Skip to content

Cleanup tracked artifacts and scope CI/secret-scan triggers to protected branches - #114

Merged
BigSimmo merged 1 commit into
mainfrom
copilot/review-and-organize-repo
Jul 1, 2026
Merged

Cleanup tracked artifacts and scope CI/secret-scan triggers to protected branches#114
BigSimmo merged 1 commit into
mainfrom
copilot/review-and-organize-repo

Conversation

Copilot AI commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

Summary

This PR performs a safe cleanup pass by removing tracked artifact noise and narrowing workflow execution to intended protected-branch coverage.

  • Artifact hygiene
    • Removed tracked runtime artifact: worker-ingestion.log
    • Added ignore rule for worker logs: worker-*.log in .gitignore
  • Workflow trigger tightening
    • Updated .github/workflows/ci.yml and .github/workflows/secret-scan.yml
    • Scoped push/pull_request triggers from all branches to main + release/**
    • Kept workflow_dispatch for explicit/manual runs
  • Trigger diff example
    on:
      push:
        branches: [main, "release/**"]
      pull_request:
        branches: [main, "release/**"]
      workflow_dispatch:

Verification

  • npm run verify:cheap
  • npm run verify:ui when UI, routing, styling, browser behavior, reduced-motion, or forced-colors behavior changed
  • npm run verify:release before release or handoff confidence claims
  • npm run format:check
  • npm run check:production-readiness when clinical workflow, privacy, environment, Supabase, source governance, or deployment behavior changed
  • npm run check:deployment-readiness when deployment startup, hosting, or rollout behavior changed

Clinical Governance Preflight

Complete this section when the change touches ingestion, answer generation, search/ranking, source rendering, document access, privacy, production env, or clinical output.

  • Source-backed claims still require linked source verification before clinical use
  • No patient-identifiable document workflow was introduced or expanded without explicit governance approval
  • Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
  • Service-role keys and private document access remain server-only
  • Demo/synthetic content remains clearly separated from real clinical sources
  • Source metadata, review status, and outdated/unknown-source behavior remain conservative
  • Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Notes

  • npm run verify:cheap could not be executed in this runner due to enforced engine mismatch (repo requires Node 24.x/npm 11.x; runner has Node 22.x/npm 10.x).

@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

@BigSimmo
BigSimmo merged commit 452cc7c into main Jul 1, 2026
3 checks passed
@BigSimmo
BigSimmo deleted the copilot/review-and-organize-repo branch July 2, 2026 16:31
BigSimmo pushed a commit that referenced this pull request Jul 30, 2026
Whole-table conflict in docs/outstanding-issues.md — main advanced 44
commits and gained rows while this PR sat open. Resolved by rebuilding
from main's current file and re-applying this branch's three changes,
not by taking either side: settling a whole-table conflict by picking a
side is the row-loss failure ledger #112 exists to make loud.

Renumbered the new row #117 -> #125. When this branch opened it, the
marker was 117; main's marker is now 125 and #117..#119 were reserved by
other sessions in the meantime, so keeping #117 would have collided with
a row someone else is about to add under that number. Ids are never
reused — renumber the incoming row above the marker and bump it.

Audited row-by-row against origin/main rather than eyeballed:

  main rows: 119   resolved rows: 120
  LOST from main: (none)
  ADDED vs main:  #125
  MOVED table:    #113 open->archive, #114 open->archive
  duplicates:     (none)

check:outstanding-issues: 120 rows (58 open, 62 archived), unique ids,
next-id=126 above the highest. verify:cheap exit 0, Tests 4493 passed |
4 skipped. format:check clean. `c2edda18` still absent from the file.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FvU8z73P6TXUXoYBqN5K1P
BigSimmo added a commit that referenced this pull request Jul 30, 2026
docs(issues): archive #113 and #114, open #117 for the stale spec reference
BigSimmo added a commit that referenced this pull request Jul 30, 2026
… audit batch (#1426)

* chore: close #108 after deleting empty remotes; record audit-branch cleanup batch

Delete five superseded remote refs (#108 trio plus circleci-project-setup and
execute-audit-code-remediation). Archive #108 and append branch-cleanup ledger
rows for a ten-branch audit/remediation review batch (two rejected, eight retained).

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* fix: resolve outstanding-issues merge without conflict markers

Rebuild from origin/main (archives #113/#114, adds #125) and re-apply the
#108 archive so the duplicate-id and conflict-marker breakage from the prior
merge commit is gone.

Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

* docs: correct branch cleanup ledger references

* docs: record PR 1426 review

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
BigSimmo pushed a commit that referenced this pull request Jul 30, 2026
Dispatched live-web-vitals.yml against psychiatry.tools (run 30548662649,
5 routes x 3 samples). #17 has been the gate on seven latency findings for
weeks with no evidence behind it. It now has evidence, and it is a breach.

Mobile medians against LCP<2500ms / CLS<0.1:

  root              4308ms  0.023
  therapy-compass   4716ms  0.142
  documents-search  3676ms  0.220
  dsm               3639ms  0.363
  forms             3786ms  0.212

Desktop passes everywhere (LCP 625-694ms, CLS 0.016-0.097), which is worth
noting because desktop-only checking would have concluded the opposite.

The verdict is gradeable rather than noisy: every LCP sample range sits wholly
above 2500ms, so the straddle rule #114 added does not fire. That distinction is
the whole point of #1407's sampling work — a single run per cell could not have
told a real breach from variance.

Applying the rule as written before the numbers were read: any breach makes only
the breaching routes' findings actionable, and NOTHING becomes WONTFIX. That is
the opposite of what a favourable sample would have produced, which is exactly
why the rule was written first.

CLS 0.363 on /dsm is the worst single number and is visible layout shift, not a
byte-count problem — so it is not addressed by the payload findings #17 gates.

Recorded honestly as one step short of complete: this reads the summariser's
emitted table, not the raw Lighthouse JSON (artifact 8762211043, 30-day
retention). The row itself asks for that cross-check before recording a verdict,
most of all a PASS; this is a breach, so the risk of the table flattering the
result is lower, but the check is still outstanding. INP is absent because
Lighthouse cannot measure it in lab conditions.

Diff stays 1 line: #17's Detail cell is 2184 chars against the column's 3268
budget, so nothing repads (see #133).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01361jh3eYVjJCzXWjAhdZiF
BigSimmo added a commit that referenced this pull request Jul 30, 2026
…ation, restore #105 after an upstream deletion (#1459)

* docs(issues): record #105's preconnect verification in a browser

The preconnect half of #105 is verified; the LoadingPanel half is not, and the
row now says which is which rather than carrying one PENDING for both.

Worth recording how it was verified, because the obvious check silently proves
nothing: locally NEXT_PUBLIC_SUPABASE_URL is unset, so supabaseOrigin() returns
null and the layout renders no link at all. Loading the app and finding no
preconnect would have looked like a failure and been an absent fixture. The
check needs a placeholder origin (no real network call — the point is React's
hoisting, not Supabase connectivity).

With that set, both the SSR HTML and the live browser DOM show preconnect and
dns-prefetch in <head> with zero stray preconnect in <body>, so React 19 does
hoist them out of the body where they are authored. crossOrigin="anonymous"
survives the hoist, which matters: without it supabase-js's CORS fetches open a
second connection and the hint buys nothing.

The remaining half needs a different technique. A LoadingPanel fallback only
renders while a lazy chunk is in flight, so it needs a throttled-network browser
check rather than verify:ui, which would race past it.

Gates: outstanding-issues guard 142 rows / unique ids; prettier clean; the edit
is a 1-line diff because it stays inside the Detail column's existing width
(1133 chars against a 3268 budget) — see #133 for why that matters in this file.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01361jh3eYVjJCzXWjAhdZiF

* docs(issues): record #17's live Web-Vitals verdict — mobile breaches

Dispatched live-web-vitals.yml against psychiatry.tools (run 30548662649,
5 routes x 3 samples). #17 has been the gate on seven latency findings for
weeks with no evidence behind it. It now has evidence, and it is a breach.

Mobile medians against LCP<2500ms / CLS<0.1:

  root              4308ms  0.023
  therapy-compass   4716ms  0.142
  documents-search  3676ms  0.220
  dsm               3639ms  0.363
  forms             3786ms  0.212

Desktop passes everywhere (LCP 625-694ms, CLS 0.016-0.097), which is worth
noting because desktop-only checking would have concluded the opposite.

The verdict is gradeable rather than noisy: every LCP sample range sits wholly
above 2500ms, so the straddle rule #114 added does not fire. That distinction is
the whole point of #1407's sampling work — a single run per cell could not have
told a real breach from variance.

Applying the rule as written before the numbers were read: any breach makes only
the breaching routes' findings actionable, and NOTHING becomes WONTFIX. That is
the opposite of what a favourable sample would have produced, which is exactly
why the rule was written first.

CLS 0.363 on /dsm is the worst single number and is visible layout shift, not a
byte-count problem — so it is not addressed by the payload findings #17 gates.

Recorded honestly as one step short of complete: this reads the summariser's
emitted table, not the raw Lighthouse JSON (artifact 8762211043, 30-day
retention). The row itself asks for that cross-check before recording a verdict,
most of all a PASS; this is a breach, so the risk of the table flattering the
result is lower, but the check is still outstanding. INP is absent because
Lighthouse cannot measure it in lab conditions.

Diff stays 1 line: #17's Detail cell is 2184 chars against the column's 3268
budget, so nothing repads (see #133).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01361jh3eYVjJCzXWjAhdZiF

* docs(issues): withdraw the #105 LoadingPanel verification — it matched the wrong component

The claim that `LoadingPanel` was verified present in the SSR response HTML
does not hold, so #105 is reopened rather than archived.

The evidence was `role="status" aria-label="Loading"` appearing in the
initial HTML of `/`, `/dsm` and `/forms`. Those hits are real, but that
exact string has exactly one renderer in `src/` — `ModeHomePageSkeleton`
(`src/components/mode-home-page-skeleton.tsx:8`). `LoadingPanel` never
emits a bare "Loading" label; it renders `aria-label={label}`, always a
specific string such as "Loading differentials". Re-checked per route
against a running server, `/`, `/dsm`, `/forms`, `/differentials` and
`/favourites` return zero `aria-label="Loading <something>"` matches.

Codex's mechanism finding on this PR stands and is not what failed: the
installed Next 16 loader does set `hasSuspenseBoundary` when a `loading`
element is supplied, and `BailoutToCSR` throws on the server, so a mounted
`ssr:false` surface emits its fallback into the response HTML. What was
missing is that this only fires for a surface mounted during the initial
render, and none of the eleven in `clinical-dashboard-lazy.tsx` are —
every one sits behind interaction state (`ClinicalDashboard.tsx:3666-4070`).
So neither a cold-load grep nor the throttled check the row originally
prescribed can observe them; that needs a driven browser session.

The reopened row and its queue entry both record the withdrawn claim and
carry an explicit stop rule against re-closing on a cold-load grep. The
preconnect half remains verified and is marked so, to avoid redoing it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01361jh3eYVjJCzXWjAhdZiF

* docs(issues): rank #17's mobile findings — CLS reproduces exactly offline

#17 asked for the mobile breach to be ranked by measured contribution.
Done, and the measurement turned up something that changes what the work
costs.

Ran the local offline production Lighthouse harness over the same five
routes the live dispatch used. The mobile CLS numbers do not merely
correlate with production — they match run 30548662649 to three decimals
on all four locally measurable routes (0.023 / 0.142 / 0.220 / 0.363),
and the desktop range matches at both endpoints (0.016-0.097). /forms
did not measure locally (Lighthouse NO_NAVSTART, its own "run again"
transient); live it was 0.212.

So CLS on these routes is deterministic layout structure, not network or
production data. The CLS half of #17 is debuggable and gate-able locally
at zero provider cost, and #17's recorded premise that production vitals
need Supabase secrets is stale — run-lighthouse-budget.mjs builds and
serves an offline production app precisely to sidestep that. Its earlier
"dev-mode CLS is excellent at 0.00-0.04" note was measuring dev, which
does not reproduce production.

LCP does NOT reproduce and must not be read from local runs: 2014-2051 ms
local against 3639-4716 ms live, because the loopback server has no
network latency. The LCP ranking does survive — /therapy-compass is the
outlier both locally and live — which corroborates #117.

Filed as #147 with the ranking (/dsm 0.363 worst, then /documents/search
0.220, /forms 0.212, /therapy-compass 0.142, / 0.023 passing) and the
next step: Lighthouse's layout-shift-elements audit returned zero items
on every route, so element attribution needs a PerformanceObserver on
layout-shift against the same offline build.

Two reproduction traps recorded with it: the harness reads CHROME_PATH
but nothing in this container sets it, so chrome-launcher fails on every
route; and a truncated `progress` package in the npx cache broke
Lighthouse startup entirely. No budget baseline was committed — the
grader correctly refused this run as incomplete evidence.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01361jh3eYVjJCzXWjAhdZiF

* docs(review): record PR 1459 final reconciliation

---------

Co-authored-by: Claude <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants