diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md index 161ccb72a..a6af85953 100644 --- a/docs/branch-review-ledger.md +++ b/docs/branch-review-ledger.md @@ -20,6 +20,7 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD | Date | Branch or ref | Reviewed HEAD | Scope | Outcome | Checks | | ---------- | -------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| 2026-07-24 | `codex/safety-plan-no-patient-data-contract` | `b94987c94537f3114a3429848fa908bdecd1d80a` | Safety Plan Generator identifier, local-state, copy, print, privacy-notice and PIA contract | APPROVE. No P0-P2 finding. The patient name/initials field is removed; the builder now asks for identifier-free minimum content, retains working state only in the mounted React component, and makes clipboard/print/PDF export an explicit handling boundary. The PIA and product privacy copy distinguish this local-only tool from provider-backed questions. Highest residual risk is outside Clinical KB: users must handle exported copies under an approved clinical-record process, which the UI now states at the export controls. | Privacy/component DOM 3/3 plus updated privacy-copy 2/2; focused Chromium copy/print/no-fetch-or-XHR 1/1; `verify:cheap` passed all 21 gates, 366 files and 3,245 tests with 1 skip; production-readiness READY using the existing canonical environment without a provider call; production build and client-bundle secret scan passed; offline RAG fixture/manifest 36 cases/21 suites passed. `verify:pr-local` passed runtime, formatting, lint and typecheck, then stopped on the unrelated load-sensitive `reconciliation-preflight` 30-second timeout; that test passed 5/5 isolated and the preceding full suite passed, so the unchanged five-minute gate was not retried. No Supabase, OpenAI, Railway, live RAG, production data or deployment action ran. | | 2026-07-24 | PR #1114 / `codex/universal-ledger-main-followup-20260724` | `eedbe594a89eaa0aad8a517ee8808b089cb5ff57` + reviewed working diff | Streamlined-sidebar handoff in the merged universal ledger | APPROVE. PRs #1112, #1116, and #1117 landed the universal-ledger baseline, two preserved UI tasks, and credential/hook hardening; this follow-up preserves that current-main schema and adds only the still-missing sidebar delivery as collision-free `#066`. The queue remains gap-free and every recommended ID has one open row. Sidebar implementation stays recoverable from remote branch `origin/codex/sidebar-test-fix-20260723` at full commit `cd54e68fbf7b07b5dffe3220e36af2caa528da54` until its local/browser/build/hosted merge proof is complete. | Focused sidebar/favourites tests previously passed 18/18 on the recorded implementation commit; this ledger follow-up passed Prettier, remote-ref recovery, 36-row contiguous-order/46-open-ID/next-ID invariants, and `git diff --check`. The broader reconciled precursor passed `verify:cheap` (365 files, 3,242 passed/1 skipped); fresh exact-head hosted CI is required on PR #1114. No OpenAI, Supabase, Railway, deployment, live-app, credential, or production-data action ran. | | 2026-07-24 | `codex/universal-ledger-main-final` | `527988c2ccabc98b4d0673d33360c971df65fa0e` + reviewed working diff | Current-main universal-ledger reconciliation after PR #1106 superseded PR #1109 | READY. Kept PR #1106's current-main ledger and IDs, carried forward only non-duplicate recommended work from the superseded branch, and fixed the confirmed SessionStart empty-open defect. Every active recommendation now has a durable open ID; exposed-GitHub-token containment is the first A1 item; the Safety Plan privacy contract, absent-relevance fail-closed rule, stranded-upload recovery, threshold-conflict design, catalogue-toolbar convergence, and Current Clinical Work brief are retained without duplicating #1106's legal/config/release/staging/seed packages. Resolved #014/#034 claims stay archived, and PR #1110's scheduled-diagnostics priority remains intact. Highest residual risk is manual queue/open-table drift. | Empty-open fixture and real-ledger Bash execution passed; 33 contiguous recommendations reference tracked open IDs; 43 open items; no duplicate queued IDs; `docs:check-links`, `docs:check-index`, `docs:check-scripts`, `check:skills`, Prettier, and `git diff --check` passed. No OpenAI, Supabase, Railway, production, deployment, live-app, or credential action. | | 2026-07-24 | PR #1106 / `codex/task-ledger-final-11318f` | `5d128a2844c2298d0da36df64e5e2f7dda11e14b` + reviewed follow-up diff | Universal task-ledger workflow and protected-main merge readiness | APPROVE after follow-up. `docs/outstanding-issues.md` is the single durable task ledger, with retained work carrying order, acuity, timing, capability, effort, dependencies, success criteria, verification and stop rules. Four actionable review findings were fixed: filtered `/issues` reads now apply the filter to open items before rendering queued and non-queued results; the session hook excludes queued IDs from its priority summary; `#030` is consistently P2/A2 in the canonical open table and queue; and the sole A1/P1 blocker is first while `#052` is explicitly the first code task. No other actionable review thread remains in the reviewed scope. | Protected CI at the initial reviewed head passed policy, static, safety/config, unit coverage, Semgrep, Gitleaks, GitGuardian and the required aggregate; UI, build, migration replay and release browser matrix were correctly skipped for the docs/workflow scope. Follow-up proof: scoped Prettier; hook syntax/runtime plus exact ID-deduplication, P2-count and A1-first assertions; docs links (1,136 references); canonical skill catalog (32 skills, 8 aliases); `git diff --check`. Exact-head hosted CI remains required after the follow-up push. No OpenAI, Supabase, Railway, deployment or production-data operation ran. | diff --git a/docs/privacy-impact-assessment.md b/docs/privacy-impact-assessment.md index 384b62a53..bc2bfdc0d 100644 --- a/docs/privacy-impact-assessment.md +++ b/docs/privacy-impact-assessment.md @@ -15,7 +15,9 @@ The app is a **clinical knowledge base** — it indexes clinical reference material (guidelines, drug monographs, protocols) and answers clinician questions over that corpus with retrieval-augmented -generation. It is **not** a patient record system and, by design, does not ask for patient data. +generation. It is **not** a patient record system. Provider-backed features do not ask for patient +identifiers. The Safety Plan Generator accepts sensitive identifier-free working content and support +contacts, but keeps them in the current browser tab rather than transmitting or persisting them. The dominant privacy risk is therefore **incidental PHI**: a clinician will inevitably type patient details into a free-text query ("42yo F on clozapine 400mg with rising WCC, next step?"). That query @@ -64,6 +66,7 @@ material. | Clinical reference corpus (documents, chunks, embeddings, images, tables) | Supabase (Sydney) + storage buckets | Low–Medium | Published guidelines are not PHI; **uploaded** docs _could_ contain PHI. | | Free-text clinical queries | Processed by Railway (Singapore); hashed into Supabase logs (Sydney); sent to OpenAI (US) for retrieval embedding and, when selected, answer synthesis | **High (potential PHI)** | The primary incidental-PHI vector; embedding egress can occur even when the final answer is source-only. | | Generated answers | `rag_queries.answer` (not persisted unless `RAG_PERSIST_ANSWER_TEXT`); short-lived `rag_response_cache.payload` | **High (derived from PHI query + corpus)** | Durable answer log dropped at rest by default (PIA-3); expired cache rows have a bounded hourly purge when `pg_cron` is available. | +| Safety-plan working content | React memory in the current browser tab; user-directed clipboard, print, or PDF output | **High (sensitive health information)** | No patient-identifier field; not sent to the application service or stored by Clinical KB. Exported copies leave this boundary. | | User identity | Supabase Auth (`auth.users`), `owner_id` foreign keys | Medium (PII) | Email + SSO identity; managed by Supabase Auth. | | Audit trail | `audit_logs` | Medium | Append-only, service-role-only, retained indefinitely by design. | | Operational telemetry | `rag_retrieval_logs`, ingestion job tables | Low–Medium | Redacted query text; per-owner. | @@ -128,6 +131,15 @@ model egress points (A) and (C) then carry query/evidence content to OpenAI in t data remains in Sydney. Governance must assess both overseas processing paths rather than treating OpenAI as the only cross-border flow. +The `/safety-plan` route has a separate local-only flow: form inputs update React state in the current +browser tab, with no API request or browser-storage write. Clearing the plan, unmounting the component, +or closing the tab discards that working state. Copy, print, and save-as-PDF are explicit user-directed +exports; the exported copy is outside Clinical KB and must be handled under the organisation's approved +clinical-record process. The tool provides no patient name, date-of-birth, or record-number field and +warns against putting patient identifiers into free text; any patient identifier must be added after +export if local policy permits it. Support-contact names and phone details are accepted as sensitive +working content within the same local-only boundary. + --- ## 4. What reaches OpenAI, and under what terms diff --git a/src/app/privacy/page.tsx b/src/app/privacy/page.tsx index 0375be696..6ee555399 100644 --- a/src/app/privacy/page.tsx +++ b/src/app/privacy/page.tsx @@ -25,14 +25,15 @@ const SECTIONS: Section[] = [ body: ( <> Clinical KB is a knowledge base over clinical reference material. It is{" "} - not a patient-record system and does not ask for patient data. The main privacy risk is - incidental patient information entered into a free-text question or uploaded document. + not a patient-record system and its provider-backed features do not ask for patient + identifiers. The Safety Plan Generator accepts sensitive working content and support contacts but deliberately + omits a patient-identifier field. ), }, { heading: "What is collected", - body: "Questions, generated answers, account identifiers, uploaded documents, retrieved excerpts, document metadata, and operational or retrieval telemetry may be processed. Free text and uploaded material can contain sensitive information if you enter it.", + body: "Questions, generated answers, account identifiers, uploaded documents, retrieved excerpts, document metadata, and operational or retrieval telemetry may be processed. Free text and uploaded material can contain sensitive information if you enter it. Safety-plan working content is different: it remains in the current browser tab and is not sent to the application service or stored by Clinical KB.", }, { heading: "How questions are handled", @@ -61,11 +62,11 @@ const SECTIONS: Section[] = [ }, { heading: "Retention", - body: "Repository migrations configure 30-day retention for RAG query records, 90-day retention for retrieval logs and query-miss telemetry, and a bounded hourly purge of expired response-cache rows when the database scheduler is available. The operator must verify that those scheduled jobs are active. Uploaded documents remain until removed under the applicable process.", + body: "Repository migrations configure 30-day retention for RAG query records, 90-day retention for retrieval logs and query-miss telemetry, and a bounded hourly purge of expired response-cache rows when the database scheduler is available. The operator must verify that those scheduled jobs are active. Uploaded documents remain until removed under the applicable process. Safety-plan working content has no Clinical KB retention: it is discarded when the component is cleared or the tab is closed. Clipboard, print, and PDF copies are outside the app and must follow the organisation's approved record-handling process.", }, { heading: "Your responsibilities", - body: "Do not enter patient-identifiable information. Upload only material you are authorised to use, keep access credentials private, review original linked sources before relying on clinical output, and report suspected privacy or access issues through your organisation's approved process.", + body: "Do not enter patient-identifiable information. In the Safety Plan Generator, add any patient identifier only after export through your organisation's approved clinical-record process. Upload only material you are authorised to use, keep access credentials private, review original linked sources before relying on clinical output, and report suspected privacy or access issues through your organisation's approved process.", }, ]; diff --git a/src/app/safety-plan/page.tsx b/src/app/safety-plan/page.tsx index 689d65073..f404cff09 100644 --- a/src/app/safety-plan/page.tsx +++ b/src/app/safety-plan/page.tsx @@ -5,7 +5,7 @@ import { PatientSafetyPlan } from "@/components/patient-safety-plan"; export const metadata: Metadata = { title: "Safety plan generator - Clinical KB", description: - "Build a patient safety plan with the Stanley-Brown six steps and a live patient copy to print, save as PDF, or hand over.", + "Build an identifier-free patient safety plan with the Stanley-Brown six steps in a transient browser session, then export it through an approved clinical workflow.", }; export default function SafetyPlanPage() { diff --git a/src/components/patient-safety-plan.tsx b/src/components/patient-safety-plan.tsx index 5fbd9b601..8461bc322 100644 --- a/src/components/patient-safety-plan.tsx +++ b/src/components/patient-safety-plan.tsx @@ -42,11 +42,13 @@ import { * A clinician builds an evidence-based safety plan *with* the patient (the * Stanley-Brown Safety Planning Intervention, six prioritised steps), and a * live patient-facing preview updates as they type — ready to print, save as - * PDF, or hand over. Sample content is seeded so the layout reads fully; every - * field is editable and "Clear all" empties the plan. Australian English + AU - * crisis resources throughout, per the Clinical KB (en-AU) voice. All chrome is - * token-driven so light/dark, reduced-motion and forced-colors follow the - * shared design system. + * PDF, or hand over. Working content stays in this mounted browser component; + * the app neither stores it nor sends it to a server. Copy and print are + * explicit user-directed exports. Sample content is seeded so the layout reads + * fully; every field is editable and "Clear all" empties the plan. + * Australian English + AU crisis resources throughout, per the Clinical KB + * (en-AU) voice. All chrome is token-driven so light/dark, reduced-motion and + * forced-colors follow the shared design system. */ const focusRing = @@ -422,7 +424,6 @@ function PreviewStep({ def, entries }: { def: StepDef; entries: Entry[] }) { export function PatientSafetyPlan() { const [entries, setEntries] = useState>(EMPTY_ENTRIES); const [reasons, setReasons] = useState([]); - const [patient, setPatient] = useState(""); const [planDate, setPlanDate] = useState(""); const [mobileTab, setMobileTab] = useState<"build" | "preview">("build"); const [copied, setCopied] = useState(false); @@ -452,7 +453,7 @@ export function PatientSafetyPlan() { const planText = useMemo(() => { const lines: string[] = [ "MY SAFETY PLAN", - patient ? `For: ${patient}` : "", + "Name (add after export): ____________________", planDate ? `Date: ${planDate}` : "", "", ]; @@ -474,7 +475,7 @@ export function PatientSafetyPlan() { lines.push("In an emergency: call 000 or go to your nearest Emergency Department."); lines.push("24/7 support: Lifeline 13 11 14 · Suicide Call Back Service 1300 659 467."); return lines.filter((line, index, all) => !(line === "" && all[index - 1] === "")).join("\n"); - }, [entries, patient, planDate, reasons]); + }, [entries, planDate, reasons]); const copyPlan = async () => { try { @@ -492,16 +493,11 @@ export function PatientSafetyPlan() { const loadExample = () => { const hasContent = - Object.values(entries).some((rows) => rows.length > 0) || - reasons.length > 0 || - patient.trim() !== "" || - planDate.trim() !== ""; + Object.values(entries).some((rows) => rows.length > 0) || reasons.length > 0 || planDate.trim() !== ""; if (hasContent && !window.confirm("Replace the current plan with the example content?")) return; setEntries(SEED); setReasons(SEED_REASONS); - // Clear the patient context so example content can never carry a real - // patient's name or date into the preview/print output. - setPatient(""); + // Clear the plan date so example content cannot look like a current handover. setPlanDate(""); setFinalised(false); }; @@ -509,7 +505,6 @@ export function PatientSafetyPlan() { const clearAll = () => { setEntries(EMPTY_ENTRIES); setReasons([]); - setPatient(""); setPlanDate(""); setFinalised(false); }; @@ -536,8 +531,8 @@ export function PatientSafetyPlan() { Safety plan generator

- Build an evidence-based safety plan with your patient — the six prioritised steps — then print, - save as PDF, or hand over a copy. + Build an identifier-free safety plan with your patient — the six prioritised steps — then + export it through your approved clinical workflow.

@@ -642,26 +637,24 @@ export function PatientSafetyPlan() { - {/* Patient context */} -
-
- - { - setPatient(event.target.value); - setFinalised(false); - }} - placeholder="e.g. Sam R." - className={fieldControlPlain} - /> + {/* Local-only working boundary */} +
+
+
+

+ Copying, printing, or saving a PDF moves the plan outside Clinical KB. Add any patient identifier only after + export, using your organisation's approved clinical record and handling process. +

+ {finalised ? (
- {patient ? patient : "Name: ________________"} + Name (add after printing): ________________ {planDate ? planDate : "Date: ____________"}

@@ -875,7 +876,8 @@ export function PatientSafetyPlan() { className="mt-3 flex items-center gap-1.5 px-1 text-2xs font-semibold text-[color:var(--text-soft)]" >

diff --git a/src/lib/tools-catalog.ts b/src/lib/tools-catalog.ts index f5d6aae3d..32d6916be 100644 --- a/src/lib/tools-catalog.ts +++ b/src/lib/tools-catalog.ts @@ -202,10 +202,10 @@ export const toolCatalogRecords: ToolCatalogRecord[] = [ id: "safety-plan", title: "Safety plan", mobileTitle: "Safety plan", - description: "Build a patient safety plan with the Stanley-Brown six steps and a printable copy.", + description: "Build an identifier-free safety plan with the Stanley-Brown six steps and a printable copy.", bestFor: "Collaborative safety planning", detail: - "Build an evidence-based safety plan with the patient — warning signs, coping strategies, supports, and means safety — with a live patient copy to print, save as PDF, or hand over.", + "Build an identifier-free safety plan with the patient — warning signs, coping strategies, supports, and means safety. Working content stays in the current browser tab until you copy, print, or save a PDF.", href: "/safety-plan", area: "care", status: "ready", @@ -224,8 +224,13 @@ export const toolCatalogRecords: ToolCatalogRecord[] = [ "means safety", ], checkFirst: ["Current risk and recent changes", "Warning signs and triggers", "Trusted supports and crisis lines"], - neededInput: ["Warning signs", "Coping strategies and supports", "Crisis contacts and means-safety steps"], - output: "A six-step safety plan with a patient copy to print, save as PDF, or hand over.", + neededInput: [ + "No patient identifiers", + "Warning signs", + "Coping strategies and supports", + "Crisis contacts and means-safety steps", + ], + output: "An identifier-free six-step safety plan to export through an approved clinical workflow.", }, { id: "monitoring", diff --git a/tests/patient-safety-plan-privacy.dom.test.tsx b/tests/patient-safety-plan-privacy.dom.test.tsx new file mode 100644 index 000000000..bb2bd8d40 --- /dev/null +++ b/tests/patient-safety-plan-privacy.dom.test.tsx @@ -0,0 +1,56 @@ +import { fireEvent, render, screen } from "@testing-library/react"; +import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"; + +import { PatientSafetyPlan } from "@/components/patient-safety-plan"; + +describe("PatientSafetyPlan privacy contract", () => { + const writeText = vi.fn(async () => undefined); + + beforeEach(() => { + vi.clearAllMocks(); + Object.defineProperty(navigator, "clipboard", { + configurable: true, + value: { writeText }, + }); + }); + + afterEach(() => { + vi.restoreAllMocks(); + }); + + it("does not ask for a patient identifier and explains the transient browser-only boundary", () => { + render(); + + expect(screen.queryByLabelText(/Patient \(name or initials\)/i)).toBeNull(); + expect(screen.getByText(/Do not enter the patient(?:'|’)s name, date of birth, or record number/i)).toBeVisible(); + expect(screen.getByText(/kept only in this browser tab/i)).toBeVisible(); + }); + + it("copies the plan without persisting or transmitting its working content", async () => { + const fetchSpy = vi.spyOn(globalThis, "fetch"); + const localStorageSpy = vi.spyOn(Storage.prototype, "setItem"); + + render(); + fireEvent.change(screen.getByLabelText("e.g. Not sleeping for a couple of nights"), { + target: { value: "Not sleeping" }, + }); + fireEvent.click(screen.getAllByRole("button", { name: "Add" })[0]); + fireEvent.click(screen.getByRole("button", { name: "Copy" })); + + expect(writeText).toHaveBeenCalledTimes(1); + expect(writeText).toHaveBeenCalledWith(expect.stringContaining("Not sleeping")); + expect(writeText).not.toHaveBeenCalledWith(expect.stringMatching(/^For:/m)); + expect(localStorageSpy).not.toHaveBeenCalled(); + expect(fetchSpy).not.toHaveBeenCalled(); + }); + + it("warns that copy, print, and PDF output leave the transient app session", () => { + const printSpy = vi.spyOn(window, "print").mockImplementation(() => undefined); + + render(); + expect(screen.getByText(/Copying, printing, or saving a PDF moves the plan outside Clinical KB/i)).toBeVisible(); + fireEvent.click(screen.getByRole("button", { name: "Print / PDF" })); + + expect(printSpy).toHaveBeenCalledTimes(1); + }); +}); diff --git a/tests/privacy-ui.test.ts b/tests/privacy-ui.test.ts index 6c3f70392..44efb1fcb 100644 --- a/tests/privacy-ui.test.ts +++ b/tests/privacy-ui.test.ts @@ -34,7 +34,10 @@ describe("privacy UI", () => { } // JSX drops a newline adjacent to a tag, so the space after the bolded // phrase must be explicit or this renders as "systemand". - expect(markup).toContain("not a patient-record system and does not ask for patient data"); + expect(markup).toContain("not a patient-record system and its provider-backed features"); + expect(markup).toContain("deliberately omits a patient-identifier field"); + expect(markup).toContain("Safety-plan working content has no Clinical KB retention"); + expect(markup).toContain("Clipboard, print, and PDF copies are outside the app"); expect(markup).toContain("Generated answer text is also omitted from durable query logs by default"); expect(markup).toContain("application service in Singapore"); expect(markup).toContain("Railway in Singapore"); diff --git a/tests/ui-tools.spec.ts b/tests/ui-tools.spec.ts index 04a2db924..b80984204 100644 --- a/tests/ui-tools.spec.ts +++ b/tests/ui-tools.spec.ts @@ -2187,6 +2187,53 @@ test.describe("Responsive layout guards", () => { expect(resultBox!.y + resultBox!.height).toBeLessThanOrEqual(dockBox!.y + 2); }); + test("safety-plan working content stays local until an explicit export", async ({ page }) => { + const appRequests: string[] = []; + page.on("request", (request) => { + if (request.resourceType() === "fetch" || request.resourceType() === "xhr") appRequests.push(request.url()); + }); + + await page.goto("/safety-plan"); + await expect(page.getByLabel(/Patient \(name or initials\)/i)).toHaveCount(0); + await expect(page.getByText(/kept only in this browser tab/i)).toBeVisible(); + await expect( + page.getByText(/Copying, printing, or saving a PDF moves the plan outside Clinical KB/i), + ).toBeVisible(); + + await page.evaluate(() => { + const testWindow = window as typeof window & { __copiedPlan?: string; __printCalled?: boolean }; + Object.defineProperty(navigator, "clipboard", { + configurable: true, + value: { + writeText: async (value: string) => { + testWindow.__copiedPlan = value; + }, + }, + }); + window.print = () => { + testWindow.__printCalled = true; + }; + }); + appRequests.length = 0; + + await page.getByLabel("e.g. Not sleeping for a couple of nights").fill("Not sleeping"); + await page.getByRole("button", { name: "Add" }).first().click(); + await page.getByRole("button", { name: "Copy" }).click(); + + await expect + .poll(() => page.evaluate(() => (window as typeof window & { __copiedPlan?: string }).__copiedPlan)) + .toContain("Not sleeping"); + expect(await page.evaluate(() => (window as typeof window & { __copiedPlan?: string }).__copiedPlan)).not.toMatch( + /^For:/m, + ); + + await page.getByRole("button", { name: "Print / PDF" }).click(); + await expect + .poll(() => page.evaluate(() => (window as typeof window & { __printCalled?: boolean }).__printCalled)) + .toBe(true); + expect(appRequests).toEqual([]); + }); + test("differentials recent work remains touch-sized inside its mobile scroll row", async ({ page }) => { await page.setViewportSize({ width: 320, height: 760 }); await mockAnswerDashboardApi(page);