Repo hygiene: gate /mockups out of production, CI audit gate, untrack scratch, archive stale docs

[BigSimmo]

Summary

• Gate the 27-page /mockups/* design-exploration route tree out of production builds: src/app/mockups/layout.tsx now calls notFound() unless mockupsEnabled() (src/lib/env.ts) — always reachable in dev/test, production requires explicit NEXT_PUBLIC_MOCKUPS_ENABLED=true (previously these shipped in production hidden only by a robots.txt disallow). New tests/env-mockups-gate.test.ts guards the flag logic.
• Add a dependency vulnerability gate to CI (npm audit --omit=dev --audit-level=high in the verify job) — the document parsers (pdf-parse, pdfjs-dist, mammoth, exceljs, jszip) process untrusted uploads, so high/critical advisories should block merges rather than wait for weekly Dependabot. Currently passes with 0 vulnerabilities.
• Untrack 24 committed .tmp-visual/ visual-QA scratch files (capture scripts + PNGs) and add .tmp-visual/ to .gitignore.
• Archive superseded/completed planning docs to docs/archive/: root COLOR_REDESIGN_PLAN.md (marked SUPERSEDED), TOOLS_CONTEXT_FOR_NEW_CHAT.md, design-qa.md, the completed search-rag-phase-0…5.5b series, and the completed clinical-chat-ui-* phase docs. No inbound references were broken (repo-wide grep); relative links inside moved files retargeted. Living docs (search-rag-master-plan/context, component map) stay.
• Fix scripts/run-playwright.mjs port-finder for IPv6-less containers: EAFNOSUPPORT/EADDRNOTAVAIL on ::1/:: binds now counts as available instead of marking every port busy (previously verify:ui could not start in such environments).
• Log all of the above in docs/process-hardening.md (dated 2026-07-06 entry).

Verification

• npm run verify:cheap — pass (runtime, sitemap, lint, typecheck, 1,097 unit tests)
• npm run verify:ui — 103/103 passed (includes the specs that exercise /mockups routes in dev, proving the gate leaves dev/test behavior unchanged)
• npm run verify:release before release or handoff confidence claims
• npm run format:check — pass
• npm run eval:retrieval:quality — N/A: no retrieval, ranking, selection, chunking, or scoring behavior changed
• npm run eval:rag / eval:quality — N/A: no answer-generation change
• npm run check:production-readiness — not run here (no live keys in this environment); the change to production behavior is route-gating only, additionally verified end-to-end: production build serves HTTP 404 on /mockups/* and 200 on real routes
• npm run check:deployment-readiness — N/A: no deployment startup/hosting change

Clinical Governance Preflight

Touches production env behavior (route gating) only; no ingestion/answer/search/source changes.

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed — no clinical decision-support behavior changed

Notes

• The /mockups gate is reversible per deploy via NEXT_PUBLIC_MOCKUPS_ENABLED=true (documented in .env.example).
• docs/site-map.md intentionally unchanged: the route segments still exist; they 404 at request time in production.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XPVNBVo4cg9PEYtNhJZBQY

---

Generated by Claude Code

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[BigSimmo]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Conflicts resolved in 9eaad91. Two files had conflicts:

• src/app/mockups/layout.tsx — kept both import type { Metadata } from "next" (added in main) and import { notFound } from "next/navigation" (added in this branch); the file uses both.
• docs/process-hardening.md — kept both 2026-07-06 entries (the "Design convergence & type-scale ratchet" section from main and the "Repository hygiene + production surface pass" section from this branch).

The PR mergeable_state is now blocked on CI checks rather than dirty on conflicts.