attempt identity and `cross-region-runner` latency context. Golden retrieval remained 36/36 with document/content recall 1.0 and no failed cases. The 44-case answer gate had grounded-supported and unsupported-correct rates of 1.0, but failed because `neuroleptic-side-effect-escalation` again returned one citation where two are required (citation-failure rate 0.0227). `admission-discharge-comparison` again omitted the specific AKG admission document after `comparison_source_extractive_fallback`; `admission-discharge-coverage-paraphrase` was advisory-only at 24,870 ms. Answer cost was reported as `$0.234736`. Do not retry immediately: retain this as the first structured datapoint, compare it with the scheduled 2026-07-26 report, and keep retrieval/ranking unchanged. > **RAG reconciliation correction (2026-07-23):** fresh current-main live evidence supersedes the broad diagnosis in #018. The three named misses are not one composer defect. Lithium reproduced an unrelated-table retrieval fast-path defect; ADHD still retrieves a relevant chart-heavy CAMHS source but exhausts the extractive route budget; metabolic retrieves the correct AKG source but selects schedule-free prose; #019 remains post-retrieval comparison source selection. A narrow lithium subject-evidence guard improved its targeting result from 0 to 1 with golden recall 1.0 and no reciprocal-rank regressions, but was reverted and rejected because the required full canary failed. Keep #029 open for the remaining fallback-stub cases. Do not combine these residuals or change ranking scores, comparator ordering, aliases, clamps, or semantic reranking without a separate reproducer and passing canary pair.