chore(claude): scope auto-mode environment rules to this project

.claude/settings.json

@@ -200,6 +200,47 @@
       "mcp__ccd_session_mgmt__search_session_transcripts"
     ]
   },
+  "autoMode": {
+    "allow": [
+      "$defaults",
+      "Bash(supabase migration list:*) and other read-only `supabase` inspection subcommands inside the BigSimmo/Database repo",
+      "Bash(npm run ledger:lookup:*) in the BigSimmo/Database repo",
+      "Bash(npm run verify:pr-local:*) in the BigSimmo/Database repo",
+      "Bash(npm run test:focused:*) in the BigSimmo/Database repo"
+    ],
+    "soft_deny": [
+      "$defaults",
+      "Bash(supabase db push:*) and Bash(supabase db reset:*) — schema mutation against the live `Clinical KB Database` project (ref sjrfecxgysukkwxsowpy)",
+      "Bash(supabase functions deploy:*) — deploying Edge Functions to the live Supabase project",
+      "Bash(npm run verify:release:*) and any non-offline `npm run eval:*` — provider-backed (live Supabase + OpenAI spend)"
+    ],
+    "environment": [
+      "### Org-wide",
+      "**Organization**: None configured — personal GitHub account `BigSimmo` (single remote `github.com/BigSimmo/Database`)",
+      "**Cloud provider(s)**: Supabase (Postgres + pgvector + Storage + Edge Functions), OpenAI (embeddings, captions, generation), Railway (app + worker deploy)",
+      "**Repository visibility**: PUBLIC — `BigSimmo/Database` is public per the authenticated gh check. Any push or file added there is publishing; the repo holds a clinical RAG prototype, so treat clinical documents, patient-identifiable content, and secrets as never publishable regardless of visibility",
+      "**Internal sharing / snippet hosting**: None configured — treat public paste/gist services as outside the trust boundary",
+      "**Secrets management**: `.env.local` from `.env.example` (git-ignored, `.env*` ignored), Supabase Edge Function secrets / Supabase Vault (`ingestion_webhook_secret`), Railway service variables, GitHub Actions secrets; service-role keys are server-only and never `NEXT_PUBLIC_*`",
+      "**Default / protected branches**: default branch `main`; `main` is protected and an active ruleset named `Protections` applies. Feature work lands on `claude/*` branches via PR",
+      "**CI/CD deploy targets**: GitHub Actions (`.github/workflows/ci.yml`, risk-scoped jobs; `pr-required` is the required aggregate); Railway project `Database` — `Database` (app) and `worker` services auto-deploy from `main`; Supabase Edge Functions (Deno 2)",
+      "**Network posture**: Local-first development; dev server port is not fixed (use `npm run ensure` and the URL it prints — never assume `localhost:3000`). Provider-backed calls (OpenAI, Supabase, GitHub, hosted CI) require explicit user confirmation per repo policy",
+      "**Source control**: `github.com/BigSimmo/Database` (origin) only — as scoped by the Trusted repo and Repository visibility entries above",
+      "**Trusted internal domains**: `sjrfecxgysukkwxsowpy.supabase.co` (live Supabase project `Clinical KB Database`); `db.sjrfecxgysukkwxsowpy.supabase.co` (direct Postgres). The ref `qjgitjyhxrwxsrydablr` is documented as stale — never use it",
+      "**Trusted cloud buckets**: `clinical-documents` and `clinical-images` — private Supabase Storage buckets (config-derived — not a confirmed upload destination; uploads of local data still require confirmation)",
+      "**Key internal services**: Supabase project `Clinical KB Database` (ref `sjrfecxgysukkwxsowpy`), the `indexing-v3-agent` Edge Function, the local ingestion worker (`npm run worker`), OpenAI API, Railway `Database` + `worker` services, optional Sentry (server-only, inert without DSN)",
+      "**Internal package registry**: None configured — public npm with `npm ci --include=dev` against the committed `package-lock.json`",
+      "**Sensitive data locations & audiences**: uploaded clinical reference documents in the private `clinical-documents` bucket and their derived rows (chunks, pages, images, embeddings, `rag_queries`, `rag_response_cache`); `.env*` files and all secret names in the CI secret list; anything owner-scoped via `owner-scope.ts` / `query-privacy.ts` / `authorization.ts`. Clinical, privacy-related, or patient-facing material is share-only with audiences cleared at the [named+specifics] bar; preserve exact handles when known",
+      "**Data retention / declassification**: retention is enforced in-database by migrations for `rag_queries`, `rag_retrieval_logs`, `rag_query_misses`, answer feedback and `rag_response_cache`; the branch-review ledger has a stamp-retention check. No declassification path is configured for clinical source documents",
+      "**Sensitive remote targets**: the live Supabase project `sjrfecxgysukkwxsowpy` (`Clinical KB Database`) and its Postgres/Storage/Edge surfaces; the Railway `Database` and `worker` services; plus any namespace, host, or container whose name carries `prod` or `production` as a whole word or name segment (hyphen/underscore/dot-delimited — e.g. matches `prod-db`, not `producer`)",
+      "**Protected deployment namespaces / environments**: the live Supabase project `sjrfecxgysukkwxsowpy` and the Railway `Database` / `worker` production services (auto-deploy from `main`); staging refs are separate and gated by the staging identity guard",
+      "**Protected IaC scopes**: `supabase/migrations/**` and `supabase/schema.sql`, RLS policies, RPC and `SECURITY DEFINER` functions, storage bucket policies, `.github/workflows/**`, plus IAM, RBAC, networking, quota, and node-pool resources; anything whose name or tag carries `prod` or `production` as a whole word or name segment",
+      "### User-specific",
+      "**Primary use of Claude Code**: software development on this personal clinical-reference RAG prototype (Next.js 16 / TypeScript / Supabase / OpenAI), with heavy use of repo verification gates, PR handoff, and review subagents",
+      "**Trusted repo**: `D:\\Repos\\Database` and its worktrees under `.claude/worktrees/`, with remote `github.com/BigSimmo/Database`. This remote is PUBLIC, so only that repo's own work may be committed or pushed there — content ported, repointed, or first read from outside this session's repo is not its own work, whoever directed the port. Visibility scopes confidential material only: secrets, clinical documents, and patient-identifiable data are never cleared into it by its visibility",
+      "**Org-specific CLIs**: `supabase` (Supabase CLI), `gh` (GitHub CLI), repo `npm run` gates (`ensure`, `verify:cheap`, `verify:pr-local`, `verify:ui`, `test:focused`, `ledger:lookup`, `ledger:append`, `skills`), `sentry-cli`, `doppler`, `fnm`, `codex`",
+      "**Routine under this repo's prefix**: read-only and offline gate work inside `D:\\Repos\\Database` and its `.claude/worktrees/*` checkouts is routine; anything provider-backed (OpenAI, live Supabase, GitHub API writes, hosted CI, `verify:release`, non-offline `eval:*`) is confirmation-required by the repo's own policy"
+    ]
+  },
   "hooks": {
     "SessionStart": [
       {

docs/branch-review-records/69c1ad571fe121333c48aba14a7725b42ff6eede02d4bb4298c972e81c267286.record.md

@@ -0,0 +1 @@
+| 2026-08-20 | claude/settings-portability-b38ea3 | 411ed4c9a92b8d6060d55f696b1fd66f4ede42c5 | Move project-specific autoMode allow/soft_deny/environment block from user settings to .claude/settings.json | Clean — verbatim move, no behaviour change intended; 41 added lines, no removals | tests/claude-code-settings.test.ts + tests/session-start-hook.test.ts (2 files, 100 tests passed); prettier clean; pr-policy risk all false |