fix(ci): route src/lib/rag/** to the offline RAG eval gates in change-scope classification

[BigSimmo]

Summary

• Fix ledger item #SDQSFD: scripts/ci-change-scope.mjs set rag_eval_changed only for the pre-refactor(rag): extract the rag cluster into src/lib/rag/ (maturity X2) #994 flat layout (src/lib/rag.ts and src/lib/rag-*.ts), so a pull request touching only the extracted src/lib/rag/** subtree classified as rag_eval_changed=false. That silently skipped eval:rag:offline and eval:rag:adversarial:offline in both verify:pr-local and the CI safety/RAG eval job, leaving only the cheap check:rag:fixtures guard. PR fix(rag): bind claim-leading for/in conditions in the high-risk trigger check (S1c follow-up) #2065 reached main that way, and the live eval canary — not the offline adversarial harness — was what caught it.
• Add the directory prefix /^src\/lib\/rag\// to ragEvalPatterns, keeping every existing legacy pattern untouched so the flat src/lib/rag.ts and src/lib/rag-*.ts paths still classify exactly as before. A directory prefix rather than a filename regex means any future file added to that subtree is covered whatever it is named — src/lib/rag/answer-composition.ts carries no rag- prefix at all and was the clearest example of the gap. This is the same shape scripts/pr-policy.mjs already uses in its ragRankingPatterns list, which was widened for the refactor(rag): extract the rag cluster into src/lib/rag/ (maturity X2) #994 move while the CI change-scope classifier was not.
• Extend the change-scope self-test (npm run check:ci-scope, the script's own --self-test assertions) with three positive cases — src/lib/rag/rag.ts, src/lib/rag/answer-composition.ts, and src/lib/rag/rag-claim-support.ts, each asserted alone — plus the first negative rag_eval_changed assertion the file has ever carried: src/lib/app-modes.ts stays false while remaining an executable source change, so a future over-broad widening that dragged the offline RAG contracts onto every pull request would be caught.
• No workflow edit was needed. .github/workflows/ci.yml and scripts/verify-pr-local.mjs both consume the rag_eval_changed output from this classifier rather than duplicating its regex, so the corrected classification reaches the RAG eval job and the PR-local selector without any change to the workflow job graph.

RAG impact: no retrieval behaviour change — CI/gate routing only. No file under src/lib/rag/** or any other retrieval, ranking, selection, or eval-fixture surface was touched; the change only widens which offline gates CI and verify:pr-local select for a diff.

Verification

• npm run verify:pr-local

scripts/** is not a recognised light scope, so the run failed closed to the heavy route: check:runtime, check:installed-lock-parity, format:changed, lint, typecheck, the full offline unit suite, build, check:rag:fixtures, check:medication-interactions, and check:medication-lexicon-report.

• npm run check:ci-scope — the change-scope self-test, including the four new assertions.
• Selector proof, the decisive before/after for this fix. npm run verify:pr-local -- --dry-run --files src/lib/rag/rag-claim-support.ts on origin/main selected npm run check:rag:fixtures and printed offline RAG production contracts skipped: no RAG-scoped changes (fixtures still selected). With this change the same command selects npm run eval:rag:offline and npm run eval:rag:adversarial:offline, and the skip line is gone.
• Mutation check on the new assertions. Deleting the added /^src\/lib\/rag\// pattern and re-running npm run check:ci-scope fails at assertScope, so the new tests genuinely detect the regression rather than passing vacuously.

UI verification not run: no UI, routing, styling, browser, reduced-motion, or forced-colors behaviour changed — this diff is a single CI classification script.

No provider-backed command was run. eval:rag:offline and eval:rag:adversarial:offline appear here only as gate names that CI will now select; neither was executed locally, and no live eval canary, OpenAI, or Supabase call was made.

Risk and rollout

• Risk: low, and one-directional. The change can only widen which offline gates run for a given diff — it adds a pattern and removes none, so no path that previously selected a gate can stop selecting it. The practical cost is that pull requests touching src/lib/rag/** now also run eval:rag:offline and eval:rag:adversarial:offline, which is exactly the coverage this item exists to restore. Both are offline harnesses that fail closed on any network attempt.
• Rollback: revert this single commit. The classifier returns to its previous behaviour immediately, with no state, cache, migration, or deployed artefact involved.
• Provider or production effects: None.

Notes

• The ledger row for #SDQSFD proposed src/lib/answer-follow-up.ts as the negative test case, but that path is already rag_eval_changed=true on origin/main and remains so here: the pre-existing answer(?:-[^/]+)?\.ts alternation in the same pattern list matches it. Making it false would narrow RAG gate coverage on an answer-path file, which is the opposite of this item's intent and outside its scope, so the negative assertion uses src/lib/app-modes.ts instead — a genuinely unrelated src/lib module that proves the new directory prefix stayed a directory prefix.
• Queued the ledger closure as an immutable inbox request with npm run issues:done; the canonical docs/outstanding-issues.md is untouched and gets reconciled separately after this lands.
• Checked the other extracted src/lib subdirectories while here. documents/, extractors/, observability/, supabase/, validation/, and webhooks/ all classify rag_eval_changed=false, which is correct — none of them is a retrieval or ranking surface under docs/rag-behaviour/safeguards.md.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 42 minutes

Limit details: You’ve used all 1 included review currently available under your plan. You completed 101 included PR reviews in the past 7 days; at that activity level, included reviews refill at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 28351a0d-7183-404d-98eb-6c5722e52638

📥 Commits

Reviewing files that changed from the base of the PR and between 533989f and 8bb93f1.

📒 Files selected for processing (3)

• docs/branch-review-records/a0a71a3be50e54391ae9bdf848e5812c92b532350013d9b9e02d7779aa1a638a.record.md
• docs/outstanding-issues-inbox/35826a8b-8ebf-4b19-8319-7ee229d028ca.json
• scripts/ci-change-scope.mjs

---

_{Comment @coderabbitai help to get the list of available commands.}