Fix Database↔Supabase interface audit findings (#052, #062, schema hygiene, table-facts latency)

.cursor/agents/pr-babysit.md

@@ -0,0 +1,20 @@
+---
+name: pr-babysit
+description: Get an open Database PR merge-ready by resolving merge conflicts, failing required CI, and actionable unresolved review threads. Use proactively when asked to babysit a PR, land a PR, or clear merge blockers.
+---
+
+You are a PR babysitter for the Database repository.
+
+When invoked:
+
+1. Identify the target PR (number, URL, or current branch) and fetch mergeability, check rollup, and unresolved review threads only.
+2. Prefer the smallest safe fix that unblocks merge. Do not rewrite unrelated code.
+3. Merge `origin/main` into the feature branch when the PR is behind or conflicts are trivial; abort and ask when intents conflict.
+4. Fix CI failures caused by this PR’s scope. Never weaken workflows or delete required checks to force green.
+5. Treat Codex/Bugbot findings as actionable only when validated against the current diff; fix clear P0/P1 and scoped P2s, otherwise reply with a concise disposition.
+6. After fixing a review thread, reply with `<!-- codex-thread-disposition:resolved -->` as the first line when using the repo’s resolve workflow, then resolve the thread when tooling allows.
+7. Respect provider confirmation boundaries: no live Supabase/OpenAI/eval spend unless the user explicitly authorized it for this PR.
+8. Push ordinary commits to the feature branch, update the PR body when policy metadata is missing (Clinical Governance Preflight, RAG impact, verification), and re-check CI until mergeable + green + comments triaged.
+9. Never merge into `main`, force-push, close the PR, or delete branches unless the user explicitly asks.
+
+Report before/after: merge state, CI, threads fixed vs left open, commits pushed, and any remaining human decision.

docs/branch-review-ledger.md

@@ -20,6 +20,8 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD
 
 | Date       | Branch or ref                                            | Reviewed HEAD                            | Scope                                                      | Outcome                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | Checks                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
 | ---------- | -------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 2026-07-24 | `cursor/database-interface-audit-0883` / PR #1133 | `8c4c5556ef470673da492aa5f901513c84637d83` | PR babysit + Bugbot + Codex thread triage | COMPLETED for current head. Fixed Codex P2s: stranded queued recovery pages past open-job rows; bulk retry_failed enrichment lease preflight scopes to failed docs only. Bugbot ClinicalDashboard safety-findings finding is not in this PR unique diff vs main. PR policy Clinical Governance Preflight added in body. Merged origin/main. | Local Bugbot; focused Vitest; gh PR/CI. |
+| 2026-07-24 | `main` | `6ceaaff50712e10e857bf9a5a7ec88b530bf7b35` | Supabase interface / performance / schema guardian audit | COMPLETED. No P0/P1 live security hole. Confirmed service-role + app-layer ownership model, fail-closed `retrieval_owner_matches`, and project-ref pinning. P2 findings: duplicate unscoped `correct_clinical_query_terms` block in `schema.sql` (safe definition wins at replay); reindex routes miss fresh enrichment-lease gate (`#052`); upload crash can strand `queued` without a job (`#062`); table-facts RPC still `LANGUAGE sql` + `force_custom_plan` (byte-identical plpgsql+EXECUTE remains the latency win). P3: base match RPC execute revokes rely on roles.sql; `invoke_ingestion_worker` hardcodes URL; cold multi-RPC fan-out. Remediation continues on `cursor/database-interface-audit-0883`. | Static schema/RLS/RPC/grant/owner-scope/auth/client inspection; upload/reindex wiring; scale/SLO/deploy docs; outstanding-issues `#052`/`#062`. Provider-gated skipped: `check:supabase-project`, live `check:drift`, `check:indexing`, `profile:retrieval`, `eval:retrieval*`, migration apply. Notion MCP unavailable (`needsAuth`). |
 | 2026-07-24 | PR #1125 / `codex/answer-relevance-fail-closed` | `8d9fb2408f13e305138749655214baa0020fcfd4` | Follow-up: clear comparison/`documentBreakdown` in untrusted clinical notes | APPROVE for the scoped P2. `trustGatedAnswerForClinicalNotes` now clears `documentBreakdown`, `comparisonMatrix`, and `comparisonEvaluationState` when relevance is not source-backed, so Clinical Notes → ClinicalOutputPanel cannot rebuild comparison-detail tables from raw `best_quote` values. Prior visual/section/quote gates remain. Residual risk is still deliberate low-trust rendering for legacy payloads without `isSourceBacked: true`. | Focused jsdom/policy regressions: `tests/visual-evidence-tabs.dom.test.tsx` 5/5 after hardening the comparison case (caption + matrix values absent). Thread disposition posted and resolved. No live RAG/OpenAI/Supabase mutation. |
 | 2026-07-24 | `codex/answer-relevance-fail-closed` | `ac0d4305478a0bc8fef03894b78ec5911912c08a` | Missing answer-relevance metadata across render policy and live dashboard grounding | APPROVE after resolving two review P2s. A shared `isAnswerSourceBacked` predicate now requires explicit `isSourceBacked: true`; missing or explicitly negative relevance cannot retain high render trust, a grounded dashboard state, visual/table evidence, or a clinical-notes table bypass. Explicitly source-backed answers preserve supported behavior. Retrieval, ranking, generation, source selection and stored data are unchanged. Highest residual risk is deliberate compatibility tightening for older answer payloads without relevance metadata; they render low-trust and expose review sources rather than richer evidence blocks. | Initial red policy proof failed with `high`; two later red proofs exposed retained visual evidence and the clinical-notes raw-table affordance, then passed after both render-model gates. Focused render/provenance/clinical-safety tests passed 37/37; the focused DOM/policy pair passed 31/31. Offline RAG passed 21 suites/308 tests and 36/36 fixtures; production-readiness was READY against `Clinical KB Database` read-only; `verify:pr-local` passed runtime, formatting, lint, typecheck, all 366 test files (3,254 passed/1 skipped), production build (1,677 pages), client-bundle secret scan and RAG fixture validation; the earlier local `verify:ui` passed 267/267. After the final UI fix, `verify:cheap` again passed all 20 non-test gates, lint, typecheck and 3,254 tests, with only tracked issue #067 timing out under machine load; its isolated retry also exceeded the same 30-second limit and was not repeated. Fresh exact-head hosted checks are required. No live RAG, OpenAI request, Supabase mutation, Railway action, production data operation or deployment ran. |
 | 2026-07-24 | `codex/safety-plan-no-patient-data-contract` | `b94987c94537f3114a3429848fa908bdecd1d80a` | Safety Plan Generator identifier, local-state, copy, print, privacy-notice and PIA contract | APPROVE. No P0-P2 finding. The patient name/initials field is removed; the builder now asks for identifier-free minimum content, retains working state only in the mounted React component, and makes clipboard/print/PDF export an explicit handling boundary. The PIA and product privacy copy distinguish this local-only tool from provider-backed questions. Highest residual risk is outside Clinical KB: users must handle exported copies under an approved clinical-record process, which the UI now states at the export controls. | Privacy/component DOM 3/3 plus updated privacy-copy 2/2; focused Chromium copy/print/no-fetch-or-XHR 1/1; `verify:cheap` passed all 21 gates, 366 files and 3,245 tests with 1 skip; production-readiness READY using the existing canonical environment without a provider call; production build and client-bundle secret scan passed; offline RAG fixture/manifest 36 cases/21 suites passed. `verify:pr-local` passed runtime, formatting, lint and typecheck, then stopped on the unrelated load-sensitive `reconciliation-preflight` 30-second timeout; that test passed 5/5 isolated and the preceding full suite passed, so the unchanged five-minute gate was not retried. No Supabase, OpenAI, Railway, live RAG, production data or deployment action ran. |