From b3ac681c532670193bca0203c0665b642044e469 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:09:11 +0800 Subject: [PATCH 01/13] docs: make outstanding issues the universal task ledger --- AGENTS.md | 9 +++-- docs/README.md | 1 + docs/branch-review-ledger.md | 2 +- docs/codebase-index.md | 1 + docs/outstanding-issues.md | 74 ++++++++++++++++++++++++++++++++++-- 5 files changed, 80 insertions(+), 7 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 32d9bc6c0..94d7841e0 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -450,9 +450,12 @@ Run the matching planner command in `docs/productivity-workflows.md` without sid ## Outstanding-work memory (`/issues`) -`docs/outstanding-issues.md` is the durable, cross-session memory of every outstanding **task**, -**recommendation**, and **issue** for this repo. Chat context resets between sessions; that file does -not, so anything worth remembering after a session ends belongs there. +`docs/outstanding-issues.md` is the single universal, durable, cross-session ledger for every +outstanding **task**, **recommendation**, and **issue** in this repo. It owns the recommended +execution order, acuity, required capability, timing, effort, approvals, evidence, status, success +criteria, stop rules, and resolution history. Chat context resets between sessions; that file does +not, so anything worth remembering after a session ends belongs there. Do not create or maintain a +second task ledger. - When the user types `/issues`, invoke the `issues` skill (`.claude/skills/issues/SKILL.md`): read `docs/outstanding-issues.md` and state the open items back, grouped by priority. A plain `/issues` diff --git a/docs/README.md b/docs/README.md index 0b743e80c..0d1c904af 100644 --- a/docs/README.md +++ b/docs/README.md @@ -71,6 +71,7 @@ npm run docs:check-links ## Plans and workstreams (living) +- [outstanding-issues.md](outstanding-issues.md) — universal task ledger, recommended execution order, evidence, status, and resolution history - [maturity-backlog-workorders.md](maturity-backlog-workorders.md) — actionable work orders tracking the repository-maturity audit backlog - [framework-dependency-modernization-checklist.md](framework-dependency-modernization-checklist.md) — ordered Next.js 16, runtime, dependency, Turbopack, and verification migration program - [search-rag-master-plan.md](search-rag-master-plan.md) / [search-rag-master-context.md](search-rag-master-context.md) — search/RAG roadmap and shared context diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md index b9b2a8b96..f8f2edb72 100644 --- a/docs/branch-review-ledger.md +++ b/docs/branch-review-ledger.md @@ -20,7 +20,7 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD | Date | Branch or ref | Reviewed HEAD | Scope | Outcome | Checks | | ---------- | -------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| 2026-07-24 | `codex/supabase-document-change-trigger` | `9c7d9edf509a51478f5bebbabcca64e3926dc877` + reviewed working diff | Document-change ingestion trigger migration, schema mirror, grants, privacy and fail-safe delivery | APPROVE. No P0-P2 finding. The trigger is update-only, acts solely on a strict JSON boolean false/absent-to-true transition, sends only the receiver's allowlisted owner-scoped fields, fails open for document writes when Vault/GUC/pg_net is unavailable, and revokes execution from public/anon/authenticated. No production URL fallback exists. Highest residual risk is deliberate pg_net at-most-once delivery; the clear-then-flip recovery and data-preserving rollback are documented, and the trigger remains inert until both the Vault secret and environment base-URL GUC are configured. | Disposable `supabase/postgres:17.6.1.127` schema replay and drift-manifest regeneration passed (16s; scratch container removed); focused schema/drift/receiver Vitest 89/89; migration-role, function-grant (30 SECURITY DEFINER functions) and owner-scope guards; production-readiness CI mode READY with expected secretless-worktree warnings; offline RAG 21 suites/307 tests; `verify:cheap` 365 files, 3,241 passed/1 skipped; static trace of receiver payload, authoritative owner-scoped reload and idempotent enqueue path. No live provider mutation or migration apply. | +| 2026-07-24 | `codex/supabase-document-change-trigger` | `9c7d9edf509a51478f5bebbabcca64e3926dc877` + reviewed working diff | Document-change ingestion trigger migration, schema mirror, grants, privacy and fail-safe delivery | APPROVE. No P0-P2 finding. The trigger is update-only, acts solely on a strict JSON boolean false/absent-to-true transition, sends only the receiver's allowlisted owner-scoped fields, fails open for document writes when Vault/GUC/pg_net is unavailable, and revokes execution from public/anon/authenticated. No production URL fallback exists. Highest residual risk is deliberate pg_net at-most-once delivery; the clear-then-flip recovery and data-preserving rollback are documented, and the trigger remains inert until both the Vault secret and environment base-URL GUC are configured. | Disposable Supabase Postgres 17.6.1.127 image replay and drift-manifest regeneration passed (16s; scratch container removed); focused schema/drift/receiver Vitest 89/89; migration-role, function-grant (30 SECURITY DEFINER functions) and owner-scope guards; production-readiness CI mode READY with expected secretless-worktree warnings; offline RAG 21 suites/307 tests; `verify:cheap` 365 files, 3,241 passed/1 skipped; static trace of receiver payload, authoritative owner-scoped reload and idempotent enqueue path. No live provider mutation or migration apply. | | 2026-07-23 | PR #1090 / `cursor/fix-phone-dock-edge-1b1d` | `761de7e9ad623b6bd8d634d849a9eb465d622e48` (merged as `09028ef217209fceb53f1122ac7738b509bce323`) | Phone safe-area and edge-to-edge search-dock UI review | MERGED. No P0-P2 finding. The branch was three commits behind, so current `origin/main` was merged before landing; the actual merge tree matched the reviewed synthetic tree. The dock remains flush to the viewport with safe-area padding inside the form, and the phone shell no longer retains the `dvh` clamp that created the Safari toolbar band. Zero actionable review threads. | `npm run ensure`; focused `ui-tools.spec.ts` phone-home and edge-to-edge scenarios: Chromium 2/2 and WebKit 2/2; refreshed hosted policy, security, unit, build, advisory UI, Production UI and required aggregate checks green; exact-head ancestry and local-main tree equality proved after merge. | | 2026-07-22 | PR #1087 / `codex/reconcile-product-truth` | `edbc2260fef59ca2fa7c6973dffb85e32354bce1` (merged as `05dc52fd8408a65117e22a6236e43252203bea92`) | Product-truth copy, account persistence and unavailable-SSO presentation | MERGED. Cross-device claims now match favourites/preferences persistence; recent searches are identified as browser-session data; the contradictory “never shared” statement is removed. All unavailable setup providers and Apple elsewhere use the connected accessible “coming soon” placeholder pattern. The single review finding was fixed, replied to and resolved. | Red DOM proof; focused 19/19; `verify:cheap` 3,220 passed / 1 skipped; `verify:ui` 265/265; PR-local build/secret scan/offline RAG; final hosted required, Production UI, policy and security checks green. No provider calls or RAG spend. | | 2026-07-22 | PR #1086 / `codex/reconcile-xlsx-budgets` | `5376880a40749b6526fd7e4603a7be9d04bc9624` (merged as `2963fba46eacd644618a588fa283f7597faa2644`) | XLSX resource-boundary review | MERGED. Enforces worksheet, non-empty-row, rendered-cell and UTF-8 output ceilings before result fragments are appended; sparse-column output is preserved. No actionable review threads. | Red 257-sheet reproducer; focused 4/4; `verify:cheap` 3,218 passed / 1 skipped; PR-local build/scan/offline RAG; hosted required/security/policy green. | diff --git a/docs/codebase-index.md b/docs/codebase-index.md index c7d597ed5..aa92ad7ad 100644 --- a/docs/codebase-index.md +++ b/docs/codebase-index.md @@ -334,6 +334,7 @@ One shared composer (`master-search-header.tsx`) serves every mode. Placement: | Full documentation index | `docs/README.md` | | Routes and modes | `docs/site-map.md` | | Search/RAG roadmap | `docs/search-rag-master-plan.md` | +| Universal task ledger | `docs/outstanding-issues.md` | | Reindex operations | `docs/reindex-runbook.md` | | Production readiness | `docs/production-readiness-checklist.md` | | Capacity / scale-up | `docs/capacity-review.md`, `docs/auth-connection-cap-runbook.md` | diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index e31b22152..9b1e7540a 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -7,6 +7,10 @@ Durable, cross-session memory of everything still outstanding for this repo: ope **Rule of thumb:** if it is worth remembering after this session ends, it belongs here. +This is the repository's **single universal task ledger**. It owns recommended execution order, +acuity, required capability, timing, effort, dependencies, approvals, evidence, status, success +criteria, stop rules, and resolution history. Do not create or maintain a second task ledger. + ## How this is used - Say `/issues` in Claude Code → the skill reads this file and states the open items back, @@ -27,7 +31,70 @@ Durable, cross-session memory of everything still outstanding for this repo: ope - Resolving an item moves its row to **Resolved / archive** with the date and a one-line outcome — rows are archived, not deleted, so the history stays auditable. - +## Execution scales + +- **A1 urgent:** active safety/privacy/data-loss/release blocker; none currently. +- **A2 important:** confirmed correctness, clinical, privacy, reliability, or evaluation-integrity + work that leads its available lane. +- **A3 planned:** worthwhile work deferred to its stated trigger. +- **Optional:** do only when measured need, ownership, and cost justify it. +- **Standard:** experienced generalist. **High:** senior cross-module reasoning. **Specialist:** + database/RAG/clinical/privacy/security/evaluation expertise. **Operator:** authorised human owner. +- Effort is active work, excluding approvals, hosted/provider waits, soak, and review time. + +The order below is planning guidance, not authority to call providers, spend money, change +production, commit, push, merge, or deploy. A waiting dependency does not block an independent +executable item below it. + +## Recommended execution queue + +| Order | Source | Recommended outcome / next action | Acuity / capability | When | Active effort | Dependencies / approval | Done, verification, and stop rule | +| ----: | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- | ----------------------------------------------------------- | --------------------------------------- | ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| 1 | `#052` | Prevent full/retry reindex overlapping a fresh agent-enrichment lease; add red single/bulk tests, then reuse `hasActiveAgentEnrichmentJob` before mutation. | A2 / High concurrency | Ready; first | 0.5–1 day | Local/offline | Fresh processing leases conflict; stale leases and enrichment mode retain behavior. Run focused route/safety tests, `verify:cheap`, production-readiness. Stop if current `main` does not reproduce it. | +| 2 | `#030` | Require distinct source identities for distinct expected comparison slots; begin with a red shared-title/two-expectation test. | A2 / High evaluation semantics | Ready; after 1 | 2–4 hours | Local/offline; protected-eval review | One source cannot satisfy both slots; existing cases stay green. Run focused matching, typecheck, `verify:cheap`. Stop before alias/retrieval/ranking changes. | +| 3 | `#019` | Prove admission evidence is lost at the comparison fallback boundary; scope the smallest correction without automatically shipping it. | A2 / Specialist RAG | Reproducer now; behavior after 9 | 0.5–1 day; fix separate | Protected review; approved baseline/post canary for behavior | Reproducer fails while packing retains both sources. Stop without behavior change if the boundary defect is not independently reproducible. | +| 4 | `#026` | Prove aged queued-without-job recovery, then activate the merged document trigger only through the approved Supabase path and configure Vault/GUC. | A2 / Specialist recovery + Operator | Recovery now; live steps in approved window | 0.5–1 day local; 1–2 hours operator | PR #1100 merged; live Supabase approval | Recovery is idempotent under crash/concurrency/repeat; migration state, controlled event, rollback, and production-readiness are recorded. Never apply raw SQL live. | +| 5 | Privacy/legal package | Execute OpenAI/Railway DPAs; decide ZDR/residency; obtain cache/subprocessor answers and APP 8 plus APP 5/1 counsel sign-off. | A2 / Operator legal/privacy | Start now; before real-patient use/privacy-approved release | 4–8 hours internal; 1–6 weeks elapsed | Signers, counsel, providers | Record countersigned evidence, IDs, dates, decisions, and approved wording in PIA/cross-border docs. Stop before public-copy changes without counsel. | +| 6 | Safety identifier config | Set a unique 32+ character `OPENAI_SAFETY_IDENTIFIER_SECRET` per environment with `OPENAI_API_KEY`, never in Git/output. | A2 / Standard local + Operator hosted | Local now; hosted approved window | 15–30 min local; 30–60 min/env | Secret manager; hosted approval | Presence-only readiness passes, HMAC pseudonymity remains, secret scans clean. Stop if governance rejects stable identifiers. | +| 7 | Operator config backlog | Reconcile query-hash, deep-probe, Supabase/OpenAI, project identity, and schedules using read-only presence checks before setting anything. | A2 / Operator platform | Next approved readiness window | 1–2 hours | Provider approval, env owners | Record status, never values; set only confirmed gaps; identity/readiness pass. Stop on target ambiguity or cross-env key reuse. | +| 8 | `#022` | Decide auditable BMJ reference policy, then review the ten highest-impact local WA documents. | A2 / Operator governance + Specialist | Decision-ready | 1–2 hours policy; 0.5–1 day reviews | Clinical authority; live writes/canary approval | Preserve third-party/unverified provenance; record reviewer/evidence/time/rationale. Stop after ten and remeasure debt. | +| 9 | `#051` + `#023` | Compare run `30018289898` with the scheduled 2026-07-26 canary/browser/label artifacts; disposition residuals without rerun. | A2 / Specialist evaluation | About 2026-07-27 02:00 AWST plus runtime | 2–4 hours | Approval to read hosted artifacts; no dispatch | Record tree/run, content/provider/latency, browser, and labeling outcomes. Stop without spend or archived lithium changes. | +| 10 | `#018` | Diagnose lithium, ADHD, metabolic residuals independently: table fast path, extractive budget, schedule-free selection. | A2 / Specialist clinical RAG | After 9; one mechanism at a time | 1–2 days diagnosis; fixes separate | Protected review; approved behavior canary | Each has a current-main fixture and scoped candidate; stop without deterministic repro or on individual canary regression. | +| 11 | `#029` | Re-enumerate fallback stubs and improve one demonstrated causal cluster at a time without weakening fail-closed behavior. | A2 / Specialist answer safety | After 9–10 | 0.5–1 day inventory; 1–3 days/fix | Approved answer validation | Replace historical 12/30 assumption; retain grounding/citation gates. Stop after each validated cluster or metric-gaming change. | +| 12 | `#001` | Reassess semantic reranking without changing default; enable only after accepted ambiguity comparison. | A2 / Specialist ranking | After 9 and rollout approval | 0.5–1 day plus canary review | Provider approval/budget | Keep off unless 36/36, recalls 1.0, zero case regressions, measured gain. Otherwise record keep-off decision. | +| 13 | `#033` | Decide whether governance metadata enters the LLM source block, distinguishing unknown from adverse status. | A3 / Specialist prompt governance | After 8–9 | 1–2 days plus eval | Better metadata, stable canary, provider approval | Prompt/serialization tests; no grounded-supported drop; zero citation failures. Stop on over-caveating/degradation. | +| 14 | `#024` | Separate Playwright `_rsc` interception failure from a real Safari defect. | A3 / High Next.js/WebKit | After 9’s matrix data or real Safari repro | 0.5–1 day | Device/provider check only if local ambiguity | Test-only fix needs discriminating repro and meaningful access-control assertions; keep Chromium green. | +| 15 | `#007` | Choose canonical Tools experience; align nav, redirects, sitemap, reachability. | A3 / Operator product + Standard frontend | Product decision window | 15–30 min decision; 0.5 day code | Product owner | One canonical path and intentional redirect with green route/UI tests. Stop on unresolved standalone need. | +| 16 | `#025` + SLO alerts | Select owned deploy/CI/ingestion/SLO channels; configure only those, ingestion after 4. | A2 / Operator integrations | Approved observability window | 1–3 hours/channel | Provider approval, secrets, destination owner | Mocked tests then one controlled non-PHI event/channel. Stop on missing owner or unsafe delivery. | +| 17 | Full release gate | Run release/clinical gates once against an exact candidate, not a moving branch. | A2 / High release + Operator | Before release/handoff needing full confidence | 0.5 day plus waits | Exact SHA, provider approval, heavy-command lock | All required gates recorded against one SHA; stop/classify first failure and do not repeat unchanged pass. | +| 18 | Staging provision | Provision dedicated Clinical KB staging on Supabase/Railway with isolated keys and synthetic/non-clinical data. | A2 / Operator + Specialist DB | After cost/ownership approval | 0.5–1 day | Billable provider approval, owner | Identity, tenancy, secrets, migrations, app/worker health, data boundary pass. Stop on target ambiguity or production data/key reuse. | +| 19 | Staging soak/rollback | Run documented soak and rollback rehearsal in dedicated staging. | A2 / Operator reliability | After 18 | 0.5 day plus soak | Staging and provider approval | SLO, rollback, data integrity, recovery evidence pass. Stop before production if unproven. | +| 20 | Production seed verification | Verify registry/differentials/medications non-empty before writes; seed only confirmed governed gaps. | A2 / Operator data + Specialist | Approved production window | 1–3 hours plus seed time | Correct owner/project, provider approval | Read-only proof precedes idempotent writes; stop if populated or target ambiguous. | +| 21 | `#011` | Switch Auth DB cap to percentage immediately before first compute scale-up. | A3 / Operator capacity | Scale-up trigger only | 30–60 min plus soak | Dashboard, planned scale-up, approval | Target only `sjrfecxgysukkwxsowpy`; record before/after and advisor/health recheck. Do not create/use staging for this task. | +| 22 | `#017` | Capture reproducible mobile/desktop production LCP, INP, CLS before performance work. | A3 / High web performance | Before 26; approved live window | 1–2 hours | Live-site approval; record route/build/throttle | Record metrics and accept/reject decision. Stop if acceptable or too noisy. | +| 23 | `#037` | Decide whether routine supported claims cap at medium trust. | A3 / Operator clinical-product + Standard frontend | Next trust-policy review | 30–60 min decision; up to 0.5 day code | Clinical/product authority | Record policy; if accepted, change flag/render expectations only and run focused tests. Stop without owner acceptance. | +| 24 | `#027` | Add uptime monitor outside GitHub/Railway only if service, budget, responder justified. | Optional / Operator SRE | Owned external-alert trigger | 1–2 hours | Vendor/privacy/owner/provider approval | Controlled non-PHI failure/recovery alerts. Stop without responder or if current monitoring accepted. | +| 25 | `#028` | Define vendor/region/retention/redaction/sampling/maps/owner before runtime error tracking. | Optional / Specialist privacy + Operator | After privacy/ownership/cost approval | 1–3 days | Privacy and provider approval | Redaction tests exclude clinical data/IDs/secrets; one non-sensitive event arrives. Stop if envelope unacceptable. | +| 26 | `#012` + `#013` + `#016` | Measure before one bundle/runtime/motion target: differentials index, catalogue chunk, prod mockup exclusion, static shell, sidebar, Therapy Compass, dialogs. | A3 / High Next.js performance | After 22 or equivalent evidence; one target | 0.5–3 days/target | Measured target, Next.js guide, UI verification | Define before/after metric, preserve behavior, run analysis/focused/`verify:cheap`/browser. Stop if gain small. | +| 27 | `#040` | Add small stable visual-regression baselines with owner/update workflow. | Optional / High visual QA | Stable surfaces and owner | 1–2 days | Stable browser, owner | Low-flake repeat runs and documented updates. Stop before blocking if churn high. | +| 28 | `#038` | Define shared comparison interaction contract before another comparison surface; keep clinical content mode-specific. | Optional / High design-system | Approved new comparison surface | 0.5–1 day | Concrete surface, product/design owner | Inventory patterns and make shared behavior testable. Stop if no new surface. | +| 29 | `#009` | Decide whether `/api/jobs` is intentional ops-only; document/test or remove. | A3 / Standard API ownership | Next API maintenance | 1–2 hours | Product/ops owner | Record owner/contract or remove unused route/tests; focused tests + `verify:cheap`. Stop if external consumers unclear. | +| 30 | `#035` | Expand conflict detection only for concrete clinically reviewed class with positive/negative fixtures. | A3 / Specialist evidence rules | Demonstrated missed conflict | 0.5–1 day design; code separate | Clinical review; provider approval only for live validation | Fixtures discriminate class without unrelated warnings. Stop if no bounded class. | +| 31 | `#036` | Decide explicit public-visibility flag vs `owner_id IS NULL` plus warning before any visibility migration. | A3 / Specialist tenancy/RLS | Before visibility/public-corpus migration | 2–4 hours decision | Security/clinical review; migration approval if adopted | Compare threat model/migration/rollback. Stop without schema if current control preferred. | +| 32 | `#039` | Converge repeated catalogue toolbar behavior only during a concrete toolbar project. | Optional / High frontend architecture | Concrete project | 0.5–1 day inventory; 1–3 days code | Product/design owner, UI verification | Prove shared behavior without flattening search semantics; stop after bounded contract. | +| 33 | `#010` | Wire a disabled Forms/Favourites placeholder only when its feature is selected. | Optional / Standard frontend-product | Per approved feature; no work now | 0.5–2 days/feature | Product scope/data contract | Action works with UI/a11y coverage. Do not batch-build unrequested placeholders. | +| 34 | `#041` | Extend Easy Read/Standard Factsheets for future patient content; no second patient mode. | Optional / High content/a11y/governance | Concrete need + source plan | 0.5–2 days/increment | Product/content/governance | Extend/test existing contracts. Stop if need/source undefined. | +| 35 | `#021` | Revisit conservative generation discards only for measured latency/waste or cheaper mechanism. | Optional / Specialist quality/cost | Evidence trigger only | 2–4 hours diagnosis; 1–2 days/candidate | Evidence and approved provider budget | Reduce cost/latency without weaker gates. Stop if cost/benefit remains poor. | + +### Queue maintenance + +1. Revalidate against current `main` before starting and remove/rewrite contradicted work. +2. Do not combine protected RAG residuals or change scores, comparators, aliases, clamps, or semantic + reranking without separate reproducers and required validation. +3. Treat provider status as a claim: verify only after approval and never store secret values. +4. Close/reclassify when a success or stop condition is met; do not preserve work for its own sake. + + ## Open items @@ -39,6 +106,7 @@ Durable, cross-session memory of everything still outstanding for this repo: ope | ---- | --- | ----- | --------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------- | | #051 | P2 | task | Stabilise the live answer-quality canary before more RAG tuning | Diagnostics landed in PR #1095: structured JSON/Markdown artifacts now record the actual checked-out SHA, run identity and latency context, and the offline trend tool separates content, provider-route and latency outcomes. First validating run `30018289898` recorded the expected tree and cost, with 36/36 retrieval green, but one report cannot establish variability; PR #1097 prevents a single failure being mislabeled as repeated. Next: compare the scheduled 2026-07-26 structured report with this run. Do not spend on an immediate retry or reapply the archived lithium guard before that comparison. | PR #1095; run `30018289898`; PR #1097; archive ref `refs/archive/rejected-rag/20260723/monitoring-subject-gate` | 2026-07-23 | | #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 | +| #052 | P2 | issue | Reindex can overlap a fresh agent-enrichment pass | Full/retry reindex preflights check `ingestion_jobs` but do not call the existing `hasActiveAgentEnrichmentJob`. A fresh `indexing_v3_agent_jobs.status='processing'` lease can therefore overlap destructive artifact work. Extend single and bulk full/retry preflights before mutation; keep stale leases non-blocking and preserve enrichment-mode behavior. | `src/lib/ingestion-mutation-safety.ts:116-159`; single/bulk reindex routes; ingestion audit 2026-07-24 | 2026-07-24 | | #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 | | #007 | P3 | rec | `/tools` vs `/?mode=tools` parallel Tools entry points | `/tools` (standalone `ApplicationsLauncherPage`) has no inbound in-app link; the sidebar Tools item uses `/?mode=tools`. Decide the canonical entry point and wire nav consistently, or drop the standalone `/tools` page + `/applications` redirect. Currently allowlisted in `tests/route-reachability.test.ts`. | `src/app/tools/page.tsx`; `src/app/applications/route.ts` | 2026-07-21 | | #009 | P3 | rec | Confirm `/api/jobs` is intentionally server/ops-only | No client `fetch()` reaches `/api/jobs` (only tests import it). Confirm it is a deliberate ops/manual surface; if abandoned, remove it. | `src/app/api/jobs/route.ts` | 2026-07-21 | @@ -46,7 +114,6 @@ Durable, cross-session memory of everything still outstanding for this repo: ope | #011 | P3 | task | Auth DB-connection allocation is operator-only | Supabase Auth (GoTrue) is capped at ~10 absolute DB connections (Supabase perf advisor). Switch to **percentage-based** allocation in the Supabase **dashboard** before the first compute scale-up — **not settable via SQL/MCP** (operator-owned). Verify via a staging soak + an approval-gated read-only advisor re-check. | `docs/auth-connection-cap-runbook.md`; `docs/process-hardening.md` (Known follow-up debts) | 2026-07-21 | | #012 | P3 | rec | Slim the lazy cross-mode differentials chunk | `cross-mode-differentials.ts` is dynamically imported (correctly code-split **out** of the initial/dashboard bundle — verified), but it pulls the full ~860 KB differentials snapshot (~125 KB gzip lazy chunk) just to build a tiny `{slug,title,clinicalHinge}` + presentations + aliases catalog. A precomputed lightweight index (generator + drift check, like the `specifiers-content` split / medications `fields=index`) would cut that lazy chunk ~5–10×. Not a bundle leak — an M-effort slim. | `src/lib/cross-mode-differentials.ts`; `src/components/clinical-dashboard/cross-mode-links.tsx:150`; session 2026-07-21 (build:analyze) | 2026-07-21 | | #013 | P3 | rec | Route-chunk + mockup catalogue JSON weight | `build:analyze`: `/specifiers` ships `specifiers-search-index.json` (~180 KB parsed), `/forms` ships `forms-catalog.json` (~132 KB), `/formulation` ships `formulation-content.json` (~52 KB, client-side local search — needs index/full split or a search endpoint, architectural). All route-scoped (not initial bundle). Also `*-mockups.tsx` (~100 KB across chunks) build though `/mockups` 404s in prod — exclude from the prod artifact. | session 2026-07-21 (build:analyze) | 2026-07-21 | -| #014 | P3 | rec | Realize the `next/image` win on signed previews | `next.config` `images` (AVIF + `*.supabase.co` `remotePatterns` pinned to the project host, from #1024) is currently inert — signed document/image previews still render as raw ``. Route them through `next/image` to actually get AVIF + lazy optimization. | #1024; `src/components/clinical-dashboard/signed-image.tsx`; session 2026-07-21 | 2026-07-21 | | #016 | P3 | rec | "Big but not easy" structural + motion perf | Deferred larger levers: (a) nonce-CSP forces every product route to `ƒ Dynamic` (zero static generation) — evaluate Partial Prerendering / static shells for the static clinical catalogues (DSM/differentials/therapy/specifiers/formulation); (b) sidebar expand/collapse animates `grid-template-columns` (biggest smoothness cost, motion-gated — needs a transform-overlay rethink); (c) Therapy Compass fetches 692 KB / 2.5 MB JSON client-side (defer until interaction + confirm brotli); (d) settings/setup/admin dialogs static-imported into the home chunk (`next/dynamic` them). | session 2026-07-21 (build route table + design audit) | 2026-07-21 | | #017 | P3 | task | Field Web-Vitals baseline via live Lighthouse | In-sandbox runtime vitals were blocked (prod server hard-requires Supabase secrets; dev-mode CLS measured excellent at 0.00–0.04, content-first pages 0.000). Run Lighthouse against `psychiatry.tools` for real LCP/INP/CLS to prioritize #012–#016 by measured impact rather than reasoning. | session 2026-07-21 (measurement pass) | 2026-07-21 | | #018 | P2 | task | Split the lithium, ADHD and metabolic residuals by mechanism | Revalidated on current main 2026-07-23: these are not one composer defect. Lithium reproduced an unrelated-table retrieval fast-path defect; ADHD retrieves a relevant chart-heavy CAMHS source but exhausts the extractive route budget; metabolic retrieves the correct AKG source but selects schedule-free prose. The narrow lithium subject-evidence guard improved targeting from 0 to 1 with golden recall 1.0 and no reciprocal-rank regressions, but it was reverted because the full canary failed. After #051 stabilises the canary, add independent current-main reproducers and assess each mechanism separately. Do not widen the matcher or combine these into a broad ranking/composer change. | runs `30007833352` and `30009207429`; PR #1093; session 2026-07-23 | 2026-07-21 | @@ -62,7 +129,6 @@ Durable, cross-session memory of everything still outstanding for this repo: ope | #030 | P3 | issue | Wide-tier alias lets one doc satisfy both comparison slots | In src/lib/eval-document-matching.ts, "Admission to Discharge for Mental Health Inpatients" appears in BOTH the AdmissionCommunityPts and Discharge alias lists, so a single document can satisfy both expectedFiles slots and make allHit true — a latent false-pass on admission-discharge cases. Not firing today (that doc is not in the failing top-5) but it would mask a real miss. Tighten the tables so one doc cannot fill both sides. | src/lib/eval-document-matching.ts:32-65; session 2026-07-22 | 2026-07-22 | | #032 | P3 | rec | Governance ranking weighting: REFUTED, not debt | The source-governance audit (PR #1051) flagged three "gaps": `review_due` carries no ranking penalty, `unknownCurrentnessPenalty` ships at 0, and `selectBestSourceRecommendation` ignores governance metadata. **These are deliberate, measured decisions — do NOT implement them as written.** Blanket metadata boosts/penalties in selection ordering were measured on 2026-07-02 to regress the golden retrieval eval to 16/23 (doc-recall@5 1.0→0.76, mrr 0.75→0.64). Two corpus facts make it unsafe: scores saturate at the clamp so stacked boosts fully override lexical relevance, and the corpus is only partially metadata-enriched while `normalizeSourceMetadata` coerces unenriched docs to `unknown`/`unverified` — so "unknown" ≠ "bad" and blanket weighting swings ranking approx. 0.35 for reasons unrelated to relevance. Even governance-as-tiebreak buried correct unenriched docs (3 designs bisected). Next action: none — treat as a guardrail. If ever revisited, RC8 (source-strength as a _filter_) is the tracked path, gated on `eval:retrieval:quality` 36/36 plus a live canary pair. | PR #118; `docs/rag-behaviour/refuted-approaches.md`; PR #1051 items 4/5/6 | 2026-07-22 | | #033 | P3 | rec | Source governance metadata absent from the LLM prompt | `buildRagSourceBlock` omits `document_status`, `clinical_validation_status`, and `extraction_quality`, so the model cannot self-caveat during generation and governance is enforced only post-hoc. Generation-surface change: needs `eval:rag` plus `eval:quality --rag-only` (grounded-supported must not drop, citation-failure 0) and explicit approval. Carries the same "unknown ≠ bad" hazard as #032 — on a partially-enriched corpus the model would likely over-caveat correct sources, so design the prompt wording before spending an eval. | `src/lib/rag/rag-source-block.ts:126-198`; PR #1051 audit item 8 | 2026-07-22 | -| #034 | P3 | issue | Answer cache can serve stale governance metadata | `cacheIndexingVersion` derives the version from `updated_at` / `indexed_at` / `index_generation_id`, so a metadata-only `document_status` flip that bumps none of those is invisible to the passive guard. **Already mitigated**: every known status-write path calls `invalidateRagCachesForOwner` or `invalidateRagCachesForDocumentMutation`. Residual risk only — a future write path that omits the invalidator would serve stale governance until TTL. Next action: add a regression test pinning the invalidator call on status-mutating routes (cheaper and safer than touching the protected cache key). | `src/lib/rag/rag-cache.ts:382-438`; PR #1051 audit item 10 | 2026-07-22 | | #035 | P3 | rec | Threshold-conflict detection covers only 3 params | `detectThresholdDisagreements` checks only ANC, WBC, and platelets paired with withholding verbs, so cross-source conflicts on medication doses, lithium/thyroid levels, or vital signs go undetected. Deliberately narrow (see the comment at `:469-474`). Broadening changes when an answer is classified `conflicting` and adds warnings — real false-positive risk. Needs new fixtures plus a behaviour review before any change. | `src/lib/evidence.ts:469-574`; PR #1051 audit item 7 | 2026-07-22 | | #036 | P3 | rec | No explicit `is_public` visibility flag on documents | Public-corpus visibility is implicit: `owner_id IS NULL` on an `indexed` document (`resolveSearchScope`). The `metadata.public_corpus` marker is written by the promotion migrations but never used as a retrieval filter. Promotion is unconditional on `clinical_validation_status`, so unverified documents are publicly searchable — compensated by keeping `unverified_source` in the frontend-visible warning set. A hard schema flag touches RLS and the clinical-risk-gated retrieval RPCs; weigh against the existing compensating control before acting. | `supabase/schema.sql:61-108`; `src/lib/search-scope.ts:181-236`; PR #1051 audit item 3 | 2026-07-22 | | #037 | P3 | rec | D5 trust-cap-all-claims flag parked OFF | `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` extends authority gating from high-risk claims to **all** supported claims (`deriveTrust`). Ships OFF by design; flipping it caps trust to `medium` for routine claims across the board — a product/clinical-UX decision, not a defect. Both states are test-pinned. Next action: product decision, then flip and re-baseline the UI expectations. | `src/lib/answer-render-policy.ts:159-177`; PR #1051 audit item 11 | 2026-07-22 | @@ -78,6 +144,8 @@ Move resolved rows here with the resolution date and a one-line outcome. Keep th | ID | Type | Summary | Outcome | Resolved | | ---- | ----- | ---------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | | #026 | task | Wire the Supabase document-change trigger | PR #1100 merged after disposable PostgreSQL replay and hosted migration replay. Production migration history and read-only catalog proof confirm the enabled metadata trigger, security-definer function, pinned search path and denied anonymous/authenticated execution; `npm run check:drift` reports no unexpected live drift. Delivery remains intentionally inert until the operator inputs tracked in #025 are configured. | 2026-07-24 | +| #034 | issue | Answer cache can serve stale governance metadata | Current-source verification found direct route coverage already asserts RAG-cache invalidation on document PATCH, source review, label, bulk and reindex mutation paths. The residual test recommendation is therefore already met; changing the protected cache key is unnecessary. | 2026-07-24 | +| #014 | rec | Realize the `next/image` win on signed previews | Superseded: `SignedImage` uses `next/image` for layout/sizing but deliberately sets `unoptimized`, preventing bearer signed URLs from entering the unauthenticated optimizer cache where cached content could outlive the token. No optimization task remains unless private-image delivery changes. | 2026-07-24 | | #031 | issue | Populate canary Source Governance table | The answer-quality step now consumes the preceding `golden-retrieval.json` only for source-governance reporting. Offline replay of run `30018289898` populated 338 top results, including 202 review-required entries, while retaining zero retrieval cases and no additional threshold failures. Retrieval and ranking behavior are unchanged. | 2026-07-24 | | #020 | task | Validate eval:quality cost readout post-fix | Confirmed on merged-main canary run `30018289898`: Answer Metrics reported 9 nonzero-cost cases and an estimated answer cost of `$0.234736`; the structured report retained the same value. The PR #1050 estimator fix is operationally proven. | 2026-07-23 | | #003 | task | Staging tenancy release evidence outstanding | Ran GitHub Action and validated isolation | 2026-07-21 | From 1be1a527393aa3a42cc81eb79c8e02382b25b26d Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:07:39 +0800 Subject: [PATCH 02/13] chore: activate universal task ledger --- .claude/hooks/issues-surface.sh | 62 +++++++++++++++++++++++++++------ .claude/skills/issues/SKILL.md | 23 ++++++++---- AGENTS.md | 15 ++++---- 3 files changed, 76 insertions(+), 24 deletions(-) diff --git a/.claude/hooks/issues-surface.sh b/.claude/hooks/issues-surface.sh index dab08f83d..f8ecffada 100755 --- a/.claude/hooks/issues-surface.sh +++ b/.claude/hooks/issues-surface.sh @@ -1,11 +1,10 @@ #!/usr/bin/env bash # SessionStart hook — surface the outstanding-work memory into context. # -# Reads docs/outstanding-issues.md (the /issues ledger) and prints a compact, -# glanceable summary of the OPEN items so every session starts already aware of -# what is outstanding. When the trigger is a context reset (compact / resume / -# clear) it also emits a reminder to run `/issues capture` — that is the moment -# a session's in-flight follow-ups are most likely to be lost. +# Reads docs/outstanding-issues.md (the universal /issues ledger) and prints the +# ordered recommended tasks plus open-item counts so every session starts with +# the same repository-wide priorities. When the trigger is a context reset +# (compact / resume / clear) it also emits a reminder to run `/issues capture`. # # Contract: READ-ONLY. Never writes, never commits, never fails a session — it # always exits 0, and every step is guarded so a parse error just yields less @@ -43,9 +42,27 @@ rows="$(awk ' } ' "$ledger" 2>/dev/null || true)" +# --- parse the ordered recommended execution queue -------------------------- +# Emit "ORDERIDACUITYWHENESTIMATE" per recommended row. +recommended="$(awk ' + /^## Recommended execution queue/ { inrecommended=1; next } + /^## / { if (inrecommended) inrecommended=0 } + inrecommended && /^\|[[:space:]]*[0-9]+[[:space:]]*\|/ { + n=split($0, c, "|") + order=c[2]; id=c[3]; acuity=c[5]; timing=c[6]; estimate=c[7] + gsub(/^[ \t]+|[ \t]+$/, "", order) + gsub(/^[ \t]+|[ \t]+$/, "", id) + gsub(/^[ \t]+|[ \t]+$/, "", acuity) + gsub(/^[ \t]+|[ \t]+$/, "", timing) + gsub(/^[ \t]+|[ \t]+$/, "", estimate) + printf "%s\t%s\t%s\t%s\t%s\n", order, id, acuity, timing, estimate + } +' "$ledger" 2>/dev/null || true)" + total="$(printf '%s' "$rows" | grep -c . || true)" +recommended_total="$(printf '%s' "$recommended" | grep -c . || true)" if [ "${total:-0}" -eq 0 ]; then - echo "[issues] Outstanding-work memory (docs/outstanding-issues.md): no open items. Record one with /issues add …" + echo "[issues] Universal task ledger (docs/outstanding-issues.md): no open items. Record one with /issues add …" exit 0 fi @@ -54,7 +71,25 @@ count() { printf '%s' "$1" | grep -c . || true; } p1="$(group P1)"; p2="$(group P2)"; p3="$(group P3)" c1="$(count "$p1")"; c2="$(count "$p2")"; c3="$(count "$p3")" -echo "[issues] Outstanding-work memory — ${total} open (${c1}×P1, ${c2}×P2, ${c3}×P3). Source of truth: docs/outstanding-issues.md · read the full list back with /issues." +echo "[issues] Universal task ledger — ${recommended_total} recommended · ${total} open (${c1}×P1, ${c2}×P2, ${c3}×P3). Source of truth: docs/outstanding-issues.md · read the full ledger with /issues." + +print_recommended() { # $1=max-to-list + local limit="$1" shown=0 more=0 order id acuity timing estimate + [ -z "$recommended" ] && return 0 + while IFS=$'\t' read -r order id acuity timing estimate; do + [ -z "$order" ] && continue + if [ "$shown" -lt "$limit" ]; then + echo " ${order} ${id} ${acuity} — ${timing} · ${estimate}" + shown=$((shown + 1)) + else + more=$((more + 1)) + fi + done <`** — append a row to **Open items**. Infer `Pri`/`Type` from the text (ask only if genuinely ambiguous; default `P2`/`task`). Allocate the ID from the `` marker, then bump that marker. Fill `Source` with - `session ` unless the user names one; `Added` is today's date. + `session ` unless the user names one; `Added` is today's date. If the work is currently + recommended, also add it to the ordered execution ledger with acuity, intelligence, timing, + estimate, dependency, and completion signal; otherwise retain it only in Open items. - **`/issues done [outcome]`** — move that row from **Open items** to **Resolved / archive** - with today's date and a one-line outcome. Archive, never delete. + with today's date and a one-line outcome, remove it from the recommended execution queue, and + close the order gap. Archive, never delete. - **`/issues update `** — edit an open row's summary or next action in place. - **`/issues capture`** — scan the current session for recommendations, follow-ups, deferrals, and unfixed problems that surfaced but were not recorded. Propose them as a numbered list and add the @@ -54,6 +60,9 @@ paragraph; put the smallest next action in **Detail / next action**. - Keep the table format and column order exactly as in `docs/outstanding-issues.md`. One row per item. - IDs are monotonic and never reused — always allocate from the `issues:next-id` marker and bump it. +- Keep the recommended execution queue dependency-ordered, gap-free, deduplicated, and synchronized + with its referenced open rows. Never add refuted, parked, superseded, resolved, or decision-only + records to the active recommendation view. - Escape `|` inside cell text (write `\|`) so the markdown table stays intact. - Respect the repo's RAG/clinical/privacy flagging rules if an item _itself_ touches a protected surface — recording it here is fine, but acting on it later still needs the usual gate. diff --git a/AGENTS.md b/AGENTS.md index 94d7841e0..d8f0c3891 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -448,7 +448,7 @@ Run the matching planner command in `docs/productivity-workflows.md` without sid -## Outstanding-work memory (`/issues`) +## Universal repository task ledger (`/issues`) `docs/outstanding-issues.md` is the single universal, durable, cross-session ledger for every outstanding **task**, **recommendation**, and **issue** in this repo. It owns the recommended @@ -457,17 +457,20 @@ criteria, stop rules, and resolution history. Chat context resets between sessio not, so anything worth remembering after a session ends belongs there. Do not create or maintain a second task ledger. +- Before starting or recommending repository work, read the ordered **Recommended execution + queue** and the referenced open item. Only rows in that ordered view are active recommendations; + refuted, parked, superseded, resolved, and decision-only records remain audit history, not tasks. - When the user types `/issues`, invoke the `issues` skill (`.claude/skills/issues/SKILL.md`): read - `docs/outstanding-issues.md` and state the open items back, grouped by priority. A plain `/issues` - is read-only — it mutates and commits nothing. + `docs/outstanding-issues.md` and state the recommended execution queue in order, then summarize + the wider open-item counts. A plain `/issues` is read-only — it mutates and commits nothing. - `/issues add|done|update|capture …` mutate the ledger; each mutation commits **only** `docs/outstanding-issues.md` (no push unless the user asks or you are already handing off). - Proactively offer to `capture` unresolved follow-ups, deferrals, and known risks into the ledger before a session's context is lost — that is what keeps it a memory rather than a stale list. - A `SessionStart` hook (`.claude/hooks/issues-surface.sh`, wired in `.claude/settings.json`) - auto-surfaces the open items into context at the start of every session and, on a context reset - (`compact`/`resume`/`clear`), nudges a `/issues capture`. It is read-only — it never writes the - ledger. `/issues` is still the way to read the full list or mutate it. + auto-surfaces the ordered recommended tasks plus open-item counts at the start of every session + and, on a context reset (`compact`/`resume`/`clear`), nudges a `/issues capture`. It is read-only — + it never writes the ledger. `/issues` is still the way to read the full list or mutate it. ## Codex GitHub review behavior From d788e79134bd059a8a448fb3bb91804dc42909b2 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:21:25 +0800 Subject: [PATCH 03/13] docs: reconcile universal task queue --- docs/maturity-backlog-workorders.md | 4 ++ docs/operator-backlog.md | 5 +- docs/outstanding-issues.md | 89 +++++++++++++++-------------- 3 files changed, 54 insertions(+), 44 deletions(-) diff --git a/docs/maturity-backlog-workorders.md b/docs/maturity-backlog-workorders.md index 2c3a945c9..3d207ed7f 100644 --- a/docs/maturity-backlog-workorders.md +++ b/docs/maturity-backlog-workorders.md @@ -7,6 +7,10 @@ files**, **risk**, **verification**, and **status**. High-risk items are deliber their own work order — the audit's rule is one dedicated PR + full-suite verification per structural change, not a single mixed PR. +This file is supporting work-order detail, not a second task ledger. Only work represented in the +recommended queue in [`outstanding-issues.md`](outstanding-issues.md) is an active repository +recommendation; that universal ledger owns current status, priority, and execution order. + **Status legend:** `DONE` (landed) · `IN PROGRESS` (partially landed; more PRs remain) · `READY` (scoped, safe to start) · `OPEN` (needs a decision or a dedicated PR) · `PROVIDER-GATED` (touches live DB/CI/provider — needs explicit confirmation) · `SATISFIED` diff --git a/docs/operator-backlog.md b/docs/operator-backlog.md index eb749675b..cc2933d29 100644 --- a/docs/operator-backlog.md +++ b/docs/operator-backlog.md @@ -1,8 +1,9 @@ # Operator backlog -Single source of truth for **human-only / provider-gated actions** that cannot be done from a coding +Detailed runbook index for **human-only / provider-gated actions** that cannot be done from a coding session (they touch Supabase, Railway, OpenAI, or GitHub settings, per the AGENTS.md provider boundary). -This exists so that launch-blocking state lives in the repo instead of chat memory. +Canonical task status, priority, and execution order live only in +[`outstanding-issues.md`](outstanding-issues.md); this file supplies operator procedures and evidence. **How to use:** work top to bottom; each row links to the detailed runbook. `Status` values are `⏳ pending`, `🔎 verify` (may already be done — confirm before repeating), `✅ done`, `—` (n/a). diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index 9b1e7540a..c8817f63e 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -1,4 +1,4 @@ -# Outstanding Issues, Recommendations & Tasks +# Universal Task Ledger — Outstanding Issues, Recommendations & Tasks Durable, cross-session memory of everything still outstanding for this repo: open **tasks**, **recommendations** not yet acted on, and **issues** not yet resolved. Chat context is ephemeral @@ -13,8 +13,8 @@ criteria, stop rules, and resolution history. Do not create or maintain a second ## How this is used -- Say `/issues` in Claude Code → the skill reads this file and states the open items back, - grouped by priority with a one-line summary count. Nothing is mutated on a plain read. +- Say `/issues` in Claude Code → the skill reads this file and states the recommended queue in + order, then summarizes the wider open-item counts. Nothing is mutated on a plain read. - `/issues add …`, `/issues done `, `/issues capture`, and friends mutate the tables below. The full command surface lives in the skill file. - Every mutation keeps this file committed so the memory survives across sessions and worktrees. @@ -33,7 +33,7 @@ criteria, stop rules, and resolution history. Do not create or maintain a second ## Execution scales -- **A1 urgent:** active safety/privacy/data-loss/release blocker; none currently. +- **A1 urgent:** active safety/privacy/data-loss/release blocker; `#053` is the current A1 item. - **A2 important:** confirmed correctness, clinical, privacy, reliability, or evaluation-integrity work that leads its available lane. - **A3 planned:** worthwhile work deferred to its stated trigger. @@ -48,43 +48,44 @@ executable item below it. ## Recommended execution queue -| Order | Source | Recommended outcome / next action | Acuity / capability | When | Active effort | Dependencies / approval | Done, verification, and stop rule | -| ----: | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- | ----------------------------------------------------------- | --------------------------------------- | ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| 1 | `#052` | Prevent full/retry reindex overlapping a fresh agent-enrichment lease; add red single/bulk tests, then reuse `hasActiveAgentEnrichmentJob` before mutation. | A2 / High concurrency | Ready; first | 0.5–1 day | Local/offline | Fresh processing leases conflict; stale leases and enrichment mode retain behavior. Run focused route/safety tests, `verify:cheap`, production-readiness. Stop if current `main` does not reproduce it. | -| 2 | `#030` | Require distinct source identities for distinct expected comparison slots; begin with a red shared-title/two-expectation test. | A2 / High evaluation semantics | Ready; after 1 | 2–4 hours | Local/offline; protected-eval review | One source cannot satisfy both slots; existing cases stay green. Run focused matching, typecheck, `verify:cheap`. Stop before alias/retrieval/ranking changes. | -| 3 | `#019` | Prove admission evidence is lost at the comparison fallback boundary; scope the smallest correction without automatically shipping it. | A2 / Specialist RAG | Reproducer now; behavior after 9 | 0.5–1 day; fix separate | Protected review; approved baseline/post canary for behavior | Reproducer fails while packing retains both sources. Stop without behavior change if the boundary defect is not independently reproducible. | -| 4 | `#026` | Prove aged queued-without-job recovery, then activate the merged document trigger only through the approved Supabase path and configure Vault/GUC. | A2 / Specialist recovery + Operator | Recovery now; live steps in approved window | 0.5–1 day local; 1–2 hours operator | PR #1100 merged; live Supabase approval | Recovery is idempotent under crash/concurrency/repeat; migration state, controlled event, rollback, and production-readiness are recorded. Never apply raw SQL live. | -| 5 | Privacy/legal package | Execute OpenAI/Railway DPAs; decide ZDR/residency; obtain cache/subprocessor answers and APP 8 plus APP 5/1 counsel sign-off. | A2 / Operator legal/privacy | Start now; before real-patient use/privacy-approved release | 4–8 hours internal; 1–6 weeks elapsed | Signers, counsel, providers | Record countersigned evidence, IDs, dates, decisions, and approved wording in PIA/cross-border docs. Stop before public-copy changes without counsel. | -| 6 | Safety identifier config | Set a unique 32+ character `OPENAI_SAFETY_IDENTIFIER_SECRET` per environment with `OPENAI_API_KEY`, never in Git/output. | A2 / Standard local + Operator hosted | Local now; hosted approved window | 15–30 min local; 30–60 min/env | Secret manager; hosted approval | Presence-only readiness passes, HMAC pseudonymity remains, secret scans clean. Stop if governance rejects stable identifiers. | -| 7 | Operator config backlog | Reconcile query-hash, deep-probe, Supabase/OpenAI, project identity, and schedules using read-only presence checks before setting anything. | A2 / Operator platform | Next approved readiness window | 1–2 hours | Provider approval, env owners | Record status, never values; set only confirmed gaps; identity/readiness pass. Stop on target ambiguity or cross-env key reuse. | -| 8 | `#022` | Decide auditable BMJ reference policy, then review the ten highest-impact local WA documents. | A2 / Operator governance + Specialist | Decision-ready | 1–2 hours policy; 0.5–1 day reviews | Clinical authority; live writes/canary approval | Preserve third-party/unverified provenance; record reviewer/evidence/time/rationale. Stop after ten and remeasure debt. | -| 9 | `#051` + `#023` | Compare run `30018289898` with the scheduled 2026-07-26 canary/browser/label artifacts; disposition residuals without rerun. | A2 / Specialist evaluation | About 2026-07-27 02:00 AWST plus runtime | 2–4 hours | Approval to read hosted artifacts; no dispatch | Record tree/run, content/provider/latency, browser, and labeling outcomes. Stop without spend or archived lithium changes. | -| 10 | `#018` | Diagnose lithium, ADHD, metabolic residuals independently: table fast path, extractive budget, schedule-free selection. | A2 / Specialist clinical RAG | After 9; one mechanism at a time | 1–2 days diagnosis; fixes separate | Protected review; approved behavior canary | Each has a current-main fixture and scoped candidate; stop without deterministic repro or on individual canary regression. | -| 11 | `#029` | Re-enumerate fallback stubs and improve one demonstrated causal cluster at a time without weakening fail-closed behavior. | A2 / Specialist answer safety | After 9–10 | 0.5–1 day inventory; 1–3 days/fix | Approved answer validation | Replace historical 12/30 assumption; retain grounding/citation gates. Stop after each validated cluster or metric-gaming change. | -| 12 | `#001` | Reassess semantic reranking without changing default; enable only after accepted ambiguity comparison. | A2 / Specialist ranking | After 9 and rollout approval | 0.5–1 day plus canary review | Provider approval/budget | Keep off unless 36/36, recalls 1.0, zero case regressions, measured gain. Otherwise record keep-off decision. | -| 13 | `#033` | Decide whether governance metadata enters the LLM source block, distinguishing unknown from adverse status. | A3 / Specialist prompt governance | After 8–9 | 1–2 days plus eval | Better metadata, stable canary, provider approval | Prompt/serialization tests; no grounded-supported drop; zero citation failures. Stop on over-caveating/degradation. | -| 14 | `#024` | Separate Playwright `_rsc` interception failure from a real Safari defect. | A3 / High Next.js/WebKit | After 9’s matrix data or real Safari repro | 0.5–1 day | Device/provider check only if local ambiguity | Test-only fix needs discriminating repro and meaningful access-control assertions; keep Chromium green. | -| 15 | `#007` | Choose canonical Tools experience; align nav, redirects, sitemap, reachability. | A3 / Operator product + Standard frontend | Product decision window | 15–30 min decision; 0.5 day code | Product owner | One canonical path and intentional redirect with green route/UI tests. Stop on unresolved standalone need. | -| 16 | `#025` + SLO alerts | Select owned deploy/CI/ingestion/SLO channels; configure only those, ingestion after 4. | A2 / Operator integrations | Approved observability window | 1–3 hours/channel | Provider approval, secrets, destination owner | Mocked tests then one controlled non-PHI event/channel. Stop on missing owner or unsafe delivery. | -| 17 | Full release gate | Run release/clinical gates once against an exact candidate, not a moving branch. | A2 / High release + Operator | Before release/handoff needing full confidence | 0.5 day plus waits | Exact SHA, provider approval, heavy-command lock | All required gates recorded against one SHA; stop/classify first failure and do not repeat unchanged pass. | -| 18 | Staging provision | Provision dedicated Clinical KB staging on Supabase/Railway with isolated keys and synthetic/non-clinical data. | A2 / Operator + Specialist DB | After cost/ownership approval | 0.5–1 day | Billable provider approval, owner | Identity, tenancy, secrets, migrations, app/worker health, data boundary pass. Stop on target ambiguity or production data/key reuse. | -| 19 | Staging soak/rollback | Run documented soak and rollback rehearsal in dedicated staging. | A2 / Operator reliability | After 18 | 0.5 day plus soak | Staging and provider approval | SLO, rollback, data integrity, recovery evidence pass. Stop before production if unproven. | -| 20 | Production seed verification | Verify registry/differentials/medications non-empty before writes; seed only confirmed governed gaps. | A2 / Operator data + Specialist | Approved production window | 1–3 hours plus seed time | Correct owner/project, provider approval | Read-only proof precedes idempotent writes; stop if populated or target ambiguous. | -| 21 | `#011` | Switch Auth DB cap to percentage immediately before first compute scale-up. | A3 / Operator capacity | Scale-up trigger only | 30–60 min plus soak | Dashboard, planned scale-up, approval | Target only `sjrfecxgysukkwxsowpy`; record before/after and advisor/health recheck. Do not create/use staging for this task. | -| 22 | `#017` | Capture reproducible mobile/desktop production LCP, INP, CLS before performance work. | A3 / High web performance | Before 26; approved live window | 1–2 hours | Live-site approval; record route/build/throttle | Record metrics and accept/reject decision. Stop if acceptable or too noisy. | -| 23 | `#037` | Decide whether routine supported claims cap at medium trust. | A3 / Operator clinical-product + Standard frontend | Next trust-policy review | 30–60 min decision; up to 0.5 day code | Clinical/product authority | Record policy; if accepted, change flag/render expectations only and run focused tests. Stop without owner acceptance. | -| 24 | `#027` | Add uptime monitor outside GitHub/Railway only if service, budget, responder justified. | Optional / Operator SRE | Owned external-alert trigger | 1–2 hours | Vendor/privacy/owner/provider approval | Controlled non-PHI failure/recovery alerts. Stop without responder or if current monitoring accepted. | -| 25 | `#028` | Define vendor/region/retention/redaction/sampling/maps/owner before runtime error tracking. | Optional / Specialist privacy + Operator | After privacy/ownership/cost approval | 1–3 days | Privacy and provider approval | Redaction tests exclude clinical data/IDs/secrets; one non-sensitive event arrives. Stop if envelope unacceptable. | -| 26 | `#012` + `#013` + `#016` | Measure before one bundle/runtime/motion target: differentials index, catalogue chunk, prod mockup exclusion, static shell, sidebar, Therapy Compass, dialogs. | A3 / High Next.js performance | After 22 or equivalent evidence; one target | 0.5–3 days/target | Measured target, Next.js guide, UI verification | Define before/after metric, preserve behavior, run analysis/focused/`verify:cheap`/browser. Stop if gain small. | -| 27 | `#040` | Add small stable visual-regression baselines with owner/update workflow. | Optional / High visual QA | Stable surfaces and owner | 1–2 days | Stable browser, owner | Low-flake repeat runs and documented updates. Stop before blocking if churn high. | -| 28 | `#038` | Define shared comparison interaction contract before another comparison surface; keep clinical content mode-specific. | Optional / High design-system | Approved new comparison surface | 0.5–1 day | Concrete surface, product/design owner | Inventory patterns and make shared behavior testable. Stop if no new surface. | -| 29 | `#009` | Decide whether `/api/jobs` is intentional ops-only; document/test or remove. | A3 / Standard API ownership | Next API maintenance | 1–2 hours | Product/ops owner | Record owner/contract or remove unused route/tests; focused tests + `verify:cheap`. Stop if external consumers unclear. | -| 30 | `#035` | Expand conflict detection only for concrete clinically reviewed class with positive/negative fixtures. | A3 / Specialist evidence rules | Demonstrated missed conflict | 0.5–1 day design; code separate | Clinical review; provider approval only for live validation | Fixtures discriminate class without unrelated warnings. Stop if no bounded class. | -| 31 | `#036` | Decide explicit public-visibility flag vs `owner_id IS NULL` plus warning before any visibility migration. | A3 / Specialist tenancy/RLS | Before visibility/public-corpus migration | 2–4 hours decision | Security/clinical review; migration approval if adopted | Compare threat model/migration/rollback. Stop without schema if current control preferred. | -| 32 | `#039` | Converge repeated catalogue toolbar behavior only during a concrete toolbar project. | Optional / High frontend architecture | Concrete project | 0.5–1 day inventory; 1–3 days code | Product/design owner, UI verification | Prove shared behavior without flattening search semantics; stop after bounded contract. | -| 33 | `#010` | Wire a disabled Forms/Favourites placeholder only when its feature is selected. | Optional / Standard frontend-product | Per approved feature; no work now | 0.5–2 days/feature | Product scope/data contract | Action works with UI/a11y coverage. Do not batch-build unrequested placeholders. | -| 34 | `#041` | Extend Easy Read/Standard Factsheets for future patient content; no second patient mode. | Optional / High content/a11y/governance | Concrete need + source plan | 0.5–2 days/increment | Product/content/governance | Extend/test existing contracts. Stop if need/source undefined. | -| 35 | `#021` | Revisit conservative generation discards only for measured latency/waste or cheaper mechanism. | Optional / Specialist quality/cost | Evidence trigger only | 2–4 hours diagnosis; 1–2 days/candidate | Evidence and approved provider budget | Reduce cost/latency without weaker gates. Stop if cost/benefit remains poor. | +Last reconciled on **2026-07-24** against fetched `origin/main` +`1eed39ed2b43509634a8d745d75a6956edb60e83`. No live application or provider state was queried. +Revalidate the referenced evidence against current `main` immediately before starting a row. + +| Order | Source | Recommended outcome / next action | Acuity / capability | When | Active effort | Dependencies / approval | Done, verification, and stop rule | +| ----: | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- | ----------------------------------------------------------- | -------------------------------------- | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| 1 | `#053` | Align the Safety Plan Generator with the repository's no-patient-data contract before real-patient use. | A1 / Specialist privacy + clinical | Ready; first | 3–5 hours | Privacy/clinical owner | Copy, behavior, print, and tests agree; no identifier is persisted/transmitted without an approved basis. Run focused UI/privacy/a11y checks, `verify:cheap`, production-readiness. Stop before adding storage/provider flow. | +| 2 | `#054` | Fail closed when answer relevance metadata is absent; add the red policy test, then make the smallest render-policy correction. | A2 / Specialist clinical safety | Ready; after `#053` | 2–4 hours | Local/offline | Missing and explicit-false relevance are conservative; explicit source-backed behavior is unchanged. Run focused policy/provenance tests, `verify:cheap`, production-readiness. Stop before retrieval/ranking/generation. | +| 3 | `#052` | Prevent full/retry reindex overlapping a fresh agent-enrichment lease; add red single/bulk tests, then reuse `hasActiveAgentEnrichmentJob` before mutation. | A2 / High concurrency | Ready; after `#054` | 0.5–1 day | Local/offline | Fresh processing leases conflict; stale leases and enrichment mode retain behavior. Run focused route/safety tests, `verify:cheap`, production-readiness. Stop if current `main` does not reproduce it. | +| 4 | `#055` | Recover aged `queued` documents that have no open ingestion job; begin with a stranded-row reproducer and the smallest idempotent owner-scoped recovery path. | A2 / Specialist queue reliability | Ready; after `#052` | 0.5–1.5 days | Local replay for schema/scheduling; hosted changes need approval | Exactly one recoverable job is created under crash/concurrency/repeat; fresh queues and open jobs are untouched. Run focused recovery/schema tests, disposable replay if needed, `verify:cheap`, production-readiness. Stop if safe age/ownership cannot be proven. | +| 5 | `#030` | Require distinct source identities for distinct expected comparison slots; begin with a red shared-title/two-expectation test. | A2 / High evaluation semantics | Decision-ready; code only after owner choice | 2–4 hours | Local/offline; protected-eval review | One source cannot satisfy both slots; existing cases stay green. Run focused matching, typecheck, `verify:cheap`. Stop before alias/retrieval/ranking changes. | +| 6 | `#019` | Prove admission evidence is lost at the comparison fallback boundary; scope the smallest correction without automatically shipping it. | A2 / Specialist RAG | Reproducer now; behavior after `#051`/`#023` | 0.5–1 day; fix separate | Protected review; approved baseline/post canary for behavior | Reproducer fails while packing retains both sources. Stop without behavior change if the boundary defect is not independently reproducible. | +| 7 | Privacy/legal package | Execute OpenAI/Railway DPAs; decide ZDR/residency; obtain cache/subprocessor answers and APP 8 plus APP 5/1 counsel sign-off. | A2 / Operator legal/privacy | Start now; before real-patient use/privacy-approved release | 4–8 hours internal; 1–6 weeks elapsed | Signers, counsel, providers | Record countersigned evidence, IDs, dates, decisions, and approved wording in PIA/cross-border docs. Stop before public-copy changes without counsel. | +| 8 | Safety identifier config | Set a unique 32+ character `OPENAI_SAFETY_IDENTIFIER_SECRET` per environment with `OPENAI_API_KEY`, never in Git/output. | A2 / Standard local + Operator hosted | Local now; hosted approved window | 15–30 min local; 30–60 min/env | Secret manager; hosted approval | Presence-only readiness passes, HMAC pseudonymity remains, secret scans clean. Stop if governance rejects stable identifiers. | +| 9 | Operator config backlog | Reconcile query-hash, deep-probe, Supabase/OpenAI, project identity, and schedules using read-only presence checks before setting anything. | A2 / Operator platform | Next approved readiness window | 1–2 hours | Provider approval, env owners | Record status, never values; set only confirmed gaps; identity/readiness pass. Stop on target ambiguity or cross-env key reuse. | +| 10 | `#022` | Decide auditable BMJ reference policy, then review the ten highest-impact local WA documents. | A2 / Operator governance + Specialist | Decision-ready | 1–2 hours policy; 0.5–1 day reviews | Clinical authority; live writes/canary approval | Preserve third-party/unverified provenance; record reviewer/evidence/time/rationale. Stop after ten and remeasure debt. | +| 11 | `#051` + `#023` | Compare run `30018289898` with the scheduled 2026-07-26 canary/browser/label artifacts; disposition residuals without rerun. | A2 / Specialist evaluation | About 2026-07-27 02:00 AWST plus runtime | 2–4 hours | Approval to read hosted artifacts; no dispatch | Record tree/run, content/provider/latency, browser, and labeling outcomes. Stop without spend or archived lithium changes. | +| 12 | `#018` | Diagnose lithium, ADHD, metabolic residuals independently: table fast path, extractive budget, schedule-free selection. | A2 / Specialist clinical RAG | After `#051`/`#023`; one mechanism at a time | 1–2 days diagnosis; fixes separate | Protected review; approved behavior canary | Each has a current-main fixture and scoped candidate; stop without deterministic repro or on individual canary regression. | +| 13 | `#001` | Reassess semantic reranking without changing default; enable only after accepted ambiguity comparison. | A2 / Specialist ranking | After `#051`/`#023` and rollout approval | 0.5–1 day plus canary review | Provider approval/budget | Keep off unless 36/36, recalls 1.0, zero case regressions, measured gain. Otherwise record keep-off decision. | +| 14 | `#033` | Decide whether governance metadata enters the LLM source block, distinguishing unknown from adverse status. | A3 / Specialist prompt governance | After `#022` and `#051`/`#023` | 1–2 days plus eval | Better metadata, stable canary, provider approval | Prompt/serialization tests; no grounded-supported drop; zero citation failures. Stop on over-caveating/degradation. | +| 15 | `#024` | Separate Playwright `_rsc` interception failure from a real Safari defect. | A3 / High Next.js/WebKit | After scheduled matrix data or real Safari repro | 0.5–1 day | Device/provider check only if local ambiguity | Test-only fix needs discriminating repro and meaningful access-control assertions; keep Chromium green. | +| 16 | `#007` | Choose canonical Tools experience; align nav, redirects, sitemap, reachability. | A3 / Operator product + Standard frontend | Product decision window | 15–30 min decision; 0.5 day code | Product owner | One canonical path and intentional redirect with green route/UI tests. Stop on unresolved standalone need. | +| 17 | `#025` + SLO alerts | Select owned deploy/CI/ingestion/SLO channels; configure only those, ingestion after `#055`. | A2 / Operator integrations | Approved observability window | 1–3 hours/channel | Provider approval, secrets, destination owner | Mocked tests then one controlled non-PHI event/channel. Stop on missing owner or unsafe delivery. | +| 18 | Full release gate | Run release/clinical gates once against an exact candidate, not a moving branch. | A2 / High release + Operator | Before release/handoff needing full confidence | 0.5 day plus waits | Exact SHA, provider approval, heavy-command lock | All required gates recorded against one SHA; stop/classify first failure and do not repeat unchanged pass. | +| 19 | Staging provision | Provision dedicated Clinical KB staging on Supabase/Railway with isolated keys and synthetic/non-clinical data. | A2 / Operator + Specialist DB | After cost/ownership approval | 0.5–1 day | Billable provider approval, owner | Identity, tenancy, secrets, migrations, app/worker health, data boundary pass. Stop on target ambiguity or production data/key reuse. | +| 20 | Staging soak/rollback | Run documented soak and rollback rehearsal in dedicated staging. | A2 / Operator reliability | After staging provision | 0.5 day plus soak | Staging and provider approval | SLO, rollback, data integrity, recovery evidence pass. Stop before production if unproven. | +| 21 | Production seed verification | Verify registry/differentials/medications non-empty before writes; seed only confirmed governed gaps. | A2 / Operator data + Specialist | Approved production window | 1–3 hours plus seed time | Correct owner/project, provider approval | Read-only proof precedes idempotent writes; stop if populated or target ambiguous. | +| 22 | `#011` | Switch Auth DB cap to percentage immediately before first compute scale-up. | A3 / Operator capacity | Scale-up trigger only | 30–60 min plus soak | Dashboard, planned scale-up, approval | Target only `sjrfecxgysukkwxsowpy`; record before/after and advisor/health recheck. Do not create/use staging for this task. | +| 23 | `#017` | Capture reproducible mobile/desktop production LCP, INP, CLS before performance work. | A3 / High web performance | Before `#012`/`#013`; approved live window | 1–2 hours | Live-site approval; record route/build/throttle | Record metrics and accept/reject decision. Stop if acceptable or too noisy. | +| 24 | `#037` | Decide whether routine supported claims cap at medium trust. | A3 / Operator clinical-product + Standard frontend | Next trust-policy review | 30–60 min decision; up to 0.5 day code | Clinical/product authority | Record policy; if accepted, change flag/render expectations only and run focused tests. Stop without owner acceptance. | +| 25 | `#027` | Add uptime monitor outside GitHub/Railway only if service, budget, responder justified. | Optional / Operator SRE | Owned external-alert trigger | 1–2 hours | Vendor/privacy/owner/provider approval | Controlled non-PHI failure/recovery alerts. Stop without responder or if current monitoring accepted. | +| 26 | `#028` | Define vendor/region/retention/redaction/sampling/maps/owner before runtime error tracking. | Optional / Specialist privacy + Operator | After privacy/ownership/cost approval | 1–3 days | Privacy and provider approval | Redaction tests exclude clinical data/IDs/secrets; one non-sensitive event arrives. Stop if envelope unacceptable. | +| 27 | `#012` + `#013` | Re-measure route payloads and slim only one production route with a demonstrated budget problem; ignore mockup-only code unless it enters production. | A3 / High Next.js performance | After `#017` or equivalent evidence; one route | 0.5–2 days/route | Measured target, Next.js guide, UI verification | Demonstrate a material parsed/gzip or interaction gain with unchanged behavior; run analysis, focused tests, `verify:cheap`, browser smoke. Stop if gain is small. | +| 28 | `#040` | Add small stable visual-regression baselines with owner/update workflow. | Optional / High visual QA | Stable surfaces and owner | 1–2 days | Stable browser, owner | Low-flake repeat runs and documented updates. Stop before blocking if churn high. | +| 29 | `#038` | Define shared comparison interaction contract before another comparison surface; keep clinical content mode-specific. | Optional / High design-system | Approved new comparison surface | 0.5–1 day | Concrete surface, product/design owner | Inventory patterns and make shared behavior testable. Stop if no new surface. | +| 30 | `#035` | Expand conflict detection only for concrete clinically reviewed class with positive/negative fixtures. | A3 / Specialist evidence rules | Demonstrated missed conflict | 0.5–1 day design; code separate | Clinical review; provider approval only for live validation | Fixtures discriminate class without unrelated warnings. Stop if no bounded class. | +| 31 | `#039` | Converge repeated catalogue toolbar behavior only during a concrete toolbar project. | Optional / High frontend architecture | Concrete project | 0.5–1 day inventory; 1–3 days code | Product/design owner, UI verification | Prove shared behavior without flattening search semantics; stop after bounded contract. | +| 32 | `#056` | Write a product/privacy/persistence brief for “Current Clinical Work” before any storage or UI implementation. | A3 / High product architecture + privacy | Only when the product owner wants to evaluate the feature | 0.5–1 day | Product owner, privacy/retention decision, evidence of demand | Define users, data classes, lifecycle, cross-device expectations, deletion, failure states, and a smallest testable slice. Stop if demand or safe persistence cannot be established. | ### Queue maintenance @@ -94,7 +95,7 @@ executable item below it. 3. Treat provider status as a claim: verify only after approval and never store secret values. 4. Close/reclassify when a success or stop condition is met; do not preserve work for its own sake. - + ## Open items @@ -107,6 +108,10 @@ executable item below it. | #051 | P2 | task | Stabilise the live answer-quality canary before more RAG tuning | Diagnostics landed in PR #1095: structured JSON/Markdown artifacts now record the actual checked-out SHA, run identity and latency context, and the offline trend tool separates content, provider-route and latency outcomes. First validating run `30018289898` recorded the expected tree and cost, with 36/36 retrieval green, but one report cannot establish variability; PR #1097 prevents a single failure being mislabeled as repeated. Next: compare the scheduled 2026-07-26 structured report with this run. Do not spend on an immediate retry or reapply the archived lithium guard before that comparison. | PR #1095; run `30018289898`; PR #1097; archive ref `refs/archive/rejected-rag/20260723/monitoring-subject-gate` | 2026-07-23 | | #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 | | #052 | P2 | issue | Reindex can overlap a fresh agent-enrichment pass | Full/retry reindex preflights check `ingestion_jobs` but do not call the existing `hasActiveAgentEnrichmentJob`. A fresh `indexing_v3_agent_jobs.status='processing'` lease can therefore overlap destructive artifact work. Extend single and bulk full/retry preflights before mutation; keep stale leases non-blocking and preserve enrichment-mode behavior. | `src/lib/ingestion-mutation-safety.ts:116-159`; single/bulk reindex routes; ingestion audit 2026-07-24 | 2026-07-24 | +| #053 | P1 | issue | Safety Plan Generator contradicts the privacy contract | **Outcome:** the tool, privacy notice, PIA, and tests agree on whether patient identifiers may be entered, copied, printed, or saved. `patient-safety-plan.tsx` asks for “Patient (name or initials)” and produces a patient copy, while `/privacy` and the PIA say the product does not ask for patient data. **Next:** obtain a privacy/clinical decision, then default to identifier-free behavior unless transient identifier processing is explicitly approved and documented. **Success:** no contradictory copy; no identifier is persisted or transmitted without an approved basis. **Verify:** focused component/privacy/copy/accessibility tests, browser print/copy smoke, `verify:cheap`, production-readiness. **Stop:** any new storage or provider transmission requires a separate review. | `src/components/patient-safety-plan.tsx:649`; `src/app/privacy/page.tsx:28`; `docs/privacy-impact-assessment.md:18` | 2026-07-24 | +| #054 | P2 | issue | Missing answer relevance metadata is treated as source-backed | **Outcome:** absent `relevance` metadata renders conservatively. `RagAnswer.relevance` is optional, but `relevance?.isSourceBacked !== false` treats `undefined` as source-backed. **Next:** add the red render-policy test, then make the smallest policy-only fix. **Success:** missing and explicit-false relevance fail closed; explicit source-backed relevance is unchanged. **Verify:** focused answer-render-policy, provenance, clinical-safety, `verify:cheap`, production-readiness. **Stop:** do not expand into retrieval, ranking, or generation. | `src/lib/types.ts:1029`; `src/lib/answer-render-policy.ts:145` | 2026-07-24 | +| #055 | P2 | issue | Upload crash can strand a queued document without a job | **Outcome:** a crash between document and job creation cannot strand an upload indefinitely. **Next:** add the stranded-row reproducer, then choose the smallest idempotent atomic-enqueue RPC or bounded scheduled sweep consistent with current ownership and rollback contracts. **Success:** exactly one recoverable job is created; existing open jobs do not duplicate; owner scope, retry, audit, and rollback remain intact. **Verify:** focused upload/recovery/schema tests, migration guards, disposable replay if needed, `verify:cheap`, production-readiness. **Stop:** hosted changes require approval, and no at-least-once claim is valid until the crash case passes. | `src/app/api/upload/route.ts`; `docs/webhooks.md:163-192` | 2026-07-24 | +| #056 | P3 | rec | Define “Current Clinical Work” before implementation | **Outcome:** decide whether a workspace combining saved comparisons, partial formulation work, recent tools, and pinned source sets is worth building. **Next:** write a product/privacy/persistence brief only; do not build storage or UI. **Success:** the brief defines users, data classes, lifecycle, cross-device expectations, deletion, failure states, evidence of demand, and the smallest testable slice. **Stop:** close the idea if demand or safe persistence cannot be established. | session 2026-07-24; `src/lib/tools-catalog.ts:253-262` | 2026-07-24 | | #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 | | #007 | P3 | rec | `/tools` vs `/?mode=tools` parallel Tools entry points | `/tools` (standalone `ApplicationsLauncherPage`) has no inbound in-app link; the sidebar Tools item uses `/?mode=tools`. Decide the canonical entry point and wire nav consistently, or drop the standalone `/tools` page + `/applications` redirect. Currently allowlisted in `tests/route-reachability.test.ts`. | `src/app/tools/page.tsx`; `src/app/applications/route.ts` | 2026-07-21 | | #009 | P3 | rec | Confirm `/api/jobs` is intentionally server/ops-only | No client `fetch()` reaches `/api/jobs` (only tests import it). Confirm it is a deliberate ops/manual surface; if abandoned, remove it. | `src/app/api/jobs/route.ts` | 2026-07-21 | From a1d69b1bd9acf2bb9139af53acf24bfe225b9c6c Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:25:06 +0800 Subject: [PATCH 04/13] docs: track exposed credential containment --- docs/outstanding-issues.md | 74 +++++++++++++++++++------------------- 1 file changed, 38 insertions(+), 36 deletions(-) diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index c8817f63e..cf9cbc369 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -33,7 +33,7 @@ criteria, stop rules, and resolution history. Do not create or maintain a second ## Execution scales -- **A1 urgent:** active safety/privacy/data-loss/release blocker; `#053` is the current A1 item. +- **A1 urgent:** active safety/privacy/data-loss/release blocker; `#057` and `#053` are the current A1 items. - **A2 important:** confirmed correctness, clinical, privacy, reliability, or evaluation-integrity work that leads its available lane. - **A3 planned:** worthwhile work deferred to its stated trigger. @@ -52,40 +52,41 @@ Last reconciled on **2026-07-24** against fetched `origin/main` `1eed39ed2b43509634a8d745d75a6956edb60e83`. No live application or provider state was queried. Revalidate the referenced evidence against current `main` immediately before starting a row. -| Order | Source | Recommended outcome / next action | Acuity / capability | When | Active effort | Dependencies / approval | Done, verification, and stop rule | -| ----: | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- | ----------------------------------------------------------- | -------------------------------------- | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| 1 | `#053` | Align the Safety Plan Generator with the repository's no-patient-data contract before real-patient use. | A1 / Specialist privacy + clinical | Ready; first | 3–5 hours | Privacy/clinical owner | Copy, behavior, print, and tests agree; no identifier is persisted/transmitted without an approved basis. Run focused UI/privacy/a11y checks, `verify:cheap`, production-readiness. Stop before adding storage/provider flow. | -| 2 | `#054` | Fail closed when answer relevance metadata is absent; add the red policy test, then make the smallest render-policy correction. | A2 / Specialist clinical safety | Ready; after `#053` | 2–4 hours | Local/offline | Missing and explicit-false relevance are conservative; explicit source-backed behavior is unchanged. Run focused policy/provenance tests, `verify:cheap`, production-readiness. Stop before retrieval/ranking/generation. | -| 3 | `#052` | Prevent full/retry reindex overlapping a fresh agent-enrichment lease; add red single/bulk tests, then reuse `hasActiveAgentEnrichmentJob` before mutation. | A2 / High concurrency | Ready; after `#054` | 0.5–1 day | Local/offline | Fresh processing leases conflict; stale leases and enrichment mode retain behavior. Run focused route/safety tests, `verify:cheap`, production-readiness. Stop if current `main` does not reproduce it. | -| 4 | `#055` | Recover aged `queued` documents that have no open ingestion job; begin with a stranded-row reproducer and the smallest idempotent owner-scoped recovery path. | A2 / Specialist queue reliability | Ready; after `#052` | 0.5–1.5 days | Local replay for schema/scheduling; hosted changes need approval | Exactly one recoverable job is created under crash/concurrency/repeat; fresh queues and open jobs are untouched. Run focused recovery/schema tests, disposable replay if needed, `verify:cheap`, production-readiness. Stop if safe age/ownership cannot be proven. | -| 5 | `#030` | Require distinct source identities for distinct expected comparison slots; begin with a red shared-title/two-expectation test. | A2 / High evaluation semantics | Decision-ready; code only after owner choice | 2–4 hours | Local/offline; protected-eval review | One source cannot satisfy both slots; existing cases stay green. Run focused matching, typecheck, `verify:cheap`. Stop before alias/retrieval/ranking changes. | -| 6 | `#019` | Prove admission evidence is lost at the comparison fallback boundary; scope the smallest correction without automatically shipping it. | A2 / Specialist RAG | Reproducer now; behavior after `#051`/`#023` | 0.5–1 day; fix separate | Protected review; approved baseline/post canary for behavior | Reproducer fails while packing retains both sources. Stop without behavior change if the boundary defect is not independently reproducible. | -| 7 | Privacy/legal package | Execute OpenAI/Railway DPAs; decide ZDR/residency; obtain cache/subprocessor answers and APP 8 plus APP 5/1 counsel sign-off. | A2 / Operator legal/privacy | Start now; before real-patient use/privacy-approved release | 4–8 hours internal; 1–6 weeks elapsed | Signers, counsel, providers | Record countersigned evidence, IDs, dates, decisions, and approved wording in PIA/cross-border docs. Stop before public-copy changes without counsel. | -| 8 | Safety identifier config | Set a unique 32+ character `OPENAI_SAFETY_IDENTIFIER_SECRET` per environment with `OPENAI_API_KEY`, never in Git/output. | A2 / Standard local + Operator hosted | Local now; hosted approved window | 15–30 min local; 30–60 min/env | Secret manager; hosted approval | Presence-only readiness passes, HMAC pseudonymity remains, secret scans clean. Stop if governance rejects stable identifiers. | -| 9 | Operator config backlog | Reconcile query-hash, deep-probe, Supabase/OpenAI, project identity, and schedules using read-only presence checks before setting anything. | A2 / Operator platform | Next approved readiness window | 1–2 hours | Provider approval, env owners | Record status, never values; set only confirmed gaps; identity/readiness pass. Stop on target ambiguity or cross-env key reuse. | -| 10 | `#022` | Decide auditable BMJ reference policy, then review the ten highest-impact local WA documents. | A2 / Operator governance + Specialist | Decision-ready | 1–2 hours policy; 0.5–1 day reviews | Clinical authority; live writes/canary approval | Preserve third-party/unverified provenance; record reviewer/evidence/time/rationale. Stop after ten and remeasure debt. | -| 11 | `#051` + `#023` | Compare run `30018289898` with the scheduled 2026-07-26 canary/browser/label artifacts; disposition residuals without rerun. | A2 / Specialist evaluation | About 2026-07-27 02:00 AWST plus runtime | 2–4 hours | Approval to read hosted artifacts; no dispatch | Record tree/run, content/provider/latency, browser, and labeling outcomes. Stop without spend or archived lithium changes. | -| 12 | `#018` | Diagnose lithium, ADHD, metabolic residuals independently: table fast path, extractive budget, schedule-free selection. | A2 / Specialist clinical RAG | After `#051`/`#023`; one mechanism at a time | 1–2 days diagnosis; fixes separate | Protected review; approved behavior canary | Each has a current-main fixture and scoped candidate; stop without deterministic repro or on individual canary regression. | -| 13 | `#001` | Reassess semantic reranking without changing default; enable only after accepted ambiguity comparison. | A2 / Specialist ranking | After `#051`/`#023` and rollout approval | 0.5–1 day plus canary review | Provider approval/budget | Keep off unless 36/36, recalls 1.0, zero case regressions, measured gain. Otherwise record keep-off decision. | -| 14 | `#033` | Decide whether governance metadata enters the LLM source block, distinguishing unknown from adverse status. | A3 / Specialist prompt governance | After `#022` and `#051`/`#023` | 1–2 days plus eval | Better metadata, stable canary, provider approval | Prompt/serialization tests; no grounded-supported drop; zero citation failures. Stop on over-caveating/degradation. | -| 15 | `#024` | Separate Playwright `_rsc` interception failure from a real Safari defect. | A3 / High Next.js/WebKit | After scheduled matrix data or real Safari repro | 0.5–1 day | Device/provider check only if local ambiguity | Test-only fix needs discriminating repro and meaningful access-control assertions; keep Chromium green. | -| 16 | `#007` | Choose canonical Tools experience; align nav, redirects, sitemap, reachability. | A3 / Operator product + Standard frontend | Product decision window | 15–30 min decision; 0.5 day code | Product owner | One canonical path and intentional redirect with green route/UI tests. Stop on unresolved standalone need. | -| 17 | `#025` + SLO alerts | Select owned deploy/CI/ingestion/SLO channels; configure only those, ingestion after `#055`. | A2 / Operator integrations | Approved observability window | 1–3 hours/channel | Provider approval, secrets, destination owner | Mocked tests then one controlled non-PHI event/channel. Stop on missing owner or unsafe delivery. | -| 18 | Full release gate | Run release/clinical gates once against an exact candidate, not a moving branch. | A2 / High release + Operator | Before release/handoff needing full confidence | 0.5 day plus waits | Exact SHA, provider approval, heavy-command lock | All required gates recorded against one SHA; stop/classify first failure and do not repeat unchanged pass. | -| 19 | Staging provision | Provision dedicated Clinical KB staging on Supabase/Railway with isolated keys and synthetic/non-clinical data. | A2 / Operator + Specialist DB | After cost/ownership approval | 0.5–1 day | Billable provider approval, owner | Identity, tenancy, secrets, migrations, app/worker health, data boundary pass. Stop on target ambiguity or production data/key reuse. | -| 20 | Staging soak/rollback | Run documented soak and rollback rehearsal in dedicated staging. | A2 / Operator reliability | After staging provision | 0.5 day plus soak | Staging and provider approval | SLO, rollback, data integrity, recovery evidence pass. Stop before production if unproven. | -| 21 | Production seed verification | Verify registry/differentials/medications non-empty before writes; seed only confirmed governed gaps. | A2 / Operator data + Specialist | Approved production window | 1–3 hours plus seed time | Correct owner/project, provider approval | Read-only proof precedes idempotent writes; stop if populated or target ambiguous. | -| 22 | `#011` | Switch Auth DB cap to percentage immediately before first compute scale-up. | A3 / Operator capacity | Scale-up trigger only | 30–60 min plus soak | Dashboard, planned scale-up, approval | Target only `sjrfecxgysukkwxsowpy`; record before/after and advisor/health recheck. Do not create/use staging for this task. | -| 23 | `#017` | Capture reproducible mobile/desktop production LCP, INP, CLS before performance work. | A3 / High web performance | Before `#012`/`#013`; approved live window | 1–2 hours | Live-site approval; record route/build/throttle | Record metrics and accept/reject decision. Stop if acceptable or too noisy. | -| 24 | `#037` | Decide whether routine supported claims cap at medium trust. | A3 / Operator clinical-product + Standard frontend | Next trust-policy review | 30–60 min decision; up to 0.5 day code | Clinical/product authority | Record policy; if accepted, change flag/render expectations only and run focused tests. Stop without owner acceptance. | -| 25 | `#027` | Add uptime monitor outside GitHub/Railway only if service, budget, responder justified. | Optional / Operator SRE | Owned external-alert trigger | 1–2 hours | Vendor/privacy/owner/provider approval | Controlled non-PHI failure/recovery alerts. Stop without responder or if current monitoring accepted. | -| 26 | `#028` | Define vendor/region/retention/redaction/sampling/maps/owner before runtime error tracking. | Optional / Specialist privacy + Operator | After privacy/ownership/cost approval | 1–3 days | Privacy and provider approval | Redaction tests exclude clinical data/IDs/secrets; one non-sensitive event arrives. Stop if envelope unacceptable. | -| 27 | `#012` + `#013` | Re-measure route payloads and slim only one production route with a demonstrated budget problem; ignore mockup-only code unless it enters production. | A3 / High Next.js performance | After `#017` or equivalent evidence; one route | 0.5–2 days/route | Measured target, Next.js guide, UI verification | Demonstrate a material parsed/gzip or interaction gain with unchanged behavior; run analysis, focused tests, `verify:cheap`, browser smoke. Stop if gain is small. | -| 28 | `#040` | Add small stable visual-regression baselines with owner/update workflow. | Optional / High visual QA | Stable surfaces and owner | 1–2 days | Stable browser, owner | Low-flake repeat runs and documented updates. Stop before blocking if churn high. | -| 29 | `#038` | Define shared comparison interaction contract before another comparison surface; keep clinical content mode-specific. | Optional / High design-system | Approved new comparison surface | 0.5–1 day | Concrete surface, product/design owner | Inventory patterns and make shared behavior testable. Stop if no new surface. | -| 30 | `#035` | Expand conflict detection only for concrete clinically reviewed class with positive/negative fixtures. | A3 / Specialist evidence rules | Demonstrated missed conflict | 0.5–1 day design; code separate | Clinical review; provider approval only for live validation | Fixtures discriminate class without unrelated warnings. Stop if no bounded class. | -| 31 | `#039` | Converge repeated catalogue toolbar behavior only during a concrete toolbar project. | Optional / High frontend architecture | Concrete project | 0.5–1 day inventory; 1–3 days code | Product/design owner, UI verification | Prove shared behavior without flattening search semantics; stop after bounded contract. | -| 32 | `#056` | Write a product/privacy/persistence brief for “Current Clinical Work” before any storage or UI implementation. | A3 / High product architecture + privacy | Only when the product owner wants to evaluate the feature | 0.5–1 day | Product owner, privacy/retention decision, evidence of demand | Define users, data classes, lifecycle, cross-device expectations, deletion, failure states, and a smallest testable slice. Stop if demand or safe persistence cannot be established. | +| Order | Source | Recommended outcome / next action | Acuity / capability | When | Active effort | Dependencies / approval | Done, verification, and stop rule | +| ----: | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------- | ----------------------------------------------------------- | -------------------------------------- | -------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| 1 | `#057` | Verify provider-side containment of credentials previously exposed outside authorised stores; revoke or rotate any still-valid OpenAI, Supabase service-role/database, and E2E credentials, then update only intended secret stores. | A1 / Operator security + independent reviewer | Immediate approved security window | 1–3 hours | Credentialed provider owners; correct target identity; explicit provider and secret-store approval | Every old credential is rejected or retired; replacements exist only in intended stores; presence/readiness checks pass; no value enters Git, logs, issues, or chat. Use approved provider evidence and secret scans. Stop before provider action without approval and do not rewrite history without separate evidence. | +| 2 | `#053` | Align the Safety Plan Generator with the repository's no-patient-data contract before real-patient use. | A1 / Specialist privacy + clinical | Ready; first | 3–5 hours | Privacy/clinical owner | Copy, behavior, print, and tests agree; no identifier is persisted/transmitted without an approved basis. Run focused UI/privacy/a11y checks, `verify:cheap`, production-readiness. Stop before adding storage/provider flow. | +| 3 | `#054` | Fail closed when answer relevance metadata is absent; add the red policy test, then make the smallest render-policy correction. | A2 / Specialist clinical safety | Ready; after `#053` | 2–4 hours | Local/offline | Missing and explicit-false relevance are conservative; explicit source-backed behavior is unchanged. Run focused policy/provenance tests, `verify:cheap`, production-readiness. Stop before retrieval/ranking/generation. | +| 4 | `#052` | Prevent full/retry reindex overlapping a fresh agent-enrichment lease; add red single/bulk tests, then reuse `hasActiveAgentEnrichmentJob` before mutation. | A2 / High concurrency | Ready; after `#054` | 0.5–1 day | Local/offline | Fresh processing leases conflict; stale leases and enrichment mode retain behavior. Run focused route/safety tests, `verify:cheap`, production-readiness. Stop if current `main` does not reproduce it. | +| 5 | `#055` | Recover aged `queued` documents that have no open ingestion job; begin with a stranded-row reproducer and the smallest idempotent owner-scoped recovery path. | A2 / Specialist queue reliability | Ready; after `#052` | 0.5–1.5 days | Local replay for schema/scheduling; hosted changes need approval | Exactly one recoverable job is created under crash/concurrency/repeat; fresh queues and open jobs are untouched. Run focused recovery/schema tests, disposable replay if needed, `verify:cheap`, production-readiness. Stop if safe age/ownership cannot be proven. | +| 6 | `#030` | Require distinct source identities for distinct expected comparison slots; begin with a red shared-title/two-expectation test. | A2 / High evaluation semantics | Decision-ready; code only after owner choice | 2–4 hours | Local/offline; protected-eval review | One source cannot satisfy both slots; existing cases stay green. Run focused matching, typecheck, `verify:cheap`. Stop before alias/retrieval/ranking changes. | +| 7 | `#019` | Prove admission evidence is lost at the comparison fallback boundary; scope the smallest correction without automatically shipping it. | A2 / Specialist RAG | Reproducer now; behavior after `#051`/`#023` | 0.5–1 day; fix separate | Protected review; approved baseline/post canary for behavior | Reproducer fails while packing retains both sources. Stop without behavior change if the boundary defect is not independently reproducible. | +| 8 | Privacy/legal package | Execute OpenAI/Railway DPAs; decide ZDR/residency; obtain cache/subprocessor answers and APP 8 plus APP 5/1 counsel sign-off. | A2 / Operator legal/privacy | Start now; before real-patient use/privacy-approved release | 4–8 hours internal; 1–6 weeks elapsed | Signers, counsel, providers | Record countersigned evidence, IDs, dates, decisions, and approved wording in PIA/cross-border docs. Stop before public-copy changes without counsel. | +| 9 | Safety identifier config | Set a unique 32+ character `OPENAI_SAFETY_IDENTIFIER_SECRET` per environment with `OPENAI_API_KEY`, never in Git/output. | A2 / Standard local + Operator hosted | Local now; hosted approved window | 15–30 min local; 30–60 min/env | Secret manager; hosted approval | Presence-only readiness passes, HMAC pseudonymity remains, secret scans clean. Stop if governance rejects stable identifiers. | +| 10 | Operator config backlog | Reconcile query-hash, deep-probe, Supabase/OpenAI, project identity, and schedules using read-only presence checks before setting anything. | A2 / Operator platform | Next approved readiness window | 1–2 hours | Provider approval, env owners | Record status, never values; set only confirmed gaps; identity/readiness pass. Stop on target ambiguity or cross-env key reuse. | +| 11 | `#022` | Decide auditable BMJ reference policy, then review the ten highest-impact local WA documents. | A2 / Operator governance + Specialist | Decision-ready | 1–2 hours policy; 0.5–1 day reviews | Clinical authority; live writes/canary approval | Preserve third-party/unverified provenance; record reviewer/evidence/time/rationale. Stop after ten and remeasure debt. | +| 12 | `#051` + `#023` | Compare run `30018289898` with the scheduled 2026-07-26 canary/browser/label artifacts; disposition residuals without rerun. | A2 / Specialist evaluation | About 2026-07-27 02:00 AWST plus runtime | 2–4 hours | Approval to read hosted artifacts; no dispatch | Record tree/run, content/provider/latency, browser, and labeling outcomes. Stop without spend or archived lithium changes. | +| 13 | `#018` | Diagnose lithium, ADHD, metabolic residuals independently: table fast path, extractive budget, schedule-free selection. | A2 / Specialist clinical RAG | After `#051`/`#023`; one mechanism at a time | 1–2 days diagnosis; fixes separate | Protected review; approved behavior canary | Each has a current-main fixture and scoped candidate; stop without deterministic repro or on individual canary regression. | +| 14 | `#001` | Reassess semantic reranking without changing default; enable only after accepted ambiguity comparison. | A2 / Specialist ranking | After `#051`/`#023` and rollout approval | 0.5–1 day plus canary review | Provider approval/budget | Keep off unless 36/36, recalls 1.0, zero case regressions, measured gain. Otherwise record keep-off decision. | +| 15 | `#033` | Decide whether governance metadata enters the LLM source block, distinguishing unknown from adverse status. | A3 / Specialist prompt governance | After `#022` and `#051`/`#023` | 1–2 days plus eval | Better metadata, stable canary, provider approval | Prompt/serialization tests; no grounded-supported drop; zero citation failures. Stop on over-caveating/degradation. | +| 16 | `#024` | Separate Playwright `_rsc` interception failure from a real Safari defect. | A3 / High Next.js/WebKit | After scheduled matrix data or real Safari repro | 0.5–1 day | Device/provider check only if local ambiguity | Test-only fix needs discriminating repro and meaningful access-control assertions; keep Chromium green. | +| 17 | `#007` | Choose canonical Tools experience; align nav, redirects, sitemap, reachability. | A3 / Operator product + Standard frontend | Product decision window | 15–30 min decision; 0.5 day code | Product owner | One canonical path and intentional redirect with green route/UI tests. Stop on unresolved standalone need. | +| 18 | `#025` + SLO alerts | Select owned deploy/CI/ingestion/SLO channels; configure only those, ingestion after `#055`. | A2 / Operator integrations | Approved observability window | 1–3 hours/channel | Provider approval, secrets, destination owner | Mocked tests then one controlled non-PHI event/channel. Stop on missing owner or unsafe delivery. | +| 19 | Full release gate | Run release/clinical gates once against an exact candidate, not a moving branch. | A2 / High release + Operator | Before release/handoff needing full confidence | 0.5 day plus waits | Exact SHA, provider approval, heavy-command lock | All required gates recorded against one SHA; stop/classify first failure and do not repeat unchanged pass. | +| 20 | Staging provision | Provision dedicated Clinical KB staging on Supabase/Railway with isolated keys and synthetic/non-clinical data. | A2 / Operator + Specialist DB | After cost/ownership approval | 0.5–1 day | Billable provider approval, owner | Identity, tenancy, secrets, migrations, app/worker health, data boundary pass. Stop on target ambiguity or production data/key reuse. | +| 21 | Staging soak/rollback | Run documented soak and rollback rehearsal in dedicated staging. | A2 / Operator reliability | After staging provision | 0.5 day plus soak | Staging and provider approval | SLO, rollback, data integrity, recovery evidence pass. Stop before production if unproven. | +| 22 | Production seed verification | Verify registry/differentials/medications non-empty before writes; seed only confirmed governed gaps. | A2 / Operator data + Specialist | Approved production window | 1–3 hours plus seed time | Correct owner/project, provider approval | Read-only proof precedes idempotent writes; stop if populated or target ambiguous. | +| 23 | `#011` | Switch Auth DB cap to percentage immediately before first compute scale-up. | A3 / Operator capacity | Scale-up trigger only | 30–60 min plus soak | Dashboard, planned scale-up, approval | Target only `sjrfecxgysukkwxsowpy`; record before/after and advisor/health recheck. Do not create/use staging for this task. | +| 24 | `#017` | Capture reproducible mobile/desktop production LCP, INP, CLS before performance work. | A3 / High web performance | Before `#012`/`#013`; approved live window | 1–2 hours | Live-site approval; record route/build/throttle | Record metrics and accept/reject decision. Stop if acceptable or too noisy. | +| 25 | `#037` | Decide whether routine supported claims cap at medium trust. | A3 / Operator clinical-product + Standard frontend | Next trust-policy review | 30–60 min decision; up to 0.5 day code | Clinical/product authority | Record policy; if accepted, change flag/render expectations only and run focused tests. Stop without owner acceptance. | +| 26 | `#027` | Add uptime monitor outside GitHub/Railway only if service, budget, responder justified. | Optional / Operator SRE | Owned external-alert trigger | 1–2 hours | Vendor/privacy/owner/provider approval | Controlled non-PHI failure/recovery alerts. Stop without responder or if current monitoring accepted. | +| 27 | `#028` | Define vendor/region/retention/redaction/sampling/maps/owner before runtime error tracking. | Optional / Specialist privacy + Operator | After privacy/ownership/cost approval | 1–3 days | Privacy and provider approval | Redaction tests exclude clinical data/IDs/secrets; one non-sensitive event arrives. Stop if envelope unacceptable. | +| 28 | `#012` + `#013` | Re-measure route payloads and slim only one production route with a demonstrated budget problem; ignore mockup-only code unless it enters production. | A3 / High Next.js performance | After `#017` or equivalent evidence; one route | 0.5–2 days/route | Measured target, Next.js guide, UI verification | Demonstrate a material parsed/gzip or interaction gain with unchanged behavior; run analysis, focused tests, `verify:cheap`, browser smoke. Stop if gain is small. | +| 29 | `#040` | Add small stable visual-regression baselines with owner/update workflow. | Optional / High visual QA | Stable surfaces and owner | 1–2 days | Stable browser, owner | Low-flake repeat runs and documented updates. Stop before blocking if churn high. | +| 30 | `#038` | Define shared comparison interaction contract before another comparison surface; keep clinical content mode-specific. | Optional / High design-system | Approved new comparison surface | 0.5–1 day | Concrete surface, product/design owner | Inventory patterns and make shared behavior testable. Stop if no new surface. | +| 31 | `#035` | Expand conflict detection only for concrete clinically reviewed class with positive/negative fixtures. | A3 / Specialist evidence rules | Demonstrated missed conflict | 0.5–1 day design; code separate | Clinical review; provider approval only for live validation | Fixtures discriminate class without unrelated warnings. Stop if no bounded class. | +| 32 | `#039` | Converge repeated catalogue toolbar behavior only during a concrete toolbar project. | Optional / High frontend architecture | Concrete project | 0.5–1 day inventory; 1–3 days code | Product/design owner, UI verification | Prove shared behavior without flattening search semantics; stop after bounded contract. | +| 33 | `#056` | Write a product/privacy/persistence brief for “Current Clinical Work” before any storage or UI implementation. | A3 / High product architecture + privacy | Only when the product owner wants to evaluate the feature | 0.5–1 day | Product owner, privacy/retention decision, evidence of demand | Define users, data classes, lifecycle, cross-device expectations, deletion, failure states, and a smallest testable slice. Stop if demand or safe persistence cannot be established. | ### Queue maintenance @@ -95,7 +96,7 @@ Revalidate the referenced evidence against current `main` immediately before sta 3. Treat provider status as a claim: verify only after approval and never store secret values. 4. Close/reclassify when a success or stop condition is met; do not preserve work for its own sake. - + ## Open items @@ -105,6 +106,7 @@ Revalidate the referenced evidence against current `main` immediately before sta | ID | Pri | Type | Summary | Detail / next action | Source | Added | | ---- | --- | ----- | --------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------- | +| #057 | P1 | task | Verify containment of previously exposed credentials | **Outcome:** credentials previously exposed outside authorised stores can no longer authenticate. **Next:** in approved provider dashboards, revoke or rotate any still-valid OpenAI, Supabase service-role/database, and E2E credentials; update only intended secret stores and record status without values. **Success:** provider evidence shows every old credential rejected or retired, replacements are scoped to intended environments, and readiness checks pass. **Verify:** approved provider audit/rotation evidence, presence-only checks, and secret scanning that never prints values. **Stop:** no provider or secret-store action without explicit approval; never paste values into Git, logs, issues, or chat, and do not rewrite history without separate evidence. | session 2026-07-24 security reconciliation | 2026-07-24 | | #051 | P2 | task | Stabilise the live answer-quality canary before more RAG tuning | Diagnostics landed in PR #1095: structured JSON/Markdown artifacts now record the actual checked-out SHA, run identity and latency context, and the offline trend tool separates content, provider-route and latency outcomes. First validating run `30018289898` recorded the expected tree and cost, with 36/36 retrieval green, but one report cannot establish variability; PR #1097 prevents a single failure being mislabeled as repeated. Next: compare the scheduled 2026-07-26 structured report with this run. Do not spend on an immediate retry or reapply the archived lithium guard before that comparison. | PR #1095; run `30018289898`; PR #1097; archive ref `refs/archive/rejected-rag/20260723/monitoring-subject-gate` | 2026-07-23 | | #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 | | #052 | P2 | issue | Reindex can overlap a fresh agent-enrichment pass | Full/retry reindex preflights check `ingestion_jobs` but do not call the existing `hasActiveAgentEnrichmentJob`. A fresh `indexing_v3_agent_jobs.status='processing'` lease can therefore overlap destructive artifact work. Extend single and bulk full/retry preflights before mutation; keep stale leases non-blocking and preserve enrichment-mode behavior. | `src/lib/ingestion-mutation-safety.ts:116-159`; single/bulk reindex routes; ingestion audit 2026-07-24 | 2026-07-24 | From 169fcced1eb6befee731392d9dedce7d3a254aa2 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:37:50 +0800 Subject: [PATCH 05/13] fix: keep recommended ledger visible without open rows --- .claude/hooks/issues-surface.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.claude/hooks/issues-surface.sh b/.claude/hooks/issues-surface.sh index f8ecffada..9ff772dbb 100755 --- a/.claude/hooks/issues-surface.sh +++ b/.claude/hooks/issues-surface.sh @@ -61,8 +61,8 @@ recommended="$(awk ' total="$(printf '%s' "$rows" | grep -c . || true)" recommended_total="$(printf '%s' "$recommended" | grep -c . || true)" -if [ "${total:-0}" -eq 0 ]; then - echo "[issues] Universal task ledger (docs/outstanding-issues.md): no open items. Record one with /issues add …" +if [ "${total:-0}" -eq 0 ] && [ "${recommended_total:-0}" -eq 0 ]; then + echo "[issues] Universal task ledger (docs/outstanding-issues.md): no recommended or open items. Record one with /issues add …" exit 0 fi From 9f022a5afcf7eeca1f4de6f392a208669f9341c3 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:40:55 +0800 Subject: [PATCH 06/13] docs: track sidebar delivery in universal ledger --- docs/outstanding-issues.md | 62 ++++++++++++++++++++------------------ 1 file changed, 32 insertions(+), 30 deletions(-) diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index cf9cbc369..e8a07efb6 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -49,7 +49,7 @@ executable item below it. ## Recommended execution queue Last reconciled on **2026-07-24** against fetched `origin/main` -`1eed39ed2b43509634a8d745d75a6956edb60e83`. No live application or provider state was queried. +`705480a348b0876179d4e58f734bff22d11dc7e3`. No live application or provider state was queried. Revalidate the referenced evidence against current `main` immediately before starting a row. | Order | Source | Recommended outcome / next action | Acuity / capability | When | Active effort | Dependencies / approval | Done, verification, and stop rule | @@ -59,34 +59,35 @@ Revalidate the referenced evidence against current `main` immediately before sta | 3 | `#054` | Fail closed when answer relevance metadata is absent; add the red policy test, then make the smallest render-policy correction. | A2 / Specialist clinical safety | Ready; after `#053` | 2–4 hours | Local/offline | Missing and explicit-false relevance are conservative; explicit source-backed behavior is unchanged. Run focused policy/provenance tests, `verify:cheap`, production-readiness. Stop before retrieval/ranking/generation. | | 4 | `#052` | Prevent full/retry reindex overlapping a fresh agent-enrichment lease; add red single/bulk tests, then reuse `hasActiveAgentEnrichmentJob` before mutation. | A2 / High concurrency | Ready; after `#054` | 0.5–1 day | Local/offline | Fresh processing leases conflict; stale leases and enrichment mode retain behavior. Run focused route/safety tests, `verify:cheap`, production-readiness. Stop if current `main` does not reproduce it. | | 5 | `#055` | Recover aged `queued` documents that have no open ingestion job; begin with a stranded-row reproducer and the smallest idempotent owner-scoped recovery path. | A2 / Specialist queue reliability | Ready; after `#052` | 0.5–1.5 days | Local replay for schema/scheduling; hosted changes need approval | Exactly one recoverable job is created under crash/concurrency/repeat; fresh queues and open jobs are untouched. Run focused recovery/schema tests, disposable replay if needed, `verify:cheap`, production-readiness. Stop if safe age/ownership cannot be proven. | -| 6 | `#030` | Require distinct source identities for distinct expected comparison slots; begin with a red shared-title/two-expectation test. | A2 / High evaluation semantics | Decision-ready; code only after owner choice | 2–4 hours | Local/offline; protected-eval review | One source cannot satisfy both slots; existing cases stay green. Run focused matching, typecheck, `verify:cheap`. Stop before alias/retrieval/ranking changes. | -| 7 | `#019` | Prove admission evidence is lost at the comparison fallback boundary; scope the smallest correction without automatically shipping it. | A2 / Specialist RAG | Reproducer now; behavior after `#051`/`#023` | 0.5–1 day; fix separate | Protected review; approved baseline/post canary for behavior | Reproducer fails while packing retains both sources. Stop without behavior change if the boundary defect is not independently reproducible. | -| 8 | Privacy/legal package | Execute OpenAI/Railway DPAs; decide ZDR/residency; obtain cache/subprocessor answers and APP 8 plus APP 5/1 counsel sign-off. | A2 / Operator legal/privacy | Start now; before real-patient use/privacy-approved release | 4–8 hours internal; 1–6 weeks elapsed | Signers, counsel, providers | Record countersigned evidence, IDs, dates, decisions, and approved wording in PIA/cross-border docs. Stop before public-copy changes without counsel. | -| 9 | Safety identifier config | Set a unique 32+ character `OPENAI_SAFETY_IDENTIFIER_SECRET` per environment with `OPENAI_API_KEY`, never in Git/output. | A2 / Standard local + Operator hosted | Local now; hosted approved window | 15–30 min local; 30–60 min/env | Secret manager; hosted approval | Presence-only readiness passes, HMAC pseudonymity remains, secret scans clean. Stop if governance rejects stable identifiers. | -| 10 | Operator config backlog | Reconcile query-hash, deep-probe, Supabase/OpenAI, project identity, and schedules using read-only presence checks before setting anything. | A2 / Operator platform | Next approved readiness window | 1–2 hours | Provider approval, env owners | Record status, never values; set only confirmed gaps; identity/readiness pass. Stop on target ambiguity or cross-env key reuse. | -| 11 | `#022` | Decide auditable BMJ reference policy, then review the ten highest-impact local WA documents. | A2 / Operator governance + Specialist | Decision-ready | 1–2 hours policy; 0.5–1 day reviews | Clinical authority; live writes/canary approval | Preserve third-party/unverified provenance; record reviewer/evidence/time/rationale. Stop after ten and remeasure debt. | -| 12 | `#051` + `#023` | Compare run `30018289898` with the scheduled 2026-07-26 canary/browser/label artifacts; disposition residuals without rerun. | A2 / Specialist evaluation | About 2026-07-27 02:00 AWST plus runtime | 2–4 hours | Approval to read hosted artifacts; no dispatch | Record tree/run, content/provider/latency, browser, and labeling outcomes. Stop without spend or archived lithium changes. | -| 13 | `#018` | Diagnose lithium, ADHD, metabolic residuals independently: table fast path, extractive budget, schedule-free selection. | A2 / Specialist clinical RAG | After `#051`/`#023`; one mechanism at a time | 1–2 days diagnosis; fixes separate | Protected review; approved behavior canary | Each has a current-main fixture and scoped candidate; stop without deterministic repro or on individual canary regression. | -| 14 | `#001` | Reassess semantic reranking without changing default; enable only after accepted ambiguity comparison. | A2 / Specialist ranking | After `#051`/`#023` and rollout approval | 0.5–1 day plus canary review | Provider approval/budget | Keep off unless 36/36, recalls 1.0, zero case regressions, measured gain. Otherwise record keep-off decision. | -| 15 | `#033` | Decide whether governance metadata enters the LLM source block, distinguishing unknown from adverse status. | A3 / Specialist prompt governance | After `#022` and `#051`/`#023` | 1–2 days plus eval | Better metadata, stable canary, provider approval | Prompt/serialization tests; no grounded-supported drop; zero citation failures. Stop on over-caveating/degradation. | -| 16 | `#024` | Separate Playwright `_rsc` interception failure from a real Safari defect. | A3 / High Next.js/WebKit | After scheduled matrix data or real Safari repro | 0.5–1 day | Device/provider check only if local ambiguity | Test-only fix needs discriminating repro and meaningful access-control assertions; keep Chromium green. | -| 17 | `#007` | Choose canonical Tools experience; align nav, redirects, sitemap, reachability. | A3 / Operator product + Standard frontend | Product decision window | 15–30 min decision; 0.5 day code | Product owner | One canonical path and intentional redirect with green route/UI tests. Stop on unresolved standalone need. | -| 18 | `#025` + SLO alerts | Select owned deploy/CI/ingestion/SLO channels; configure only those, ingestion after `#055`. | A2 / Operator integrations | Approved observability window | 1–3 hours/channel | Provider approval, secrets, destination owner | Mocked tests then one controlled non-PHI event/channel. Stop on missing owner or unsafe delivery. | -| 19 | Full release gate | Run release/clinical gates once against an exact candidate, not a moving branch. | A2 / High release + Operator | Before release/handoff needing full confidence | 0.5 day plus waits | Exact SHA, provider approval, heavy-command lock | All required gates recorded against one SHA; stop/classify first failure and do not repeat unchanged pass. | -| 20 | Staging provision | Provision dedicated Clinical KB staging on Supabase/Railway with isolated keys and synthetic/non-clinical data. | A2 / Operator + Specialist DB | After cost/ownership approval | 0.5–1 day | Billable provider approval, owner | Identity, tenancy, secrets, migrations, app/worker health, data boundary pass. Stop on target ambiguity or production data/key reuse. | -| 21 | Staging soak/rollback | Run documented soak and rollback rehearsal in dedicated staging. | A2 / Operator reliability | After staging provision | 0.5 day plus soak | Staging and provider approval | SLO, rollback, data integrity, recovery evidence pass. Stop before production if unproven. | -| 22 | Production seed verification | Verify registry/differentials/medications non-empty before writes; seed only confirmed governed gaps. | A2 / Operator data + Specialist | Approved production window | 1–3 hours plus seed time | Correct owner/project, provider approval | Read-only proof precedes idempotent writes; stop if populated or target ambiguous. | -| 23 | `#011` | Switch Auth DB cap to percentage immediately before first compute scale-up. | A3 / Operator capacity | Scale-up trigger only | 30–60 min plus soak | Dashboard, planned scale-up, approval | Target only `sjrfecxgysukkwxsowpy`; record before/after and advisor/health recheck. Do not create/use staging for this task. | -| 24 | `#017` | Capture reproducible mobile/desktop production LCP, INP, CLS before performance work. | A3 / High web performance | Before `#012`/`#013`; approved live window | 1–2 hours | Live-site approval; record route/build/throttle | Record metrics and accept/reject decision. Stop if acceptable or too noisy. | -| 25 | `#037` | Decide whether routine supported claims cap at medium trust. | A3 / Operator clinical-product + Standard frontend | Next trust-policy review | 30–60 min decision; up to 0.5 day code | Clinical/product authority | Record policy; if accepted, change flag/render expectations only and run focused tests. Stop without owner acceptance. | -| 26 | `#027` | Add uptime monitor outside GitHub/Railway only if service, budget, responder justified. | Optional / Operator SRE | Owned external-alert trigger | 1–2 hours | Vendor/privacy/owner/provider approval | Controlled non-PHI failure/recovery alerts. Stop without responder or if current monitoring accepted. | -| 27 | `#028` | Define vendor/region/retention/redaction/sampling/maps/owner before runtime error tracking. | Optional / Specialist privacy + Operator | After privacy/ownership/cost approval | 1–3 days | Privacy and provider approval | Redaction tests exclude clinical data/IDs/secrets; one non-sensitive event arrives. Stop if envelope unacceptable. | -| 28 | `#012` + `#013` | Re-measure route payloads and slim only one production route with a demonstrated budget problem; ignore mockup-only code unless it enters production. | A3 / High Next.js performance | After `#017` or equivalent evidence; one route | 0.5–2 days/route | Measured target, Next.js guide, UI verification | Demonstrate a material parsed/gzip or interaction gain with unchanged behavior; run analysis, focused tests, `verify:cheap`, browser smoke. Stop if gain is small. | -| 29 | `#040` | Add small stable visual-regression baselines with owner/update workflow. | Optional / High visual QA | Stable surfaces and owner | 1–2 days | Stable browser, owner | Low-flake repeat runs and documented updates. Stop before blocking if churn high. | -| 30 | `#038` | Define shared comparison interaction contract before another comparison surface; keep clinical content mode-specific. | Optional / High design-system | Approved new comparison surface | 0.5–1 day | Concrete surface, product/design owner | Inventory patterns and make shared behavior testable. Stop if no new surface. | -| 31 | `#035` | Expand conflict detection only for concrete clinically reviewed class with positive/negative fixtures. | A3 / Specialist evidence rules | Demonstrated missed conflict | 0.5–1 day design; code separate | Clinical review; provider approval only for live validation | Fixtures discriminate class without unrelated warnings. Stop if no bounded class. | -| 32 | `#039` | Converge repeated catalogue toolbar behavior only during a concrete toolbar project. | Optional / High frontend architecture | Concrete project | 0.5–1 day inventory; 1–3 days code | Product/design owner, UI verification | Prove shared behavior without flattening search semantics; stop after bounded contract. | -| 33 | `#056` | Write a product/privacy/persistence brief for “Current Clinical Work” before any storage or UI implementation. | A3 / High product architecture + privacy | Only when the product owner wants to evaluate the feature | 0.5–1 day | Product owner, privacy/retention decision, evidence of demand | Define users, data classes, lifecycle, cross-device expectations, deletion, failure states, and a smallest testable slice. Stop if demand or safe persistence cannot be established. | +| 6 | `#058` | Finish local and browser QA on the isolated sidebar delivery branch, open its PR, and prove the approved six-item navigation lands on `main`. | A2 / High frontend release | Ready; after `#055` | 2–4 hours | Local heavyweight lock; GitHub approval | Run `verify:pr-local`, responsive/accessibility browser checks, `verify:ui`, production build and bundle budget; merge only with green required checks and exact `origin/main` content proof. Stop on any regression. | +| 7 | `#030` | Require distinct source identities for distinct expected comparison slots; begin with a red shared-title/two-expectation test. | A2 / High evaluation semantics | Decision-ready; code only after owner choice | 2–4 hours | Local/offline; protected-eval review | One source cannot satisfy both slots; existing cases stay green. Run focused matching, typecheck, `verify:cheap`. Stop before alias/retrieval/ranking changes. | +| 8 | `#019` | Prove admission evidence is lost at the comparison fallback boundary; scope the smallest correction without automatically shipping it. | A2 / Specialist RAG | Reproducer now; behavior after `#051`/`#023` | 0.5–1 day; fix separate | Protected review; approved baseline/post canary for behavior | Reproducer fails while packing retains both sources. Stop without behavior change if the boundary defect is not independently reproducible. | +| 9 | Privacy/legal package | Execute OpenAI/Railway DPAs; decide ZDR/residency; obtain cache/subprocessor answers and APP 8 plus APP 5/1 counsel sign-off. | A2 / Operator legal/privacy | Start now; before real-patient use/privacy-approved release | 4–8 hours internal; 1–6 weeks elapsed | Signers, counsel, providers | Record countersigned evidence, IDs, dates, decisions, and approved wording in PIA/cross-border docs. Stop before public-copy changes without counsel. | +| 10 | Safety identifier config | Set a unique 32+ character `OPENAI_SAFETY_IDENTIFIER_SECRET` per environment with `OPENAI_API_KEY`, never in Git/output. | A2 / Standard local + Operator hosted | Local now; hosted approved window | 15–30 min local; 30–60 min/env | Secret manager; hosted approval | Presence-only readiness passes, HMAC pseudonymity remains, secret scans clean. Stop if governance rejects stable identifiers. | +| 11 | Operator config backlog | Reconcile query-hash, deep-probe, Supabase/OpenAI, project identity, and schedules using read-only presence checks before setting anything. | A2 / Operator platform | Next approved readiness window | 1–2 hours | Provider approval, env owners | Record status, never values; set only confirmed gaps; identity/readiness pass. Stop on target ambiguity or cross-env key reuse. | +| 12 | `#022` | Decide auditable BMJ reference policy, then review the ten highest-impact local WA documents. | A2 / Operator governance + Specialist | Decision-ready | 1–2 hours policy; 0.5–1 day reviews | Clinical authority; live writes/canary approval | Preserve third-party/unverified provenance; record reviewer/evidence/time/rationale. Stop after ten and remeasure debt. | +| 13 | `#051` + `#023` | Compare run `30018289898` with the scheduled 2026-07-26 canary/browser/label artifacts; disposition residuals without rerun. | A2 / Specialist evaluation | About 2026-07-27 02:00 AWST plus runtime | 2–4 hours | Approval to read hosted artifacts; no dispatch | Record tree/run, content/provider/latency, browser, and labeling outcomes. Stop without spend or archived lithium changes. | +| 14 | `#018` | Diagnose lithium, ADHD, metabolic residuals independently: table fast path, extractive budget, schedule-free selection. | A2 / Specialist clinical RAG | After `#051`/`#023`; one mechanism at a time | 1–2 days diagnosis; fixes separate | Protected review; approved behavior canary | Each has a current-main fixture and scoped candidate; stop without deterministic repro or on individual canary regression. | +| 15 | `#001` | Reassess semantic reranking without changing default; enable only after accepted ambiguity comparison. | A2 / Specialist ranking | After `#051`/`#023` and rollout approval | 0.5–1 day plus canary review | Provider approval/budget | Keep off unless 36/36, recalls 1.0, zero case regressions, measured gain. Otherwise record keep-off decision. | +| 16 | `#033` | Decide whether governance metadata enters the LLM source block, distinguishing unknown from adverse status. | A3 / Specialist prompt governance | After `#022` and `#051`/`#023` | 1–2 days plus eval | Better metadata, stable canary, provider approval | Prompt/serialization tests; no grounded-supported drop; zero citation failures. Stop on over-caveating/degradation. | +| 17 | `#024` | Separate Playwright `_rsc` interception failure from a real Safari defect. | A3 / High Next.js/WebKit | After scheduled matrix data or real Safari repro | 0.5–1 day | Device/provider check only if local ambiguity | Test-only fix needs discriminating repro and meaningful access-control assertions; keep Chromium green. | +| 18 | `#007` | Choose canonical Tools experience; align nav, redirects, sitemap, reachability. | A3 / Operator product + Standard frontend | Product decision window | 15–30 min decision; 0.5 day code | Product owner | One canonical path and intentional redirect with green route/UI tests. Stop on unresolved standalone need. | +| 19 | `#025` + SLO alerts | Select owned deploy/CI/ingestion/SLO channels; configure only those, ingestion after `#055`. | A2 / Operator integrations | Approved observability window | 1–3 hours/channel | Provider approval, secrets, destination owner | Mocked tests then one controlled non-PHI event/channel. Stop on missing owner or unsafe delivery. | +| 20 | Full release gate | Run release/clinical gates once against an exact candidate, not a moving branch. | A2 / High release + Operator | Before release/handoff needing full confidence | 0.5 day plus waits | Exact SHA, provider approval, heavy-command lock | All required gates recorded against one SHA; stop/classify first failure and do not repeat unchanged pass. | +| 21 | Staging provision | Provision dedicated Clinical KB staging on Supabase/Railway with isolated keys and synthetic/non-clinical data. | A2 / Operator + Specialist DB | After cost/ownership approval | 0.5–1 day | Billable provider approval, owner | Identity, tenancy, secrets, migrations, app/worker health, data boundary pass. Stop on target ambiguity or production data/key reuse. | +| 22 | Staging soak/rollback | Run documented soak and rollback rehearsal in dedicated staging. | A2 / Operator reliability | After staging provision | 0.5 day plus soak | Staging and provider approval | SLO, rollback, data integrity, recovery evidence pass. Stop before production if unproven. | +| 23 | Production seed verification | Verify registry/differentials/medications non-empty before writes; seed only confirmed governed gaps. | A2 / Operator data + Specialist | Approved production window | 1–3 hours plus seed time | Correct owner/project, provider approval | Read-only proof precedes idempotent writes; stop if populated or target ambiguous. | +| 24 | `#011` | Switch Auth DB cap to percentage immediately before first compute scale-up. | A3 / Operator capacity | Scale-up trigger only | 30–60 min plus soak | Dashboard, planned scale-up, approval | Target only `sjrfecxgysukkwxsowpy`; record before/after and advisor/health recheck. Do not create/use staging for this task. | +| 25 | `#017` | Capture reproducible mobile/desktop production LCP, INP, CLS before performance work. | A3 / High web performance | Before `#012`/`#013`; approved live window | 1–2 hours | Live-site approval; record route/build/throttle | Record metrics and accept/reject decision. Stop if acceptable or too noisy. | +| 26 | `#037` | Decide whether routine supported claims cap at medium trust. | A3 / Operator clinical-product + Standard frontend | Next trust-policy review | 30–60 min decision; up to 0.5 day code | Clinical/product authority | Record policy; if accepted, change flag/render expectations only and run focused tests. Stop without owner acceptance. | +| 27 | `#027` | Add uptime monitor outside GitHub/Railway only if service, budget, responder justified. | Optional / Operator SRE | Owned external-alert trigger | 1–2 hours | Vendor/privacy/owner/provider approval | Controlled non-PHI failure/recovery alerts. Stop without responder or if current monitoring accepted. | +| 28 | `#028` | Define vendor/region/retention/redaction/sampling/maps/owner before runtime error tracking. | Optional / Specialist privacy + Operator | After privacy/ownership/cost approval | 1–3 days | Privacy and provider approval | Redaction tests exclude clinical data/IDs/secrets; one non-sensitive event arrives. Stop if envelope unacceptable. | +| 29 | `#012` + `#013` | Re-measure route payloads and slim only one production route with a demonstrated budget problem; ignore mockup-only code unless it enters production. | A3 / High Next.js performance | After `#017` or equivalent evidence; one route | 0.5–2 days/route | Measured target, Next.js guide, UI verification | Demonstrate a material parsed/gzip or interaction gain with unchanged behavior; run analysis, focused tests, `verify:cheap`, browser smoke. Stop if gain is small. | +| 30 | `#040` | Add small stable visual-regression baselines with owner/update workflow. | Optional / High visual QA | Stable surfaces and owner | 1–2 days | Stable browser, owner | Low-flake repeat runs and documented updates. Stop before blocking if churn high. | +| 31 | `#038` | Define shared comparison interaction contract before another comparison surface; keep clinical content mode-specific. | Optional / High design-system | Approved new comparison surface | 0.5–1 day | Concrete surface, product/design owner | Inventory patterns and make shared behavior testable. Stop if no new surface. | +| 32 | `#035` | Expand conflict detection only for concrete clinically reviewed class with positive/negative fixtures. | A3 / Specialist evidence rules | Demonstrated missed conflict | 0.5–1 day design; code separate | Clinical review; provider approval only for live validation | Fixtures discriminate class without unrelated warnings. Stop if no bounded class. | +| 33 | `#039` | Converge repeated catalogue toolbar behavior only during a concrete toolbar project. | Optional / High frontend architecture | Concrete project | 0.5–1 day inventory; 1–3 days code | Product/design owner, UI verification | Prove shared behavior without flattening search semantics; stop after bounded contract. | +| 34 | `#056` | Write a product/privacy/persistence brief for “Current Clinical Work” before any storage or UI implementation. | A3 / High product architecture + privacy | Only when the product owner wants to evaluate the feature | 0.5–1 day | Product owner, privacy/retention decision, evidence of demand | Define users, data classes, lifecycle, cross-device expectations, deletion, failure states, and a smallest testable slice. Stop if demand or safe persistence cannot be established. | ### Queue maintenance @@ -96,7 +97,7 @@ Revalidate the referenced evidence against current `main` immediately before sta 3. Treat provider status as a claim: verify only after approval and never store secret values. 4. Close/reclassify when a success or stop condition is met; do not preserve work for its own sake. - + ## Open items @@ -107,6 +108,7 @@ Revalidate the referenced evidence against current `main` immediately before sta | ID | Pri | Type | Summary | Detail / next action | Source | Added | | ---- | --- | ----- | --------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------- | | #057 | P1 | task | Verify containment of previously exposed credentials | **Outcome:** credentials previously exposed outside authorised stores can no longer authenticate. **Next:** in approved provider dashboards, revoke or rotate any still-valid OpenAI, Supabase service-role/database, and E2E credentials; update only intended secret stores and record status without values. **Success:** provider evidence shows every old credential rejected or retired, replacements are scoped to intended environments, and readiness checks pass. **Verify:** approved provider audit/rotation evidence, presence-only checks, and secret scanning that never prints values. **Stop:** no provider or secret-store action without explicit approval; never paste values into Git, logs, issues, or chat, and do not rewrite history without separate evidence. | session 2026-07-24 security reconciliation | 2026-07-24 | +| #058 | P2 | task | Land and prove the streamlined six-item sidebar | Implementation and the corrected Therapy wiring assertion are committed on `codex/sidebar-test-fix-20260723`; focused sidebar/favourites suites pass 18/18. Remaining: run `verify:pr-local`, start the app and inspect desktop/tablet/mobile plus short-height scrolling and keyboard/focus behavior, run `verify:ui`, production build and bundle-budget checks, then open/merge the PR and prove the exact content is on `origin/main`. | branch `codex/sidebar-test-fix-20260723`; commit `cd54e68fb`; session 2026-07-24 | 2026-07-24 | | #051 | P2 | task | Stabilise the live answer-quality canary before more RAG tuning | Diagnostics landed in PR #1095: structured JSON/Markdown artifacts now record the actual checked-out SHA, run identity and latency context, and the offline trend tool separates content, provider-route and latency outcomes. First validating run `30018289898` recorded the expected tree and cost, with 36/36 retrieval green, but one report cannot establish variability; PR #1097 prevents a single failure being mislabeled as repeated. Next: compare the scheduled 2026-07-26 structured report with this run. Do not spend on an immediate retry or reapply the archived lithium guard before that comparison. | PR #1095; run `30018289898`; PR #1097; archive ref `refs/archive/rejected-rag/20260723/monitoring-subject-gate` | 2026-07-23 | | #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 | | #052 | P2 | issue | Reindex can overlap a fresh agent-enrichment pass | Full/retry reindex preflights check `ingestion_jobs` but do not call the existing `hasActiveAgentEnrichmentJob`. A fresh `indexing_v3_agent_jobs.status='processing'` lease can therefore overlap destructive artifact work. Extend single and bulk full/retry preflights before mutation; keep stale leases non-blocking and preserve enrichment-mode behavior. | `src/lib/ingestion-mutation-safety.ts:116-159`; single/bulk reindex routes; ingestion audit 2026-07-24 | 2026-07-24 | From b0f439c3c5be91baee68c37a7a83ffe953f5d619 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:41:32 +0800 Subject: [PATCH 07/13] fix: keep universal ledger tasks closable --- .claude/hooks/issues-surface.sh | 2 +- docs/branch-review-ledger.md | 1 + docs/outstanding-issues.md | 82 ++++++++++++++++++--------------- 3 files changed, 47 insertions(+), 38 deletions(-) diff --git a/.claude/hooks/issues-surface.sh b/.claude/hooks/issues-surface.sh index f8ecffada..8d2cb13c2 100755 --- a/.claude/hooks/issues-surface.sh +++ b/.claude/hooks/issues-surface.sh @@ -61,7 +61,7 @@ recommended="$(awk ' total="$(printf '%s' "$rows" | grep -c . || true)" recommended_total="$(printf '%s' "$recommended" | grep -c . || true)" -if [ "${total:-0}" -eq 0 ]; then +if [ "${total:-0}" -eq 0 ] && [ "${recommended_total:-0}" -eq 0 ]; then echo "[issues] Universal task ledger (docs/outstanding-issues.md): no open items. Record one with /issues add …" exit 0 fi diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md index f8f2edb72..96e57f5b7 100644 --- a/docs/branch-review-ledger.md +++ b/docs/branch-review-ledger.md @@ -20,6 +20,7 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD | Date | Branch or ref | Reviewed HEAD | Scope | Outcome | Checks | | ---------- | -------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| 2026-07-24 | PR #1109 / `codex/universal-ledger-security-followup-082afe` | `3996b866ca69fa8dfc171fe51f41832eb269006c` + reviewed working diff | Universal task ledger, `/issues` lifecycle and SessionStart surfacing | READY AFTER FIXES. Two P2 lifecycle defects were confirmed and corrected before merge: the SessionStart hook now preserves a non-empty recommended queue when the wider open table is empty, and every active queue package has a durable open-item ID so `/issues done` can archive it without leaving stale recommendations. The ledger provenance was also advanced to the actual merged `origin/main` base. Highest residual risk is human maintenance drift between the queue and open table; the documented mutation contract and invariant check are the current guardrails. | Bash syntax and live SessionStart execution passed (33 recommended, 45 open); queue order is contiguous and unique; every queue source contains only tracked open IDs; `docs:check-links` passed (1,142 references); `docs:check-index` passed (42 modules/routes plus all schema tables); `docs:check-scripts` passed (334 npm script references); `check:skills` passed (32 canonical skills, 8 aliases); Prettier and `git diff --check` passed. No live application, OpenAI, Supabase, Railway, deployment, or production-data action. | | 2026-07-24 | `codex/supabase-document-change-trigger` | `9c7d9edf509a51478f5bebbabcca64e3926dc877` + reviewed working diff | Document-change ingestion trigger migration, schema mirror, grants, privacy and fail-safe delivery | APPROVE. No P0-P2 finding. The trigger is update-only, acts solely on a strict JSON boolean false/absent-to-true transition, sends only the receiver's allowlisted owner-scoped fields, fails open for document writes when Vault/GUC/pg_net is unavailable, and revokes execution from public/anon/authenticated. No production URL fallback exists. Highest residual risk is deliberate pg_net at-most-once delivery; the clear-then-flip recovery and data-preserving rollback are documented, and the trigger remains inert until both the Vault secret and environment base-URL GUC are configured. | Disposable Supabase Postgres 17.6.1.127 image replay and drift-manifest regeneration passed (16s; scratch container removed); focused schema/drift/receiver Vitest 89/89; migration-role, function-grant (30 SECURITY DEFINER functions) and owner-scope guards; production-readiness CI mode READY with expected secretless-worktree warnings; offline RAG 21 suites/307 tests; `verify:cheap` 365 files, 3,241 passed/1 skipped; static trace of receiver payload, authoritative owner-scoped reload and idempotent enqueue path. No live provider mutation or migration apply. | | 2026-07-23 | PR #1090 / `cursor/fix-phone-dock-edge-1b1d` | `761de7e9ad623b6bd8d634d849a9eb465d622e48` (merged as `09028ef217209fceb53f1122ac7738b509bce323`) | Phone safe-area and edge-to-edge search-dock UI review | MERGED. No P0-P2 finding. The branch was three commits behind, so current `origin/main` was merged before landing; the actual merge tree matched the reviewed synthetic tree. The dock remains flush to the viewport with safe-area padding inside the form, and the phone shell no longer retains the `dvh` clamp that created the Safari toolbar band. Zero actionable review threads. | `npm run ensure`; focused `ui-tools.spec.ts` phone-home and edge-to-edge scenarios: Chromium 2/2 and WebKit 2/2; refreshed hosted policy, security, unit, build, advisory UI, Production UI and required aggregate checks green; exact-head ancestry and local-main tree equality proved after merge. | | 2026-07-22 | PR #1087 / `codex/reconcile-product-truth` | `edbc2260fef59ca2fa7c6973dffb85e32354bce1` (merged as `05dc52fd8408a65117e22a6236e43252203bea92`) | Product-truth copy, account persistence and unavailable-SSO presentation | MERGED. Cross-device claims now match favourites/preferences persistence; recent searches are identified as browser-session data; the contradictory “never shared” statement is removed. All unavailable setup providers and Apple elsewhere use the connected accessible “coming soon” placeholder pattern. The single review finding was fixed, replied to and resolved. | Red DOM proof; focused 19/19; `verify:cheap` 3,220 passed / 1 skipped; `verify:ui` 265/265; PR-local build/secret scan/offline RAG; final hosted required, Production UI, policy and security checks green. No provider calls or RAG spend. | diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index cf9cbc369..66ad64ad0 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -49,44 +49,44 @@ executable item below it. ## Recommended execution queue Last reconciled on **2026-07-24** against fetched `origin/main` -`1eed39ed2b43509634a8d745d75a6956edb60e83`. No live application or provider state was queried. +`bb701618c08946a0f2ece8052b6376e366567f71`. No live application or provider state was queried. Revalidate the referenced evidence against current `main` immediately before starting a row. -| Order | Source | Recommended outcome / next action | Acuity / capability | When | Active effort | Dependencies / approval | Done, verification, and stop rule | -| ----: | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------- | ----------------------------------------------------------- | -------------------------------------- | -------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| 1 | `#057` | Verify provider-side containment of credentials previously exposed outside authorised stores; revoke or rotate any still-valid OpenAI, Supabase service-role/database, and E2E credentials, then update only intended secret stores. | A1 / Operator security + independent reviewer | Immediate approved security window | 1–3 hours | Credentialed provider owners; correct target identity; explicit provider and secret-store approval | Every old credential is rejected or retired; replacements exist only in intended stores; presence/readiness checks pass; no value enters Git, logs, issues, or chat. Use approved provider evidence and secret scans. Stop before provider action without approval and do not rewrite history without separate evidence. | -| 2 | `#053` | Align the Safety Plan Generator with the repository's no-patient-data contract before real-patient use. | A1 / Specialist privacy + clinical | Ready; first | 3–5 hours | Privacy/clinical owner | Copy, behavior, print, and tests agree; no identifier is persisted/transmitted without an approved basis. Run focused UI/privacy/a11y checks, `verify:cheap`, production-readiness. Stop before adding storage/provider flow. | -| 3 | `#054` | Fail closed when answer relevance metadata is absent; add the red policy test, then make the smallest render-policy correction. | A2 / Specialist clinical safety | Ready; after `#053` | 2–4 hours | Local/offline | Missing and explicit-false relevance are conservative; explicit source-backed behavior is unchanged. Run focused policy/provenance tests, `verify:cheap`, production-readiness. Stop before retrieval/ranking/generation. | -| 4 | `#052` | Prevent full/retry reindex overlapping a fresh agent-enrichment lease; add red single/bulk tests, then reuse `hasActiveAgentEnrichmentJob` before mutation. | A2 / High concurrency | Ready; after `#054` | 0.5–1 day | Local/offline | Fresh processing leases conflict; stale leases and enrichment mode retain behavior. Run focused route/safety tests, `verify:cheap`, production-readiness. Stop if current `main` does not reproduce it. | -| 5 | `#055` | Recover aged `queued` documents that have no open ingestion job; begin with a stranded-row reproducer and the smallest idempotent owner-scoped recovery path. | A2 / Specialist queue reliability | Ready; after `#052` | 0.5–1.5 days | Local replay for schema/scheduling; hosted changes need approval | Exactly one recoverable job is created under crash/concurrency/repeat; fresh queues and open jobs are untouched. Run focused recovery/schema tests, disposable replay if needed, `verify:cheap`, production-readiness. Stop if safe age/ownership cannot be proven. | -| 6 | `#030` | Require distinct source identities for distinct expected comparison slots; begin with a red shared-title/two-expectation test. | A2 / High evaluation semantics | Decision-ready; code only after owner choice | 2–4 hours | Local/offline; protected-eval review | One source cannot satisfy both slots; existing cases stay green. Run focused matching, typecheck, `verify:cheap`. Stop before alias/retrieval/ranking changes. | -| 7 | `#019` | Prove admission evidence is lost at the comparison fallback boundary; scope the smallest correction without automatically shipping it. | A2 / Specialist RAG | Reproducer now; behavior after `#051`/`#023` | 0.5–1 day; fix separate | Protected review; approved baseline/post canary for behavior | Reproducer fails while packing retains both sources. Stop without behavior change if the boundary defect is not independently reproducible. | -| 8 | Privacy/legal package | Execute OpenAI/Railway DPAs; decide ZDR/residency; obtain cache/subprocessor answers and APP 8 plus APP 5/1 counsel sign-off. | A2 / Operator legal/privacy | Start now; before real-patient use/privacy-approved release | 4–8 hours internal; 1–6 weeks elapsed | Signers, counsel, providers | Record countersigned evidence, IDs, dates, decisions, and approved wording in PIA/cross-border docs. Stop before public-copy changes without counsel. | -| 9 | Safety identifier config | Set a unique 32+ character `OPENAI_SAFETY_IDENTIFIER_SECRET` per environment with `OPENAI_API_KEY`, never in Git/output. | A2 / Standard local + Operator hosted | Local now; hosted approved window | 15–30 min local; 30–60 min/env | Secret manager; hosted approval | Presence-only readiness passes, HMAC pseudonymity remains, secret scans clean. Stop if governance rejects stable identifiers. | -| 10 | Operator config backlog | Reconcile query-hash, deep-probe, Supabase/OpenAI, project identity, and schedules using read-only presence checks before setting anything. | A2 / Operator platform | Next approved readiness window | 1–2 hours | Provider approval, env owners | Record status, never values; set only confirmed gaps; identity/readiness pass. Stop on target ambiguity or cross-env key reuse. | -| 11 | `#022` | Decide auditable BMJ reference policy, then review the ten highest-impact local WA documents. | A2 / Operator governance + Specialist | Decision-ready | 1–2 hours policy; 0.5–1 day reviews | Clinical authority; live writes/canary approval | Preserve third-party/unverified provenance; record reviewer/evidence/time/rationale. Stop after ten and remeasure debt. | -| 12 | `#051` + `#023` | Compare run `30018289898` with the scheduled 2026-07-26 canary/browser/label artifacts; disposition residuals without rerun. | A2 / Specialist evaluation | About 2026-07-27 02:00 AWST plus runtime | 2–4 hours | Approval to read hosted artifacts; no dispatch | Record tree/run, content/provider/latency, browser, and labeling outcomes. Stop without spend or archived lithium changes. | -| 13 | `#018` | Diagnose lithium, ADHD, metabolic residuals independently: table fast path, extractive budget, schedule-free selection. | A2 / Specialist clinical RAG | After `#051`/`#023`; one mechanism at a time | 1–2 days diagnosis; fixes separate | Protected review; approved behavior canary | Each has a current-main fixture and scoped candidate; stop without deterministic repro or on individual canary regression. | -| 14 | `#001` | Reassess semantic reranking without changing default; enable only after accepted ambiguity comparison. | A2 / Specialist ranking | After `#051`/`#023` and rollout approval | 0.5–1 day plus canary review | Provider approval/budget | Keep off unless 36/36, recalls 1.0, zero case regressions, measured gain. Otherwise record keep-off decision. | -| 15 | `#033` | Decide whether governance metadata enters the LLM source block, distinguishing unknown from adverse status. | A3 / Specialist prompt governance | After `#022` and `#051`/`#023` | 1–2 days plus eval | Better metadata, stable canary, provider approval | Prompt/serialization tests; no grounded-supported drop; zero citation failures. Stop on over-caveating/degradation. | -| 16 | `#024` | Separate Playwright `_rsc` interception failure from a real Safari defect. | A3 / High Next.js/WebKit | After scheduled matrix data or real Safari repro | 0.5–1 day | Device/provider check only if local ambiguity | Test-only fix needs discriminating repro and meaningful access-control assertions; keep Chromium green. | -| 17 | `#007` | Choose canonical Tools experience; align nav, redirects, sitemap, reachability. | A3 / Operator product + Standard frontend | Product decision window | 15–30 min decision; 0.5 day code | Product owner | One canonical path and intentional redirect with green route/UI tests. Stop on unresolved standalone need. | -| 18 | `#025` + SLO alerts | Select owned deploy/CI/ingestion/SLO channels; configure only those, ingestion after `#055`. | A2 / Operator integrations | Approved observability window | 1–3 hours/channel | Provider approval, secrets, destination owner | Mocked tests then one controlled non-PHI event/channel. Stop on missing owner or unsafe delivery. | -| 19 | Full release gate | Run release/clinical gates once against an exact candidate, not a moving branch. | A2 / High release + Operator | Before release/handoff needing full confidence | 0.5 day plus waits | Exact SHA, provider approval, heavy-command lock | All required gates recorded against one SHA; stop/classify first failure and do not repeat unchanged pass. | -| 20 | Staging provision | Provision dedicated Clinical KB staging on Supabase/Railway with isolated keys and synthetic/non-clinical data. | A2 / Operator + Specialist DB | After cost/ownership approval | 0.5–1 day | Billable provider approval, owner | Identity, tenancy, secrets, migrations, app/worker health, data boundary pass. Stop on target ambiguity or production data/key reuse. | -| 21 | Staging soak/rollback | Run documented soak and rollback rehearsal in dedicated staging. | A2 / Operator reliability | After staging provision | 0.5 day plus soak | Staging and provider approval | SLO, rollback, data integrity, recovery evidence pass. Stop before production if unproven. | -| 22 | Production seed verification | Verify registry/differentials/medications non-empty before writes; seed only confirmed governed gaps. | A2 / Operator data + Specialist | Approved production window | 1–3 hours plus seed time | Correct owner/project, provider approval | Read-only proof precedes idempotent writes; stop if populated or target ambiguous. | -| 23 | `#011` | Switch Auth DB cap to percentage immediately before first compute scale-up. | A3 / Operator capacity | Scale-up trigger only | 30–60 min plus soak | Dashboard, planned scale-up, approval | Target only `sjrfecxgysukkwxsowpy`; record before/after and advisor/health recheck. Do not create/use staging for this task. | -| 24 | `#017` | Capture reproducible mobile/desktop production LCP, INP, CLS before performance work. | A3 / High web performance | Before `#012`/`#013`; approved live window | 1–2 hours | Live-site approval; record route/build/throttle | Record metrics and accept/reject decision. Stop if acceptable or too noisy. | -| 25 | `#037` | Decide whether routine supported claims cap at medium trust. | A3 / Operator clinical-product + Standard frontend | Next trust-policy review | 30–60 min decision; up to 0.5 day code | Clinical/product authority | Record policy; if accepted, change flag/render expectations only and run focused tests. Stop without owner acceptance. | -| 26 | `#027` | Add uptime monitor outside GitHub/Railway only if service, budget, responder justified. | Optional / Operator SRE | Owned external-alert trigger | 1–2 hours | Vendor/privacy/owner/provider approval | Controlled non-PHI failure/recovery alerts. Stop without responder or if current monitoring accepted. | -| 27 | `#028` | Define vendor/region/retention/redaction/sampling/maps/owner before runtime error tracking. | Optional / Specialist privacy + Operator | After privacy/ownership/cost approval | 1–3 days | Privacy and provider approval | Redaction tests exclude clinical data/IDs/secrets; one non-sensitive event arrives. Stop if envelope unacceptable. | -| 28 | `#012` + `#013` | Re-measure route payloads and slim only one production route with a demonstrated budget problem; ignore mockup-only code unless it enters production. | A3 / High Next.js performance | After `#017` or equivalent evidence; one route | 0.5–2 days/route | Measured target, Next.js guide, UI verification | Demonstrate a material parsed/gzip or interaction gain with unchanged behavior; run analysis, focused tests, `verify:cheap`, browser smoke. Stop if gain is small. | -| 29 | `#040` | Add small stable visual-regression baselines with owner/update workflow. | Optional / High visual QA | Stable surfaces and owner | 1–2 days | Stable browser, owner | Low-flake repeat runs and documented updates. Stop before blocking if churn high. | -| 30 | `#038` | Define shared comparison interaction contract before another comparison surface; keep clinical content mode-specific. | Optional / High design-system | Approved new comparison surface | 0.5–1 day | Concrete surface, product/design owner | Inventory patterns and make shared behavior testable. Stop if no new surface. | -| 31 | `#035` | Expand conflict detection only for concrete clinically reviewed class with positive/negative fixtures. | A3 / Specialist evidence rules | Demonstrated missed conflict | 0.5–1 day design; code separate | Clinical review; provider approval only for live validation | Fixtures discriminate class without unrelated warnings. Stop if no bounded class. | -| 32 | `#039` | Converge repeated catalogue toolbar behavior only during a concrete toolbar project. | Optional / High frontend architecture | Concrete project | 0.5–1 day inventory; 1–3 days code | Product/design owner, UI verification | Prove shared behavior without flattening search semantics; stop after bounded contract. | -| 33 | `#056` | Write a product/privacy/persistence brief for “Current Clinical Work” before any storage or UI implementation. | A3 / High product architecture + privacy | Only when the product owner wants to evaluate the feature | 0.5–1 day | Product owner, privacy/retention decision, evidence of demand | Define users, data classes, lifecycle, cross-device expectations, deletion, failure states, and a smallest testable slice. Stop if demand or safe persistence cannot be established. | +| Order | Source | Recommended outcome / next action | Acuity / capability | When | Active effort | Dependencies / approval | Done, verification, and stop rule | +| ----: | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------- | ----------------------------------------------------------- | -------------------------------------- | -------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| 1 | `#057` | Verify provider-side containment of credentials previously exposed outside authorised stores; revoke or rotate any still-valid OpenAI, Supabase service-role/database, and E2E credentials, then update only intended secret stores. | A1 / Operator security + independent reviewer | Immediate approved security window | 1–3 hours | Credentialed provider owners; correct target identity; explicit provider and secret-store approval | Every old credential is rejected or retired; replacements exist only in intended stores; presence/readiness checks pass; no value enters Git, logs, issues, or chat. Use approved provider evidence and secret scans. Stop before provider action without approval and do not rewrite history without separate evidence. | +| 2 | `#053` | Align the Safety Plan Generator with the repository's no-patient-data contract before real-patient use. | A1 / Specialist privacy + clinical | Ready; first | 3–5 hours | Privacy/clinical owner | Copy, behavior, print, and tests agree; no identifier is persisted/transmitted without an approved basis. Run focused UI/privacy/a11y checks, `verify:cheap`, production-readiness. Stop before adding storage/provider flow. | +| 3 | `#054` | Fail closed when answer relevance metadata is absent; add the red policy test, then make the smallest render-policy correction. | A2 / Specialist clinical safety | Ready; after `#053` | 2–4 hours | Local/offline | Missing and explicit-false relevance are conservative; explicit source-backed behavior is unchanged. Run focused policy/provenance tests, `verify:cheap`, production-readiness. Stop before retrieval/ranking/generation. | +| 4 | `#052` | Prevent full/retry reindex overlapping a fresh agent-enrichment lease; add red single/bulk tests, then reuse `hasActiveAgentEnrichmentJob` before mutation. | A2 / High concurrency | Ready; after `#054` | 0.5–1 day | Local/offline | Fresh processing leases conflict; stale leases and enrichment mode retain behavior. Run focused route/safety tests, `verify:cheap`, production-readiness. Stop if current `main` does not reproduce it. | +| 5 | `#055` | Recover aged `queued` documents that have no open ingestion job; begin with a stranded-row reproducer and the smallest idempotent owner-scoped recovery path. | A2 / Specialist queue reliability | Ready; after `#052` | 0.5–1.5 days | Local replay for schema/scheduling; hosted changes need approval | Exactly one recoverable job is created under crash/concurrency/repeat; fresh queues and open jobs are untouched. Run focused recovery/schema tests, disposable replay if needed, `verify:cheap`, production-readiness. Stop if safe age/ownership cannot be proven. | +| 6 | `#030` | Require distinct source identities for distinct expected comparison slots; begin with a red shared-title/two-expectation test. | A2 / High evaluation semantics | Decision-ready; code only after owner choice | 2–4 hours | Local/offline; protected-eval review | One source cannot satisfy both slots; existing cases stay green. Run focused matching, typecheck, `verify:cheap`. Stop before alias/retrieval/ranking changes. | +| 7 | `#019` | Prove admission evidence is lost at the comparison fallback boundary; scope the smallest correction without automatically shipping it. | A2 / Specialist RAG | Reproducer now; behavior after `#051`/`#023` | 0.5–1 day; fix separate | Protected review; approved baseline/post canary for behavior | Reproducer fails while packing retains both sources. Stop without behavior change if the boundary defect is not independently reproducible. | +| 8 | `#058` | Execute OpenAI/Railway DPAs; decide ZDR/residency; obtain cache/subprocessor answers and APP 8 plus APP 5/1 counsel sign-off. | A2 / Operator legal/privacy | Start now; before real-patient use/privacy-approved release | 4–8 hours internal; 1–6 weeks elapsed | Signers, counsel, providers | Record countersigned evidence, IDs, dates, decisions, and approved wording in PIA/cross-border docs. Stop before public-copy changes without counsel. | +| 9 | `#059` | Set a unique 32+ character `OPENAI_SAFETY_IDENTIFIER_SECRET` per environment with `OPENAI_API_KEY`, never in Git/output. | A2 / Standard local + Operator hosted | Local now; hosted approved window | 15–30 min local; 30–60 min/env | Secret manager; hosted approval | Presence-only readiness passes, HMAC pseudonymity remains, secret scans clean. Stop if governance rejects stable identifiers. | +| 10 | `#060` | Reconcile query-hash, deep-probe, Supabase/OpenAI, project identity, and schedules using read-only presence checks before setting anything. | A2 / Operator platform | Next approved readiness window | 1–2 hours | Provider approval, env owners | Record status, never values; set only confirmed gaps; identity/readiness pass. Stop on target ambiguity or cross-env key reuse. | +| 11 | `#022` | Decide auditable BMJ reference policy, then review the ten highest-impact local WA documents. | A2 / Operator governance + Specialist | Decision-ready | 1–2 hours policy; 0.5–1 day reviews | Clinical authority; live writes/canary approval | Preserve third-party/unverified provenance; record reviewer/evidence/time/rationale. Stop after ten and remeasure debt. | +| 12 | `#051` + `#023` | Compare run `30018289898` with the scheduled 2026-07-26 canary/browser/label artifacts; disposition residuals without rerun. | A2 / Specialist evaluation | About 2026-07-27 02:00 AWST plus runtime | 2–4 hours | Approval to read hosted artifacts; no dispatch | Record tree/run, content/provider/latency, browser, and labeling outcomes. Stop without spend or archived lithium changes. | +| 13 | `#018` | Diagnose lithium, ADHD, metabolic residuals independently: table fast path, extractive budget, schedule-free selection. | A2 / Specialist clinical RAG | After `#051`/`#023`; one mechanism at a time | 1–2 days diagnosis; fixes separate | Protected review; approved behavior canary | Each has a current-main fixture and scoped candidate; stop without deterministic repro or on individual canary regression. | +| 14 | `#001` | Reassess semantic reranking without changing default; enable only after accepted ambiguity comparison. | A2 / Specialist ranking | After `#051`/`#023` and rollout approval | 0.5–1 day plus canary review | Provider approval/budget | Keep off unless 36/36, recalls 1.0, zero case regressions, measured gain. Otherwise record keep-off decision. | +| 15 | `#033` | Decide whether governance metadata enters the LLM source block, distinguishing unknown from adverse status. | A3 / Specialist prompt governance | After `#022` and `#051`/`#023` | 1–2 days plus eval | Better metadata, stable canary, provider approval | Prompt/serialization tests; no grounded-supported drop; zero citation failures. Stop on over-caveating/degradation. | +| 16 | `#024` | Separate Playwright `_rsc` interception failure from a real Safari defect. | A3 / High Next.js/WebKit | After scheduled matrix data or real Safari repro | 0.5–1 day | Device/provider check only if local ambiguity | Test-only fix needs discriminating repro and meaningful access-control assertions; keep Chromium green. | +| 17 | `#007` | Choose canonical Tools experience; align nav, redirects, sitemap, reachability. | A3 / Operator product + Standard frontend | Product decision window | 15–30 min decision; 0.5 day code | Product owner | One canonical path and intentional redirect with green route/UI tests. Stop on unresolved standalone need. | +| 18 | `#025` + `#061` | Select owned deploy/CI/ingestion/SLO channels; configure only those, ingestion after `#055`. | A2 / Operator integrations | Approved observability window | 1–3 hours/channel | Provider approval, secrets, destination owner | Mocked tests then one controlled non-PHI event/channel. Stop on missing owner or unsafe delivery. | +| 19 | `#062` | Run release/clinical gates once against an exact candidate, not a moving branch. | A2 / High release + Operator | Before release/handoff needing full confidence | 0.5 day plus waits | Exact SHA, provider approval, heavy-command lock | All required gates recorded against one SHA; stop/classify first failure and do not repeat unchanged pass. | +| 20 | `#063` | Provision dedicated Clinical KB staging on Supabase/Railway with isolated keys and synthetic/non-clinical data. | A2 / Operator + Specialist DB | After cost/ownership approval | 0.5–1 day | Billable provider approval, owner | Identity, tenancy, secrets, migrations, app/worker health, data boundary pass. Stop on target ambiguity or production data/key reuse. | +| 21 | `#064` | Run documented soak and rollback rehearsal in dedicated staging. | A2 / Operator reliability | After `#063` | 0.5 day plus soak | Staging and provider approval | SLO, rollback, data integrity, recovery evidence pass. Stop before production if unproven. | +| 22 | `#065` | Verify registry/differentials/medications non-empty before writes; seed only confirmed governed gaps. | A2 / Operator data + Specialist | Approved production window | 1–3 hours plus seed time | Correct owner/project, provider approval | Read-only proof precedes idempotent writes; stop if populated or target ambiguous. | +| 23 | `#011` | Switch Auth DB cap to percentage immediately before first compute scale-up. | A3 / Operator capacity | Scale-up trigger only | 30–60 min plus soak | Dashboard, planned scale-up, approval | Target only `sjrfecxgysukkwxsowpy`; record before/after and advisor/health recheck. Do not create/use staging for this task. | +| 24 | `#017` | Capture reproducible mobile/desktop production LCP, INP, CLS before performance work. | A3 / High web performance | Before `#012`/`#013`; approved live window | 1–2 hours | Live-site approval; record route/build/throttle | Record metrics and accept/reject decision. Stop if acceptable or too noisy. | +| 25 | `#037` | Decide whether routine supported claims cap at medium trust. | A3 / Operator clinical-product + Standard frontend | Next trust-policy review | 30–60 min decision; up to 0.5 day code | Clinical/product authority | Record policy; if accepted, change flag/render expectations only and run focused tests. Stop without owner acceptance. | +| 26 | `#027` | Add uptime monitor outside GitHub/Railway only if service, budget, responder justified. | Optional / Operator SRE | Owned external-alert trigger | 1–2 hours | Vendor/privacy/owner/provider approval | Controlled non-PHI failure/recovery alerts. Stop without responder or if current monitoring accepted. | +| 27 | `#028` | Define vendor/region/retention/redaction/sampling/maps/owner before runtime error tracking. | Optional / Specialist privacy + Operator | After privacy/ownership/cost approval | 1–3 days | Privacy and provider approval | Redaction tests exclude clinical data/IDs/secrets; one non-sensitive event arrives. Stop if envelope unacceptable. | +| 28 | `#012` + `#013` | Re-measure route payloads and slim only one production route with a demonstrated budget problem; ignore mockup-only code unless it enters production. | A3 / High Next.js performance | After `#017` or equivalent evidence; one route | 0.5–2 days/route | Measured target, Next.js guide, UI verification | Demonstrate a material parsed/gzip or interaction gain with unchanged behavior; run analysis, focused tests, `verify:cheap`, browser smoke. Stop if gain is small. | +| 29 | `#040` | Add small stable visual-regression baselines with owner/update workflow. | Optional / High visual QA | Stable surfaces and owner | 1–2 days | Stable browser, owner | Low-flake repeat runs and documented updates. Stop before blocking if churn high. | +| 30 | `#038` | Define shared comparison interaction contract before another comparison surface; keep clinical content mode-specific. | Optional / High design-system | Approved new comparison surface | 0.5–1 day | Concrete surface, product/design owner | Inventory patterns and make shared behavior testable. Stop if no new surface. | +| 31 | `#035` | Expand conflict detection only for concrete clinically reviewed class with positive/negative fixtures. | A3 / Specialist evidence rules | Demonstrated missed conflict | 0.5–1 day design; code separate | Clinical review; provider approval only for live validation | Fixtures discriminate class without unrelated warnings. Stop if no bounded class. | +| 32 | `#039` | Converge repeated catalogue toolbar behavior only during a concrete toolbar project. | Optional / High frontend architecture | Concrete project | 0.5–1 day inventory; 1–3 days code | Product/design owner, UI verification | Prove shared behavior without flattening search semantics; stop after bounded contract. | +| 33 | `#056` | Write a product/privacy/persistence brief for “Current Clinical Work” before any storage or UI implementation. | A3 / High product architecture + privacy | Only when the product owner wants to evaluate the feature | 0.5–1 day | Product owner, privacy/retention decision, evidence of demand | Define users, data classes, lifecycle, cross-device expectations, deletion, failure states, and a smallest testable slice. Stop if demand or safe persistence cannot be established. | ### Queue maintenance @@ -96,7 +96,7 @@ Revalidate the referenced evidence against current `main` immediately before sta 3. Treat provider status as a claim: verify only after approval and never store secret values. 4. Close/reclassify when a success or stop condition is met; do not preserve work for its own sake. - + ## Open items @@ -113,6 +113,14 @@ Revalidate the referenced evidence against current `main` immediately before sta | #053 | P1 | issue | Safety Plan Generator contradicts the privacy contract | **Outcome:** the tool, privacy notice, PIA, and tests agree on whether patient identifiers may be entered, copied, printed, or saved. `patient-safety-plan.tsx` asks for “Patient (name or initials)” and produces a patient copy, while `/privacy` and the PIA say the product does not ask for patient data. **Next:** obtain a privacy/clinical decision, then default to identifier-free behavior unless transient identifier processing is explicitly approved and documented. **Success:** no contradictory copy; no identifier is persisted or transmitted without an approved basis. **Verify:** focused component/privacy/copy/accessibility tests, browser print/copy smoke, `verify:cheap`, production-readiness. **Stop:** any new storage or provider transmission requires a separate review. | `src/components/patient-safety-plan.tsx:649`; `src/app/privacy/page.tsx:28`; `docs/privacy-impact-assessment.md:18` | 2026-07-24 | | #054 | P2 | issue | Missing answer relevance metadata is treated as source-backed | **Outcome:** absent `relevance` metadata renders conservatively. `RagAnswer.relevance` is optional, but `relevance?.isSourceBacked !== false` treats `undefined` as source-backed. **Next:** add the red render-policy test, then make the smallest policy-only fix. **Success:** missing and explicit-false relevance fail closed; explicit source-backed relevance is unchanged. **Verify:** focused answer-render-policy, provenance, clinical-safety, `verify:cheap`, production-readiness. **Stop:** do not expand into retrieval, ranking, or generation. | `src/lib/types.ts:1029`; `src/lib/answer-render-policy.ts:145` | 2026-07-24 | | #055 | P2 | issue | Upload crash can strand a queued document without a job | **Outcome:** a crash between document and job creation cannot strand an upload indefinitely. **Next:** add the stranded-row reproducer, then choose the smallest idempotent atomic-enqueue RPC or bounded scheduled sweep consistent with current ownership and rollback contracts. **Success:** exactly one recoverable job is created; existing open jobs do not duplicate; owner scope, retry, audit, and rollback remain intact. **Verify:** focused upload/recovery/schema tests, migration guards, disposable replay if needed, `verify:cheap`, production-readiness. **Stop:** hosted changes require approval, and no at-least-once claim is valid until the crash case passes. | `src/app/api/upload/route.ts`; `docs/webhooks.md:163-192` | 2026-07-24 | +| #058 | P2 | task | Complete privacy and cross-border legal package | Execute the OpenAI and Railway DPAs; decide ZDR and residency; obtain written prompt-cache/subprocessor answers; and obtain APP 8 plus APP 5/1 counsel sign-off. Record evidence IDs, dates, decisions, and only counsel-approved public wording. Stop before provider outreach, signatures, account changes, or public-copy edits without the applicable owner approval. | `docs/openai-cross-border-basis.md`; `docs/privacy-impact-assessment.md` | 2026-07-24 | +| #059 | P2 | task | Configure privacy-preserving OpenAI safety identifiers | Set a unique 32+ character `OPENAI_SAFETY_IDENTIFIER_SECRET` in each approved environment that has `OPENAI_API_KEY`, using only the intended secret manager. Verify presence-only production readiness, HMAC pseudonymity, and clean secret scans. Stop on cross-environment reuse, target ambiguity, or a governance decision against stable identifiers. | `.env.example`; `src/lib/env.ts`; `scripts/production-readiness.ts` | 2026-07-24 | +| #060 | P2 | task | Reconcile operator configuration backlog | In the next approved readiness window, use read-only presence checks to reconcile query-hash, deep-probe, Supabase/OpenAI, project-identity, and schedule configuration before setting anything. Record status, never values; set only confirmed gaps. Stop on target ambiguity or cross-environment key reuse. | `docs/operator-backlog.md`; `docs/launch-operator-runbook.md` | 2026-07-24 | +| #061 | P2 | task | Select and verify owned SLO alert channels | Choose owned deploy, CI, ingestion, and SLO alert destinations, then configure only those channels; defer ingestion alerts until `#055` is resolved. Run mocked checks first and one controlled non-PHI event per approved channel. Stop without a destination owner or if safe delivery cannot be demonstrated. | `docs/operator-backlog.md`; `docs/webhooks.md`; `docs/capacity-review.md` | 2026-07-24 | +| #062 | P2 | task | Run the full release gate against an exact candidate | Run the release and clinical gates once against one immutable candidate SHA before a release or handoff that requires full confidence. Record every gate against that SHA, classify the first failure, and do not repeat an unchanged pass. Provider-backed portions and the heavy-command lock require their normal approvals. | `docs/production-readiness-checklist.md`; `.agents/skills/release/SKILL.md` | 2026-07-24 | +| #063 | P2 | task | Provision an isolated Clinical KB staging environment | After billable provider cost and ownership approval, provision dedicated Supabase/Railway staging with isolated keys and synthetic or non-clinical data. Verify target identity, tenancy, secrets, migrations, app/worker health, and the data boundary. Stop on target ambiguity or any production data/key reuse. | `docs/staging-setup.md`; `docs/deployment-architecture.md` | 2026-07-24 | +| #064 | P2 | task | Rehearse staging soak and rollback | After `#063`, run the documented soak and rollback rehearsal in dedicated staging. Record SLO, rollback, data-integrity, and recovery evidence. Stop before production if any outcome is unproven. | `docs/launch-operator-runbook.md`; `docs/capacity-review.md` | 2026-07-24 | +| #065 | P2 | task | Verify governed production seed coverage | In an approved production window, first prove read-only that registry, differentials, and medications data are non-empty; seed only confirmed governed gaps with idempotent procedures. Stop if the corpus is already populated or the owner/project target is ambiguous. | `docs/launch-operator-runbook.md`; `docs/operator-backlog.md` | 2026-07-24 | | #056 | P3 | rec | Define “Current Clinical Work” before implementation | **Outcome:** decide whether a workspace combining saved comparisons, partial formulation work, recent tools, and pinned source sets is worth building. **Next:** write a product/privacy/persistence brief only; do not build storage or UI. **Success:** the brief defines users, data classes, lifecycle, cross-device expectations, deletion, failure states, evidence of demand, and the smallest testable slice. **Stop:** close the idea if demand or safe persistence cannot be established. | session 2026-07-24; `src/lib/tools-catalog.ts:253-262` | 2026-07-24 | | #005 | P3 | rec | `finalScore` saturates at clamp ceiling | Base + ~40 stacked boosts routinely exceed 1.0, so strong matches tie at 1.0 and order by an arbitrary `document_id` tiebreak. If ranking is ever revisited, break ties by the **pre-clamp** score rather than raising the `[0,1]` ceiling (downstream gates assume `[0,1]`). Ordering already sorts by the unbounded pre-clamp `rankScore` (`clinical-search.ts:1735,1927,1950-1955`), so the clamp confines only the reported confidence value, not result order. Not a defect on the current golden set; any change here is a protected RAG surface (canary required). | `docs/rag-hybrid-findings-and-todo.md` P1 item 4; `src/lib/clinical-search.ts:1735` | 2026-07-21 | | #007 | P3 | rec | `/tools` vs `/?mode=tools` parallel Tools entry points | `/tools` (standalone `ApplicationsLauncherPage`) has no inbound in-app link; the sidebar Tools item uses `/?mode=tools`. Decide the canonical entry point and wire nav consistently, or drop the standalone `/tools` page + `/applications` redirect. Currently allowlisted in `tests/route-reachability.test.ts`. | `src/app/tools/page.tsx`; `src/app/applications/route.ts` | 2026-07-21 | From 10e065d2db581dafd581289bb50e11918c446754 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:43:54 +0800 Subject: [PATCH 08/13] fix: give every recommended task a ledger ID --- docs/outstanding-issues.md | 81 +++++++++++++++++++++----------------- 1 file changed, 44 insertions(+), 37 deletions(-) diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index e8a07efb6..f1baab216 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -52,42 +52,42 @@ Last reconciled on **2026-07-24** against fetched `origin/main` `705480a348b0876179d4e58f734bff22d11dc7e3`. No live application or provider state was queried. Revalidate the referenced evidence against current `main` immediately before starting a row. -| Order | Source | Recommended outcome / next action | Acuity / capability | When | Active effort | Dependencies / approval | Done, verification, and stop rule | -| ----: | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------- | ----------------------------------------------------------- | -------------------------------------- | -------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| 1 | `#057` | Verify provider-side containment of credentials previously exposed outside authorised stores; revoke or rotate any still-valid OpenAI, Supabase service-role/database, and E2E credentials, then update only intended secret stores. | A1 / Operator security + independent reviewer | Immediate approved security window | 1–3 hours | Credentialed provider owners; correct target identity; explicit provider and secret-store approval | Every old credential is rejected or retired; replacements exist only in intended stores; presence/readiness checks pass; no value enters Git, logs, issues, or chat. Use approved provider evidence and secret scans. Stop before provider action without approval and do not rewrite history without separate evidence. | -| 2 | `#053` | Align the Safety Plan Generator with the repository's no-patient-data contract before real-patient use. | A1 / Specialist privacy + clinical | Ready; first | 3–5 hours | Privacy/clinical owner | Copy, behavior, print, and tests agree; no identifier is persisted/transmitted without an approved basis. Run focused UI/privacy/a11y checks, `verify:cheap`, production-readiness. Stop before adding storage/provider flow. | -| 3 | `#054` | Fail closed when answer relevance metadata is absent; add the red policy test, then make the smallest render-policy correction. | A2 / Specialist clinical safety | Ready; after `#053` | 2–4 hours | Local/offline | Missing and explicit-false relevance are conservative; explicit source-backed behavior is unchanged. Run focused policy/provenance tests, `verify:cheap`, production-readiness. Stop before retrieval/ranking/generation. | -| 4 | `#052` | Prevent full/retry reindex overlapping a fresh agent-enrichment lease; add red single/bulk tests, then reuse `hasActiveAgentEnrichmentJob` before mutation. | A2 / High concurrency | Ready; after `#054` | 0.5–1 day | Local/offline | Fresh processing leases conflict; stale leases and enrichment mode retain behavior. Run focused route/safety tests, `verify:cheap`, production-readiness. Stop if current `main` does not reproduce it. | -| 5 | `#055` | Recover aged `queued` documents that have no open ingestion job; begin with a stranded-row reproducer and the smallest idempotent owner-scoped recovery path. | A2 / Specialist queue reliability | Ready; after `#052` | 0.5–1.5 days | Local replay for schema/scheduling; hosted changes need approval | Exactly one recoverable job is created under crash/concurrency/repeat; fresh queues and open jobs are untouched. Run focused recovery/schema tests, disposable replay if needed, `verify:cheap`, production-readiness. Stop if safe age/ownership cannot be proven. | -| 6 | `#058` | Finish local and browser QA on the isolated sidebar delivery branch, open its PR, and prove the approved six-item navigation lands on `main`. | A2 / High frontend release | Ready; after `#055` | 2–4 hours | Local heavyweight lock; GitHub approval | Run `verify:pr-local`, responsive/accessibility browser checks, `verify:ui`, production build and bundle budget; merge only with green required checks and exact `origin/main` content proof. Stop on any regression. | -| 7 | `#030` | Require distinct source identities for distinct expected comparison slots; begin with a red shared-title/two-expectation test. | A2 / High evaluation semantics | Decision-ready; code only after owner choice | 2–4 hours | Local/offline; protected-eval review | One source cannot satisfy both slots; existing cases stay green. Run focused matching, typecheck, `verify:cheap`. Stop before alias/retrieval/ranking changes. | -| 8 | `#019` | Prove admission evidence is lost at the comparison fallback boundary; scope the smallest correction without automatically shipping it. | A2 / Specialist RAG | Reproducer now; behavior after `#051`/`#023` | 0.5–1 day; fix separate | Protected review; approved baseline/post canary for behavior | Reproducer fails while packing retains both sources. Stop without behavior change if the boundary defect is not independently reproducible. | -| 9 | Privacy/legal package | Execute OpenAI/Railway DPAs; decide ZDR/residency; obtain cache/subprocessor answers and APP 8 plus APP 5/1 counsel sign-off. | A2 / Operator legal/privacy | Start now; before real-patient use/privacy-approved release | 4–8 hours internal; 1–6 weeks elapsed | Signers, counsel, providers | Record countersigned evidence, IDs, dates, decisions, and approved wording in PIA/cross-border docs. Stop before public-copy changes without counsel. | -| 10 | Safety identifier config | Set a unique 32+ character `OPENAI_SAFETY_IDENTIFIER_SECRET` per environment with `OPENAI_API_KEY`, never in Git/output. | A2 / Standard local + Operator hosted | Local now; hosted approved window | 15–30 min local; 30–60 min/env | Secret manager; hosted approval | Presence-only readiness passes, HMAC pseudonymity remains, secret scans clean. Stop if governance rejects stable identifiers. | -| 11 | Operator config backlog | Reconcile query-hash, deep-probe, Supabase/OpenAI, project identity, and schedules using read-only presence checks before setting anything. | A2 / Operator platform | Next approved readiness window | 1–2 hours | Provider approval, env owners | Record status, never values; set only confirmed gaps; identity/readiness pass. Stop on target ambiguity or cross-env key reuse. | -| 12 | `#022` | Decide auditable BMJ reference policy, then review the ten highest-impact local WA documents. | A2 / Operator governance + Specialist | Decision-ready | 1–2 hours policy; 0.5–1 day reviews | Clinical authority; live writes/canary approval | Preserve third-party/unverified provenance; record reviewer/evidence/time/rationale. Stop after ten and remeasure debt. | -| 13 | `#051` + `#023` | Compare run `30018289898` with the scheduled 2026-07-26 canary/browser/label artifacts; disposition residuals without rerun. | A2 / Specialist evaluation | About 2026-07-27 02:00 AWST plus runtime | 2–4 hours | Approval to read hosted artifacts; no dispatch | Record tree/run, content/provider/latency, browser, and labeling outcomes. Stop without spend or archived lithium changes. | -| 14 | `#018` | Diagnose lithium, ADHD, metabolic residuals independently: table fast path, extractive budget, schedule-free selection. | A2 / Specialist clinical RAG | After `#051`/`#023`; one mechanism at a time | 1–2 days diagnosis; fixes separate | Protected review; approved behavior canary | Each has a current-main fixture and scoped candidate; stop without deterministic repro or on individual canary regression. | -| 15 | `#001` | Reassess semantic reranking without changing default; enable only after accepted ambiguity comparison. | A2 / Specialist ranking | After `#051`/`#023` and rollout approval | 0.5–1 day plus canary review | Provider approval/budget | Keep off unless 36/36, recalls 1.0, zero case regressions, measured gain. Otherwise record keep-off decision. | -| 16 | `#033` | Decide whether governance metadata enters the LLM source block, distinguishing unknown from adverse status. | A3 / Specialist prompt governance | After `#022` and `#051`/`#023` | 1–2 days plus eval | Better metadata, stable canary, provider approval | Prompt/serialization tests; no grounded-supported drop; zero citation failures. Stop on over-caveating/degradation. | -| 17 | `#024` | Separate Playwright `_rsc` interception failure from a real Safari defect. | A3 / High Next.js/WebKit | After scheduled matrix data or real Safari repro | 0.5–1 day | Device/provider check only if local ambiguity | Test-only fix needs discriminating repro and meaningful access-control assertions; keep Chromium green. | -| 18 | `#007` | Choose canonical Tools experience; align nav, redirects, sitemap, reachability. | A3 / Operator product + Standard frontend | Product decision window | 15–30 min decision; 0.5 day code | Product owner | One canonical path and intentional redirect with green route/UI tests. Stop on unresolved standalone need. | -| 19 | `#025` + SLO alerts | Select owned deploy/CI/ingestion/SLO channels; configure only those, ingestion after `#055`. | A2 / Operator integrations | Approved observability window | 1–3 hours/channel | Provider approval, secrets, destination owner | Mocked tests then one controlled non-PHI event/channel. Stop on missing owner or unsafe delivery. | -| 20 | Full release gate | Run release/clinical gates once against an exact candidate, not a moving branch. | A2 / High release + Operator | Before release/handoff needing full confidence | 0.5 day plus waits | Exact SHA, provider approval, heavy-command lock | All required gates recorded against one SHA; stop/classify first failure and do not repeat unchanged pass. | -| 21 | Staging provision | Provision dedicated Clinical KB staging on Supabase/Railway with isolated keys and synthetic/non-clinical data. | A2 / Operator + Specialist DB | After cost/ownership approval | 0.5–1 day | Billable provider approval, owner | Identity, tenancy, secrets, migrations, app/worker health, data boundary pass. Stop on target ambiguity or production data/key reuse. | -| 22 | Staging soak/rollback | Run documented soak and rollback rehearsal in dedicated staging. | A2 / Operator reliability | After staging provision | 0.5 day plus soak | Staging and provider approval | SLO, rollback, data integrity, recovery evidence pass. Stop before production if unproven. | -| 23 | Production seed verification | Verify registry/differentials/medications non-empty before writes; seed only confirmed governed gaps. | A2 / Operator data + Specialist | Approved production window | 1–3 hours plus seed time | Correct owner/project, provider approval | Read-only proof precedes idempotent writes; stop if populated or target ambiguous. | -| 24 | `#011` | Switch Auth DB cap to percentage immediately before first compute scale-up. | A3 / Operator capacity | Scale-up trigger only | 30–60 min plus soak | Dashboard, planned scale-up, approval | Target only `sjrfecxgysukkwxsowpy`; record before/after and advisor/health recheck. Do not create/use staging for this task. | -| 25 | `#017` | Capture reproducible mobile/desktop production LCP, INP, CLS before performance work. | A3 / High web performance | Before `#012`/`#013`; approved live window | 1–2 hours | Live-site approval; record route/build/throttle | Record metrics and accept/reject decision. Stop if acceptable or too noisy. | -| 26 | `#037` | Decide whether routine supported claims cap at medium trust. | A3 / Operator clinical-product + Standard frontend | Next trust-policy review | 30–60 min decision; up to 0.5 day code | Clinical/product authority | Record policy; if accepted, change flag/render expectations only and run focused tests. Stop without owner acceptance. | -| 27 | `#027` | Add uptime monitor outside GitHub/Railway only if service, budget, responder justified. | Optional / Operator SRE | Owned external-alert trigger | 1–2 hours | Vendor/privacy/owner/provider approval | Controlled non-PHI failure/recovery alerts. Stop without responder or if current monitoring accepted. | -| 28 | `#028` | Define vendor/region/retention/redaction/sampling/maps/owner before runtime error tracking. | Optional / Specialist privacy + Operator | After privacy/ownership/cost approval | 1–3 days | Privacy and provider approval | Redaction tests exclude clinical data/IDs/secrets; one non-sensitive event arrives. Stop if envelope unacceptable. | -| 29 | `#012` + `#013` | Re-measure route payloads and slim only one production route with a demonstrated budget problem; ignore mockup-only code unless it enters production. | A3 / High Next.js performance | After `#017` or equivalent evidence; one route | 0.5–2 days/route | Measured target, Next.js guide, UI verification | Demonstrate a material parsed/gzip or interaction gain with unchanged behavior; run analysis, focused tests, `verify:cheap`, browser smoke. Stop if gain is small. | -| 30 | `#040` | Add small stable visual-regression baselines with owner/update workflow. | Optional / High visual QA | Stable surfaces and owner | 1–2 days | Stable browser, owner | Low-flake repeat runs and documented updates. Stop before blocking if churn high. | -| 31 | `#038` | Define shared comparison interaction contract before another comparison surface; keep clinical content mode-specific. | Optional / High design-system | Approved new comparison surface | 0.5–1 day | Concrete surface, product/design owner | Inventory patterns and make shared behavior testable. Stop if no new surface. | -| 32 | `#035` | Expand conflict detection only for concrete clinically reviewed class with positive/negative fixtures. | A3 / Specialist evidence rules | Demonstrated missed conflict | 0.5–1 day design; code separate | Clinical review; provider approval only for live validation | Fixtures discriminate class without unrelated warnings. Stop if no bounded class. | -| 33 | `#039` | Converge repeated catalogue toolbar behavior only during a concrete toolbar project. | Optional / High frontend architecture | Concrete project | 0.5–1 day inventory; 1–3 days code | Product/design owner, UI verification | Prove shared behavior without flattening search semantics; stop after bounded contract. | -| 34 | `#056` | Write a product/privacy/persistence brief for “Current Clinical Work” before any storage or UI implementation. | A3 / High product architecture + privacy | Only when the product owner wants to evaluate the feature | 0.5–1 day | Product owner, privacy/retention decision, evidence of demand | Define users, data classes, lifecycle, cross-device expectations, deletion, failure states, and a smallest testable slice. Stop if demand or safe persistence cannot be established. | +| Order | Source | Recommended outcome / next action | Acuity / capability | When | Active effort | Dependencies / approval | Done, verification, and stop rule | +| ----: | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------- | ----------------------------------------------------------- | -------------------------------------- | -------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| 1 | `#057` | Verify provider-side containment of credentials previously exposed outside authorised stores; revoke or rotate any still-valid OpenAI, Supabase service-role/database, and E2E credentials, then update only intended secret stores. | A1 / Operator security + independent reviewer | Immediate approved security window | 1–3 hours | Credentialed provider owners; correct target identity; explicit provider and secret-store approval | Every old credential is rejected or retired; replacements exist only in intended stores; presence/readiness checks pass; no value enters Git, logs, issues, or chat. Use approved provider evidence and secret scans. Stop before provider action without approval and do not rewrite history without separate evidence. | +| 2 | `#053` | Align the Safety Plan Generator with the repository's no-patient-data contract before real-patient use. | A1 / Specialist privacy + clinical | Ready; first | 3–5 hours | Privacy/clinical owner | Copy, behavior, print, and tests agree; no identifier is persisted/transmitted without an approved basis. Run focused UI/privacy/a11y checks, `verify:cheap`, production-readiness. Stop before adding storage/provider flow. | +| 3 | `#054` | Fail closed when answer relevance metadata is absent; add the red policy test, then make the smallest render-policy correction. | A2 / Specialist clinical safety | Ready; after `#053` | 2–4 hours | Local/offline | Missing and explicit-false relevance are conservative; explicit source-backed behavior is unchanged. Run focused policy/provenance tests, `verify:cheap`, production-readiness. Stop before retrieval/ranking/generation. | +| 4 | `#052` | Prevent full/retry reindex overlapping a fresh agent-enrichment lease; add red single/bulk tests, then reuse `hasActiveAgentEnrichmentJob` before mutation. | A2 / High concurrency | Ready; after `#054` | 0.5–1 day | Local/offline | Fresh processing leases conflict; stale leases and enrichment mode retain behavior. Run focused route/safety tests, `verify:cheap`, production-readiness. Stop if current `main` does not reproduce it. | +| 5 | `#055` | Recover aged `queued` documents that have no open ingestion job; begin with a stranded-row reproducer and the smallest idempotent owner-scoped recovery path. | A2 / Specialist queue reliability | Ready; after `#052` | 0.5–1.5 days | Local replay for schema/scheduling; hosted changes need approval | Exactly one recoverable job is created under crash/concurrency/repeat; fresh queues and open jobs are untouched. Run focused recovery/schema tests, disposable replay if needed, `verify:cheap`, production-readiness. Stop if safe age/ownership cannot be proven. | +| 6 | `#058` | Finish local and browser QA on the isolated sidebar delivery branch, open its PR, and prove the approved six-item navigation lands on `main`. | A2 / High frontend release | Ready; after `#055` | 2–4 hours | Local heavyweight lock; GitHub approval | Run `verify:pr-local`, responsive/accessibility browser checks, `verify:ui`, production build and bundle budget; merge only with green required checks and exact `origin/main` content proof. Stop on any regression. | +| 7 | `#030` | Require distinct source identities for distinct expected comparison slots; begin with a red shared-title/two-expectation test. | A2 / High evaluation semantics | Decision-ready; code only after owner choice | 2–4 hours | Local/offline; protected-eval review | One source cannot satisfy both slots; existing cases stay green. Run focused matching, typecheck, `verify:cheap`. Stop before alias/retrieval/ranking changes. | +| 8 | `#019` | Prove admission evidence is lost at the comparison fallback boundary; scope the smallest correction without automatically shipping it. | A2 / Specialist RAG | Reproducer now; behavior after `#051`/`#023` | 0.5–1 day; fix separate | Protected review; approved baseline/post canary for behavior | Reproducer fails while packing retains both sources. Stop without behavior change if the boundary defect is not independently reproducible. | +| 9 | `#059` | Execute OpenAI/Railway DPAs; decide ZDR/residency; obtain cache/subprocessor answers and APP 8 plus APP 5/1 counsel sign-off. | A2 / Operator legal/privacy | Start now; before real-patient use/privacy-approved release | 4–8 hours internal; 1–6 weeks elapsed | Signers, counsel, providers | Record countersigned evidence, IDs, dates, decisions, and approved wording in PIA/cross-border docs. Stop before public-copy changes without counsel. | +| 10 | `#060` | Set a unique 32+ character `OPENAI_SAFETY_IDENTIFIER_SECRET` per environment with `OPENAI_API_KEY`, never in Git/output. | A2 / Standard local + Operator hosted | Local now; hosted approved window | 15–30 min local; 30–60 min/env | Secret manager; hosted approval | Presence-only readiness passes, HMAC pseudonymity remains, secret scans clean. Stop if governance rejects stable identifiers. | +| 11 | `#061` | Reconcile query-hash, deep-probe, Supabase/OpenAI, project identity, and schedules using read-only presence checks before setting anything. | A2 / Operator platform | Next approved readiness window | 1–2 hours | Provider approval, env owners | Record status, never values; set only confirmed gaps; identity/readiness pass. Stop on target ambiguity or cross-env key reuse. | +| 12 | `#022` | Decide auditable BMJ reference policy, then review the ten highest-impact local WA documents. | A2 / Operator governance + Specialist | Decision-ready | 1–2 hours policy; 0.5–1 day reviews | Clinical authority; live writes/canary approval | Preserve third-party/unverified provenance; record reviewer/evidence/time/rationale. Stop after ten and remeasure debt. | +| 13 | `#051` + `#023` | Compare run `30018289898` with the scheduled 2026-07-26 canary/browser/label artifacts; disposition residuals without rerun. | A2 / Specialist evaluation | About 2026-07-27 02:00 AWST plus runtime | 2–4 hours | Approval to read hosted artifacts; no dispatch | Record tree/run, content/provider/latency, browser, and labeling outcomes. Stop without spend or archived lithium changes. | +| 14 | `#018` | Diagnose lithium, ADHD, metabolic residuals independently: table fast path, extractive budget, schedule-free selection. | A2 / Specialist clinical RAG | After `#051`/`#023`; one mechanism at a time | 1–2 days diagnosis; fixes separate | Protected review; approved behavior canary | Each has a current-main fixture and scoped candidate; stop without deterministic repro or on individual canary regression. | +| 15 | `#001` | Reassess semantic reranking without changing default; enable only after accepted ambiguity comparison. | A2 / Specialist ranking | After `#051`/`#023` and rollout approval | 0.5–1 day plus canary review | Provider approval/budget | Keep off unless 36/36, recalls 1.0, zero case regressions, measured gain. Otherwise record keep-off decision. | +| 16 | `#033` | Decide whether governance metadata enters the LLM source block, distinguishing unknown from adverse status. | A3 / Specialist prompt governance | After `#022` and `#051`/`#023` | 1–2 days plus eval | Better metadata, stable canary, provider approval | Prompt/serialization tests; no grounded-supported drop; zero citation failures. Stop on over-caveating/degradation. | +| 17 | `#024` | Separate Playwright `_rsc` interception failure from a real Safari defect. | A3 / High Next.js/WebKit | After scheduled matrix data or real Safari repro | 0.5–1 day | Device/provider check only if local ambiguity | Test-only fix needs discriminating repro and meaningful access-control assertions; keep Chromium green. | +| 18 | `#007` | Choose canonical Tools experience; align nav, redirects, sitemap, reachability. | A3 / Operator product + Standard frontend | Product decision window | 15–30 min decision; 0.5 day code | Product owner | One canonical path and intentional redirect with green route/UI tests. Stop on unresolved standalone need. | +| 19 | `#025` + SLO alerts | Select owned deploy/CI/ingestion/SLO channels; configure only those, ingestion after `#055`. | A2 / Operator integrations | Approved observability window | 1–3 hours/channel | Provider approval, secrets, destination owner | Mocked tests then one controlled non-PHI event/channel. Stop on missing owner or unsafe delivery. | +| 20 | `#062` | Run release/clinical gates once against an exact candidate, not a moving branch. | A2 / High release + Operator | Before release/handoff needing full confidence | 0.5 day plus waits | Exact SHA, provider approval, heavy-command lock | All required gates recorded against one SHA; stop/classify first failure and do not repeat unchanged pass. | +| 21 | `#063` | Provision dedicated Clinical KB staging on Supabase/Railway with isolated keys and synthetic/non-clinical data. | A2 / Operator + Specialist DB | After cost/ownership approval | 0.5–1 day | Billable provider approval, owner | Identity, tenancy, secrets, migrations, app/worker health, data boundary pass. Stop on target ambiguity or production data/key reuse. | +| 22 | `#064` | Run documented soak and rollback rehearsal in dedicated staging. | A2 / Operator reliability | After `#063` | 0.5 day plus soak | Staging and provider approval | SLO, rollback, data integrity, recovery evidence pass. Stop before production if unproven. | +| 23 | `#065` | Verify registry/differentials/medications non-empty before writes; seed only confirmed governed gaps. | A2 / Operator data + Specialist | Approved production window | 1–3 hours plus seed time | Correct owner/project, provider approval | Read-only proof precedes idempotent writes; stop if populated or target ambiguous. | +| 24 | `#011` | Switch Auth DB cap to percentage immediately before first compute scale-up. | A3 / Operator capacity | Scale-up trigger only | 30–60 min plus soak | Dashboard, planned scale-up, approval | Target only `sjrfecxgysukkwxsowpy`; record before/after and advisor/health recheck. Do not create/use staging for this task. | +| 25 | `#017` | Capture reproducible mobile/desktop production LCP, INP, CLS before performance work. | A3 / High web performance | Before `#012`/`#013`; approved live window | 1–2 hours | Live-site approval; record route/build/throttle | Record metrics and accept/reject decision. Stop if acceptable or too noisy. | +| 26 | `#037` | Decide whether routine supported claims cap at medium trust. | A3 / Operator clinical-product + Standard frontend | Next trust-policy review | 30–60 min decision; up to 0.5 day code | Clinical/product authority | Record policy; if accepted, change flag/render expectations only and run focused tests. Stop without owner acceptance. | +| 27 | `#027` | Add uptime monitor outside GitHub/Railway only if service, budget, responder justified. | Optional / Operator SRE | Owned external-alert trigger | 1–2 hours | Vendor/privacy/owner/provider approval | Controlled non-PHI failure/recovery alerts. Stop without responder or if current monitoring accepted. | +| 28 | `#028` | Define vendor/region/retention/redaction/sampling/maps/owner before runtime error tracking. | Optional / Specialist privacy + Operator | After privacy/ownership/cost approval | 1–3 days | Privacy and provider approval | Redaction tests exclude clinical data/IDs/secrets; one non-sensitive event arrives. Stop if envelope unacceptable. | +| 29 | `#012` + `#013` | Re-measure route payloads and slim only one production route with a demonstrated budget problem; ignore mockup-only code unless it enters production. | A3 / High Next.js performance | After `#017` or equivalent evidence; one route | 0.5–2 days/route | Measured target, Next.js guide, UI verification | Demonstrate a material parsed/gzip or interaction gain with unchanged behavior; run analysis, focused tests, `verify:cheap`, browser smoke. Stop if gain is small. | +| 30 | `#040` | Add small stable visual-regression baselines with owner/update workflow. | Optional / High visual QA | Stable surfaces and owner | 1–2 days | Stable browser, owner | Low-flake repeat runs and documented updates. Stop before blocking if churn high. | +| 31 | `#038` | Define shared comparison interaction contract before another comparison surface; keep clinical content mode-specific. | Optional / High design-system | Approved new comparison surface | 0.5–1 day | Concrete surface, product/design owner | Inventory patterns and make shared behavior testable. Stop if no new surface. | +| 32 | `#035` | Expand conflict detection only for concrete clinically reviewed class with positive/negative fixtures. | A3 / Specialist evidence rules | Demonstrated missed conflict | 0.5–1 day design; code separate | Clinical review; provider approval only for live validation | Fixtures discriminate class without unrelated warnings. Stop if no bounded class. | +| 33 | `#039` | Converge repeated catalogue toolbar behavior only during a concrete toolbar project. | Optional / High frontend architecture | Concrete project | 0.5–1 day inventory; 1–3 days code | Product/design owner, UI verification | Prove shared behavior without flattening search semantics; stop after bounded contract. | +| 34 | `#056` | Write a product/privacy/persistence brief for “Current Clinical Work” before any storage or UI implementation. | A3 / High product architecture + privacy | Only when the product owner wants to evaluate the feature | 0.5–1 day | Product owner, privacy/retention decision, evidence of demand | Define users, data classes, lifecycle, cross-device expectations, deletion, failure states, and a smallest testable slice. Stop if demand or safe persistence cannot be established. | ### Queue maintenance @@ -97,7 +97,7 @@ Revalidate the referenced evidence against current `main` immediately before sta 3. Treat provider status as a claim: verify only after approval and never store secret values. 4. Close/reclassify when a success or stop condition is met; do not preserve work for its own sake. - + ## Open items @@ -109,6 +109,13 @@ Revalidate the referenced evidence against current `main` immediately before sta | ---- | --- | ----- | --------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ---------- | | #057 | P1 | task | Verify containment of previously exposed credentials | **Outcome:** credentials previously exposed outside authorised stores can no longer authenticate. **Next:** in approved provider dashboards, revoke or rotate any still-valid OpenAI, Supabase service-role/database, and E2E credentials; update only intended secret stores and record status without values. **Success:** provider evidence shows every old credential rejected or retired, replacements are scoped to intended environments, and readiness checks pass. **Verify:** approved provider audit/rotation evidence, presence-only checks, and secret scanning that never prints values. **Stop:** no provider or secret-store action without explicit approval; never paste values into Git, logs, issues, or chat, and do not rewrite history without separate evidence. | session 2026-07-24 security reconciliation | 2026-07-24 | | #058 | P2 | task | Land and prove the streamlined six-item sidebar | Implementation and the corrected Therapy wiring assertion are committed on `codex/sidebar-test-fix-20260723`; focused sidebar/favourites suites pass 18/18. Remaining: run `verify:pr-local`, start the app and inspect desktop/tablet/mobile plus short-height scrolling and keyboard/focus behavior, run `verify:ui`, production build and bundle-budget checks, then open/merge the PR and prove the exact content is on `origin/main`. | branch `codex/sidebar-test-fix-20260723`; commit `cd54e68fb`; session 2026-07-24 | 2026-07-24 | +| #059 | P2 | task | Complete the cross-border privacy and legal package | Execute the OpenAI and Railway DPAs; decide ZDR and Australian residency; obtain prompt-cache and subprocessor answers; secure APP 8 plus APP 5/1 counsel sign-off. Record dated evidence and approved wording, and do not represent real-patient use as privacy-approved or change final public copy before counsel approval. | `docs/openai-cross-border-basis.md`; `docs/privacy-impact-assessment.md`; `docs/operator-backlog.md` | 2026-07-24 | +| #060 | P2 | task | Configure pseudonymous OpenAI safety identifiers | Set a unique 32+ character `OPENAI_SAFETY_IDENTIFIER_SECRET` alongside `OPENAI_API_KEY` in each intended environment using approved secret stores. Verify presence-only readiness and HMAC pseudonymity without printing values; stop if governance rejects stable identifiers or the target environment is ambiguous. | `docs/operator-backlog.md`; production-readiness configuration | 2026-07-24 | +| #061 | P2 | task | Reconcile the operator configuration backlog | In an approved readiness window, use read-only presence checks to reconcile query-hash, deep-probe, Supabase/OpenAI, project identity, and schedules before setting anything. Record status rather than values; configure only confirmed gaps and stop on target ambiguity or cross-environment key reuse. | `docs/operator-backlog.md`; `docs/production-readiness-checklist.md` | 2026-07-24 | +| #062 | P2 | task | Run the full release gate on one exact candidate | Run the required release and clinical gates once against one immutable candidate SHA, recording every result against that SHA. Obtain approval before provider-backed checks, respect the heavyweight lock, classify the first failure, and do not repeat an unchanged passing gate. | `docs/operator-backlog.md`; `.agents/skills/release/SKILL.md` | 2026-07-24 | +| #063 | P2 | task | Provision isolated Clinical KB staging | After cost and ownership approval, provision dedicated Supabase and Railway staging with isolated keys and synthetic or non-clinical data. Prove project identity, tenancy, secrets, migrations, app/worker health, and data boundaries; stop on target ambiguity or any production data/key reuse. | `docs/operator-backlog.md`; `docs/launch-operator-runbook.md` | 2026-07-24 | +| #064 | P2 | task | Complete staging soak and rollback rehearsal | After `#063`, run the documented soak and rollback rehearsal in dedicated staging. Record SLO, rollback, data-integrity, and recovery evidence; stop before production if rollback or recovery remains unproven. | `docs/operator-backlog.md`; `docs/launch-operator-runbook.md`; `docs/capacity-review.md` | 2026-07-24 | +| #065 | P2 | task | Verify production seed data before any write | In an approved production window, prove the registry, differentials, and medications datasets are non-empty before making changes; seed only confirmed governed gaps through idempotent paths. Stop without writing if data is already populated or project/owner identity is ambiguous. | `docs/operator-backlog.md`; production data-readiness workstream | 2026-07-24 | | #051 | P2 | task | Stabilise the live answer-quality canary before more RAG tuning | Diagnostics landed in PR #1095: structured JSON/Markdown artifacts now record the actual checked-out SHA, run identity and latency context, and the offline trend tool separates content, provider-route and latency outcomes. First validating run `30018289898` recorded the expected tree and cost, with 36/36 retrieval green, but one report cannot establish variability; PR #1097 prevents a single failure being mislabeled as repeated. Next: compare the scheduled 2026-07-26 structured report with this run. Do not spend on an immediate retry or reapply the archived lithium guard before that comparison. | PR #1095; run `30018289898`; PR #1097; archive ref `refs/archive/rejected-rag/20260723/monitoring-subject-gate` | 2026-07-23 | | #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 | | #052 | P2 | issue | Reindex can overlap a fresh agent-enrichment pass | Full/retry reindex preflights check `ingestion_jobs` but do not call the existing `hasActiveAgentEnrichmentJob`. A fresh `indexing_v3_agent_jobs.status='processing'` lease can therefore overlap destructive artifact work. Extend single and bulk full/retry preflights before mutation; keep stale leases non-blocking and preserve enrichment-mode behavior. | `src/lib/ingestion-mutation-safety.ts:116-159`; single/bulk reindex routes; ingestion audit 2026-07-24 | 2026-07-24 | From 86e948494e05cb43f7ca0d270e67843d07aa8b1c Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:45:07 +0800 Subject: [PATCH 09/13] docs: refresh ledger reconciliation base --- docs/outstanding-issues.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index 66ad64ad0..e6b32e23c 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -49,7 +49,7 @@ executable item below it. ## Recommended execution queue Last reconciled on **2026-07-24** against fetched `origin/main` -`bb701618c08946a0f2ece8052b6376e366567f71`. No live application or provider state was queried. +`705480a34c2dd8b70fc27ce021350e7f26a107a7`. No live application or provider state was queried. Revalidate the referenced evidence against current `main` immediately before starting a row. | Order | Source | Recommended outcome / next action | Acuity / capability | When | Active effort | Dependencies / approval | Done, verification, and stop rule | From a969f2c4ecee683f9f77608c6ef10dbf9cc08a7d Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 08:58:10 +0800 Subject: [PATCH 10/13] docs: record universal ledger follow-up review --- docs/branch-review-ledger.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md index 65d17fc47..35ecd0c59 100644 --- a/docs/branch-review-ledger.md +++ b/docs/branch-review-ledger.md @@ -20,6 +20,7 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD | Date | Branch or ref | Reviewed HEAD | Scope | Outcome | Checks | | ---------- | -------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| 2026-07-24 | `codex/pr1109-final-merge` | `5be82c10a83d2db1f295092f3074bf821209b450` + reviewed ledger entry | Universal-ledger follow-up and merge readiness | APPROVE. No P0-P2 finding remains. The follow-up preserves merged-main IDs, adds six distinct follow-ups as `#059`–`#064`, closes the inherited queue-order gap, keeps all 32 recommendations backed by open IDs, and fixes the SessionStart hook so a non-empty queue is still surfaced when the open table is empty. The streamlined-sidebar handoff is retained as `#064`; no live provider action is performed by this change. | `npm run format:changed`; hook `bash -n` and startup output; custom queue/open-ID invariants (32 contiguous orders, 46 unique open IDs, no missing queue references, next ID 065); `npm run verify:cheap` (365 files, 3,242 passed/1 skipped) on the reviewed follow-up before merging one subsequent docs-only `#023` priority commit from main; final formatting, hook, invariant, and diff checks rerun after that merge. No OpenAI, Supabase, Railway, deployment, or production-data workflow ran. | | 2026-07-24 | PR #1106 / `codex/task-ledger-final-11318f` | `5d128a2844c2298d0da36df64e5e2f7dda11e14b` + reviewed follow-up diff | Universal task-ledger workflow and protected-main merge readiness | APPROVE after follow-up. `docs/outstanding-issues.md` is the single durable task ledger, with retained work carrying order, acuity, timing, capability, effort, dependencies, success criteria, verification and stop rules. Four actionable review findings were fixed: filtered `/issues` reads now apply the filter to open items before rendering queued and non-queued results; the session hook excludes queued IDs from its priority summary; `#030` is consistently P2/A2 in the canonical open table and queue; and the sole A1/P1 blocker is first while `#052` is explicitly the first code task. No other actionable review thread remains in the reviewed scope. | Protected CI at the initial reviewed head passed policy, static, safety/config, unit coverage, Semgrep, Gitleaks, GitGuardian and the required aggregate; UI, build, migration replay and release browser matrix were correctly skipped for the docs/workflow scope. Follow-up proof: scoped Prettier; hook syntax/runtime plus exact ID-deduplication, P2-count and A1-first assertions; docs links (1,136 references); canonical skill catalog (32 skills, 8 aliases); `git diff --check`. Exact-head hosted CI remains required after the follow-up push. No OpenAI, Supabase, Railway, deployment or production-data operation ran. | | 2026-07-24 | `codex/supabase-document-change-trigger` | `9c7d9edf509a51478f5bebbabcca64e3926dc877` + reviewed working diff | Document-change ingestion trigger migration, schema mirror, grants, privacy and fail-safe delivery | APPROVE. No P0-P2 finding. The trigger is update-only, acts solely on a strict JSON boolean false/absent-to-true transition, sends only the receiver's allowlisted owner-scoped fields, fails open for document writes when Vault/GUC/pg_net is unavailable, and revokes execution from public/anon/authenticated. No production URL fallback exists. Highest residual risk is deliberate pg_net at-most-once delivery; the clear-then-flip recovery and data-preserving rollback are documented, and the trigger remains inert until both the Vault secret and environment base-URL GUC are configured. | Disposable Supabase Postgres `17.6.1.127` schema replay and drift-manifest regeneration passed (16s; scratch container removed); focused schema/drift/receiver Vitest 89/89; migration-role, function-grant (30 SECURITY DEFINER functions) and owner-scope guards; production-readiness CI mode READY with expected secretless-worktree warnings; offline RAG 21 suites/307 tests; `verify:cheap` 365 files, 3,241 passed/1 skipped; static trace of receiver payload, authoritative owner-scoped reload and idempotent enqueue path. No live provider mutation or migration apply. | | 2026-07-23 | PR #1090 / `cursor/fix-phone-dock-edge-1b1d` | `761de7e9ad623b6bd8d634d849a9eb465d622e48` (merged as `09028ef217209fceb53f1122ac7738b509bce323`) | Phone safe-area and edge-to-edge search-dock UI review | MERGED. No P0-P2 finding. The branch was three commits behind, so current `origin/main` was merged before landing; the actual merge tree matched the reviewed synthetic tree. The dock remains flush to the viewport with safe-area padding inside the form, and the phone shell no longer retains the `dvh` clamp that created the Safari toolbar band. Zero actionable review threads. | `npm run ensure`; focused `ui-tools.spec.ts` phone-home and edge-to-edge scenarios: Chromium 2/2 and WebKit 2/2; refreshed hosted policy, security, unit, build, advisory UI, Production UI and required aggregate checks green; exact-head ancestry and local-main tree equality proved after merge. | From 6a7400d334db5650280ed8f641a08eb299561564 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 09:02:58 +0800 Subject: [PATCH 11/13] fix: correct staging soak ledger dependency --- docs/branch-review-ledger.md | 2 +- docs/outstanding-issues.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md index 35ecd0c59..103d31214 100644 --- a/docs/branch-review-ledger.md +++ b/docs/branch-review-ledger.md @@ -20,7 +20,7 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD | Date | Branch or ref | Reviewed HEAD | Scope | Outcome | Checks | | ---------- | -------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| 2026-07-24 | `codex/pr1109-final-merge` | `5be82c10a83d2db1f295092f3074bf821209b450` + reviewed ledger entry | Universal-ledger follow-up and merge readiness | APPROVE. No P0-P2 finding remains. The follow-up preserves merged-main IDs, adds six distinct follow-ups as `#059`–`#064`, closes the inherited queue-order gap, keeps all 32 recommendations backed by open IDs, and fixes the SessionStart hook so a non-empty queue is still surfaced when the open table is empty. The streamlined-sidebar handoff is retained as `#064`; no live provider action is performed by this change. | `npm run format:changed`; hook `bash -n` and startup output; custom queue/open-ID invariants (32 contiguous orders, 46 unique open IDs, no missing queue references, next ID 065); `npm run verify:cheap` (365 files, 3,242 passed/1 skipped) on the reviewed follow-up before merging one subsequent docs-only `#023` priority commit from main; final formatting, hook, invariant, and diff checks rerun after that merge. No OpenAI, Supabase, Railway, deployment, or production-data workflow ran. | +| 2026-07-24 | `codex/pr1109-final-merge` | `a969f2c4ecee683f9f77608c6ef10dbf9cc08a7d` + reviewed follow-up diff | Universal-ledger follow-up and merge readiness | APPROVE after follow-up. Both automated review threads identified the same stale staging dependency; `#057` now depends explicitly on staging provision `#056` at order 18. The follow-up preserves merged-main IDs, adds six distinct follow-ups as `#059`–`#064`, closes the inherited queue-order gap, keeps all 32 recommendations backed by open IDs, and fixes the SessionStart hook so a non-empty queue is still surfaced when the open table is empty. The streamlined-sidebar handoff is retained as `#064`; no live provider action is performed by this change. | `npm run format:changed`; hook `bash -n` and startup output; custom queue/open-ID invariants (32 contiguous orders, 46 unique open IDs, no missing queue references, next ID 065); `npm run verify:cheap` (365 files, 3,242 passed/1 skipped) on the reviewed follow-up before merging one subsequent docs-only `#023` priority commit from main; final formatting, hook, invariant, dependency-reference, and diff checks rerun after that merge and review fix. No OpenAI, Supabase, Railway, deployment, or production-data workflow ran. | | 2026-07-24 | PR #1106 / `codex/task-ledger-final-11318f` | `5d128a2844c2298d0da36df64e5e2f7dda11e14b` + reviewed follow-up diff | Universal task-ledger workflow and protected-main merge readiness | APPROVE after follow-up. `docs/outstanding-issues.md` is the single durable task ledger, with retained work carrying order, acuity, timing, capability, effort, dependencies, success criteria, verification and stop rules. Four actionable review findings were fixed: filtered `/issues` reads now apply the filter to open items before rendering queued and non-queued results; the session hook excludes queued IDs from its priority summary; `#030` is consistently P2/A2 in the canonical open table and queue; and the sole A1/P1 blocker is first while `#052` is explicitly the first code task. No other actionable review thread remains in the reviewed scope. | Protected CI at the initial reviewed head passed policy, static, safety/config, unit coverage, Semgrep, Gitleaks, GitGuardian and the required aggregate; UI, build, migration replay and release browser matrix were correctly skipped for the docs/workflow scope. Follow-up proof: scoped Prettier; hook syntax/runtime plus exact ID-deduplication, P2-count and A1-first assertions; docs links (1,136 references); canonical skill catalog (32 skills, 8 aliases); `git diff --check`. Exact-head hosted CI remains required after the follow-up push. No OpenAI, Supabase, Railway, deployment or production-data operation ran. | | 2026-07-24 | `codex/supabase-document-change-trigger` | `9c7d9edf509a51478f5bebbabcca64e3926dc877` + reviewed working diff | Document-change ingestion trigger migration, schema mirror, grants, privacy and fail-safe delivery | APPROVE. No P0-P2 finding. The trigger is update-only, acts solely on a strict JSON boolean false/absent-to-true transition, sends only the receiver's allowlisted owner-scoped fields, fails open for document writes when Vault/GUC/pg_net is unavailable, and revokes execution from public/anon/authenticated. No production URL fallback exists. Highest residual risk is deliberate pg_net at-most-once delivery; the clear-then-flip recovery and data-preserving rollback are documented, and the trigger remains inert until both the Vault secret and environment base-URL GUC are configured. | Disposable Supabase Postgres `17.6.1.127` schema replay and drift-manifest regeneration passed (16s; scratch container removed); focused schema/drift/receiver Vitest 89/89; migration-role, function-grant (30 SECURITY DEFINER functions) and owner-scope guards; production-readiness CI mode READY with expected secretless-worktree warnings; offline RAG 21 suites/307 tests; `verify:cheap` 365 files, 3,241 passed/1 skipped; static trace of receiver payload, authoritative owner-scoped reload and idempotent enqueue path. No live provider mutation or migration apply. | | 2026-07-23 | PR #1090 / `cursor/fix-phone-dock-edge-1b1d` | `761de7e9ad623b6bd8d634d849a9eb465d622e48` (merged as `09028ef217209fceb53f1122ac7738b509bce323`) | Phone safe-area and edge-to-edge search-dock UI review | MERGED. No P0-P2 finding. The branch was three commits behind, so current `origin/main` was merged before landing; the actual merge tree matched the reviewed synthetic tree. The dock remains flush to the viewport with safe-area padding inside the form, and the phone shell no longer retains the `dvh` clamp that created the Safari toolbar band. Zero actionable review threads. | `npm run ensure`; focused `ui-tools.spec.ts` phone-home and edge-to-edge scenarios: Chromium 2/2 and WebKit 2/2; refreshed hosted policy, security, unit, build, advisory UI, Production UI and required aggregate checks green; exact-head ancestry and local-main tree equality proved after merge. | diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index 1631abe8b..589dab2ee 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -68,7 +68,7 @@ removed after current-main verification; it is not missing recommended work. | 16 | `#025` | A2 | Operator — Railway/GitHub/chat/Supabase | Next approved observability window | 1–3 hours/channel | Choose owned deployment, CI, ingestion, and SLO alerts; mock first, then one approved controlled provider event/channel. The merged Supabase trigger remains inert until its verified inputs are configured. Stop without an accountable responder. | | 17 | `#055` | A2 | Specialist release owner + Operator | Before next full-confidence release/handoff | 2–4 hours plus runtime | On one exact SHA, run local/provider gates, Firefox/WebKit, required hosted CI, and close actionable GitHub threads. Stop at first failure and rerun only the repaired smallest gate. | | 18 | `#056` | A2 | Operator — Supabase/Railway + Specialist | After cost/ownership approval | 0.5–1 day | Provision isolated `Clinical KB Staging` with synthetic data and distinct secrets. Verify identity, schema, indexing, health, and data boundary; never copy production clinical documents. | -| 19 | `#057` | A2 | High — release/SRE + Operator | After order 14 | 2–4 hours plus soak | Run documented staging soak and rollback against an exact candidate. Retain latency/error/rollback evidence; stop on unsafe data, identity mismatch, or unowned rollback. | +| 19 | `#057` | A2 | High — release/SRE + Operator | After `#056` (order 18) | 2–4 hours plus soak | Run documented staging soak and rollback against an exact candidate. Retain latency/error/rollback evidence; stop on unsafe data, identity mismatch, or unowned rollback. | | 20 | `#058` | A2 | Operator — production data + Specialist | Next approved production verification window | 30–60 min read-only; 1–2 hours if needed | Verify registry/differentials/medications are non-empty before writing; seed only confirmed gaps idempotently. Stop when healthy or owner/project identity is ambiguous. | | 21 | `#007` | A3 | Operator decision + Standard frontend | When product chooses canonical Tools route | 15–30 min decision; 0.5 day | Align navigation, redirect, sitemap, and reachability around one entry point. Stop while the standalone page has an unresolved requirement. | | 22 | `#011` | A3 | Operator — Supabase capacity | Immediately before first compute scale-up | 30–60 min plus observation | Switch Auth to percentage allocation, record before/after, and run approved advisor/health checks. Stop if no scale-up is planned. | From 1ea929fc65f4d9d52b9898240d25b81054c4b797 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 09:12:07 +0800 Subject: [PATCH 12/13] docs: make sidebar handoff recoverable --- docs/outstanding-issues.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index 56bc5c526..3956bf2aa 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -100,7 +100,7 @@ removed after current-main verification; it is not missing recommended work. | #061 | P2 | issue | Missing answer relevance metadata is treated as source-backed | **Outcome:** absent `relevance` metadata renders conservatively. `RagAnswer.relevance` is optional, but `relevance?.isSourceBacked !== false` treats `undefined` as source-backed. **Next:** add the red render-policy test, then make the smallest policy-only fix. **Success:** missing and explicit-false relevance fail closed while explicit source-backed behavior is unchanged. **Verify:** focused render-policy/provenance/clinical-safety tests, `verify:cheap`, and production-readiness. **Stop:** do not expand into retrieval, ranking, or generation. | `src/lib/types.ts`; `src/lib/answer-render-policy.ts` | 2026-07-24 | | #062 | P2 | issue | Upload crash can strand a queued document without a job | **Outcome:** a crash between document and job creation cannot strand an upload indefinitely. **Next:** add the stranded-row reproducer, then choose the smallest idempotent atomic-enqueue RPC or bounded scheduled sweep consistent with ownership and rollback contracts. **Success:** exactly one recoverable job is created, existing open jobs do not duplicate, and owner scope remains intact. **Verify:** focused upload/recovery/schema tests, migration guards, disposable replay if needed, `verify:cheap`, and production-readiness. **Stop:** hosted changes require approval; no at-least-once claim until the crash case passes. | `src/app/api/upload/route.ts`; `docs/webhooks.md` | 2026-07-24 | | #063 | P3 | rec | Define “Current Clinical Work” before implementation | **Outcome:** decide whether a workspace combining saved comparisons, partial formulation work, recent tools, and pinned source sets is worth building. **Next:** write a product/privacy/persistence brief only; do not build storage or UI. **Success:** define users, data classes, lifecycle, cross-device expectations, deletion, failure states, demand evidence, and the smallest testable slice. **Stop:** close the idea if demand or safe persistence cannot be established. | session 2026-07-24; `src/lib/tools-catalog.ts` | 2026-07-24 | -| #064 | P2 | task | Land and prove the streamlined six-item sidebar | Implementation and the corrected Therapy wiring assertion are committed on `codex/sidebar-test-fix-20260723`; focused sidebar/favourites suites pass 18/18. Remaining: run `verify:pr-local`, start the app and inspect desktop/tablet/mobile plus short-height scrolling and keyboard/focus behavior, run `verify:ui`, production build and bundle-budget checks, then open/merge the PR and prove the exact content is on `origin/main`. | branch `codex/sidebar-test-fix-20260723`; commit `cd54e68fb`; session 2026-07-24 | 2026-07-24 | +| #064 | P2 | task | Land and prove the streamlined six-item sidebar | Implementation and the corrected Therapy wiring assertion are recoverable from remote branch `origin/codex/sidebar-test-fix-20260723` at full commit `cd54e68fbf7b07b5dffe3220e36af2caa528da54`; fetch it in a fresh checkout with `git fetch origin refs/heads/codex/sidebar-test-fix-20260723`. Focused sidebar/favourites suites pass 18/18. Remaining: run `verify:pr-local`, start the app and inspect desktop/tablet/mobile plus short-height scrolling and keyboard/focus behavior, run `verify:ui`, production build and bundle-budget checks, then open/merge the PR and prove the exact content is on `origin/main`. | remote branch `origin/codex/sidebar-test-fix-20260723`; commit `cd54e68fbf7b07b5dffe3220e36af2caa528da54`; session 2026-07-24 | 2026-07-24 | | #051 | P2 | task | Stabilise the live answer-quality canary before more RAG tuning | Diagnostics landed in PR #1095: structured JSON/Markdown artifacts now record the actual checked-out SHA, run identity and latency context, and the offline trend tool separates content, provider-route and latency outcomes. First validating run `30018289898` recorded the expected tree and cost, with 36/36 retrieval green, but one report cannot establish variability; PR #1097 prevents a single failure being mislabeled as repeated. Next: compare the scheduled 2026-07-26 structured report with this run. Do not spend on an immediate retry or reapply the archived lithium guard before that comparison. | PR #1095; run `30018289898`; PR #1097; archive ref `refs/archive/rejected-rag/20260723/monitoring-subject-gate` | 2026-07-23 | | #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 | | #052 | P2 | issue | Reindex can overlap a fresh agent-enrichment pass | Full/retry single and bulk routes consult `ingestion_jobs` but not the implemented `hasActiveAgentEnrichmentJob` predicate. Add red route tests, then block fresh `indexing_v3_agent_jobs.status='processing'` leases before mutation while keeping stale leases and enrichment mode unchanged. | `src/lib/ingestion-mutation-safety.ts`; single/bulk reindex routes; repository audit 2026-07-24 | 2026-07-24 | From da53382bef380b87a5a9c6c769fd6c31d16f7e37 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Fri, 24 Jul 2026 09:18:05 +0800 Subject: [PATCH 13/13] docs: refresh sidebar review baseline --- docs/branch-review-ledger.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md index a93294605..161ccb72a 100644 --- a/docs/branch-review-ledger.md +++ b/docs/branch-review-ledger.md @@ -20,7 +20,7 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD | Date | Branch or ref | Reviewed HEAD | Scope | Outcome | Checks | | ---------- | -------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| 2026-07-24 | PR #1114 / `codex/universal-ledger-main-followup-20260724` | `6df0b5135799a0ee048a61dfe70a8e6eb1a87629` + reviewed working diff | Streamlined-sidebar handoff in the merged universal ledger | APPROVE. PR #1112 landed the universal-ledger reconciliation and hook fix, and PR #1116 then reserved `#064` and `#065`; this follow-up preserves that current-main schema and adds only the still-missing sidebar delivery as collision-free `#066`. The queue remains gap-free and every recommended ID has one open row. Sidebar implementation stays recoverable from remote branch `origin/codex/sidebar-test-fix-20260723` at full commit `cd54e68fbf7b07b5dffe3220e36af2caa528da54` until its local/browser/build/hosted merge proof is complete. | Focused sidebar/favourites tests previously passed 18/18 on the recorded implementation commit; this ledger follow-up passed Prettier, remote-ref recovery, 36-row contiguous-order/46-open-ID/next-ID invariants, and `git diff --check`. The broader reconciled precursor passed `verify:cheap` (365 files, 3,242 passed/1 skipped); fresh exact-head hosted CI is required on PR #1114. No OpenAI, Supabase, Railway, deployment, live-app, credential, or production-data action ran. | +| 2026-07-24 | PR #1114 / `codex/universal-ledger-main-followup-20260724` | `eedbe594a89eaa0aad8a517ee8808b089cb5ff57` + reviewed working diff | Streamlined-sidebar handoff in the merged universal ledger | APPROVE. PRs #1112, #1116, and #1117 landed the universal-ledger baseline, two preserved UI tasks, and credential/hook hardening; this follow-up preserves that current-main schema and adds only the still-missing sidebar delivery as collision-free `#066`. The queue remains gap-free and every recommended ID has one open row. Sidebar implementation stays recoverable from remote branch `origin/codex/sidebar-test-fix-20260723` at full commit `cd54e68fbf7b07b5dffe3220e36af2caa528da54` until its local/browser/build/hosted merge proof is complete. | Focused sidebar/favourites tests previously passed 18/18 on the recorded implementation commit; this ledger follow-up passed Prettier, remote-ref recovery, 36-row contiguous-order/46-open-ID/next-ID invariants, and `git diff --check`. The broader reconciled precursor passed `verify:cheap` (365 files, 3,242 passed/1 skipped); fresh exact-head hosted CI is required on PR #1114. No OpenAI, Supabase, Railway, deployment, live-app, credential, or production-data action ran. | | 2026-07-24 | `codex/universal-ledger-main-final` | `527988c2ccabc98b4d0673d33360c971df65fa0e` + reviewed working diff | Current-main universal-ledger reconciliation after PR #1106 superseded PR #1109 | READY. Kept PR #1106's current-main ledger and IDs, carried forward only non-duplicate recommended work from the superseded branch, and fixed the confirmed SessionStart empty-open defect. Every active recommendation now has a durable open ID; exposed-GitHub-token containment is the first A1 item; the Safety Plan privacy contract, absent-relevance fail-closed rule, stranded-upload recovery, threshold-conflict design, catalogue-toolbar convergence, and Current Clinical Work brief are retained without duplicating #1106's legal/config/release/staging/seed packages. Resolved #014/#034 claims stay archived, and PR #1110's scheduled-diagnostics priority remains intact. Highest residual risk is manual queue/open-table drift. | Empty-open fixture and real-ledger Bash execution passed; 33 contiguous recommendations reference tracked open IDs; 43 open items; no duplicate queued IDs; `docs:check-links`, `docs:check-index`, `docs:check-scripts`, `check:skills`, Prettier, and `git diff --check` passed. No OpenAI, Supabase, Railway, production, deployment, live-app, or credential action. | | 2026-07-24 | PR #1106 / `codex/task-ledger-final-11318f` | `5d128a2844c2298d0da36df64e5e2f7dda11e14b` + reviewed follow-up diff | Universal task-ledger workflow and protected-main merge readiness | APPROVE after follow-up. `docs/outstanding-issues.md` is the single durable task ledger, with retained work carrying order, acuity, timing, capability, effort, dependencies, success criteria, verification and stop rules. Four actionable review findings were fixed: filtered `/issues` reads now apply the filter to open items before rendering queued and non-queued results; the session hook excludes queued IDs from its priority summary; `#030` is consistently P2/A2 in the canonical open table and queue; and the sole A1/P1 blocker is first while `#052` is explicitly the first code task. No other actionable review thread remains in the reviewed scope. | Protected CI at the initial reviewed head passed policy, static, safety/config, unit coverage, Semgrep, Gitleaks, GitGuardian and the required aggregate; UI, build, migration replay and release browser matrix were correctly skipped for the docs/workflow scope. Follow-up proof: scoped Prettier; hook syntax/runtime plus exact ID-deduplication, P2-count and A1-first assertions; docs links (1,136 references); canonical skill catalog (32 skills, 8 aliases); `git diff --check`. Exact-head hosted CI remains required after the follow-up push. No OpenAI, Supabase, Railway, deployment or production-data operation ran. | | 2026-07-24 | `codex/supabase-document-change-trigger` | `9c7d9edf509a51478f5bebbabcca64e3926dc877` + reviewed working diff | Document-change ingestion trigger migration, schema mirror, grants, privacy and fail-safe delivery | APPROVE. No P0-P2 finding. The trigger is update-only, acts solely on a strict JSON boolean false/absent-to-true transition, sends only the receiver's allowlisted owner-scoped fields, fails open for document writes when Vault/GUC/pg_net is unavailable, and revokes execution from public/anon/authenticated. No production URL fallback exists. Highest residual risk is deliberate pg_net at-most-once delivery; the clear-then-flip recovery and data-preserving rollback are documented, and the trigger remains inert until both the Vault secret and environment base-URL GUC are configured. | Disposable Supabase Postgres `17.6.1.127` schema replay and drift-manifest regeneration passed (16s; scratch container removed); focused schema/drift/receiver Vitest 89/89; migration-role, function-grant (30 SECURITY DEFINER functions) and owner-scope guards; production-readiness CI mode READY with expected secretless-worktree warnings; offline RAG 21 suites/307 tests; `verify:cheap` 365 files, 3,241 passed/1 skipped; static trace of receiver payload, authoritative owner-scoped reload and idempotent enqueue path. No live provider mutation or migration apply. |