fix(access): complete outstanding P0/P1 hardening and test alignment

[BigSimmo]

Summary

Completes outstanding access-hardening work and P2/P3 follow-up verification.

Code fixes (prior commits)

• Image signed-url route: repair broken merge while preserving owner-check-before-storage + committed-generation gating
• Setup status: JSON error envelope on unexpected failures
• Access route tests: managed port 4298, upload guard 409, withOwnerReadScope mock alignment

P2/P3 verification (this turn)

• npm run governance:release — PASS (label coverage, label governance, source metadata audit)
• Gold-label backfill dry-run — 0 documents need labels
• tests/private-access-routes.test.ts + tests/answer-render-policy.test.ts — 99/99 pass
• npm run eval:quality:release — FAIL thresholds: P95 latency ~50.7s (ceiling 25s); 4 latency cases >20s; 2 routing mismatches (illegal-substances, unsupported-close-title-noise)
• tests/ui-tools.spec.ts — blocked by local server port churn (4298 vs 4299) during long Playwright run; needs a single ensured URL for the full suite

Docs

• docs/clinical-governance.md: records public/anonymous API access patterns, rate-limit buckets, signed-url gates, and upload local-project guard

Follow-up

• Product decision on eval latency / review thresholds (or infra tuning for answer generation)
• Re-run verify:ui / ui-tools with stable npm run ensure URL (no competing dev servers)
• Live DB-level RLS integration test (anon key, two users) — still tracked as follow-up

  

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[BigSimmo]

Organizing open PRs (Jul 6): Superseded in part by #274 on main. Rebase remaining unique hardening onto main if still needed.

[BigSimmo]

Closing as superseded by merged work on \main:

• feat: complete public access rollout with migrations and public corpus promotion #274 — public access rollout, migrations, public corpus promotion
• fix: restore anonymous production setup-status for psychiatry.tools #277 — anonymous /api/setup-status\
• fix: treat Supabase project warning as ready in setup-status #287 — setup-status project \warning\ →
  eady\

Production is live with these fixes. Any remaining unique commits should be cherry-picked onto a fresh branch from current \main.