fix(pr-1197): sync main and keep safe audit SQL remediation

[BigSimmo]

Summary

Fixes PR #1197 after Bugbot / local review found merge-conflict regressions. Branch is synced to current main. Product/clinical/RAG surfaces match main (trust-gated clinical notes, stream-required summaryMode, no ISSUE-07 pre-classifier). Remaining delta is additive hosted SQL remediation plus ledger.

What remains vs main

• supabase/migrations/20260725000000_audit_security_remediation.sql — restores real sjrfecxgysukkwxsowpy ingestion-worker URL (replacing [REDACTED] fallback from Fix Database↔Supabase interface audit findings (#052, #062, schema hygiene, table-facts latency) #1133), reasserts ISSUE-05 execute revokes and service_role grants, ISSUE-04 table/sequence revokes, and reasserts grants after CREATE OR REPLACE
• supabase/schema.sql — same URL fix + ISSUE-05 revoke/grant trail
• supabase/drift-manifest.json — regenerated via Docker drift:manifest
• docs/branch-review-ledger.md — review/fix record

What was removed / restored from bad conflict resolutions

• Restored trustGatedAnswerForClinicalNotes + ClinicalNotes boundary tests
• Restored non-stream summaryMode → 400 summary_mode_stream_required contract
• Dropped unattested deterministic RAG pre-classifier (rag.ts identical to main)
• Dropped broken upload canonicalAuthority / identityAuthority references (undefined → 500)
• Restored current docs/outstanding-issues.md and process tooling from main

RAG impact: no retrieval behaviour change — tip matches main RAG path; no src/lib/rag/** delta remains.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Verification

• Vitest: rejects non-stream document summaries + ClinicalNotes boundary — 4/4
• Vitest: rag-classifier-memo + rag-tail-latency — 17/17
• Vitest: upload smart-title + storage cleanup — 3/3
• Vitest: supabase-schema + function-grants — 83/83
• npm run check:migration-role
• npm run drift:manifest regenerated (Docker scratch replay)
• npm run check:branch-review-ledger
• Hosted PR required / Migration replay / Unit / Static / PR policy (prior tip green; tip re-running after grant harden)
• UI verification not run: no UI/product component delta vs main
• Verification not run: provider-backed live Supabase/OpenAI checks (not required for this SQL remediation)

Risk and rollout

• Risk: low — SQL/schema/manifest-only delta after full main sync; clinical/RAG product code matches main; migration is additive/idempotent
• Rollback: revert this tip; if migration already applied hosted, URL/grants remain correct (idempotent reassert) — no destructive schema drop
• Twin agent branch PR fix(pr-1197): sync main and keep safe audit SQL remediation #1218 tracks the same tip and should be closed as duplicate after fix: audit SQL remediation (worker URL + grants) after main sync #1197 merges

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy due to reaching the limit of concurrent preview branches.
Go to Project Integrations Settings ↗︎ if you wish to update this limit.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 54cb57f7-378f-4cfb-a1bf-8fc774243dfd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/pr1197-fix-regressions-d06a

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[BigSimmo]

Closing as duplicate of squash-merged #1197 (8ec2a3c). Same tip content landed on main; keep #1197 as the canonical merge.