Harden clinical-notes trust gating and finish audit remediations - #1305
Conversation
RAG impact: no retrieval behaviour change — remediation of merge conflicts and UI RAG governance fail-closed boundary
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe PR adds fail-closed clinical answer handling, centralizes ClinicalDashboard UI state, introduces z-index lint enforcement and stacking updates, adds reusable UI components and overlay tracking, and updates review-ledger documentation. ChangesClinical governance remediation
Dashboard state and provider integration
UI foundations and stacking rules
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant GlobalSearchShell
participant SettingsStateProvider
participant ClinicalDashboard
participant UtilityDrawer
GlobalSearchShell->>SettingsStateProvider: wrap dashboard subtree
SettingsStateProvider->>ClinicalDashboard: provide drawer and sidebar state
ClinicalDashboard->>SettingsStateProvider: update drawer, tab, and sidebar state
ClinicalDashboard->>UtilityDrawer: render with shared open state
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Comment |
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
|
@cursoragent please resolve all CI failing tests after understanding the issue. Please also fix any comments and resolve them and also ensure that you fix with smallest required fix with best coding practice and u derstabding the fix rather than simple patch. Please fix any merge conflicts and ensure any issues are found. Please resolve any issues you find. Please also run bugbot. Please mark comments resolved also once you resolve them. |
|
Taking a look!   |
Resolve conflicts while preserving audit remediations: z-index ladder lint rule, SettingsStateProvider extraction, fail-closed clinical-notes trust gating (clear free-text answer when not source-backed), and UI primitives exports. Prefer main for ledger/docs and stronger privacy test coverage already landed upstream.
Satisfy push format guard for outstanding-issues and search-chrome-behaviour.
Merge left references to undefined canonicalAuthority/identityAuthority, causing upload POSTs to 500. Keep main's spoof-resistant null publisher fields (filename must not mint Official/Trusted codes).
Container-query migration on ClinicalDashboard reintroduced a fixed/inset phone shell and broke max-sm composer-reserve contracts. Restore viewport breakpoints and privacy-notice z-[5] (ladder rung 5) so Safari document scroll ownership and suggestion stacking stay correct.
Use a single settingsState context handle (no prettier-expanded destructure), memoize SettingsStateProvider value for stable deps, and update the account-access source contract for the prefixed fields.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/outstanding-issues.md`:
- Line 169: Move the `#034` entry out of the `#061` table row in the
outstanding-issues table. Make `#034` begin on its own line with the standard
five-column Markdown row structure, preserving the existing `#061` content
unchanged.
In `@eslint-rules/require-z-index-ladder.mjs`:
- Line 26: Update the regex in the z-index class matching logic to use a
boundary that matches the closing bracket followed by whitespace or the end of
the class string, while preserving detection of numeric z-[...] tokens such as
z-[1] and embedded class lists. Ensure the rule’s existing ladder enforcement
receives these matches.
In `@src/components/ui/card.tsx`:
- Around line 24-26: Update the CardTitle forwardRef declaration to use
HTMLHeadingElement for both the forwarded ref and component props, matching its
rendered h3 element while preserving the existing className and prop forwarding.
In `@src/components/ui/OverlayProvider.tsx`:
- Line 40: Update the overlay registration effect to depend on the stable
registerOverlay and unregisterOverlay callbacks instead of the recreated context
object. Destructure these callbacks from the overlay context and use them
alongside id in the effect dependency array, preserving the existing
registration and cleanup behavior.
🪄 Autofix (Beta)
✅ Autofix completed
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: f86a8dc5-d2ed-4382-a775-a020846ab70b
📒 Files selected for processing (17)
docs/branch-review-ledger.mddocs/outstanding-issues.mdeslint-rules/require-z-index-ladder.mjseslint.config.mjssrc/components/ClinicalDashboard.tsxsrc/components/clinical-dashboard/SettingsStateProvider.tsxsrc/components/clinical-dashboard/evidence-panels.tsxsrc/components/clinical-dashboard/global-search-shell.tsxsrc/components/clinical-dashboard/image-lightbox.tsxsrc/components/clinical-dashboard/mode-action-popup.tsxsrc/components/clinical-dashboard/signed-image.tsxsrc/components/document-viewer/pdf-canvas-viewer.tsxsrc/components/ui-primitives.tsxsrc/components/ui/OverlayProvider.tsxsrc/components/ui/badge.tsxsrc/components/ui/card.tsxtests/visual-evidence-tabs.dom.test.tsx
Token cannot edit the PR description (403); CI Sync PR policy body applies this template so Summary/Verification/Risk/governance are complete.
Keep the synced PR description; drop the temporary template so later commits cannot overwrite it with stale text.
cursor
Bot
changed the title
The Docker Desktop memory safeguard was failing hosted Build on runners that report ~7.8 GiB totalmem. Keep the guard for local builds only.
|
@cursoragent Inspect the PR and repository state, identify the root cause of every failing CI check, unresolved review comment, merge conflict, and related defect. Apply the smallest robust fix using existing project patterns and best practices, without unrelated changes. Run Bugbot and all relevant lint, type-check, test, build, and CI-equivalent commands, fix any issues found, then resolve only the review comments that are fully addressed. Summarise the root causes, changes made, validation results, and any remaining blockers. |
|
Taking a look! |
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. ❌ Cannot run autofix: This PR has merge conflicts. Please resolve the conflicts with the base branch and try again. Alternatively, use |
CI triageCI failed on this PR. Automated classification of the 2 failed job(s):
Compared with main CI run #6154 (success). Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger. |
Hosted CI did not start for the guard fix tip; append ledger and push to re-fire the pull_request workflow.
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. ❌ Cannot run autofix: This PR has merge conflicts. Please resolve the conflicts with the base branch and try again. Alternatively, use |
|
@cursoragent Inspect the PR and repository state, identify the root cause of every failing CI check, unresolved review comment, merge conflict, and related defect. Apply the smallest robust fix using existing project patterns and best practices, without unrelated changes. Run all relevant lint, type-check, test, build, and CI-equivalent commands, fix any issues found, then resolve only the review comments that are fully addressed. Summarise the root causes, changes made, validation results, and any remaining blockers. Also run Bugbot if not already done on this PR yet. |
|
Taking a look! |
GitHub did not start the pull_request CI workflow for the RAM-guard fix tip; empty commit to re-emit synchronize.
Adopt main's evaluateNextBuildRamGuard (CI soft-warn) for the same hosted Build flake this branch had patched more narrowly.
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Fixes Applied SuccessfullyFixed 4 file(s) based on 4 unresolved review comments. Files modified:
Commit: The changes have been pushed to the Time taken: |
Fixed 4 file(s) based on 4 unresolved review comments. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
Complements the CodeRabbit effect-deps fix so consumers do not see a new context object every render.
|
@cursoragent fix failing CI |
|
Taking a look! |
merge=union reintroduced an identical #1306 closeout row; keep the first copy so check:branch-review-ledger passes.
CodeRabbit's z-index matcher fix correctly flagged z-[32] in the phone chrome safe-area band; use the nearest allowed rung above sticky z-30.
|
@cursor review |
Append the branch-review ledger row for tip 71ed508 after hosted PR required and Production UI passed, with Bugbot-equivalent review finding no P0/P1/P2 on the unique product delta.
Record the b101b69 tip after main re-sync once hosted Production UI and PR required both passed, with zero unresolved review threads.
2 participants
Summary
main: fail-closed clinical-notes trust gating (clear free-text answer when not source-backed), SettingsStateProvider extraction under the ClinicalDashboard maintainability budget, z-index ladder lint rule, shared UI primitives, and phone-chrome breakpoint restoration.Verification
npm run verify:cheap— passed after merge + trust-gate / phone-chrome / budget fixesverify:uistill recommended before merge confidencenpm run verify:pr-localnot yet completed in this sweep (unit suite already green via verify:cheap)Risk and rollout
Clinical Governance Preflight
Clinical KB Database(sjrfecxgysukkwxsowpy)Notes
origin/mainand resolved conflicts; restored upload publisher null-minting (undefinedcanonicalAuthoritymerge hazard)cursor[bot]threads; fixed phone-chrome@max-@smregression and privacy notice z-index stackingSummary by CodeRabbit
New Features
Bug Fixes
Accessibility