Implement Audit Recommendations for Provenance and Safety - #1254
Conversation
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
|
Warning Review limit reached
Next review available in: 11 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughChangesThe PR adds a locality metadata verification command, propagates query context for citation telemetry, updates citation and evidence processing, and centralizes source governance codes, severity mappings, UI tokens, and metadata enum validation. Locality verification
Citation-open telemetry
Citation and evidence processing
Source governance metadata
Review ledger updates
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant AnswerSurface
participant SourcePreview
participant SourceActions
participant InteractionAPI
AnswerSurface->>SourcePreview: pass query context
SourcePreview->>SourceActions: log source open
SourceActions->>InteractionAPI: submit citation telemetry
InteractionAPI-->>SourceActions: record interaction result
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
CI triageCI failed on this PR. Automated classification of the 2 failed job(s):
Compared with main CI run #5872 (failure). Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 748b8530ac
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex resolve actionable Codex review findings for this pull request and current head using the repository instructions. This is the pull request's single automatic repair pass: do not perform a fresh review, create new standalone findings, or request another review. Work only the existing unresolved Codex threads on the current head. Always fix P0 and P1 findings. For P2 and lower findings, fix only clear, scoped, low-risk issues; otherwise disposition them with a concise reason. After fixing or dispositioning a thread, reply in that thread with as the first line, followed by a concise summary; that marker authorizes the workflow to close that exact thread. If human input or new authorization is required, do not use the marker and leave the thread open with the blocker. Finish only after every actionable thread is fixed or dispositioned and closed, or explicitly left open for a human decision. Do not update the branch from main, address unrelated reviews, broaden scope, or create more than one scoped fix commit. Do not use external APIs, paid services, credentials, dependency changes, or broad refactors unless explicitly authorized. Add targeted tests where behavior changes and run the narrowest relevant validation. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: be03131eaf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/components/clinical-dashboard/evidence-panels.tsx (1)
933-967: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winThread the active query through every evidence-panel caller.
These handlers only log when
queryis present, butanswer-result-surface.tsxrendersMobileEvidenceSheetContentwithout a query at Lines 325-340 and rendersSafetyFindingsListContentwithoutqueryat Line 369. As a result, safety-finding opens—and the nested quote-card path unless the intermediate prop is threaded—produce no citation telemetry on this surface.Pass
querythroughMobileEvidenceSheetContent, then intoQuoteCardsandSafetyFindingsListContent, and add coverage for both paths.Also applies to: 1313-1381
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/components/clinical-dashboard/evidence-panels.tsx` around lines 933 - 967, Thread the active query from answer-result-surface.tsx through MobileEvidenceSheetContent into QuoteCards and SafetyFindingsListContent. Update each component’s props and call sites so both direct safety-finding links and nested quote-card links receive the query and trigger citation telemetry, then add coverage for both paths.
🧹 Nitpick comments (1)
src/lib/source-governance.ts (1)
15-39: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winMatrix typing forces unsafe
ascasts at every call site.
GOVERNANCE_SEVERITY_MATRIX/GOVERNANCE_UI_TOKEN_MATRIXare annotated asRecord<SourceGovernanceCode, X | "dynamic">, so indexing with any specific code still types as the full union, forcing every consumer (Lines 116-211) toas-cast away the"dynamic"branch.WEAK_EVIDENCEnever actually reads these maps today (it's special-cased at Lines 98-106), so this is latent — but if a future change readsGOVERNANCE_SEVERITY_MATRIX[SOURCE_GOVERNANCE_CODES.WEAK_EVIDENCE]and casts it like the others, it will silently produce the literal"dynamic"as aseverity/uiToken, which isn't a member of either union and would break theseverityRank[...]sort at Lines 215/270.Using
satisfiesinstead of an explicitRecord<...>annotation preserves per-key literal types, removes the need for casts on the safe codes, and turns any accidentalWEAK_EVIDENCElookup into a compile error instead of a silent bad value.♻️ Proposed fix
-export const GOVERNANCE_SEVERITY_MATRIX: Record<SourceGovernanceCode, SourceGovernanceWarning["severity"] | "dynamic"> = { +export const GOVERNANCE_SEVERITY_MATRIX = { [SOURCE_GOVERNANCE_CODES.OUTDATED]: "danger", [SOURCE_GOVERNANCE_CODES.POOR_EXTRACTION]: "danger", [SOURCE_GOVERNANCE_CODES.REVIEW_DUE]: "warning", [SOURCE_GOVERNANCE_CODES.UNVERIFIED]: "warning", [SOURCE_GOVERNANCE_CODES.PARTIAL_EXTRACTION]: "warning", [SOURCE_GOVERNANCE_CODES.LOW_INDEX_QUALITY]: "warning", [SOURCE_GOVERNANCE_CODES.WEAK_TABLE_EXTRACTION]: "warning", [SOURCE_GOVERNANCE_CODES.NON_LOCAL]: "info", [SOURCE_GOVERNANCE_CODES.REGISTRY_RECORD]: "info", [SOURCE_GOVERNANCE_CODES.WEAK_EVIDENCE]: "dynamic", -} as const; +} as const satisfies Record<SourceGovernanceCode, SourceGovernanceWarning["severity"] | "dynamic">; -export const GOVERNANCE_UI_TOKEN_MATRIX: Record<SourceGovernanceCode, SourceGovernanceUiToken | "dynamic"> = { +export const GOVERNANCE_UI_TOKEN_MATRIX = { [SOURCE_GOVERNANCE_CODES.OUTDATED]: "destructive", [SOURCE_GOVERNANCE_CODES.POOR_EXTRACTION]: "destructive", [SOURCE_GOVERNANCE_CODES.REVIEW_DUE]: "warning", [SOURCE_GOVERNANCE_CODES.UNVERIFIED]: "warning", [SOURCE_GOVERNANCE_CODES.PARTIAL_EXTRACTION]: "caution", [SOURCE_GOVERNANCE_CODES.LOW_INDEX_QUALITY]: "caution", [SOURCE_GOVERNANCE_CODES.WEAK_TABLE_EXTRACTION]: "caution", [SOURCE_GOVERNANCE_CODES.NON_LOCAL]: "neutral", [SOURCE_GOVERNANCE_CODES.REGISTRY_RECORD]: "muted", [SOURCE_GOVERNANCE_CODES.WEAK_EVIDENCE]: "dynamic", -} as const; +} as const satisfies Record<SourceGovernanceCode, SourceGovernanceUiToken | "dynamic">;With
satisfies,GOVERNANCE_SEVERITY_MATRIX[SOURCE_GOVERNANCE_CODES.OUTDATED]now types as the literal"danger", so theas SourceGovernanceWarning["severity"]casts at each call site can be dropped for the non-dynamic codes.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/source-governance.ts` around lines 15 - 39, Replace the explicit Record annotations on GOVERNANCE_SEVERITY_MATRIX and GOVERNANCE_UI_TOKEN_MATRIX with satisfies-based validation that includes only the safe governance codes and preserves per-key literal types. Remove the corresponding as casts in the consumers around the governance warning/token handling, while retaining the existing WEAK_EVIDENCE special case so that direct lookups cannot yield "dynamic".
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/verify-locality-metadata.ts`:
- Line 19: The documents accumulator in the locality metadata verification flow
must not use explicit any. Update documents near auditSourceAuthorityDocuments
to use the function’s expected SourceAuthorityDocument[] type or the canonical
generated row type, and explicitly normalize Supabase query results before
passing them to the audit function.
In `@src/app/api/search/interaction/route.ts`:
- Around line 33-38: Harden the citationTelemetry schema before it reaches
rag_query_misses.metadata: reject unknown keys, trim and cap
provenance/source_strength/document_status, validate them against their allowed
domains or enums, and constrain similarity to the documented retrieval-score
range. Ensure safeTelemetryText does not replace schema validation. Run the
required RAG/search domain check, npm run check:production-readiness, and the
route-level UI gates.
In `@src/lib/evidence.ts`:
- Around line 513-517: Update THRESHOLD_SPAN_PATTERN and the
threshold-observation parsing flow to capture and normalize the comparator
alongside the numeric threshold, then retain that comparator in
ThresholdObservation. Update conflict evaluation to compare comparator direction
as well as the numeric value, so opposite constraints such as QTc > 500 and QTc
< 500 are treated as conflicting.
- Around line 502-505: Update the clozapine pattern in the evidence catalog to
match dosage expressions such as “clozapine > 600 mg/day” without requiring the
literal word “dose,” while preserving the existing comparator and numeric-dose
captures used by the surrounding span matcher. Apply the same adjustment to the
related clozapine entry around the alternate referenced range.
---
Outside diff comments:
In `@src/components/clinical-dashboard/evidence-panels.tsx`:
- Around line 933-967: Thread the active query from answer-result-surface.tsx
through MobileEvidenceSheetContent into QuoteCards and
SafetyFindingsListContent. Update each component’s props and call sites so both
direct safety-finding links and nested quote-card links receive the query and
trigger citation telemetry, then add coverage for both paths.
---
Nitpick comments:
In `@src/lib/source-governance.ts`:
- Around line 15-39: Replace the explicit Record annotations on
GOVERNANCE_SEVERITY_MATRIX and GOVERNANCE_UI_TOKEN_MATRIX with satisfies-based
validation that includes only the safe governance codes and preserves per-key
literal types. Remove the corresponding as casts in the consumers around the
governance warning/token handling, while retaining the existing WEAK_EVIDENCE
special case so that direct lookups cannot yield "dynamic".
🪄 Autofix (Beta)
❌ Autofix failed (check again to retry)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 80c2f57e-a501-4bc6-9253-08272dba2336
📒 Files selected for processing (17)
package.jsonscripts/verify-locality-metadata.tsscripts/verify-pr-local.mjssrc/app/api/search/interaction/route.tssrc/components/clinical-dashboard/answer-content.tsxsrc/components/clinical-dashboard/answer-result-surface.tsxsrc/components/clinical-dashboard/answer-thread-turn.tsxsrc/components/clinical-dashboard/evidence-panels.tsxsrc/components/clinical-dashboard/prior-answer-turn-surface.tsxsrc/components/clinical-dashboard/source-actions.tsxsrc/lib/citations.tssrc/lib/evidence.tssrc/lib/source-authority-metadata.tssrc/lib/source-governance.tssrc/lib/source-metadata.tssrc/lib/source-text-sanitizer.tssrc/lib/types.ts
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. The branch was updated while autofix was in progress. Please try again. |
…rators Remove the live Supabase locality metadata check from unconditional verify:pr-local, capture comparator direction in withholding-threshold conflicts, harden citation telemetry validation, and type the locality audit accumulator.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 91aeb19d4d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
PR policy blockers: hosted check needs both ## Clinical Governance Preflight
- [x] Source-backed claims still require linked source verification before clinical use
- [x] No patient-identifiable document workflow was introduced or expanded without explicit governance approval
- [x] Supabase target remains `Clinical KB Database` (`sjrfecxgysukkwxsowpy`)
- [x] Service-role keys and private document access remain server-only
- [x] Demo/synthetic content remains clearly separated from real clinical sources
- [x] Source metadata, review status, and outdated/unknown-source behavior remain conservative
- [x] Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed
RAG impact: no retrieval behaviour change — source governance metadata/UI matrices, locality verification, and citation telemetry only; ranking/comparator formulas and retrieval RPCs unchanged. |
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found. |
* fix: stop choppy screen resize when switching modes Mode switches animated phone composer reserve because searchMode updated before the pathname landed, briefly leaving isStandaloneModeHome false and running the 200ms padding transition. Detect mode homes from pathname only, navigate without optimistic mode state, and limit padding transitions to scroll-hide. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * test: align therapy-compass wiring with pathname mode-home gate Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs(ledger): record mode-switch lag same-class bug hunt Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * fix: close same-class mode-switch layout thrash bugs After the reserve-flip fix, related choppiness remained from eager crossModeSearch chrome updates, inherited phone scroll/hide across mode homes, a hero-portal null gap while slots rebound, a taller mode-home loading skeleton, and services/forms contentAlign jumping after registry load. Navigate out of the dashboard without rewriting chrome, reset scroll-hide on pathname change, keep the default composer until the portal attaches, align the skeleton to the shell header token, and keep loading homes top-aligned on phone. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs(ledger): record mode-switch thrash review fixes Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * fix: satisfy lint for mode-switch scroll and portal cleanup Reset bottom-composer hidden state during render on pathname change instead of setState-in-effect, and drop the unused hero-portal fallback flag now that the default composer stays mounted until the host attaches. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs(ledger): record mode-switch thrash lint closeout Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs(ledger): record frontend-architecture loading/nav review Append review of mode/page loading and navigation architecture at HEAD 0ef62ff: P1 shell bundle + hydration blanking; residual remount/tools dual. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * fix: reduce mode/page loading blanking and layout rework Parallel loading review found hard-load blanking from ClientHydrationBoundary, mismatched/missing mode-home loading skeletons, forms catalog in the client chunk, ClinicalDashboard static weight on namespaced routes, sidebar column animation on remount, forms query remounts, and document viewer remounts on page flips. Paint RSC children immediately, align ModeHomeRouteLoading, wire mode-home loading.tsx files, server-pass the default form slug, dynamic-import ClinicalDashboard, gate sidebar transitions after mount, and stop unnecessary remount keys. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * docs(ledger): record parallel loading behaviour review fixes Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * refactor: extract sidebar transition hook and private-scope URL helper Keeps ClinicalDashboard inside the maintainability budget after the loading-performance pass, and shares the remount-safe sidebar transition gate with GlobalSearchShell. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * test: allow DocumentViewer identity-only remount key Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * test: align chrome contracts with pathname reset and gated padding After merging main's cross-breakpoint scroll-hide wiring, update static contracts for resetKey=pathname, and keep phone padding transitions gated to scroll-hide only so mode switches still snap. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * fix: clear CI hydration and phone-scroll failures Gate desktop composer portal adoption until page-owned slots mark themselves ready after hydration, so hard-loads no longer inject a display:contents host into still-unhydrated RSC HTML (React #418). Update phone-scroll expectations for scroll-hide-only reserve transitions. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * style: prettier-format portal ready-gate files Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * fix: keep document searches dashboard-owned and animate reserve reveal Treat /documents/search as in-shell for cross-mode sync, keep a short-lived reserve-transition marker through hide and reveal, omit readiness cards without a default slug, and preserve URL hashes when clearing private scope refs. * fix: stop duplicate page-root testids from searchParams Suspense Nesting route children inside the shell's useSearchParams Suspense left a hidden Next streaming S: clone of forms/favourites/presentation roots under CI load. Gate always-standalone paths off that boundary and bridge params beside the shell body so mode-home RSC paint stays. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * style: prettier format DocumentViewer reserve-transition import * docs: record babysit sweep ledger rows for #1241/#1248/#1254/#1257/#1253/#1255 * refactor: extract DocumentViewer/Dashboard helpers under budgets Pull PDF viewer mode helpers and document chrome scroll wiring into focused modules, and isolate the dashboard desktop result composer slot, so maintainability no-growth budgets pass after the reserve-transition and portal ready-gate work. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * test: align desktop page-slot contract with extracted helper Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * fix: satisfy hooks lint for searchParams Suspense bridge Use useSyncExternalStore for the client-only gate and call the param callback from layout effect deps instead of updating a ref during render. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * fix: seed standalone submitted search params Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * test: stabilize phone-scroll and presentation page assertions Drop the settled-bottom 0.24s reserve check (transition is short-lived on data-reserve-transitioning), and scope differential presentation lookups to the live shell scrollport so hidden Next streaming clones cannot fail strict mode under CI load. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> * fix: narrow submitted search param seeding Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…on-fixes Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/branch-review-ledger.md`:
- Line 1072: Update the ledger entry identified by PR `#1254` and commit
b3b1eb7e7084859cd18c05152be1b9f8968592ff to explicitly state that it is a
clarification or superseding record for the earlier duplicate entry on Line
1070, while preserving the existing audit details.
In `@src/lib/evidence.ts`:
- Around line 648-650: Update the distinct-key construction in the observation
comparison flow around thresholdObservationKey so an unknown comparator is
compatible with any known comparator at the same numeric threshold, rather than
creating a disagreement; continue treating observations with genuinely different
numeric values as distinct conflicts.
- Line 518: Update the evidence-matching regex so the bare clozapine alternative
only matches when its captured threshold is followed by a dosage unit such as
mg, preventing the lookahead from consuming an incidental dose before a later
QTc comparator. Preserve independent QTc extraction for text like “Withhold
clozapine 300 mg daily if QTc > 500 ms,” and add this case to the existing
regression tests.
- Around line 652-655: Update the conflict-detection logic around the
distinctKeys/distinctDocuments checks to track comparator-value keys per
document and only emit a cross-source conflict when differing keys are
represented by separate documents, not when one document contains both
conflicting observations. Add a regression test covering one document with both
QTc observations and a second document repeating only one of them, ensuring no
cross-source conflict is emitted.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 1e4942e0-1fb5-4750-a476-374b9bc2d509
📒 Files selected for processing (13)
docs/branch-review-ledger.mdpackage.jsonscripts/verify-locality-metadata.tsscripts/verify-pr-local.mjssrc/app/api/search/interaction/route.tssrc/components/clinical-dashboard/answer-content.tsxsrc/components/clinical-dashboard/source-actions.tsxsrc/lib/evidence.tssrc/lib/source-authority-metadata.tssrc/lib/source-governance.tssrc/lib/source-metadata.tssrc/lib/types.tstests/evidence.test.ts
🚧 Files skipped from review as they are similar to previous changes (7)
- package.json
- src/lib/types.ts
- src/app/api/search/interaction/route.ts
- src/lib/source-authority-metadata.ts
- src/lib/source-metadata.ts
- src/components/clinical-dashboard/source-actions.tsx
- src/lib/source-governance.ts
Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
2 participants
Summary
check:locality-metadataand out of the unconditional offlineverify:pr-localbase script.RAG impact: no retrieval behaviour change — provenance/governance UI tokens, citation telemetry, and locality audit only; ranking/imputation formulas untouched
Verification
npm run test -- tests/evidence.test.ts— PASS (26/26) after threshold false-positive hardening.npm run typecheck— PASS.npm run format:check— PASS.npm run lint— PASS.npm run build— PASS.npm run check:rag:fixtures— PASS.npm run check:branch-review-ledger— PASS after the append-only ledger clarification.tests/ui-tools.spec.ts— PASS for the PR-scoped strict-locator failures.a4c5f286: Static PR, Safety and config, Unit coverage, Build, app image, Production UI, Migration replay, SAST, and secret scans passed.npm run verify:pr-local— not rerun after the latest docs-only ledger clarification; narrower checks above cover the touched file.npm run verify:ui— not rerun as the full local gate; focused production UI reruns and hosted Production UI passed.npm run verify:uiwas not rerun after the docs-only ledger clarification; focused production UI reruns and hosted Production UI passed.npm run verify:release— not run; release gate is out of scope for PR babysitting and includes provider-backed checks.npm run eval:retrieval:quality— not run; no retrieval/ranking behaviour change is intended and live provider-backed eval was not authorized.npm run check:production-readiness— attempted earlier and blocked by missing local Supabase/OpenAI env secrets; no live provider-backed rerun performed.Risk and rollout
Clinical Governance Preflight
Clinical KB Database(sjrfecxgysukkwxsowpy)Notes