Remove Evidence-based and All sources chips from answer footer

package.json

@@ -68,6 +68,7 @@
     "reindex:cleanup-staged": "tsx scripts/cleanup-abandoned-reindex-generations.ts",
     "supabase:recovery-status": "tsx scripts/supabase-recovery-status.ts",
     "promote:query-misses": "tsx scripts/promote-query-misses.ts",
+    "promote:public-documents": "tsx scripts/promote-public-documents.ts",
     "eval:rag": "node scripts/run-eval-safe.mjs scripts/eval-rag.ts",
     "eval:answer-quality": "node scripts/run-eval-safe.mjs scripts/eval-answer-quality.ts",
     "eval:quality": "node scripts/run-eval-safe.mjs scripts/eval-quality.ts",

scripts/capture-answer-bar-screenshot.ts

@@ -0,0 +1,90 @@
+import { mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { chromium } from "playwright";
+import { demoAnswer, demoDocuments } from "../src/lib/demo-data";
+
+const baseUrl = process.env.PLAYWRIGHT_BASE_URL ?? "http://localhost:4298";
+const outDir = join(process.cwd(), "scratch", "screenshots");
+const outPath = join(outDir, "answer-bar-after-chip-removal.png");
+const outBottomPath = join(outDir, "answer-bar-bottom-after-chip-removal.png");
+
+const readySetupChecks = [
+  { id: "env", label: ".env.local configured", status: "ready", detail: "Test environment ready." },
+  { id: "project", label: "Clinical KB Database target", status: "ready", detail: "Test Supabase project ready." },
+  { id: "schema", label: "supabase/schema.sql applied", status: "ready", detail: "Test schema ready." },
+  { id: "search", label: "Search RPC and vector indexes", status: "ready", detail: "Test search schema ready." },
+  { id: "openai", label: "OpenAI API key available", status: "ready", detail: "Test OpenAI ready." },
+  { id: "worker", label: "npm run worker running", status: "unknown", detail: "Worker not required." },
+];
+
+async function mockDemoApi(page) {
+  await page.route("**/api/setup-status**", async (route) => {
+    await route.fulfill({ json: { demoMode: true, checks: readySetupChecks } });
+  });
+  await page.route(/\/api\/documents(?:\?.*)?$/, async (route) => {
+    await route.fulfill({
+      json: {
+        documents: demoDocuments,
+        demoMode: true,
+        pagination: {
+          limit: 150,
+          offset: 0,
+          total: demoDocuments.length,
+          nextOffset: demoDocuments.length,
+          hasMore: false,
+        },
+      },
+    });
+  });
+  await page.route(/\/api\/ingestion\/(jobs|batches|quality)(?:\?.*)?$/, async (route) => {
+    await route.fulfill({ json: { jobs: [], batches: [], items: [], demoMode: true } });
+  });
+  await page.route(/\/api\/answer(?:\/stream)?(?:\?.*)?$/, async (route) => {
+    const body = route.request().postDataJSON();
+    const payload = { ...demoAnswer(body?.query ?? "clozapine monitoring"), demoMode: true };
+    if (route.request().url().includes("/stream")) {
+      await route.fulfill({
+        body: [
+          `event: progress\ndata: ${JSON.stringify({ stage: "retrieving", message: "Searching indexed documents." })}`,
+          `event: final\ndata: ${JSON.stringify(payload)}`,
+          "",
+        ].join("\n\n"),
+        contentType: "text/event-stream; charset=utf-8",
+      });
+      return;
+    }
+    await route.fulfill({ json: payload });
+  });
+}
+
+async function main() {
+  mkdirSync(outDir, { recursive: true });
+  const browser = await chromium.launch();
+  const page = await browser.newPage({ viewport: { width: 390, height: 820 } });
+  await mockDemoApi(page);
+  await page.goto(`${baseUrl}/`, { waitUntil: "domcontentloaded" });
+  await page.waitForLoadState("networkidle", { timeout: 15000 }).catch(() => undefined);
+
+  const input = page.locator('[data-testid="global-search-input"]:visible').first();
+  await input.waitFor({ state: "visible", timeout: 30000 });
+  await input.fill("clozapine monitoring");
+  await page.locator('[aria-label="Generate source-backed answer"]:visible').first().click();
+  await page.getByTestId("plain-answer-response").waitFor({ timeout: 30000 });
+  await page.waitForTimeout(600);
+
+  const chipCount = await page.locator(".answer-footer-search-chip:visible").count();
+  if (chipCount > 0) {
+    throw new Error(`Expected 0 footer chips in answer mode, found ${chipCount}.`);
+  }
+
+  await page.screenshot({ path: outPath, fullPage: false });
+  await page.locator("form.answer-footer-search-edge").first().screenshot({ path: outBottomPath });
+  console.log(outPath);
+  console.log(outBottomPath);
+  await browser.close();
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});

scripts/capture-chrome-parity.ts

@@ -82,10 +82,6 @@ const selectorGroups: Array<{ key: string; selector: string; pseudo?: string }>
   { key: "composer-pill-children", selector: 'form:has([data-testid="global-search-input"]) > div > *' },
   { key: "composer-input", selector: '[data-testid="global-search-input"]', pseudo: "::placeholder" },
   { key: "composer-buttons", selector: 'form:has([data-testid="global-search-input"]) button' },
-  { key: "evidence-chip", selector: 'button[aria-label="Open evidence-backed answer sources"]' },
-  { key: "evidence-chip-icon", selector: 'button[aria-label="Open evidence-backed answer sources"] svg' },
-  { key: "scope-chip", selector: 'button[aria-label="Open source scope"]' },
-  { key: "scope-chip-icon", selector: 'button[aria-label="Open source scope"] svg' },
   { key: "viewer-header", selector: "main header, body > div > header", pseudo: "::after" },
   { key: "viewer-composer", selector: 'form:has(input[placeholder^="Search or answer"])' },
   { key: "viewer-composer-children", selector: 'form:has(input[placeholder^="Search or answer"]) > *' },

scripts/commit-access-rag-fix.mjs

@@ -0,0 +1,209 @@
+import fs from "node:fs";
+import { execSync } from "node:child_process";
+
+const ownerScope = `import { isDemoMode, isLocalNoAuthMode } from "@/lib/env";
+
+export const PUBLIC_OWNER_FILTER_SENTINEL = "00000000-0000-0000-0000-000000000000";
+
+export function requireOwnerScope(ownerId: string | null | undefined): string | undefined {
+  if (ownerId) return ownerId;
+  if (isDemoMode() || isLocalNoAuthMode() || process.env.NODE_ENV === "test") {
+    return undefined;
+  }
+  throw new Error(
+    "Owner-scoped retrieval was called without an ownerId; refusing to run to avoid returning another tenant's data.",
+  );
+}
+
+export function retrievalOwnerFilter(args: {
+  ownerId?: string | null;
+  documentIds?: string[];
+  allowGlobalSearch?: boolean;
+}): string | null | undefined {
+  if (args.ownerId) return requireOwnerScope(args.ownerId);
+  if (isDemoMode() || isLocalNoAuthMode() || process.env.NODE_ENV === "test") {
+    return undefined;
+  }
+  if (args.allowGlobalSearch || args.documentIds?.length) {
+    return PUBLIC_OWNER_FILTER_SENTINEL;
+  }
+  throw new Error(
+    "Owner-scoped retrieval was called without an ownerId; refusing to run to avoid returning another tenant's data.",
+  );
+}
+`;
+
+fs.writeFileSync("src/lib/owner-scope.ts", ownerScope);
+
+let rag = fs.readFileSync("src/lib/rag.ts", "utf8");
+rag = rag.replace(
+  'import { requireOwnerScope } from "@/lib/owner-scope";',
+  'import { requireOwnerScope, retrievalOwnerFilter } from "@/lib/owner-scope";',
+);
+rag = rag.replace(
+  /function ownerScopeForDocumentFilteredRetrieval\([\s\S]*?\n\}/,
+  `function ownerScopeForDocumentFilteredRetrieval(
+  ownerId: string | undefined,
+  documentIds: string[] | undefined,
+  allowGlobalSearch?: boolean,
+) {
+  return retrievalOwnerFilter({ ownerId, documentIds, allowGlobalSearch });
+}`,
+);
+rag = rag.replaceAll(
+  "ownerScopeForDocumentFilteredRetrieval(args.ownerId, args.documentIds)",
+  "ownerScopeForDocumentFilteredRetrieval(args.ownerId, args.documentIds, args.allowGlobalSearch)",
+);
+rag = rag.replaceAll(
+  "ownerScopeForDocumentFilteredRetrieval(args.ownerId, documentFilterList)",
+  "ownerScopeForDocumentFilteredRetrieval(args.ownerId, documentFilterList, args.allowGlobalSearch)",
+);
+rag = rag.replace(
+  `documentFilter ? [documentFilter] : undefined,
+        ),`,
+  `documentFilter ? [documentFilter] : undefined,
+          documentFilter ? undefined : args.allowGlobalSearch,
+        ),`,
+);
+rag = rag.replace(
+  `documentIds: documentFilterList,
+    matchCount: textCandidateCount,`,
+  `documentIds: documentFilterList,
+    allowGlobalSearch: args.allowGlobalSearch,
+    matchCount: textCandidateCount,`,
+);
+rag = rag.replaceAll(
+  `documentIds: documentFilterList,
+      matchCount: Math.min(candidateCount, 48),`,
+  `documentIds: documentFilterList,
+      allowGlobalSearch: args.allowGlobalSearch,
+      matchCount: Math.min(candidateCount, 48),`,
+);
+rag = rag.replace(
+  `documentIds: documentFilterList,
+      matchCount: Math.min(candidateCount, 64),`,
+  `documentIds: documentFilterList,
+      allowGlobalSearch: args.allowGlobalSearch,
+      matchCount: Math.min(candidateCount, 64),`,
+);
+rag = rag.replace(
+  "documentIds?: string[];\n  matchCount: number;\n}) {\n  const runChunkText",
+  "documentIds?: string[];\n  allowGlobalSearch?: boolean;\n  matchCount: number;\n}) {\n  const runChunkText",
+);
+for (const fn of ["searchTableFactCandidates", "searchEmbeddingFieldCandidates", "searchIndexUnitCandidates"]) {
+  rag = rag.replace(
+    new RegExp(`async function ${fn}\\([\\s\\S]*?documentIds\\?: string\\[\\];\\n  matchCount: number;`),
+    (m) => m.replace("documentIds?: string[];\n  matchCount: number;", "documentIds?: string[];\n  allowGlobalSearch?: boolean;\n  matchCount: number;"),
+  );
+}
+if (!rag.includes('else documentQuery = documentQuery.is("owner_id", null);')) {
+  rag = rag.replace(
+    `if (args.ownerId) documentQuery = documentQuery.eq("owner_id", args.ownerId);
+  const { data: documents, error: documentsError } = await documentQuery;`,
+    `if (args.ownerId) documentQuery = documentQuery.eq("owner_id", args.ownerId);
+  else documentQuery = documentQuery.is("owner_id", null);
+  const { data: documents, error: documentsError } = await documentQuery;`,
+  );
+}
+fs.writeFileSync("src/lib/rag.ts", rag);
+
+let enrichment = fs.readFileSync("src/lib/document-enrichment.ts", "utf8");
+enrichment = enrichment.replace(
+  'import { requireOwnerScope } from "@/lib/owner-scope";',
+  'import { retrievalOwnerFilter } from "@/lib/owner-scope";',
+);
+enrichment = enrichment.replace(
+  "owner_filter: args.ownerId ? requireOwnerScope(args.ownerId) : null,",
+  "owner_filter: retrievalOwnerFilter({ ownerId: args.ownerId, documentIds: args.documentIds }),",
+);
+fs.writeFileSync("src/lib/document-enrichment.ts", enrichment);
+
+let memory = fs.readFileSync("src/lib/deep-memory.ts", "utf8");
+if (!memory.includes("retrievalOwnerFilter")) {
+  memory = memory.replace(
+    'import { requireOwnerScope } from "@/lib/owner-scope";',
+    'import { retrievalOwnerFilter } from "@/lib/owner-scope";',
+  );
+  memory = memory.replace(
+    /owner_filter:[\s\S]*?requireOwnerScope\(args\.ownerId\)[\s\S]*?\),/,
+    `owner_filter: retrievalOwnerFilter({
+          ownerId: args.ownerId,
+          documentIds: args.documentIds,
+          allowGlobalSearch: !args.ownerId && !args.documentIds?.length,
+        }),`,
+  );
+}
+fs.writeFileSync("src/lib/deep-memory.ts", memory);
+
+let schema = fs.readFileSync("supabase/schema.sql", "utf8");
+if (!schema.includes("create or replace function public.retrieval_owner_matches")) {
+  schema = schema.replace(
+    "create or replace function public.match_document_chunks(",
+    `create or replace function public.retrieval_owner_matches(owner_filter uuid, row_owner_id uuid)
+returns boolean
+language sql
+immutable
+parallel safe
+set search_path = public, pg_temp
+as $$
+  select case
+    when owner_filter is null then true
+    when owner_filter = '00000000-0000-0000-0000-000000000000'::uuid then row_owner_id is null
+    else row_owner_id = owner_filter
+  end;
+$$;
+
+create or replace function public.match_document_chunks(`,
+  );
+}
+schema = schema.replaceAll("(owner_filter is null or d.owner_id = owner_filter)", "public.retrieval_owner_matches(owner_filter, d.owner_id)");
+schema = schema.replaceAll("(owner_filter is null or l.owner_id = owner_filter)", "public.retrieval_owner_matches(owner_filter, l.owner_id)");
+schema = schema.replaceAll("(owner_filter is null or s.owner_id = owner_filter)", "public.retrieval_owner_matches(owner_filter, s.owner_id)");
+schema = schema.replaceAll("(owner_filter is null or f.owner_id = owner_filter)", "public.retrieval_owner_matches(owner_filter, f.owner_id)");
+fs.writeFileSync("supabase/schema.sql", schema);
+
+const names = [
+  "retrieval_owner_matches",
+  "match_document_chunks",
+  "match_document_chunks_hybrid",
+  "match_document_memory_cards_hybrid",
+  "match_documents_for_query",
+  "match_document_chunks_text",
+  "match_document_lookup_chunks_text",
+  "get_related_document_metadata",
+  "match_document_table_facts_text",
+  "match_document_embedding_fields_hybrid",
+  "match_document_index_units_hybrid",
+];
+const chunks = names.map((name) => {
+  const re = new RegExp(`create or replace function public\\.${name}[\\s\\S]*?\\n\\$\\$;`, "i");
+  const match = schema.match(re);
+  if (!match) throw new Error(`missing ${name}`);
+  return match[0];
+});
+fs.writeFileSync(
+  "supabase/migrations/20260705210000_retrieval_owner_filter_sentinel.sql",
+  `-- Public-only retrieval owner filter sentinel for hybrid RPCs.\nset search_path = public, extensions, pg_temp;\n\n${chunks.join("\n\n")}\n`,
+);
+
+let ownerTest = fs.readFileSync("tests/owner-scope.test.ts", "utf8");
+if (!ownerTest.includes("retrievalOwnerFilter")) {
+  ownerTest += `\ndescribe("retrievalOwnerFilter", () => {
+  it("returns the public sentinel for anonymous production global search", async () => {
+    vi.doMock("@/lib/env", () => ({ isDemoMode: () => false, isLocalNoAuthMode: () => false }));
+    vi.stubEnv("NODE_ENV", "production");
+    const { retrievalOwnerFilter, PUBLIC_OWNER_FILTER_SENTINEL } = await import("../src/lib/owner-scope");
+    expect(retrievalOwnerFilter({ allowGlobalSearch: true })).toBe(PUBLIC_OWNER_FILTER_SENTINEL);
+  });
+});\n`;
+  fs.writeFileSync("tests/owner-scope.test.ts", ownerTest);
+}
+
+execSync(
+  "git add src/lib/owner-scope.ts src/lib/rag.ts src/lib/document-enrichment.ts src/lib/deep-memory.ts supabase/schema.sql supabase/migrations/20260705210000_retrieval_owner_filter_sentinel.sql tests/owner-scope.test.ts scripts/commit-access-rag-fix.mjs",
+  { stdio: "inherit" },
+);
+execSync('git commit -m "fix(rag): scope anonymous retrieval to public documents via owner sentinel"', {
+  stdio: "inherit",
+});
+console.log("committed");

scripts/eval-quality.ts

@@ -45,6 +45,7 @@ type EvalQualityArgs = {
   retrievalOnly: boolean;
   ragOnly: boolean;
   skipPreflight: boolean;
+  forceEmbedding: boolean;
 };
 
 export type RagQualityResult = {
@@ -150,6 +151,7 @@ function parseArgs(argv: string[]): EvalQualityArgs {
     retrievalOnly: false,
     ragOnly: false,
     skipPreflight: false,
+    forceEmbedding: false,
   };
 
   for (let index = 0; index < argv.length; index += 1) {
@@ -176,6 +178,10 @@ function parseArgs(argv: string[]): EvalQualityArgs {
       args.skipPreflight = true;
       continue;
     }
+    if (token === "--force-embedding") {
+      args.forceEmbedding = true;
+      continue;
+    }
 
     const value = argv[index + 1];
     if (!value || value.startsWith("--")) throw new Error(`Missing value for ${token}`);
@@ -476,6 +482,11 @@ export function buildEvalQualityReport(args: {
         `retrieval content_recall_at_5 ${retrievalSummary.content_recall_at_5} below ${qualityThresholds.retrievalContentRecallAt5}`,
       );
     }
+    if (retrievalSummary.force_embedding_failure_count > 0) {
+      thresholdFailures.push(
+        `retrieval force_embedding_failure_count ${retrievalSummary.force_embedding_failure_count} above 0`,
+      );
+    }
     if (governance.stale_rate > qualityThresholds.staleTopResultRate) {
       thresholdFailures.push(
         `top-result stale_rate ${governance.stale_rate} above ${qualityThresholds.staleTopResultRate}`,
@@ -664,6 +675,8 @@ ${markdownTable([
 ## Retrieval Decision Metrics
 
 ${markdownTable([
+  ["Force-embedding cases", retrieval.force_embedding_case_count],
+  ["Force-embedding failures", retrieval.force_embedding_failure_count],
   ["Embedding skipped rate", retrieval.embedding_skipped_rate],
   ["Median text candidate budget", retrieval.median_text_candidate_budget],
   ["Second-stage rerank rate", retrieval.second_stage_rerank_rate],
@@ -728,6 +741,7 @@ async function runRetrievalQualityCases(args: {
   ownerId?: string;
   limit?: number;
   query?: string;
+  forceEmbedding?: boolean;
   supabase: Awaited<ReturnType<typeof loadAdminClient>>;
 }) {
   const [{ searchChunksWithTelemetry }, capturedCases] = await Promise.all([
@@ -756,7 +770,7 @@ async function runRetrievalQualityCases(args: {
         topK: retrievalLimitForGoldenCase(testCase),
         minSimilarity: 0.12,
         skipCache: true,
-        forceEmbedding: testCase.forceEmbedding,
+        forceEmbedding: testCase.forceEmbedding || args.forceEmbedding,
       }),
     );
     const latencyMs =