From 4002699c08dab012cff856ed281c0ef57a985267 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 9 Jul 2026 04:02:11 +0000 Subject: [PATCH 1/2] fix(ci): supply RAG_QUERY_HASH_SECRET placeholder for deployment boot smoke The production instrumentation hook requires a keyed query-hash secret so logged clinical queries are not reversible. CI boot smoke only checks that the server starts and reports the correct local project identity, so a non-production placeholder is sufficient (same pattern as service-role and OpenAI placeholders). Co-authored-by: BigSimmo --- scripts/deployment-boot-smoke.mjs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/scripts/deployment-boot-smoke.mjs b/scripts/deployment-boot-smoke.mjs index 66950e5b0..2637df156 100644 --- a/scripts/deployment-boot-smoke.mjs +++ b/scripts/deployment-boot-smoke.mjs @@ -124,6 +124,9 @@ async function bootSmoke() { // fail with real errors, but /api/local-project-id does not. SUPABASE_SERVICE_ROLE_KEY: process.env.SUPABASE_SERVICE_ROLE_KEY ?? "placeholder-ci-service-role", OPENAI_API_KEY: process.env.OPENAI_API_KEY ?? "placeholder-ci-openai", + // instrumentation.ts requireQueryHashSecret() needs a min-16-char value in production. + RAG_QUERY_HASH_SECRET: + process.env.RAG_QUERY_HASH_SECRET ?? "placeholder-ci-rag-query-hash-secret", }, stdio: ["ignore", "pipe", "pipe"], windowsHide: true, From c8e7baf9bf71f4d6580ff68f72ef2c76b1d7be54 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 9 Jul 2026 04:09:17 +0000 Subject: [PATCH 2/2] style: run Prettier on deployment-boot-smoke.mjs Co-authored-by: BigSimmo --- scripts/deployment-boot-smoke.mjs | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/scripts/deployment-boot-smoke.mjs b/scripts/deployment-boot-smoke.mjs index 2637df156..015efc3b1 100644 --- a/scripts/deployment-boot-smoke.mjs +++ b/scripts/deployment-boot-smoke.mjs @@ -125,8 +125,7 @@ async function bootSmoke() { SUPABASE_SERVICE_ROLE_KEY: process.env.SUPABASE_SERVICE_ROLE_KEY ?? "placeholder-ci-service-role", OPENAI_API_KEY: process.env.OPENAI_API_KEY ?? "placeholder-ci-openai", // instrumentation.ts requireQueryHashSecret() needs a min-16-char value in production. - RAG_QUERY_HASH_SECRET: - process.env.RAG_QUERY_HASH_SECRET ?? "placeholder-ci-rag-query-hash-secret", + RAG_QUERY_HASH_SECRET: process.env.RAG_QUERY_HASH_SECRET ?? "placeholder-ci-rag-query-hash-secret", }, stdio: ["ignore", "pipe", "pipe"], windowsHide: true,