Bind publication approval to immutable reviewed state - #1081
Conversation
|
Updates to Preview Branch (codex/reconcile-publication-approval) ↗︎
Tasks are run on every commit but only new migration files are pushed.
View logs for this Workflow Run ↗︎. |
📝 WalkthroughWalkthroughPublication approvals now bind documents to a canonical reviewed-state digest. Database functions validate unchanged content during transitions and publishing, while manifests, promotion scripts, audits, generated types, schema metadata, and verification tests propagate and validate the digest. ChangesPublication integrity
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant PromotionScript
participant SupabaseRPC
participant ApprovalLedger
participant PublishFunction
PromotionScript->>SupabaseRPC: Request document_publication_state_digest
SupabaseRPC-->>PromotionScript: Return current state digest
PromotionScript->>ApprovalLedger: Insert reviewed_state_digest approval
PromotionScript->>PublishFunction: Pass expected_state_digest
PublishFunction->>ApprovalLedger: Match approved reviewed-state evidence
PublishFunction->>SupabaseRPC: Recompute current state digest
SupabaseRPC-->>PublishFunction: Return current state digest
PublishFunction-->>PromotionScript: Publish result or changed-after-review error
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 659e417. Configure here.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 659e417a08
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex resolve actionable Codex review findings for this pull request and current head using the repository instructions. This is the pull request's single automatic repair pass: do not perform a fresh review, create new standalone findings, or request another review. Work only the existing unresolved Codex threads on the current head. Always fix P0 and P1 findings. For P2 and lower findings, fix only clear, scoped, low-risk issues; otherwise disposition them with a concise reason. After fixing or dispositioning a thread, reply in that thread with as the first line, followed by a concise summary; that marker authorizes the workflow to close that exact thread. If human input or new authorization is required, do not use the marker and leave the thread open with the blocker. Finish only after every actionable thread is fixed or dispositioned and closed, or explicitly left open for a human decision. Do not update the branch from main, address unrelated reviews, broaden scope, or create more than one scoped fix commit. Do not use external APIs, paid services, credentials, dependency changes, or broad refactors unless explicitly authorized. Add targeted tests where behavior changes and run the narrowest relevant validation. |
Summary
Testing
Note: I did not call external provider/GitHub APIs to post a review-thread reply directly; the required disposition marker and summary were included in the generated PR body for the repair pass. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
supabase/migrations/20260722190000_bind_publication_approval_to_reviewed_state.sql (1)
11-13: 🗄️ Data Integrity & Integration | 🔵 Trivial | 💤 Low valueUse
NOT VALIDfor this CHECK —ADD CONSTRAINT ... CHECKholds anACCESS EXCLUSIVElock while it validates existing rows;NOT VALIDdefers that scan and shortens the blocking window. Ifdocument_publication_approvalsstays a tiny append-only ledger, the current form is acceptable.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@supabase/migrations/20260722190000_bind_publication_approval_to_reviewed_state.sql` around lines 11 - 13, Update the document_publication_approvals constraint document_publication_approvals_reviewed_state_digest_format to add it with NOT VALID, deferring validation of existing rows while preserving CHECK enforcement for new or updated rows.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In
`@supabase/migrations/20260722190000_bind_publication_approval_to_reviewed_state.sql`:
- Around line 11-13: Update the document_publication_approvals constraint
document_publication_approvals_reviewed_state_digest_format to add it with NOT
VALID, deferring validation of existing rows while preserving CHECK enforcement
for new or updated rows.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 9cc43968-d775-432d-9682-8d940e7590ee
📒 Files selected for processing (10)
scripts/audit-public-document-approvals.tsscripts/promote-public-documents-batch.tsscripts/sql/verify-publication-approval.sqlsrc/lib/publication-manifest.tssrc/lib/supabase/database.types.tssupabase/drift-manifest.jsonsupabase/migrations/20260722190000_bind_publication_approval_to_reviewed_state.sqlsupabase/schema.sqltests/publication-manifest.test.tstests/supabase-schema.test.ts
1 participant
Summary
20260722190000_bind_publication_approval_to_reviewed_state.sqlmigration, regenerate schema/types/drift evidence, and update promotion/audit tooling.Verification
npm run verify:pr-local -- --files scripts/audit-public-document-approvals.ts,scripts/promote-public-documents-batch.ts,scripts/sql/verify-publication-approval.sql,src/lib/publication-manifest.ts,src/lib/supabase/database.types.ts,supabase/drift-manifest.json,supabase/schema.sql,supabase/migrations/20260722190000_bind_publication_approval_to_reviewed_state.sql,tests/publication-manifest.test.ts,tests/supabase-schema.test.ts— final head passed: 3,201 tests, 1 skipped; production build, client-bundle secret scan, and 36 offline RAG fixtures passed.npm run verify:cheap— passed all 21 gates; 3,201 tests passed, 1 skipped before the final SQL-only active-job remediation. The final remediation then passed focused schema tests, all database guards, the full migration replay, andverify:pr-local.npm run verify:uiwhen UI, routing, styling, browser behavior, reduced-motion, or forced-colors behavior changednpm run verify:releasebefore release or handoff confidence claimsnpm run eval:retrieval:quality(must stay 36/36) when retrieval, ranking, selection, chunking, or scoring behavior changednpm run eval:rag -- --limit 15+npm run eval:quality -- --rag-onlywhen answer generation, the synthesis prompt, or answer post-processing changednpm run check:production-readinesswhen clinical workflow, privacy, environment, Supabase, source governance, or deployment behavior changed.env.local, Supabase credentials, or OpenAI credentials; no provider call occurred.npm run check:deployment-readinesswhen deployment startup, hosting, or rollout behavior changednpm exec vitest run tests/publication-manifest.test.ts tests/supabase-schema.test.ts— 72/72 passed.npm run check:migration-role,npm run check:function-grants, andnpm run check:owner-scope— passed on final head.supabase/postgres:17.6.1.127with dynamic storage-owner discovery — passed; drift manifest regenerated.scripts/sql/verify-publication-approval.sqlpassed and rolled back.Risk and rollout
Clinical Governance Preflight
Clinical KB Database(sjrfecxgysukkwxsowpy)Notes
202c10eebaligns the approval digest with the union of artifacts visible through current SQL and application readers.79dadbc46locks/checksingestion_jobsandindexing_v3_agent_jobsin both publication paths and fails closed on lock contention or active/retryable work.20260719055622migration was not reused.Summary by CodeRabbit