docs(rag): fix buildRagSourceBlock & applyNumericVerification citations after the src/lib/rag extraction

[BigSimmo]

Summary

Follow-up to the merged #994 review. #994 extracted the rag cluster into src/lib/rag/ and did a mechanical src/lib/rag.ts → src/lib/rag/rag.ts path bump on the two safety docs. But several cited symbols do not live in rag.ts at all, so the citations ended up pointing at the wrong file/line — exactly what the CodeRabbit review flagged. #997 (rag-evidence-gates extraction) then shifted rag.ts line numbers again by −129. This PR re-verifies every affected citation against current HEAD so both documents are reproducible again.

Resolves the two review comments on #994:

• buildRagSourceBlock citations (docs/rag-injection-threat-model.md): the prompt-assembly and per-field render sites (title/file_name/caption/tableTitle/tableLabel/tableTextSnippet/memory_cards/retrieval_synopsis/adjacent_context/section_path/table_facts/indexing_quality/fenced content/id lines) now point at the extracted module src/lib/rag/rag-source-block.ts (lines 112–185), as §6 already noted. answerInstructions (rag.ts:3884) and buildAnswerInput/answer-input assembly (rag.ts:3938, cross-doc brief rag.ts:3998) are retained in rag.ts with corrected line numbers.
• applyNumericVerification citations (docs/clinical-hazard-analysis.md): the helper and its internals (hasActionableNumericContext, blank-to-gap, per-section scoping, verifyAnswerNumbers, NUMERIC_TOKEN_PATTERN, and the union set — renamed sourceNumericTokenSet → sourceClinicalValueAtomSet) now cite their real definition in src/lib/answer-verification.ts plus the call site rag.ts:4753. The companion H6b RAW-field refs also move to rag-source-block.ts.

Scope is limited to these two flagged citation groups across both companion docs. Other pre-existing stale rag.ts references from the same refactor (e.g. sanitizeCitations, deriveConfidence, evaluateEvidenceCoverageGate) were not in scope of these comments and are left for a separate sweep — noted here for visibility.

Verification

• prettier --check passes on both files (table alignment preserved — replacements are equal-width)
• Every cited file:line verified by sed/grep against the rebased HEAD (4a72c93)
• Docs-only change — no unit/UI/eval/readiness gates apply (no source, config, or test code touched)

Risk and rollout

• Risk: None — documentation-only; no product code, behavior, or configuration changed.
• Rollback: revert this commit.
• Provider or production effects: None.

Clinical Governance Preflight

N/A — this change edits only two analysis documents' internal code cross-references. No ingestion, answer generation, search/ranking, source rendering, document access, privacy, production env, or clinical output behavior is modified.

Notes

Rebased onto the current origin/main (4a72c93, includes #997) before verifying, so the line numbers reflect post-#997 rag.ts.

---

Generated by Claude Code

Summary by CodeRabbit

• Documentation
  • Updated the clinical hazard analysis to reflect current safety-control references and clarify known verification limitations.
  • Refreshed the RAG injection threat model with current prompt-data handling, sanitization boundaries, attack vectors, and citation/provenance risks.
  • Updated referenced code locations throughout both documents for improved accuracy.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b4c40753-dd65-4bc9-ae52-6381e7f2fedb

📥 Commits

Reviewing files that changed from the base of the PR and between 4a72c93 and 7be78a4.

📒 Files selected for processing (2)

• docs/clinical-hazard-analysis.md
• docs/rag-injection-threat-model.md

---

📝 Walkthrough

Walkthrough

Updated two safety documents with current code references and revised descriptions of numeric verification, prompt-field handling, fencing, injection vectors, mitigations, and citation-scoping behavior. No exported or public entities were changed.

Changes

Safety documentation updates

Layer / File(s)	Summary
Clinical hazard control references docs/clinical-hazard-analysis.md	Updated H1 and H6 hazard references and the “working well” numeric-faithfulness citations.
RAG injection threat-model wiring docs/rag-injection-threat-model.md	Revised prompt-field mappings, attack vectors, mitigation references, key file index, and numeric-scoping follow-up citation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• BigSimmo/Database#994: Refactors RAG code locations referenced by these documentation updates.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/pr-994-issues-p6bmuj

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.