docs+chore: implement safe maturity-backlog items + work orders for the rest#985
Conversation
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Jc1ZYHFjXjn6mE6U6riVU
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Jc1ZYHFjXjn6mE6U6riVU
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Jc1ZYHFjXjn6mE6U6riVU
📝 WalkthroughWalkthroughDependabot now groups npm and GitHub Actions updates. Repository documentation adds scripts and maturity indexes, an AI tooling map, WCAG 2.2 AA coverage notes, and a structured maturity backlog. ChangesDependency automation
Repository documentation
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/design-system.md (1)
153-154: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winCorrect the documented accessibility viewport.
The cited test sets the reduced-motion viewport to
390×844, not390×820. This mismatch can cause manual checks to use a different layout than the automated coverage.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/design-system.md` around lines 153 - 154, Update the canonical mobile viewport documentation in docs/design-system.md from 390×820 to 390×844, matching the viewport configured by tests/ui-accessibility.spec.ts while preserving the surrounding accessibility-check context.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/design-system.md`:
- Around line 137-140: Update the WCAG 2.2 AA statement in the design-system
documentation to describe tests/ui-accessibility.spec.ts as partial automated
coverage, noting that it checks selected areas rather than enforcing the full
WCAG 2.2 AA standard. Preserve the existing manual-checks distinction unless the
automated gate is expanded.
In `@docs/maturity-backlog-workorders.md`:
- Around line 25-26: Update the Verification note in the maturity backlog
document to remove the claim that grouping keeps pinned action SHAs uniform
across workflows. State only that the YAML is valid and takes effect on the next
Monday cadence, while preserving the separate L2 status that uniform SHAs remain
OPEN.
---
Outside diff comments:
In `@docs/design-system.md`:
- Around line 153-154: Update the canonical mobile viewport documentation in
docs/design-system.md from 390×820 to 390×844, matching the viewport configured
by tests/ui-accessibility.spec.ts while preserving the surrounding
accessibility-check context.
🪄 Autofix (Beta)
✅ Autofix completed
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: d4ac7421-0ec6-401a-804f-9a96eece3d39
📒 Files selected for processing (6)
.github/dependabot.ymldocs/README.mddocs/agents-guide.mddocs/design-system.mddocs/maturity-backlog-workorders.mddocs/scripts-index.md
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Fixes Applied SuccessfullyFixed 2 file(s) based on 2 unresolved review comments. Files modified:
Commit: The changes have been pushed to the Time taken: |
Fixed 2 file(s) based on 2 unresolved review comments. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
2 participants
Summary
Follow-up to the merged repository-maturity audit (#981): lands the safe, behaviour-preserving backlog items and turns every remaining recommendation into an actionable work order. Docs + one config file only — no source, API, schema, auth, or deployment behaviour changed.
.github/dependabot.yml) — batch npm minor/patch (prod/dev) and allgithub-actionsbumps into a few PRs instead of up to ~10/week; majors stay individual. Grouping action bumps also keeps pinned SHAs uniform across workflows (mitigates the action-version-skew finding).docs/maturity-backlog-workorders.md(new) — a sequenced work order per deferred item (import-boundary linter,src/lib/ragextraction, monolith decomposition, SAST-blocking, ACL consolidation, coverage floors, one-shot archival, ledger rotation, single gate manifest, action-SHA uniformity): outcome · approach · files · risk · verification · status. Includes two audit corrections found while scoping: the mockup import-boundary rule is zero-violation and ready; the "service-role only inadmin.ts" rule is invalid (30+ server routes legitimately use it) — the real protection (check:client-bundle-secrets+server-only) already exists.docs/scripts-index.md(new) — curated map of the ~135scripts/+ 166 npm commands by purpose, flagging one-shot archive candidates.docs/agents-guide.md) — which of the five AI systems owns which job, all deferring toAGENTS.md.docs/design-system.md§7).Already-satisfied items recorded (not re-done): RPO/RTO is already documented in the DR runbook.
Verification
Docs + non-behavioural config only:
npm run docs:check-links— pass (988 refs resolve)npm run docs:check-scripts— pass (315 refs)npm run docs:check-index— pass (40 modules/routes + schema tables)npm run format:check— pass (Prettier clean).github/dependabot.yml— valid YAML (2 ecosystems, 3 groups)Verification not run:
verify:pr-local/ evals — no source, UI, retrieval, answer, or schema behaviour changed; CI runs the full gate on this PR.Risk and rollout
Clinical Governance Preflight
N/A — no ingestion, answer generation, search/ranking, source rendering, document access, privacy, production-env, or clinical-output behaviour changed.
Notes
The high-risk backlog items (
src/librestructure, monolith decomposition, SAST-blocking, ACL consolidation, coverage floors) are intentionally captured as ready-to-execute work orders indocs/maturity-backlog-workorders.mdrather than forced into this PR — each warrants its own PR + full-suite verification, per the audit's own guidance. The import-boundary linter (X1) is scoped and zero-violation; say the word and I'll take it next.Generated by Claude Code
Summary by CodeRabbit
Documentation
Chores