docs: repository maturity audit — report, security policy, diagrams, index cleanup#981
Conversation
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Jc1ZYHFjXjn6mE6U6riVU
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Jc1ZYHFjXjn6mE6U6riVU
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Jc1ZYHFjXjn6mE6U6riVU
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Jc1ZYHFjXjn6mE6U6riVU
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Jc1ZYHFjXjn6mE6U6riVU
|
Warning Review limit reached
Next review available in: 7 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR adds repository security and licensing documentation, expands documentation indexes and archives, introduces architecture and lifecycle diagrams, records a repository maturity audit, and updates CI guidance to describe bundle-budget and codebase-index checks as enforced. ChangesRepository governance and documentation
Estimated code review effort: 2 (Simple) | ~15 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/audit/2026-07-20-repository-maturity.md`:
- Around line 30-31: Reconcile the “Most important risks” summary with the
`Security-reporting policy` entry in the maturity matrix so both use one
authoritative severity statement; either remove the High priority from the
matrix or update the summary to acknowledge it, while preserving the intended
risk classification.
- Around line 167-173: Add the text language identifier to the opening fenced
code block surrounding the repository directory listing, leaving the block
contents unchanged.
In `@docs/ingestion-state-machine.md`:
- Around line 31-37: Update the documents.status state transitions in the
diagram: show atomic reindex enqueue from indexed as remaining indexed while
creating a pending ingestion job, and distinguish the non-atomic reindex path
that transitions indexed to queued. Also add the processing-to-queued transition
for retry, while preserving the existing processing-to-failed and terminal
indexed transitions.
🪄 Autofix (Beta)
❌ Autofix failed (check again to retry)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: d2f75e04-2571-41ae-a34b-35c457721773
📒 Files selected for processing (16)
.github/workflows/ci.ymlREADME.mdSECURITY.mddocs/README.mddocs/archive/BRANCH_ARCHIVE_20260709.mddocs/archive/design-qa-2026-07-15.mddocs/archive/project-alignment-cleanup.mddocs/archive/source-governance-priorities-2026-07-02.mddocs/archive/source-governance-status-2026-07-08.mddocs/audit/2026-07-20-repository-maturity.mddocs/codebase-index.mddocs/deployment-architecture.mddocs/ingestion-state-machine.mdpackage.jsonscripts/check-bundle-budget.mjsscripts/check-codebase-index-coverage.mjs
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. The branch was updated while autofix was in progress. Please try again. |
ok Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
- State the one High-priority gap (missing SECURITY.md, row 35) is closed in this PR so the summary and maturity matrix agree on severity. - Add the `text` language identifier to the src/lib restructure fence (markdownlint MD040). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H5TymRtbrygE4HiaDgiAFo
2 participants
Summary
Repository maturity, mapping, and organisation audit for Clinical KB, plus a small set of safe, reversible improvements. No source, API, schema, auth, retrieval, or deployment behaviour changed — documentation and non-behavioural config only.
docs/audit/2026-07-20-repository-maturity.md— project profile, current map, a maturity gap matrix (35 rows across the assessment domains), target structure, a repository-host settings checklist, risks/assumptions, and a Now/Next/Later/Not-recommended backlog. Headline finding: the repo is already High maturity (top-decile CI/CD, security, migrations, testing, docs); the right work is pruning/indexing/diagramming, not adding scaffolding.SECURITY.md(private vulnerability-reporting channel + links to the existing threat models); README security pointer. This was the one genuinely-missing governance file."license": "UNLICENSED"inpackage.json+ a one-line README note (ownership/intent are known; this is not an OSS license).deployment-architecture.md,ingestion-state-machine.md, andcodebase-index.md.docs/READMEindex (added 7 orphaned living docs; softened the "everything" over-claim) and moved 5 completed/misplaced point-in-time docs todocs/archive/per the repo's own maintenance rule.source-review-priority-2026-07-02.mdwas deliberately left in place — it is referenced by the live governance-debt manifestrelease-source-metadata-debt-2026-06-30.json.verify:cheap) and the bundle-budget CI step label ("warn-only" → the budget is now enforced with a committed baseline).Verification
Docs + non-behavioural config only; the relevant gates all pass:
npm run docs:check-links— pass (937 repo path refs resolve)npm run docs:check-scripts— pass (305 npm-run refs)npm run docs:check-index— pass (38 modules/routes + all schema tables)npm run format:check— pass (Prettier clean)npm run check:runtime— pass (Node 24.13.0 / npm 11.6.2)npm run check:github-actions— pass (pins/YAML valid after theci.ymllabel edit)Verification not run:
npm run verify:pr-local/verify:ui/ evals — no source, UI, retrieval, answer, or schema behaviour changed; CI runs the full gate on this PR.Risk and rollout
git mvrenames with inbound links retargeted and verified bydocs:check-links.Clinical Governance Preflight
N/A — no ingestion, answer generation, search/ranking, source rendering, document access, privacy, production-env, or clinical-output behaviour changed. The Supabase target and the service-role/private-document-access boundaries are untouched.
Notes
src/libdomain-directory restructure, monolith decomposition (rag.ts,ClinicalDashboard.tsx), an import-boundary linter, and SAST-blocking on the parser path are intentionally deferred to the backlog in the report — each warrants its own PR plus full-suite verification.Generated by Claude Code
Summary by CodeRabbit
Documentation
Quality Improvements