diff --git a/.env.example b/.env.example index 7064fce31..5a0463eb2 100644 --- a/.env.example +++ b/.env.example @@ -99,8 +99,10 @@ RAG_PROVIDER_MODE=auto # Omit for current defaults. Example (enable diversity demotion + linear freshness): # RAG_RANKING_CONFIG={"documentDiversityPenalty":0.03,"freshness":{"mode":"linear"}} # Append OR-relaxed recall behind weak-but-nonzero strict text matches (P8b extension). -# Set false to restore relax-only-on-empty behaviour (golden retrieval eval kill switch). -RAG_TEXT_WEAK_OR_RELAXATION=true +# Opt-in experiment ONLY and OFF by default (matches the src/lib/env.ts default): it is known to +# regress the golden retrieval eval (buries some correct docs after re-ranking). Leave false; +# re-enable solely behind a fresh 36/36 golden retrieval run. false = relax-only-on-empty. +RAG_TEXT_WEAK_OR_RELAXATION=false RAG_ANSWER_CACHE_TTL_MS=300000 RAG_ANSWER_CACHE_SIZE=100 RAG_SEARCH_CACHE_TTL_MS=60000 diff --git a/docs/audit-remediation-plan-2026-07-14.md b/docs/audit-remediation-plan-2026-07-14.md index 4013edf0c..4209f5f04 100644 --- a/docs/audit-remediation-plan-2026-07-14.md +++ b/docs/audit-remediation-plan-2026-07-14.md @@ -6,6 +6,25 @@ every finding: major blockers first, then P2 sub-issues, then P3 cleanup. **Findings handover (inventory + status):** [`audit-handover-2026-07-14.md`](audit-handover-2026-07-14.md). +**Reconciliation — 2026-07-17 (`claude/memory-tasks-review-glmntq`):** a read-only cross-check of +every finding against current `main` found the code side largely landed since this plan was written. + +- **DONE in code:** C1 (anon catalog rate-limit), D1 (public-doc DTO redaction), D5 (bulk error + redaction), E1 (unreachable commit fallback), E2 (recovery dedup), F4 (flake ledger emptied), + G1–G4 (full frontend a11y wave), H6 (`/api/jobs` auth-first + 503), F5 (`.env.example` weak-OR + default corrected to `false` to match the `src/lib/env.ts` default — this pass). The a11y wave + (G) and the ingestion recovery/commit wave (E1/E2) are fully closed. +- **Superseded:** F2 (CI RAG-eval scope) — the offline RAG-eval gate now runs unconditionally. +- **Still open — OWNER:CODE:** D2 (tenancy CI guard `check-owner-scope-api.mjs` still absent), D3 + (`getSession()`→`getUser()` in `client.tsx`), E3 (wire `decideReindexGate` into `scripts/reindex.ts`), + F1 (CI UI-scope patterns miss `app-modes`/`ui-copy`), F3 (`@critical` safety assert still + conditional), F6 (bundle-budget `enforce:false`), + H1–H5 (API-contract hygiene: error envelopes, admin-route rate limits, list-offset cap, + upload Content-Length reserve, authed-summarize public scope). Biggest remaining cluster is H1–H5. +- **In flight (do not restart):** draft PRs **#708** (frontend a11y/layout P2s) and **#710** + (storage-bucket migration drift — "closes the audit's open P2 list"). +- **Operator-pending (⏸):** Waves A/B/J and D4 (all live/legal/ops). Wave I (P3) untouched. + **Rules for executing this plan** - Prefer the smallest safe change per finding; do not bundle unrelated domains in one PR. diff --git a/docs/ingestion-concurrency-fix-workorder.md b/docs/ingestion-concurrency-fix-workorder.md index 91378e4e2..2ad02e707 100644 --- a/docs/ingestion-concurrency-fix-workorder.md +++ b/docs/ingestion-concurrency-fix-workorder.md @@ -1,5 +1,17 @@ # Ingestion-concurrency phase-3 — fix work-order +**Status refresh 2026-07-17:** the last remaining repository design item below — +deep-memory section ownership / delete-scoping — is now **RESOLVED**, so this document has +**no open repository items**. It shipped as the producer-scoped replacement model: migration +`20260713030000_producer_scoped_deep_memory.sql` adds `producer` + `artifact_generation_id` +columns with **disjoint** unique indexes (`document_sections_legacy_section_index_key` for +`artifact_generation_id is null` vs `document_sections_producer_generation_section_index_key`), +so the enrichment agent and deep-memory can no longer collide on `section_index`; the +service-role commit RPC removes only older artifacts owned by the same producer; and +`src/lib/deep-memory.ts` stages and deletes strictly scoped by `producer = local-deep-memory` + +`artifact_generation_id` (`cleanupStagedArtifacts`), with the commit body reconciled in #569. No +unscoped cross-producer delete remains. The design section at the bottom is retained as provenance. + **Status refresh 2026-07-15:** the July-8 migration batch is applied and verified live. The only remaining repository design item in this document is deep-memory section ownership/delete scoping (see the final section); it is intentionally blocked on an explicit ownership model and a @@ -32,7 +44,9 @@ nothing here was applied to live at author time. **Historical status (2026-07-09 ## Still open (not merged or needs design) -- **deep-memory delete-scoping** — design required (see bottom of this doc). +- _None._ **deep-memory delete-scoping** landed via the producer-scoped model (migration + `20260713030000` + commit #569 + `src/lib/deep-memory.ts`) — see the 2026-07-17 status refresh + at the top. The design section at the bottom of this doc is retained as provenance only. ## Global rules for this release @@ -318,7 +332,10 @@ for live apply of R24e → RPC hardening → fail-closed → R5 → R17 (`202607 Remaining repo work: -1. **deep-memory scoping** — only after the section-ownership design is agreed. +1. ~~**deep-memory scoping**~~ — **DONE (2026-07-17)** via the producer-scoped model + (`20260713030000` + #569 + `src/lib/deep-memory.ts`). The section-ownership question was + settled by giving each producer a disjoint `(document_id, producer, artifact_generation_id, +section_index)` key. No remaining repo work in this document. Every DB item ends with `npm run check:drift` green and (for retrieval-affecting items) `npm run eval:retrieval:quality` unchanged. diff --git a/docs/operator-backlog.md b/docs/operator-backlog.md index f43306d8a..9a99254d3 100644 --- a/docs/operator-backlog.md +++ b/docs/operator-backlog.md @@ -17,14 +17,15 @@ Findings inventory for handover: [audit-handover-2026-07-14.md](audit-handover-2 ## Launch-gating actions -| Action | Status | Blocked by | Verify command | Runbook | -| -------------------------------------------------------------------------- | ---------- | -------------------- | -------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | -| Apply July-8 migration batch (a–g) to live | ✅ done | — | `SUPABASE_ENVIRONMENT=production npm run check:july8-live-batch` (2026-07-13: 6 live, apply=no-op) | [operator-apply-july8-batch.md](operator-apply-july8-batch.md) | -| Apply drift-codify forward migration (step 1h) | ✅ done | — | Applied and drift/readiness verified 2026-07-13; verify only unless new reviewed drift is found | [database-drift-detection.md](database-drift-detection.md) | -| Full release gate (bounded OpenAI spend) | ⏳ pending | migrations 1 applied | `npm run verify:release`; `npm run eval:quality -- --rag-only` | [launch-operator-runbook.md §2](launch-operator-runbook.md) | -| Provision staging Supabase project (`Clinical KB Staging`, ap-southeast-2) | ⏳ pending | — | `npm run check:indexing` after `db push` | [staging-setup.md](staging-setup.md) | -| Staging soak + rollback rehearsal on Railway | ⏳ pending | staging provisioned | `scripts/soak-test.ts --confirm-staging` (answer p95 ≤ 25 s) | [launch-operator-runbook.md §4](launch-operator-runbook.md) · [capacity-review.md](capacity-review.md) | -| Production deploy to Railway | ✅ done | — | App deployment recorded live 2026-07-14; re-verify with `GET /api/health` and deployment readiness | [deployment-architecture.md](deployment-architecture.md) | +| Action | Status | Blocked by | Verify command | Runbook | +| -------------------------------------------------------------------------- | ---------- | ---------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | +| Apply July-8 migration batch (a–g) to live | ✅ done | — | `SUPABASE_ENVIRONMENT=production npm run check:july8-live-batch` (2026-07-13: 6 live, apply=no-op) | [operator-apply-july8-batch.md](operator-apply-july8-batch.md) | +| Apply drift-codify forward migration (step 1h) | ✅ done | — | Applied and drift/readiness verified 2026-07-13; verify only unless new reviewed drift is found | [database-drift-detection.md](database-drift-detection.md) | +| Apply repo-ahead migrations to live (post-2026-07-13) | 🔎 verify | `20260713201542` · `20260714110000` · `20260717120000` committed, live-apply unconfirmed | `npm run check:drift`; then `eval:retrieval:quality` (36/36) for the corrector | [deploy-corrector-public-titles.md](deploy-corrector-public-titles.md) | +| Full release gate (bounded OpenAI spend) | ⏳ pending | migrations 1 applied | `npm run verify:release`; `npm run eval:quality -- --rag-only` | [launch-operator-runbook.md §2](launch-operator-runbook.md) | +| Provision staging Supabase project (`Clinical KB Staging`, ap-southeast-2) | ⏳ pending | — | `npm run check:indexing` after `db push` | [staging-setup.md](staging-setup.md) | +| Staging soak + rollback rehearsal on Railway | ⏳ pending | staging provisioned | `scripts/soak-test.ts --confirm-staging` (answer p95 ≤ 25 s) | [launch-operator-runbook.md §4](launch-operator-runbook.md) · [capacity-review.md](capacity-review.md) | +| Production deploy to Railway | ✅ done | — | App deployment recorded live 2026-07-14; re-verify with `GET /api/health` and deployment readiness | [deployment-architecture.md](deployment-architecture.md) | ## Post-deploy actions