From 10b99b3308b41b43b34e56d805c9510793faa70b Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Sat, 25 Jul 2026 22:31:59 +0800 Subject: [PATCH] docs(ledger): record Cursor Bugbot review of PR #1186 Append merge-readiness and prlanded outcome for remediate-repository-audit-findings @ 8637fec: DO NOT MERGE, not landed, CONFLICTING vs main. --- docs/branch-review-ledger.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md index d956b4dc1..69c00d8a4 100644 --- a/docs/branch-review-ledger.md +++ b/docs/branch-review-ledger.md @@ -797,3 +797,14 @@ This file is append-only. Never rewrite or delete an existing review record; app | 2026-07-25 | codex/search-results-filters-20260725 | 88131e7267efd33059766dec80355a9246fbb2bf | Search result filters and document Sources merge-readiness review | APPROVE. No P0-P2 finding after current-main sync. Documents open Sources as an on-screen filtering surface with source-type controls; the shared results ribbon is applied across search pages. Highest residual risk: unusual real-content combinations may alter perceived density, while responsive, forced-colors, focus, and overflow paths are browser-covered. RAG impact: no retrieval behaviour change - UI controls and source browsing only. | `npm run verify:ui` pass 268/268; `npm run verify:cheap` pass (377 files, 3340 passed, 1 skipped); post-sync `npm run verify:pr-local` pass (378 files, 3349 passed, 1 skipped, production build, bundle-secret scan, offline RAG fixtures); `npm run check:production-readiness` pass with OPENAI_SAFETY_IDENTIFIER_SECRET warning; no live/provider-backed app checks run. | | 2026-07-25 | `codex/therapy-page-polish-ad78b4` | `157559aa0678f02de09c14f66d544b62a5138c4a` | Targeted release review: Therapy naming, centred navigation, and white canvas | APPROVE. No P0-P3 findings. The production Therapy route consistently uses the title Therapy, the shared page background token, and a centred overflow-safe section navigation. The latest `origin/main` merge was clean and retained both upstream responsive/home-composer assertions. Highest residual risk is visual drift at an untested browser engine; exact desktop and phone Chromium measurements were stable. | Focused Vitest 40/40; pre-sync `verify:cheap` 378 files / 3342 passed / 1 skipped; pre-sync `verify:ui` passed; integrated runtime, Prettier, lint, and typecheck passed; integrated Vitest was interrupted by the shared heavyweight-test queue after an independent 378-file / 3342-pass run. Required hosted checks must pass on the published exact head before merge. No clinical/provider workflow ran. | | 2026-07-25 | codex/search-results-filters-20260725 (PR #1184) | 8f74d8bd40810ede34ad4b155973b598c1be0101 | Superseding merge-readiness review after Sources focus repair | APPROVE. Supersedes the 88131e72 row: the automated P2 showed a transient Daily Actions menu item could disconnect before Sources restored focus. Closing Sources now falls back after unmount to the currently rendered action trigger, and the regression requires the visible Documents trigger to own focus. No P0-P2 finding remains. RAG impact: no retrieval behaviour change - UI focus restoration only. | Post-fix isolated production Chromium 1/1; post-current-main local Chromium 1/1; `npm run verify:cheap` pass (378 files, 3350 passed, 1 skipped); targeted Prettier and ESLint pass; required hosted checks must rerun on the published exact head; no live clinical/provider workflow ran. | + +| 2026-07-25 | PR #1192 / `cursor/fix-mobile-composer-edge-scroll-5b1d` | `0c2b60a646fd6e7a53cf24f778aa59e3d54ba8aa` | Explicit thorough open-PR review (Antigravity/Cursor queue) | REQUEST CHANGES. P1: `composerChromeFocused` latches forever when focused dock unmounts (no blur), pinning header scroll-hide permanently. P2: reserve-only hide gate ignores offset → near-bottom clamp (stress: 120/224 frames on answer geometry; 584 clamp-risk across sweep). P2s: submit blur to body; autofocus re-fire; non-answer `focus=1` unfixed; untested collapseKind DOM mapping; PR body copy-paste mismatch. | Focused Vitest mobile-composer-reserve + use-hide-on-scroll PASS in detached worktree; Node stress of reserve-only gate; static diff review. No provider/UI browser matrix. | +| 2026-07-25 | PR #1187 / `cursor/fix-mode-switch-lag-22f6` | `113de416970cceea8952df55b3fe41cd7a2ca82a` | Explicit thorough open-PR review | DO NOT MERGE. CONFLICTING on `globals.css` (semantic vs main motion tokens). P1: `isDashboardModeHref` early-return breaks Answer→Documents cross-mode search (`/documents/search` keeps ClinicalDashboard mounted; stale mode + `run=1` can fire unintended answer generation). P2: dock reveal snap; phone dock flash on mode-home nav; forced scrollTop=0 on every pathname; skeleton min-height overshoot. PR body mismatched. | Static path trace through app-modes/search-route-ownership; merge-tree confirmed globals.css conflict. Hosted CI previously red (Static PR + Production UI). No provider calls. | +| 2026-07-25 | PR #1195 / `subagent-Asset-Optimization-Implementer-self-b295a5bb` | `d63682c7e68b6ea41670a0db2349817c2e29988f` | Explicit thorough Antigravity PR review | DO NOT MERGE. Stale divergent base `faa50e6e3` (not ancestor of main; 434 behind) still carries literal conflict markers in `answer`/`upload` API routes. P1: `minimumCacheTTL: 86400` contradicts private signed-URL cache warning. P1: mutating `svgo` `check:assets` wired into required CI. P2: SignedImage transform query params silent no-op (not SSRF); immutable year-long unversioned icons; orphan AVIF binaries. | Verified markers via `git grep` on head; next.config comment contradiction confirmed. No provider calls. | +| 2026-07-25 | PR #1190 / `remediate-dark-mode-audit` | `00eca49b9b0d7e5fbfa5703a15e9e930963984a6` | Explicit thorough Antigravity PR review | DO NOT MERGE / CLOSE+REDO. P0: deletes `trustGatedAnswerForClinicalNotes` fail-closed clinical notes gate (zero hits on branch; four on main). P1: fake favourites handler; unused theme imports after removing PWA colours; answer route imports nonexistent `@/lib/rag`; upload RPC not on main; deletes security/ingestion-safety tests. Conflict markers cleaned by discarding main's side. | `git grep trustGatedAnswerForClinicalNotes` main vs head; marker scan. No provider calls. | +| 2026-07-25 | PR #1188 / `execute-audit-remediation-plan` | `8b8639113925601e1687bfe4f1f29c44a4308b61` | Explicit thorough Antigravity PR review | DO NOT MERGE. P0: `ClinicalDashboard.tsx` orphaned import body (syntax error). P0: `indexing-v3-agent/utils.ts` has `async export function` + missing `CLINICAL_PHRASE_PATTERN`. Also inherits conflict markers from `faa50e6e3`. Prune commit otherwise clean. | `git show` of broken import + utils.ts; marker scan. No provider calls. | +| 2026-07-25 | PR #1186 / `remediate-repository-audit-findings` | `8637fec36dea6534c02e5b3f12e5a913c10bc455` | Explicit thorough Antigravity PR review | DO NOT MERGE. P0: duplicate `const results` in `scripts/eval-retrieval.ts` (RAG eval surface; needs RAG impact line). P0: skills catalog 32→35 breaks `tests/database-skills.test.ts`. P1: stale-lock heartbeat never fires under `spawnSync`; `skill-create` YAML wrong shape; `sweep-merged-branches` destructive without dry-run + shell interpolation. Inherits conflict markers. | `git show` eval-retrieval duplicate const; marker scan. No provider/eval runs. | +| 2026-07-25 | PR #1185 / `execute-typography-audit-fixes` | `dd641579f4cf54f82de89ef268ac8aa6acb439b5` | Explicit thorough Antigravity PR review | REBASE/CHERRY-PICK ONLY. Intentional delta is safe (5 files, font-stack + mockup heading/truncation). Tree still carries conflict markers from `faa50e6e3` so PR as-is cannot build. Cherry-pick `dd641579` onto current main. | Intentional `git show --stat`; marker scan on head. No provider calls. | +| 2026-07-25 | PR #1162 / `execute-audit-code-remediation` | `692eb248c095d64443a5f9ed0ab7b02394f0ed4b` | Explicit thorough Antigravity PR review | CONDITIONAL after rebase. Substantive upload RPC + batch signed-URL work looks sound (service_role-only SECURITY DEFINER; batch auth equivalent to single-image). Still CONFLICTING vs main (ClinicalDashboard, global-search-shell, mode-home-template, search-scope, tests, pdf extractor). P2: batch rate-limit amplification ×100; mobile back `push` vs `back` semantics; duplicate-hash match via plpgsql message text. CI red on Static/Safety/Unit/UI/Migration. | merge-tree conflict list; static auth/RPC review. No provider/migration replay. | +| 2026-07-25 | PR #1186 / `remediate-repository-audit-findings` | `8637fec36dea6534c02e5b3f12e5a913c10bc455` | Explicit Bugbot PR review (reconfirm same HEAD) | DO NOT MERGE. Reconfirmed prior Antigravity findings; skill count correction 32?36 (not 35). P0: conflict markers in API/UI/tests/docs (tsc TS1185). P0: duplicate `const results` in `scripts/eval-retrieval.ts` (RAG eval; PR body lacks RAG impact line). P0: skills catalog 36 vs test/AGENTS 32. P1: heartbeat under `spawnSync` never runs so 30m mtime stale reclaim can steal live locks; `branch:cleanup` deletes with no dry-run + shell-interpolated branch names; `skill-create` emits non-`interface:` openai.yaml. | Marker grep + tsc sample; catalog count node; static lock/sweep/skill-create review. No provider/eval runs. | +| 2026-07-25 | PR #1186 / `remediate-repository-audit-findings` | `8637fec36dea6534c02e5b3f12e5a913c10bc455` | Cursor Bugbot+review+prlanded (fresh pass, same HEAD) | DO NOT MERGE; NOT LANDED (state=OPEN, mergeable=CONFLICTING, DIRTY). Supersedes same-HEAD Antigravity/Bugbot rows with runtime proof: `tsc` TS1185 on answer/upload routes; head 436 behind / 2 ahead of main; PR policy FAIL. P0 conflict markers in 8 src + 2 tests + scripts/docs; P0 duplicate `const results` eval-retrieval.ts:905/932 (RAG; no RAG impact line); P0 skills catalog 36 vs AGENTS/tests 32. P1 spawnSync blocks lock heartbeat + 30m reclaim steals locks; branch:cleanup no dry-run + shell interpolation; skill-create wrong openai.yaml shape. Do not delete branch. | Bugbot; tsc sample; marker/catalog grep; gh pr view mergeable; no provider/eval/UI runs. |