fix: remediate 2026-07 repo audit findings (clinical answer path, data integrity, privacy)

[BigSimmo]

Summary

• Remediates all 42 findings from the full multi-agent repo audit (report: docs/audit/repo-audit-2026-07-01.md), hardened by an adversarial review of the fix diff itself (R1–R13, all resolved).
• Clinical answer path: numeric-verification corpus now covers everything shown to the model (synopsis, image table text, table-fact metadata snippets); sanitizer no longer deletes threshold sentences; copied ward-note tables share the on-screen conservative normalization + low-confidence caveat (incl. AccessibleTable parity); confidence scoped to cited chunks.
• Data integrity: DELETE blocks pending reindex jobs; deep-memory computes embeddings before deleting old memory and fails closed on generation-lookup errors; perceptual hash ph1 (16-bit) → ph2 (192-bit); new migration 20260702000000_commit_generation_preserve_legacy_artifacts.sql (not yet applied to the live DB — apply via normal flow, then reindex:health + check:indexing), mirrored in the worker fallback; chunking forward-progress guard + whole-line page-noise anchoring.
• Privacy/security: optional HMAC-keyed query hashing via new RAG_QUERY_HASH_SECRET (recommend setting wherever real queries are logged); non-string log fields serialized before redaction; timing-safe edge-function secret compare; fail-fast on non-retryable OpenAI 4xx.
• Retrieval: retrieval-selection.ts + its governance contract test are aligned verbatim with PR RAG optimisation: answer quality (P1-P10), v17 numeric grounding, offline fallback, hybrid RPC hardening + golden-recall regression fix #118's relevance-first design (audit H3/L4 superseded by the measured golden-eval contract; no metadata weighting reintroduced).
• Also: word-boundary intent signals with digit-attached dose support, classification fixes (site-in-title, BMJ false attribution, flowchart-vs-table), stale-search request guard incl. progress updates, strict CLI arg validation, dead-code removal, CSP host dedup, ~13 new regression tests.
• Merged origin/main (through PR Merge codex/RAG_FIX modes (Differentials/Services/Forms/Favourites) restyled to Clinical White theme #120) into the branch; conflicts in search/route.ts and ClinicalDashboard.tsx resolved onto main's source-library/differentials refactor.

Verification

• npm run verify:cheap — pass on the merged tree after clean npm ci (lint ✅, typecheck ✅, vitest 785 passed / 2 skipped across 98 files)
• npm run verify:ui — not run locally; CI's chromium e2e gate covers the UI changes (ClinicalDashboard request guard, AccessibleTable header-source parity)
• npm run verify:release — not run (no release claim)
• npm run format:check — pass (drifted files on both branch and main formatted)
• npm run check:production-readiness — not run locally (no .env in this worktree); check:production-readiness:ci runs in CI. Post-merge: apply the new migration, then run check:production-readiness + reindex:health + check:indexing
• npm run check:deployment-readiness — covered by CI

Also run locally: npm run check:edge:functions (Deno) — pass.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use — strengthened: verification corpus now matches the model-visible corpus; quote/number gates fail closed
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval — none introduced; query-hash redaction strengthened (optional HMAC pseudonymization)
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only — RAG_QUERY_HASH_SECRET is server-only (not NEXT_PUBLIC_*); reviewer-verified no client-bundle leak
• Demo/synthetic content remains clearly separated from real clinical sources — untouched
• Source metadata, review status, and outdated/unknown-source behavior remain conservative — governance enforcement stays in ranking penalties + answer/source-governance layer per the PR RAG optimisation: answer quality (P1-P10), v17 numeric grounding, offline fallback, hybrid RPC hardening + golden-recall regression fix #118 measured contract; deep-memory generation filter now fails closed
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed — behavior changes are conservative-direction (more caveats surfaced, fewer silent drops); the outstanding classification/TGA sign-offs tracked in docs/clinical-governance.md are unchanged by this PR

Notes

• The audit report with per-finding outcomes, dispositions (L5/L9/L11/L18/L19), and the diff-review round is in docs/audit/repo-audit-2026-07-01.md.
• Golden retrieval eval not re-run: retrieval-selection.ts matches origin/main byte-for-byte, so the 23/23 contract is unchanged.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Remediates a broad set of clinical-safety, data-integrity, and privacy/security findings across the RAG answer path, ingestion/indexing pipeline, Supabase schema/RPCs, and supporting UI/scripts, with regression tests and a new migration to preserve legacy artifacts safely during reindex commits.

Changes:

• Expands numeric/quote verification and table-handling so the verification corpus and clipboard/table outputs match the model-visible/cited corpus (synopsis, image table text, table-fact metadata), and preserves low-confidence caveats.
• Hardens indexing/data-integrity paths (generation commit preservation rules, deep-memory rebuild ordering, delete guards, chunking forward-progress, perceptual hash upgrade).
• Improves privacy/security/ops robustness (optional HMAC query hashing, safer log redaction for non-strings, timing-safe edge secret compare, fail-fast on non-retryable OpenAI 4xx, stricter CLI arg parsing).

Reviewed changes

Copilot reviewed 51 out of 51 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
worker/main.ts	Mirrors the new “preserve legacy artifacts unless replaced” rule in the worker fallback deletion logic; documents image I/O trade-off.
tests/ward-output.test.ts	Adds regression coverage for clipboard/ward-note table normalization and caveat parity.
tests/supabase-schema.test.ts	Reformats assertions for schema/migration hybrid function ordering checks.
tests/source-text-sanitizer.test.ts	Adds regression coverage for keeping threshold sentences while still dropping title-noise fragments.
tests/retrieval-selection.test.ts	Adds coverage for clamping annotated hybrid_score and documents audit disposition context.
tests/rag-provider.test.ts	Minor formatting update around rate-limit classification test.
tests/rag-content-accuracy.test.ts	Minor formatting update for unbolding verified figures test.
tests/private-access-routes.test.ts	Extends DELETE guard test to cover both pending and processing ingestion jobs.
tests/openai-error-mapping.test.ts	Minor formatting update for quota-message classification test.
tests/image-filtering.test.ts	Updates tests to assert the new ph2 perceptual-hash format.
tests/document-organization.test.ts	Adds regression tests for title-only site detection and BMJ false-attribution avoidance.
tests/deep-memory.test.ts	Updates behavior expectation to fail-closed when committed-generation lookup fails.
tests/clinical-search.test.ts	Adds regression coverage for word-boundary intent signals and dose/visual focus detection.
tests/chunking.test.ts	Adds regression tests for overlap>=chunkSize termination and inline page-reference preservation.
tests/answer-verification.test.ts	Adds regression tests covering synopsis-only and image-table-text-only numeric verification.
tests/answer-prose-runons.test.ts	Minor formatting update for run-on sentence polishing test.
supabase/schema.sql	Updates commit_document_index_generation semantics in the schema snapshot to preserve legacy artifacts unless replaced.
supabase/migrations/20260702000000_commit_generation_preserve_legacy_artifacts.sql	Introduces migration redefining commit_document_index_generation to avoid destroying legacy NULL-generation artifacts unless replacements exist.
supabase/functions/indexing-v3-agent/index.ts	Adds timing-safe secret compare and fail-fast behavior for non-retryable OpenAI 4xx in embedding fetches; updates auth call site to await.
src/lib/ward-output.ts	Normalizes copied tables via normalizeAccessibleTable, preserves low-confidence caveat, avoids header duplication and column shifts; avoids dangling headings.
src/lib/visual-intelligence.ts	Derives medications from clinical vocabulary category matches instead of a hardcoded allowlist.
src/lib/validation/form-data.ts	Clarifies preprocess behavior so non-string multipart values are rejected (not silently coerced).
src/lib/source-text-sanitizer.ts	Adds threshold-signal detection to prevent dropping threshold-bearing fragments; adjusts provenance scoring to avoid gating regressions.
src/lib/rag.ts	Scopes confidence derivation to cited chunks; expands table-fact quote corpus to include prompt-visible metadata snippet fields.
src/lib/rag-provider.ts	Type formatting cleanup for ProviderFailureKind union.
src/lib/query-privacy.ts	Adds optional HMAC-SHA256 query hashing keyed by RAG_QUERY_HASH_SECRET (falls back to legacy SHA-256 when unset).
src/lib/privacy.ts	Serializes non-string log fields before redaction to avoid leaking URLs/emails/secrets in structured fields.
src/lib/ingestion.ts	Simplifies retryable-ingestion error logic and documents duplicate-key/manual-recovery path.
src/lib/image-filtering.ts	Upgrades lightweight perceptual hash from ph1 (16-bit) to ph2 (192-bit) to reduce collisions.
src/lib/evidence.ts	Allows callers to pass precomputed relevance/visualEvidence into buildSmartPanel to avoid recomputation.
src/lib/evidence-relevance.ts	Fixes unreachable “none” verdict; uses matched terms and score to avoid overstating evidence.
src/lib/env.ts	Adds optional RAG_QUERY_HASH_SECRET env var with minimum length constraint.
src/lib/document-tags.ts	Removes misleading dead branches and clarifies label-noise behavior.
src/lib/document-organization.ts	Fixes BMJ attribution rule, expands evidence text to include title/filename with bracket stripping, and corrects fallback gating on confirmed candidates.
src/lib/document-index-units.ts	Prevents “yes/no” from classifying table-like images as flowcharts unless structurally non-table.
src/lib/deep-memory.ts	Computes embeddings before deleting existing rows; fails closed on committed-generation lookup errors.
src/lib/cross-document-synthesis.ts	Removes dead ternary and simplifies maxPerDocument assignment.
src/lib/clinical-search.ts	Makes intent-signal matching word-boundary aware (with digit-adjacent doses) and preserves explicit dose signals despite escalation terms.
src/lib/chunking.ts	Anchors page-noise stripping to whole lines and enforces forward progress when overlap>=chunkSize.
src/lib/answer-verification.ts	Extends verification corpus to include retrieval_synopsis, image table text, and table-fact metadata snippet fields.
src/lib/answer-ranking.ts	Fixes bold-segment capping to count per-occurrence “free passes” rather than Set-based bypass.
src/components/ClinicalDashboard.tsx	Adds request sequencing guard so only the latest in-flight search updates UI state and progress.
src/components/AccessibleTable.tsx	Ensures markdown-parsed tables don’t incorrectly re-emit headers as data rows; keeps parity with clipboard normalization.
src/app/api/search/route.ts	Avoids recomputing relevance/visual evidence by caching and passing precomputed values through to smart panel and payload.
src/app/api/documents/[id]/route.ts	Blocks permanent delete when ingestion_jobs are pending or processing; improves the conflict message.
scripts/recover-ingestion-queue.ts	Replaces permissive arg parsing with strict validation (unknown flags/missing values/invalid ints fail).
scripts/purge-query-logs.ts	Makes CLI parsing fail loudly on unknown flags.
next.config.ts	Deduplicates CSP connect-src Supabase host entry (keeps wildcard).
docs/rag-hybrid-findings-and-todo.md	Markdown formatting tweaks (indentation/italics changes); note: current diff introduces broken indentation in one section.
docs/audit/repo-audit-2026-07-01.md	Adds the audit report documenting findings, fixes, verification, and dispositions.
.env.example	Documents the new optional RAG_QUERY_HASH_SECRET env var and its implications.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.