Skip to content

chore: apply 51278a70d remediations onto main lineage #850

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
BigSimmo wants to merge 12 commits into from
Closed

chore: apply 51278a70d remediations onto main lineage #850

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
b073133
Merge branch 'codex/pwa-optimization-pr-ready' into main
BigSimmo Jul 17, 2026
4bb0cae
fix: finalize design audit regression hardening
BigSimmo Jul 17, 2026
ccd3756
merge: finalize design audit regression hardening
BigSimmo Jul 17, 2026
b3bbe5a
chore: fix drift manifest parity for query-corrector function
BigSimmo Jul 17, 2026
7e4ceb3
fix: make Playwright config typings match supported options
BigSimmo Jul 17, 2026
4b98cea
test: align retrieval and schema expectations with current behavior
BigSimmo Jul 17, 2026
c7e4215
chore: refresh PR policy state for merge checks
BigSimmo Jul 17, 2026
425366f
fix: exclude worktree scratch directories from typecheck
BigSimmo Jul 17, 2026
8d262b7
test: run answer progress journey in CI
BigSimmo Jul 17, 2026
b1fe53b
Merge remote-tracking branch 'refs/remotes/origin/main'
BigSimmo Jul 18, 2026
4335d36
Merge branch 'codex/pwa-optimization-pr-ready' into main
BigSimmo Jul 18, 2026
df30f49
Merge commit '51278a70d' into codex/main-merge-safe-final-20260718-fi…
BigSimmo Jul 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/branch-review-ledger.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD
| 2026-07-17 | PR #738 / cursor/storage-bucket-migration-02e7 | b2755c814b47cdec6868bd009f3ca1cdbc3a7dea | open-PR review + merge babysit | Merge-ready storage-bucket idempotent migration + PR-policy base_ref checkout. Comment clarified for on-conflict reconciliation. Duplicate #710 closed. Merged to main. | Hosted required checks + Migration replay green; review thread resolved. |
| 2026-07-17 | PR #739 / cursor/pwa-optimization-merge-02e7 | 0d4aa5c73a4ff30274bb6286be04465286c815d7 | open-PR review + privacy fix + merge babysit | P1 fixed: removed backdated RAG migrations/schema seed that would regress public-only title corrector privacy. Also fixed sitemap API/redirect classification, services RightRail remount, focus=1 mode-menu flake, and merge conflict markers. Supersedes #735/#721. Merged to main. | Hosted full CI green including Production UI/Migration replay after fixes; unresolved CodeRabbit threads resolved. No OpenAI/Supabase writes. |
| 2026-07-17 | PR batch #732-#739 (screenshot queue) | 1ab611915e0630a527a533ee7ff16b82fd3e8982 | multi-PR merge babysit summary | Merged in order: #738, #733, #737, #732, #736, #739. #735 left open (token cannot close; CONFLICTING/superseded by #739). #710/#721 closed as duplicates. Residual: close #735 manually. | Hosted CI babysit + merge-tree; #739 Production UI flake fixed and re-verified green before merge. |
| 2026-07-17 | codex/ci-answer-progress-regression | bfa0ed3dfc69d5b333ba43479023cb9a8e8925d3 | CI verification gap | Fixed: the production answer-progress Playwright journey was excluded by both top-level and Chromium project matchers, while its filename also skipped the CI UI trigger; its assertions could therefore change without the required UI job executing. | Local static inspection of `playwright.config.ts`, `scripts/ci-change-scope.mjs`, Vitest globs, and CI workflow; classifier self-test confirms the journey now sets `ui_changed=true`. Focused Playwright execution reached the isolated Next build but was blocked by unavailable Google font downloads; no hosted CI or provider-backed checks run. |

| 2026-07-17 | PR #635 / claude/github-actions-codex-issue-f4t4s5 | ab09a8d52cc0a8a7e71b37885aaa358aae2522c8 | post-merge merge-readiness review | Already squash-merged to main on 2026-07-14 by BigSimmo. No open review threads or inline comments. CI required checks all green (Change scope, Static PR checks, Safety and config checks, Unit coverage, PR required, Semgrep, Gitleaks, GitGuardian); UI/build/migration jobs correctly skipped. Landed diff is test/guard hardening only for missing `CODEX_TRIGGER_TOKEN` graceful skip. No high-confidence P0-P2 defect. Source branch already deleted. No further merge action needed. | Hosted CI status via `gh pr checks 635` (all required pass); local `node scripts/check-codex-autofix-workflow.mjs` pass; focused Vitest `tests/codex-autofix-workflow.test.ts` 41/41. No OpenAI/Supabase/provider writes. |
| 2026-07-17 | PR #718 / codex/performance-latency-remediation-20260717 | b5f509744d4f4bac74d414644cd1802f64b97fa9 | CodeRabbit performance and SQL correctness follow-up | Resolved nine confirmed findings and dispositioned one stale test comment: document downloads revalidate signed URLs on every action; committed-generation filtering precedes detail pagination; enrichment fallback errors preserve identity; caller cancellation leaves the shared classifier flight alive; registry seeding preserves its cache signal; aliases emit canonical corrections; rate-limit success metadata is coherent; ambiguous upserts use named constraints; and grantable default ACLs fail closed. The proxy mock duplicate was not present. No remaining high-confidence P0-P2 defect was found. | Integrated focused Vitest 122/122; post-format Vitest 71/71; `npm run verify:cheap` passed runtime/policy/static guards, ESLint, TypeScript, and 2,684/2,684 tests; focused Prettier and `git diff --check`; disposable Docker replay, regenerated drift manifest, and transactional local SQL probes. No OpenAI calls, live Supabase DDL/migration/data write, deployment, or production mutation ran. |
Expand Down
30 changes: 16 additions & 14 deletions docs/codebase-index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,17 +68,19 @@ Structured map for AI agents and onboarding. For live routes, see `docs/site-map

### API routes (`src/app/api/`)

| Area | Routes | Entry files |
| ----------- | ----------------------------------------------------------------------- | --------------------------------------------------------------- |
| Answers | `/api/answer`, `/api/answer/stream`, `/api/answer-feedback` | `answer/route.ts`, `answer/stream/route.ts`, `answer-feedback/` |
| Search | `/api/search`, `/api/search/interaction` | `search/` |
| Upload | `/api/upload` | `upload/route.ts` |
| Documents | CRUD, bulk, reindex, labels, search, summarize, table-facts, signed-url | `documents/` |
| Ingestion | batches, jobs, retry, quality | `ingestion/` |
| Registry | records CRUD | `registry/records/` |
| Images | signed URLs | `images/[id]/signed-url/route.ts` |
| Ops | health, setup-status, local-project-id | `health/`, `setup-status/`, `local-project-id/` |
| Eval / jobs | eval cases, job state | `eval-cases/`, `jobs/` |
| Area | Routes | Entry files |
| ------------- | ------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- |
| Answers | `/api/answer`, `/api/answer/stream`, `/api/answer-feedback` | `answer/route.ts`, `answer/stream/route.ts`, `answer-feedback/` |
| Search | `/api/search`, `/api/search/interaction`, `/api/search/universal` | `search/` |
| Upload | `/api/upload` | `upload/route.ts` |
| Documents | `/api/documents`, `/api/documents/[id]`, bulk/reindex, labels, reviews, search, signed URLs, summaries, table facts | `documents/` |
| Differentials | `/api/differentials`, `/api/differentials/[slug]`, `/api/differentials/presentations/[slug]` | `differentials/` |
| Medications | `/api/medications`, `/api/medications/[slug]` | `medications/` |
| Ingestion | `/api/ingestion/batches`, `/api/ingestion/jobs`, retry, quality | `ingestion/` |
| Registry | `/api/registry/records`, `/api/registry/records/[slug]` | `registry/records/` |
| Images | `/api/images/[id]/signed-url` | `images/[id]/signed-url/route.ts` |
| Ops | `/api/health`, `/api/health/ready`, `/api/setup-status`, `/api/local-project-id` | `health/`, `setup-status/`, `local-project-id/` |
| Eval / jobs | `/api/eval-cases`, `/api/jobs` | `eval-cases/`, `jobs/` |

---

Expand Down Expand Up @@ -151,12 +153,12 @@ Structured map for AI agents and onboarding. For live routes, see `docs/site-map

- **CLI:** `supabase/config.toml` — `indexing-v3-agent` function, `verify_jwt = false`
- **Schema mirror:** `supabase/schema.sql` (reference; migrations are source of truth)
- **Migrations:** `supabase/migrations/*.sql` (~90 files, May–Jul 2026)
- **Migrations:** `supabase/migrations/*.sql` (chronological source of truth; do not hardcode a count)
- **Drift policy:** `docs/supabase-migration-reconciliation.md`

### Core tables
### Schema tables

`documents`, `document_pages`, `document_images`, `document_chunks`, `document_embedding_fields`, `document_index_units`, `document_table_facts`, `document_labels`, `document_summaries`, `document_sections`, `document_memory_cards`, `document_index_quality`, `ingestion_jobs`, `ingestion_job_stages`, `indexing_v3_agent_jobs`, `import_batches`, `rag_queries`, `rag_query_misses`, `rag_aliases`, `rag_response_cache`, `rag_retrieval_logs`, `clinical_registry_records`, `api_rate_limits`, `audit_logs`, `storage_cleanup_jobs`
`documents`, `document_pages`, `document_images`, `document_chunks`, `document_embedding_fields`, `document_index_units`, `document_table_facts`, `document_labels`, `document_summaries`, `document_sections`, `document_memory_cards`, `document_index_quality`, `document_title_words`, `ingestion_jobs`, `ingestion_job_stages`, `indexing_v3_agent_jobs`, `import_batches`, `image_caption_cache`, `rag_queries`, `rag_query_misses`, `rag_aliases`, `rag_response_cache`, `rag_retrieval_logs`, `rag_visual_eval_cases`, `rag_visual_eval_runs`, `rag_answer_feedback`, `clinical_registry_records`, `clinical_registry_record_sources`, `medication_records`, `differential_records`, `source_review_events`, `api_rate_limits`, `api_rate_limit_subjects`, `audit_logs`, `storage_cleanup_jobs`

**Storage buckets:** `clinical-documents`, `clinical-images` (private)

Expand Down
13 changes: 7 additions & 6 deletions docs/site-map.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

This file is generated by `npm run sitemap:update`. Run `npm run sitemap:check` to verify it is current.

## Main product pages
## Main product routes

- `/` - Main Clinical KB shell. Source: `src/app/page.tsx`.
- `/differentials` - Differentials home and search surface. Source: `src/app/differentials/page.tsx`.
Expand Down Expand Up @@ -802,6 +802,11 @@ This file is generated by `npm run sitemap:update`. Run `npm run sitemap:check`
- `/mockups/universal-search-command` - Route discovered from app directory Source: `src/app/mockups/universal-search-command/page.tsx`.
- `/mockups/universal-search-redesign` - Route discovered from app directory Source: `src/app/mockups/universal-search-redesign/page.tsx`.

## Public utility route handlers

- `/auth/callback` - Authentication callback handler. Source: `src/app/auth/callback/route.ts`.
- `/icons/[variant]` - Dynamically generated application icon handler. Source: `src/app/icons/[variant]/route.tsx`.

## API routes

- `/api/answer` - Generate answer response. Source: `src/app/api/answer/route.ts`.
Expand Down Expand Up @@ -841,14 +846,10 @@ This file is generated by `npm run sitemap:update`. Run `npm run sitemap:check`
- `/api/setup-status` - Setup status. Source: `src/app/api/setup-status/route.ts`.
- `/api/upload` - Upload endpoint. Source: `src/app/api/upload/route.ts`.

## App route handlers

- `/auth/callback` - Route discovered from app directory Source: `src/app/auth/callback/route.ts`.

## Redirects

- `/applications` - Redirects to `/tools`. Source: `src/app/applications/route.ts`.
- `/differentials/presentations` - Redirects to `/differentials/presentations/[slug]`. Source: `src/app/differentials/presentations/route.ts`.
- `/differentials/presentations` - Redirects to `/differentials/presentations/[workflow-slug]`. Source: `src/app/differentials/presentations/route.ts`.
- `/documents/source` - Redirects to `/documents/search`. Source: `src/app/documents/source/page.tsx`.
- `/medications` - Redirects to `/?mode=prescribing`. Source: `src/app/medications/route.ts`.
- `/mockups/favourites-hub` - Redirects to `/favourites`. Source: `src/app/mockups/favourites-hub/page.tsx`.
Expand Down
8 changes: 5 additions & 3 deletions playwright.config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,9 +43,9 @@ export default defineConfig({
trace: "retain-on-failure",
screenshot: "only-on-failure",
// Disable CSS/web animations suite-wide so a click can't land mid-transition
// on a moving target (documented races in ui-stress/ui-smoke). Set via
// contextOptions (the supported form in this Playwright build); the dedicated
// reduced-motion a11y spec emulates it per-test too, so it is unaffected.
// on a moving target (documented races in ui-stress/ui-smoke). The dedicated
// reduced-motion a11y spec emulates a per-test mode, so suite-wide settings
// remain stable across builds.
contextOptions: { reducedMotion: "reduce" },
},
projects: [
Expand All @@ -55,6 +55,7 @@ export default defineConfig({
grepInvert: mockupTag,
use: {
...devices["Desktop Chrome"],
contextOptions: { reducedMotion: "no-preference" },
...(chromiumExecutablePath ? { launchOptions: { executablePath: chromiumExecutablePath } } : {}),
},
},
Expand All @@ -81,3 +82,4 @@ export default defineConfig({
},
],
});

16 changes: 11 additions & 5 deletions scripts/check-github-action-pins.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
import { readdirSync, readFileSync } from "node:fs";
import { existsSync, readFileSync, readdirSync } from "node:fs";
import path from "node:path";
import { validateActionReference } from "./github-action-pins.mjs";
import { yamlBlock } from "./yaml-contract.mjs";
Expand All @@ -10,10 +10,16 @@ const failures = [];
const expectedSupabaseCliVersion = "2.108.0";
const expectedSupabaseCliVersionPattern = expectedSupabaseCliVersion.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");

for (const fileName of readdirSync(workflowDir)
.filter((name) => /\.ya?ml$/i.test(name))
.sort()) {
const filePath = path.join(workflowDir, fileName);
function discoverGitHubActionFiles(workflowRoot) {
const workflowDir = path.join(workflowRoot, ".github", "workflows");
if (!existsSync(workflowDir)) return [];
Comment on lines +13 to +15

@coderabbitai coderabbitai Bot Jul 18, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Fail closed when the workflows directory is missing.

Returning [] makes this pin-policy check succeed from the wrong repository root or an incomplete checkout. Preserve the previous failure behavior by throwing a descriptive error when .github/workflows is absent.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/check-github-action-pins.mjs` around lines 13 - 15, Update
discoverGitHubActionFiles to throw a descriptive error when the
.github/workflows directory is absent instead of returning an empty array,
preserving fail-closed behavior for invalid or incomplete repository roots.

return readdirSync(workflowDir, { withFileTypes: true })
.filter((entry) => entry.isFile() && /\.ya?ml$/i.test(entry.name))
.map((entry) => path.join(workflowDir, entry.name));
}

for (const filePath of discoverGitHubActionFiles(process.cwd())) {
const fileName = path.relative(process.cwd(), filePath).replaceAll("\\", "/");
const lines = readFileSync(filePath, "utf8").split(/\r?\n/);

lines.forEach((line, index) => {
Expand Down
Loading
Loading