fix: repair Codex Cloud environment verification

[BigSimmo]

Summary

• restore enforced provider-free Codex Cloud modes in every supported Bash startup path
• distinguish offline Cloud readiness from explicitly provisioned connected/live validation without persisting provider credentials
• pin and validate stable Railway/Codex CLIs, repair a missing credential-free origin, and sanitize MCP/capability reporting
• add focused coverage for idempotence, browser/runtime detection, credential gaps, Git remote safety, and Railway/MCP gates

RAG impact: no retrieval behaviour change — Cloud setup/runtime and provider-capability checks only.

Verification

• npm run verify:pr-local — PASS; 442 files, 4,636 tests passed, 3 skipped; offline RAG fixtures passed
• focused Cloud regression suite — PASS; 3 files, 45 tests
• npm run check:codex-cloud — PASS
• exact offline npm run check:codex-cloud -- --environment — PASS
• exact offline npm run check:production-readiness — CLOUD PROVIDER-FREE READY
• npm run check:branch-review-ledger — PASS
• npm run format — PASS/unchanged
• git diff --check — PASS

Security and operations

• no provider secrets were copied, printed, or persisted
• provider-backed checks remain capability-gated in ordinary Cloud agent shells
• Railway reads require the dedicated RAILWAY_API_TOKEN; RAILWAY_TOKEN is never substituted
• origin repair uses credential-free HTTPS and refuses to overwrite an existing wrong or credential-bearing remote

Risk and rollout

Risk is limited to Codex Cloud bootstrap and validation behavior; application retrieval and production data paths are unchanged. Roll back the squash commit if fresh-cache Cloud setup regresses.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use; this PR changes Cloud tooling only.
• No patient-identifiable document workflow was introduced or expanded.
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy).
• Service-role keys and private document access remain server-only.
• Demo/synthetic content remains clearly separated from real clinical sources.
• Source metadata, review status, and outdated/unknown-source behavior remain conservative.
• Deployment classification/TGA SaMD impact is unchanged because clinical decision-support behavior is unchanged.

Summary by CodeRabbit

• New Features
  • Pinned Cloud CLI versions and enhanced Cloud environment setup with automatic, credential-safe Git origin repair.
  • Clearer “provider-free” capability-gap and readiness messaging to better reflect offline limitations.
  • Sanitized Cloud capability output to avoid exposing sensitive values.
• Bug Fixes
  • Prevented live tests from running when provider access is intentionally unavailable.
  • Avoided modifying incorrect or credential-bearing Git remotes.
• Documentation
  • Expanded Cloud setup/verification/maintenance guidance, including stricter credential-handling rules.
• Tests
  • Added coverage for offline/provider-free behavior, origin repair, and secret redaction guarantees.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 32 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 9507136c-623b-4dbb-afb4-3b8789af2d0a

📥 Commits

Reviewing files that changed from the base of the PR and between 68591ac and 9e6330d.

📒 Files selected for processing (2)

• docs/branch-review-ledger.md
• tests/production-readiness-offline.test.ts

📝 Walkthrough

Walkthrough

Codex Cloud setup now pins CLI versions, repairs Git remotes safely, validates sanitized environment capabilities, and distinguishes provider-free capability gaps from readiness failures. Documentation, review records, and tests cover credential boundaries, Railway token handling, runtime checks, and live-test gating.

Changes

Codex Cloud environment hardening

Layer / File(s)	Summary
Pinned Cloud toolchain and environment setup .mcp.json, AGENTS.md, docs/codex-cloud.md, docs/scripts-index.md, scripts/setup-codex-cloud.sh	Railway and Codex CLI versions are pinned, offline shell profiles are strengthened, and Cloud setup and acceptance guidance is expanded.
Safe origin and GitHub helper configuration scripts/ensure-codex-cloud-git-remote.mjs, scripts/maintain-codex-cloud.sh, docs/codex-cloud.md	Missing origins can be restored safely, credential-bearing or incorrect remotes are rejected, and GitHub CLI helper setup is integrated into maintenance.
Cloud contract and capability validation scripts/check-codex-cloud-setup.mjs, tests/codex-cloud-setup.test.ts, docs/codex-cloud.md	Static, environment, runtime, CLI-version, MCP metadata, origin, and sanitized capability checks are expanded and tested.
Provider-free readiness and test gating scripts/production-readiness.ts, scripts/test-environment.mjs, scripts/run-live-tests.mjs, tests/*offline*, tests/test-runner-safety.test.ts, tests/universal-search-owner.live.test.ts	Provider-free environments report capability gaps, live tests exit before execution, and missing live capabilities are reported without exposing credentials.
Review ledger reconciliation docs/branch-review-ledger.md	Review records are reorganized with additional PR, reconciliation, reopening, closure, and current-main entries.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Cloud as Codex Cloud setup
  participant Validator as Cloud validation
  participant Providers as Provider readiness checks
  participant Tests as Live-test runner
  Cloud->>Validator: install and expose pinned environment
  Validator->>Validator: inspect origin and sanitize capabilities
  Validator->>Providers: evaluate provider-free capability state
  Providers->>Tests: allow execution or return capability gap

Loading

Possibly related PRs

• BigSimmo/Database#699: Updates the same provider-safe live-test execution surface.
• BigSimmo/Database#705: Extends the same provider test-environment hardening.
• BigSimmo/Database#909: Previously pins the Railway MCP CLI version updated here.

Suggested labels: codex

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 18.75% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the PR’s main Codex Cloud verification repair.
Description check	✅ Passed	The description matches the template well, covering Summary, Verification, Risk and rollout, and Clinical Governance Preflight.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

• Static PR checks — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.
• PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #7350 (cancelled).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.

[BigSimmo]

@cursoragent fix failing CI

[cursor]

Fixed the Static PR typecheck failure.

result.error?.code failed because Error has no code. Cast it to NodeJS.ErrnoException so the ETIMEDOUT path typechecks.

• tsc — clean for this file
• vitest run tests/production-readiness-offline.test.ts — 6 passed
• Pushed as 1042cc8c on PR fix: repair Codex Cloud environment verification #1497