docs+chore: implement safe maturity-backlog items + work orders for the rest

[BigSimmo]

Summary

Follow-up to the merged repository-maturity audit (#981): lands the safe, behaviour-preserving backlog items and turns every remaining recommendation into an actionable work order. Docs + one config file only — no source, API, schema, auth, or deployment behaviour changed.

• Dependabot grouping (.github/dependabot.yml) — batch npm minor/patch (prod/dev) and all github-actions bumps into a few PRs instead of up to ~10/week; majors stay individual. Grouping action bumps also keeps pinned SHAs uniform across workflows (mitigates the action-version-skew finding).
• docs/maturity-backlog-workorders.md (new) — a sequenced work order per deferred item (import-boundary linter, src/lib/rag extraction, monolith decomposition, SAST-blocking, ACL consolidation, coverage floors, one-shot archival, ledger rotation, single gate manifest, action-SHA uniformity): outcome · approach · files · risk · verification · status. Includes two audit corrections found while scoping: the mockup import-boundary rule is zero-violation and ready; the "service-role only in admin.ts" rule is invalid (30+ server routes legitimately use it) — the real protection (check:client-bundle-secrets + server-only) already exists.
• docs/scripts-index.md (new) — curated map of the ~135 scripts/ + 166 npm commands by purpose, flagging one-shot archive candidates.
• AI-tooling map (docs/agents-guide.md) — which of the five AI systems owns which job, all deferring to AGENTS.md.
• WCAG 2.2 AA named as the accessibility target (docs/design-system.md §7).
• Documentation index updated for the two new docs.

Already-satisfied items recorded (not re-done): RPO/RTO is already documented in the DR runbook.

Verification

Docs + non-behavioural config only:

• npm run docs:check-links — pass (988 refs resolve)
• npm run docs:check-scripts — pass (315 refs)
• npm run docs:check-index — pass (40 modules/routes + schema tables)
• npm run format:check — pass (Prettier clean)
• .github/dependabot.yml — valid YAML (2 ecosystems, 3 groups)

Verification not run: verify:pr-local / evals — no source, UI, retrieval, answer, or schema behaviour changed; CI runs the full gate on this PR.

Risk and rollout

• Risk: minimal — one config file (Dependabot grouping) + documentation. Grouping takes effect on the next weekly cadence.
• Rollback: revert the PR.
• Provider or production effects: None.

Clinical Governance Preflight

N/A — no ingestion, answer generation, search/ranking, source rendering, document access, privacy, production-env, or clinical-output behaviour changed.

Notes

The high-risk backlog items (src/lib restructure, monolith decomposition, SAST-blocking, ACL consolidation, coverage floors) are intentionally captured as ready-to-execute work orders in docs/maturity-backlog-workorders.md rather than forced into this PR — each warrants its own PR + full-suite verification, per the audit's own guidance. The import-boundary linter (X1) is scoped and zero-violation; say the word and I'll take it next.

---

Generated by Claude Code

Summary by CodeRabbit

• Documentation

  • Expanded the documentation index with guides for scripts, commands, and repository maturity work orders.
  • Added an AI tooling map describing configuration ownership and maintenance guidance.
  • Clarified accessibility goals, including WCAG 2.2 AA targets and automated coverage.
  • Added a structured tracker for planned repository improvements, priorities, risks, and verification steps.

• Chores

  • Grouped compatible dependency and GitHub Actions updates to streamline maintenance.

[coderabbitai]

📝 Walkthrough

Walkthrough

Dependabot now groups npm and GitHub Actions updates. Repository documentation adds scripts and maturity indexes, an AI tooling map, WCAG 2.2 AA coverage notes, and a structured maturity backlog.

Changes

Dependency automation

Layer / File(s)	Summary
Dependabot update groups .github/dependabot.yml	Groups npm production and development minor/patch updates separately and batches GitHub Actions updates.

Repository documentation

Layer / File(s)	Summary
Documentation indexes and script map docs/README.md, docs/scripts-index.md	Adds navigation links and catalogs scripts, commands, roles, and verification references.
Maturity backlog work orders docs/README.md, docs/maturity-backlog-workorders.md	Adds sequenced work orders, statuses, verification steps, exclusions, and a progress summary.
Guidance and accessibility documentation docs/agents-guide.md, docs/design-system.md	Documents AI tooling ownership and WCAG 2.2 AA automated and manual coverage.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• BigSimmo/Database#584: Related documentation index and agent-guidance updates.
• BigSimmo/Database#616: Implements the docs:check-scripts command referenced by the new scripts index.

Suggested labels: codex

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the PR's main changes: maturity backlog work orders, docs updates, and Dependabot grouping.
Description check	✅ Passed	The description follows the template well, covering Summary, Verification, Risk and rollout, Clinical Governance Preflight, and Notes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/repository-maturity-audit-yx5hdp

---

_{Comment @coderabbitai help to get the list of available commands.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

docs/design-system.md (1)

153-154: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Correct the documented accessibility viewport.

The cited test sets the reduced-motion viewport to 390×844, not 390×820. This mismatch can cause manual checks to use a different layout than the automated coverage.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/design-system.md` around lines 153 - 154, Update the canonical mobile
viewport documentation in docs/design-system.md from 390×820 to 390×844,
matching the viewport configured by tests/ui-accessibility.spec.ts while
preserving the surrounding accessibility-check context.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/design-system.md`:
- Around line 137-140: Update the WCAG 2.2 AA statement in the design-system
documentation to describe tests/ui-accessibility.spec.ts as partial automated
coverage, noting that it checks selected areas rather than enforcing the full
WCAG 2.2 AA standard. Preserve the existing manual-checks distinction unless the
automated gate is expanded.

In `@docs/maturity-backlog-workorders.md`:
- Around line 25-26: Update the Verification note in the maturity backlog
document to remove the claim that grouping keeps pinned action SHAs uniform
across workflows. State only that the YAML is valid and takes effect on the next
Monday cadence, while preserving the separate L2 status that uniform SHAs remain
OPEN.

---

Outside diff comments:
In `@docs/design-system.md`:
- Around line 153-154: Update the canonical mobile viewport documentation in
docs/design-system.md from 390×820 to 390×844, matching the viewport configured
by tests/ui-accessibility.spec.ts while preserving the surrounding
accessibility-check context.

🪄 Autofix (Beta)

✅ Autofix completed

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d4ac7421-0ec6-401a-804f-9a96eece3d39

📥 Commits

Reviewing files that changed from the base of the PR and between d7a824b and 53ff5c8.

📒 Files selected for processing (6)

• .github/dependabot.yml
• docs/README.md
• docs/agents-guide.md
• docs/design-system.md
• docs/maturity-backlog-workorders.md
• docs/scripts-index.md

[coderabbitai]

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Fixes Applied Successfully

Fixed 2 file(s) based on 2 unresolved review comments.

Files modified:

• docs/design-system.md
• docs/maturity-backlog-workorders.md

Commit: a9cd0781df3d153459d330de7e71942e2d350253

The changes have been pushed to the claude/repository-maturity-audit-yx5hdp branch.

Time taken: 2m 13s