Fix offline release retrieval latency by BigSimmo · Pull Request #666 · BigSimmo/Database

BigSimmo · 2026-07-14T14:08:08Z

Summary

Prevent generic agitation table lookups from expanding into unnecessary dose/route terms.
Bound explicit IM/PO agitation retrieval to only the dose and route signals requested.
Refuse adversarial prompt-injection and secret-exfiltration queries before cache, classifier, provider-client, or Supabase work.

Why

PR #655 was squash-merged while its provider-free release evaluation was still completing. These three focused follow-ups remove the remaining live offline-route latency failures without changing release thresholds or enabling OpenAI.

Areas touched

src/lib/clinical-search.ts
src/lib/rag.ts
focused retrieval tests
branch review ledger

Verification

npx vitest run tests/clinical-search.test.ts tests/retrieval-query-variants.test.ts tests/rag-abort-signal.test.ts — 113/113 passed after merging current main.
Scoped ESLint — passed.
Scoped Prettier — passed.
git diff --check origin/main..HEAD — passed.
Live provider-free adversarial case — 100 ms before sync; 0 ms Supabase RPC, unsupported refusal, no model.
npm run eval:quality:release:offline — passed before sync with no blocking failures; retrieval 26/26, unsupported correctness 100%, citation/numeric/danger failures 0, and 0 model cases, OpenAI request IDs, token usage, nonzero cost, or generation latency.
Exact-head Railway staging deployment b143d737-b168-49e1-a751-51484d576899 — success for 9b56eebe4b23ab783207445fb827c317c8d59be8; health ok, OpenAI config skipped.
Staging Supabase identity — Clinical KB Staging (gdkoelrgjshpjxieaolv).
npm run test:cross-tenant:staging — passed all 12 isolation checkpoints; cleanup passed with zero errors on exact head.

Checks not rerun locally

Full Playwright, verify:pr-local, and aggregate release composites are intentionally left to hosted CI because local runs are flaky and lag-prone.
Post-sync TypeScript produced no diagnostics after stale .next route types were removed, but exceeded a three-minute local timeout. Hosted CI is authoritative.
The original OpenAI-backed evaluator and verify:release remain deferred, not passed, because this workflow forbids OpenAI API use.

Clinical Governance Preflight

Source-backed claims still require linked source verification before clinical use.
No patient-identifiable document workflow was introduced or expanded.
Production Supabase remains Clinical KB Database (sjrfecxgysukkwxsowpy); staging evidence used only Clinical KB Staging (gdkoelrgjshpjxieaolv).
Service-role keys and private document access remain server-only.
Demo/synthetic content remains separated from real clinical sources; tenancy users and fixtures are synthetic and were cleaned up.
Source metadata, review status, and outdated/unknown-source behavior remain conservative.
SaMD impact checked: this is a fail-closed safety/latency correction and narrower query expansion, with no new clinical recommendation or deployment classification change.

Risk and release notes

The changes are limited to query expansion and a fail-closed adversarial retrieval guard. They do not mutate embeddings, chunks, clinical documents, registry metadata, production deployment, or release thresholds. Production registry governance was already reconciled by PR #655 with zero smart-v2 and registry-contract gaps. The repository-approved source-metadata debt remains accepted and was not widened.

Summary by CodeRabbit

New Features
- Added safeguards that refuse adversarial manipulation requests before any external search/provider work begins.
- Such requests now return empty results and skip embeddings (no caching performed).
Improvements
- Refined agitation and medication-related search queries to require tighter dose/route/unit evidence, producing shorter, more precise query strings.
- Improved retrieval behavior for targeted clinical queries.
Tests
- Added coverage for early refusal behavior and updated expected clinical search query outputs.
Documentation
- Updated branch review ledger with offline release latency follow-ups.

…-remediation

…-remediation # Conflicts: # docs/branch-review-ledger.md

Resolved merge conflict in docs/branch-review-ledger.md by keeping all entries from both branches in chronological order.

…n' into codex/release-blocker-remediation

…-remediation

…-remediation # Conflicts: # docs/branch-review-ledger.md

supabase · 2026-07-14T14:08:14Z

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

coderabbitai · 2026-07-14T14:08:15Z

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b8caf782-203c-4940-9228-ba0abcf0ad84

📥 Commits

Reviewing files that changed from the base of the PR and between 9b56eeb and 8a7ec72.

📒 Files selected for processing (1)

src/lib/clinical-search.ts

📝 Walkthrough

Walkthrough

Agitation search expansion now requires explicit dose or route evidence and retains matching terms. RAG retrieval centralizes telemetry and rejects adversarial queries before Supabase access. Tests and the review ledger record the updated behavior.

Changes

Offline retrieval safeguards

Layer / File(s)	Summary
Narrow clinical query expansion `src/lib/clinical-search.ts`, `tests/clinical-search.test.ts`, `tests/retrieval-query-variants.test.ts`	Agitation medication-chart queries require dose or route signals and produce shorter canonical token strings, with exact expectations updated in both test suites.
Fail-closed adversarial retrieval `src/lib/rag.ts`, `tests/rag-abort-signal.test.ts`, `docs/branch-review-ledger.md`	Baseline search telemetry is centralized, adversarial queries return empty results before Supabase work, and the behavior is tested and recorded in the review ledger.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant searchChunksWithTelemetry
  participant hasAdversarialManipulationIntent
  participant createAdminClient
  Caller->>searchChunksWithTelemetry: submit retrieval query
  searchChunksWithTelemetry->>hasAdversarialManipulationIntent: inspect query intent
  hasAdversarialManipulationIntent-->>searchChunksWithTelemetry: adversarial intent detected
  searchChunksWithTelemetry-->>Caller: empty results with refusal telemetry
  Note over createAdminClient: no Supabase client is created

Possibly related PRs

BigSimmo/Database#514: Both changes modify searchChunksWithTelemetry and SearchTelemetry construction in src/lib/rag.ts.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise and matches the main change: lowering offline release retrieval latency.
Description check	✅ Passed	The description covers summary, rationale, touched areas, verification, governance, and release notes, though it doesn't use the exact checkbox template.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/release-blocker-remediation

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install failed. For unrecoverable errors, disable the tool in CodeRabbit configuration.

_{Comment @coderabbitai help to get the list of available commands.}

…-remediation

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/clinical-search.ts`:
- Line 1254: Align the agitation/arousal medication signal gate and
emitted-token mapping around wantsAgitationArousal with the aliases supported by
buildRetrievalIntent: dosage, mg, mcg, subcutaneous/sc, sublingual/sl,
frequency, and prn in addition to the existing terms. Share a single mapping or
signal definition between these layers so queries such as subcutaneous dosing
and numeric mg amounts retain their supported dose/route intent.

🪄 Autofix (Beta)

✅ Autofix completed

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 9dde3e25-9189-4e2d-ae49-6724aaf693e0

📥 Commits

Reviewing files that changed from the base of the PR and between cb76a7d and 9b56eeb.

📒 Files selected for processing (6)

docs/branch-review-ledger.md
src/lib/clinical-search.ts
src/lib/rag.ts
tests/clinical-search.test.ts
tests/rag-abort-signal.test.ts
tests/retrieval-query-variants.test.ts

coderabbitai · 2026-07-14T14:28:10Z

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Fixes Applied Successfully

Fixed 1 file(s) based on 1 unresolved review comment.

Files modified:

src/lib/clinical-search.ts

Commit: ada86dd04d5e8acd51f94b7adca6d44bbd279553

The changes have been pushed to the codex/release-blocker-remediation branch.

Time taken: 9m 7s

Fixed 1 file(s) based on 1 unresolved review comment. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>

github-actions · 2026-07-14T14:40:01Z

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

Static PR checks — needs investigation.
PR required — possible known flake: UI/Playwright job; check tests/flake-ledger.json (tests/ui-smoke.spec.ts, tests/ui-smoke.spec.ts, tests/ui-tools.spec.ts, tests/ui-tools.spec.ts) and re-run before bisecting.

Heuristic only — a main-side or flake label is a starting point, not a verdict.

Static PR checks failed on format:check for a single wrapped assignment. Collapse it so Prettier --check passes and PR required can gate green.

BigSimmo and others added 17 commits July 14, 2026 18:57

fix: close release governance and offline readiness gaps

881c51e

Merge remote-tracking branch 'origin/main' into codex/release-blocker…

1ca2f9f

…-remediation

Merge remote-tracking branch 'origin/main' into codex/release-blocker…

c4f16d5

…-remediation # Conflicts: # docs/branch-review-ledger.md

fix: allow explicit offline production startup

c8a3dd1

Merge branch 'main' into codex/release-blocker-remediation

409d6e8

Resolved merge conflict in docs/branch-review-ledger.md by keeping all entries from both branches in chronological order.

fix: preserve public registry governance scope

bca4734

Merge remote-tracking branch 'origin/codex/release-blocker-remediatio…

3c6cf9d

…n' into codex/release-blocker-remediation

test: anchor staging tenancy retrieval fixture

98aaad4

test: read document IDs in tenancy evidence

3b152ed

fix: preserve registry scope during refresh

4d55c3d

Merge remote-tracking branch 'origin/main' into codex/release-blocker…

978d4f4

…-remediation

fix: close final offline and governance review gaps

dedb38a

fix: close late review safety gaps

1ece1b8

fix: keep generic table lookup within latency budget

3ed3a7a

fix: bound agitation dose-route retrieval

a3f3a89

fix: short-circuit adversarial retrieval

dd79a95

Merge remote-tracking branch 'origin/main' into codex/release-blocker…

66f6d4a

…-remediation # Conflicts: # docs/branch-review-ledger.md

BigSimmo marked this pull request as ready for review July 14, 2026 14:13

Merge remote-tracking branch 'origin/main' into codex/release-blocker…

9b56eeb

…-remediation

coderabbitai Bot reviewed Jul 14, 2026

View reviewed changes

Comment thread src/lib/clinical-search.ts Outdated

BigSimmo enabled auto-merge (squash) July 14, 2026 14:27

fix: apply CodeRabbit auto-fixes

ada86dd

Fixed 1 file(s) based on 1 unresolved review comment. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>

fix: format clinical-search.ts for prettier CI check

8a7ec72

Static PR checks failed on format:check for a single wrapped assignment. Collapse it so Prettier --check passes and PR required can gate green.

BigSimmo merged commit a593f8f into main Jul 14, 2026
16 checks passed

BigSimmo mentioned this pull request Jul 14, 2026

Align offline agitation retrieval signals #668

Merged

4 tasks

BigSimmo deleted the codex/release-blocker-remediation branch July 17, 2026 06:54

This was referenced Jul 18, 2026

fix(rag): eliminate source-backed latency tails #845

Closed

fix(rag): keep agitation chart expansion without over-broad management matches #853

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix offline release retrieval latency#666

Fix offline release retrieval latency#666
BigSimmo merged 20 commits into
mainfrom
codex/release-blocker-remediation

BigSimmo commented Jul 14, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

supabase Bot commented Jul 14, 2026

Uh oh!

coderabbitai Bot commented Jul 14, 2026 •

edited

Loading

Review failed

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

coderabbitai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 14, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

BigSimmo commented Jul 14, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Areas touched

Verification

Checks not rerun locally

Clinical Governance Preflight

Risk and release notes

Summary by CodeRabbit

Uh oh!

supabase Bot commented Jul 14, 2026

Uh oh!

coderabbitai Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

coderabbitai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Fixes Applied Successfully

Uh oh!

github-actions Bot commented Jul 14, 2026

CI triage

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

BigSimmo commented Jul 14, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 14, 2026 •

edited

Loading

coderabbitai Bot left a comment •

edited

Loading

coderabbitai Bot commented Jul 14, 2026 •

edited

Loading