fix: audit SQL remediation (worker URL + grants) after main sync by BigSimmo · Pull Request #1197 · BigSimmo/Database

BigSimmo · 2026-07-25T11:43:48Z

Summary

Fixes PR #1197 after Bugbot / local review found merge-conflict regressions. Branch is synced to current main. Product/clinical/RAG surfaces match main (trust-gated clinical notes, stream-required summaryMode, no ISSUE-07 pre-classifier). Remaining delta is additive hosted SQL remediation plus ledger.

What remains vs main

supabase/migrations/20260725000000_audit_security_remediation.sql — restores real sjrfecxgysukkwxsowpy ingestion-worker URL (replacing [REDACTED] fallback from Fix Database↔Supabase interface audit findings (#052, #062, schema hygiene, table-facts latency) #1133), reasserts ISSUE-05 execute revokes and service_role grants, ISSUE-04 table/sequence revokes, and reasserts grants after CREATE OR REPLACE
supabase/schema.sql — same URL fix + ISSUE-05 revoke/grant trail
supabase/drift-manifest.json — regenerated via Docker drift:manifest
docs/branch-review-ledger.md — review/fix record

What was removed / restored from bad conflict resolutions

Restored trustGatedAnswerForClinicalNotes + ClinicalNotes boundary tests
Restored non-stream summaryMode → 400 summary_mode_stream_required contract
Dropped unattested deterministic RAG pre-classifier (rag.ts identical to main)
Dropped broken upload canonicalAuthority / identityAuthority references (undefined → 500)
Restored current docs/outstanding-issues.md and process tooling from main

RAG impact: no retrieval behaviour change — tip matches main RAG path; no src/lib/rag/** delta remains.

Clinical Governance Preflight

Source-backed claims still require linked source verification before clinical use
No patient-identifiable document workflow was introduced or expanded without explicit governance approval
Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
Service-role keys and private document access remain server-only
Demo/synthetic content remains clearly separated from real clinical sources
Source metadata, review status, and outdated/unknown-source behavior remain conservative
Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Verification

Vitest: rejects non-stream document summaries + ClinicalNotes boundary — 4/4
Vitest: rag-classifier-memo + rag-tail-latency — 17/17
Vitest: upload smart-title + storage cleanup — 3/3
Vitest: supabase-schema + function-grants — 83/83
npm run check:migration-role
npm run drift:manifest regenerated (Docker scratch replay)
npm run check:branch-review-ledger
Hosted PR required / Migration replay / Unit / Static / PR policy (prior tip green; tip re-running after grant harden)
UI verification not run: no UI/product component delta vs main
Verification not run: provider-backed live Supabase/OpenAI checks (not required for this SQL remediation)

Risk and rollout

Risk: low — SQL/schema/manifest-only delta after full main sync; clinical/RAG product code matches main; migration is additive/idempotent
Rollback: revert this tip; if migration already applied hosted, URL/grants remain correct (idempotent reassert) — no destructive schema drop
Twin agent branch PR fix(pr-1197): sync main and keep safe audit SQL remediation #1218 tracks the same tip and should be closed as duplicate after fix: audit SQL remediation (worker URL + grants) after main sync #1197 merges

- Added security revokes to schema - Implemented deterministic pre-classifier for RAG - Fixed CSS layer order for globals - Resolved test latency and timeout issues - Fixed responsive layout regressions

chatgpt-codex-connector · 2026-07-25T11:43:52Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

coderabbitai · 2026-07-25T11:43:54Z

Warning

Review limit reached

@BigSimmo, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 33 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: fd06dca0-166d-4b6b-a80f-02c7ebd4ecb1

📥 Commits

Reviewing files that changed from the base of the PR and between 85d4564 and 12ab1af.

📒 Files selected for processing (4)

docs/branch-review-ledger.md
supabase/drift-manifest.json
supabase/migrations/20260725000000_audit_security_remediation.sql
supabase/schema.sql

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch execute-system-audit-remediation

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

supabase · 2026-07-25T11:43:57Z

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy due to reaching the limit of concurrent preview branches.
Go to Project Integrations Settings ↗︎ if you wish to update this limit.

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

Merge origin/main into execute-system-audit-remediation tip and drop the bad conflict resolutions that removed clinical-notes trust gating, broke the summaryMode stream-required contract, and introduced an unattested RAG pre-classifier. Retain the additive hosted remediation migration that restores the real ingestion-worker URL (replacing main's [REDACTED] fallback), reasserts ISSUE-05 execute revokes, and regenerates the drift manifest from the updated schema.sql.

Record sync-to-main outcome, restored clinical contracts, dropped unattested RAG pre-classifier, and retained SQL URL remediation only.

Reassert service_role EXECUTE after CREATE OR REPLACE for invoke_ingestion_worker and the ISSUE-05 invoker RPCs, align schema.sql trailing ACL with the migration, and regenerate the drift manifest.

Sync with main, fix the ambiguous reviewed-head separator to the established `<head> / squash <sha>` form, record the ledger check in Checks, and drop the exact duplicate row from the union merge.

BigSimmo added 3 commits July 25, 2026 10:05

fix(audit): finalize audit remediation

e9f2b97

- Added security revokes to schema - Implemented deterministic pre-classifier for RAG - Fixed CSS layer order for globals - Resolved test latency and timeout issues - Fixed responsive layout regressions

fix(audit): resolve merge conflict markers and formatting

939288b

chore: fix merge conflicts and sync drift manifest

16c3184

BigSimmo mentioned this pull request Jul 25, 2026

docs: ledger PR #1197 Bugbot do-not-merge review #1211

Closed

BigSimmo added 3 commits July 25, 2026 23:29

merge: catch up to latest origin/main

c1e9696

docs: ledger PR #1197 fix-forward after Bugbot remediation

6c6555d

Record sync-to-main outcome, restored clinical contracts, dropped unattested RAG pre-classifier, and retained SQL URL remediation only.

BigSimmo mentioned this pull request Jul 25, 2026

fix(pr-1197): sync main and keep safe audit SQL remediation #1218

Closed

15 tasks

BigSimmo changed the title ~~fix: merge conflicts and audit remediation~~ fix: audit SQL remediation (worker URL + grants) after main sync Jul 25, 2026

github-actions Bot and others added 8 commits July 25, 2026 15:35

Merge branch 'main' into cursor/pr1197-fix-regressions-d06a

0511a41

Merge branch 'main' into execute-system-audit-remediation

936b9f4

merge: keep PR #1197 tip current with origin/main

165b372

merge: integrate remote PR #1197 tip after branch-sync

60bf388

merge: align cursor twin branch with remote

980d1f7

fix(pr-1197): harden audit migration grants for merge safety

c7ae011

Reassert service_role EXECUTE after CREATE OR REPLACE for invoke_ingestion_worker and the ISSUE-05 invoker RPCs, align schema.sql trailing ACL with the migration, and regenerate the drift manifest.

docs: ledger PR #1197 merge-ready grant harden

44f68a3

merge: sync origin/main to clear GitHub DIRTY staleness

12ab1af

BigSimmo merged commit 8ec2a3c into main Jul 25, 2026
35 of 36 checks passed

BigSimmo deleted the execute-system-audit-remediation branch July 25, 2026 16:03

BigSimmo mentioned this pull request Jul 25, 2026

docs: ledger prlanded merge for PR #1197 #1224

Merged

1 task

cursor Bot mentioned this pull request Jul 25, 2026

fix(chrome): hide and return the universal header on scroll at every breakpoint #1222

Merged

6 tasks

BigSimmo mentioned this pull request Jul 25, 2026

docs(ledger): batch the review appends from #1206, #1207, #1210, #1211, #1224 and the #1192 landing #1232

Merged

5 tasks

cursor Bot mentioned this pull request Jul 25, 2026

fix(audit): remediate system audit findings (P0, P1, P2) #1198

Closed

9 tasks

BigSimmo added a commit that referenced this pull request Jul 26, 2026

docs: ledger prlanded merge for PR #1197 (#1224)

357af1b

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: audit SQL remediation (worker URL + grants) after main sync#1197

fix: audit SQL remediation (worker URL + grants) after main sync#1197
BigSimmo merged 14 commits into
mainfrom
execute-system-audit-remediation

BigSimmo commented Jul 25, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Jul 25, 2026

Uh oh!

coderabbitai Bot commented Jul 25, 2026 •

edited

Loading

Review limit reached

Uh oh!

supabase Bot commented Jul 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

BigSimmo commented Jul 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Clinical Governance Preflight

Verification

Risk and rollout

Uh oh!

chatgpt-codex-connector Bot commented Jul 25, 2026

Uh oh!

coderabbitai Bot commented Jul 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

supabase Bot commented Jul 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

BigSimmo commented Jul 25, 2026 •

edited

Loading

coderabbitai Bot commented Jul 25, 2026 •

edited

Loading