fix(rag/db/hub): Core RAG, Security Definer hardening, DB functions, and Developer Hub (PR Group 2) by BigSimmo · Pull Request #2477 · BigSimmo/Database

BigSimmo · 2026-08-31T03:22:09Z

Summary

Hardens the bounded RAG cache cleanup and SECURITY DEFINER search paths while keeping grants and owner scope constrained.
Improves RAG answer quality, source handling, and Developer Hub freshness/error presentation.
Adds a fail-closed bare-document-list guard and prevents unverified governance wording from being echoed into source-only fallbacks.

Detailed changes

Pins pg_temp in the search paths for set_owner_id_from_auth_uid, correct_clinical_query_terms, and create_uploaded_document_with_ingestion_job.
Removes the legacy zero-argument, unbounded purge_expired_rag_response_cache overload and retains the bounded (p_limit integer DEFAULT 1000) overload.
Improves RAG answer/source documentation and rejects bare document-title lists for substantive clinical questions.
Keeps procedural-artifact fallbacks conservative and prevents requested governance claims from being restated as if verified.
Improves Developer Hub ingestion errors, sub-hour freshness formatting, and explicit live-status rendering.
Records the existing S2 latency advisory and queues the related governed issue-resolution evidence.

Verification

npm run check:migration-role — passed.
npm run check:function-grants — passed; all 36 public SECURITY DEFINER functions remain revoked from PUBLIC and anon.
npm run check:owner-scope — passed; 60 API files clean against 26 owner-scoped tables.
npm run drift:manifest — scratch PostgreSQL replay completed and regenerated the manifest for the current schema.
npm run eval:rag:adversarial:offline — passed; 24 fixture cases and 25 regression-harness tests.
npm run test -- tests/drift-detection.test.ts tests/rag-extractive-procedural-artifact.test.ts tests/answer-responsiveness-gate.test.ts tests/extractive-answer-formatting.test.ts — 4 files and 205 tests passed.
npm run eval:rag:offline — 26 files and 628 offline RAG tests passed.
npm run verify:pr-local — partial: runtime, lock parity, formatting, repository/docs/ledger checks, lint, and typecheck passed; the full unit phase passed 930 files and 11,679 tests, then failed six unchanged claude-cloud-profile.test.ts assertions because this Windows host resolves bash to the WSL shim. The affected test and script are byte-identical to origin/main; build and later stages were not reached.
Supabase Preview — recreated and passed against the fresh head; migrations applied chronologically without the prior out-of-order warning.

UI verification not run: existing PR-head CI passed Production UI critical and all three Production UI shards; the repair diff itself is non-UI.

Live provider, production-readiness, live retrieval evaluation, and live Supabase drift checks were not run; they remain approval-gated.

Risk and rollout

Risk: Medium. This changes clinical answer post-processing and adds an additive migration that removes the legacy unbounded cache-cleanup overload.
Rollback: Revert the answer changes; restore database compatibility only through a new reviewed forward migration if the zero-argument overload is proven necessary.
Provider or production effects: None from this PR repair. No live Supabase migration, provider evaluation, or production deployment was run.
RAG impact: no retrieval behaviour change — the repair changes answer post-processing and conservative fallback wording only; retrieval ranking, ordering, and RPC selection are unchanged.
SaMD classification impact: reviewed as no expansion of clinical purpose; the repair is more conservative and still requires human clinical/legal approval before release.

Clinical Governance Preflight

Source-backed claims still require linked source verification before clinical use
No patient-identifiable document workflow was introduced or expanded without explicit governance approval
Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
Service-role keys and private document access remain server-only
Demo/synthetic content remains clearly separated from real clinical sources
Source metadata, review status, and outdated/unknown-source behavior remain conservative
Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Notes

Supabase Preview's out-of-order warning was preview-history state: the repository order is 20260828000000 followed by 20260831100000. Closing/reopening the PR recreated the preview, and a fresh-head status refresh replaced the stale removed-preview check with a passing preview check.
The immutable branch review record and governed issue-resolution inbox entries remain part of the PR.

Remaining Lucide size={15} and 1px shadow spreads were blocking the token contract. Map those to named tokens, drop unused v2 line-height companions, and record leftover Hazard 2/3 items in FIX-GUIDE. Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com> # Conflicts: # src/components/therapy-compass/therapy-card.tsx

Co-authored-by: Cursor <cursoragent@cursor.com>

Keep quoted contract numbers in lockstep with the baseline JSON, and replace nested brief-duration ternaries plus leftover Lucide size={16} on screens this sweep already touched. Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

…rings, bare doc guard, and developer freshness

coderabbitai · 2026-08-31T03:22:16Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: c8ae8e68-e2bc-4000-9576-711e1d84c849

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

cursor · 2026-08-31T03:22:21Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_ffff6640-99c4-48fc-bd8c-0ec35234526b)

chatgpt-codex-connector · 2026-08-31T03:22:22Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-31T03:23:11.824610Z	`262bbee`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

…saging with main

github-actions · 2026-08-31T03:48:48Z

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

Production UI (1) — not baselined: this job did NOT run on the main comparison below (path-scoped skip), so that run says nothing about it either way. Treat the comparison as absent, not green, and inspect the failing step.
PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #14542 (success). That run's conclusion is an aggregate and did not exercise Production UI (1).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.

BigSimmo · 2026-08-31T04:42:12Z

Recreating the ephemeral Supabase preview so the migrations replay in timestamp order after the older migration arrived from main.

cursor · 2026-08-31T04:42:12Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_d04095bb-abc3-43d0-98e1-e09cca2f04ad)

supabase · 2026-08-31T04:42:44Z

Updates to Preview Branch (core_rag_security_hub) ↗︎

Deployments	Status	Updated
Database	⚠️	Mon, 31 Aug 2026 04:45:20 UTC
Services	⚠️	Mon, 31 Aug 2026 04:45:20 UTC
APIs	⚠️	Mon, 31 Aug 2026 04:45:20 UTC

Tasks are run on every commit but only new migration files are pushed.
Close and reopen this PR if you want to apply changes from existing seed or migration files.

Tasks	Status	Updated
Configurations	❌	Mon, 31 Aug 2026 04:45:44 UTC
Migrations	⏸️	Mon, 31 Aug 2026 04:42:36 UTC
Seeding	⏸️	Mon, 31 Aug 2026 04:42:36 UTC
Edge Functions	⏸️	Mon, 31 Aug 2026 04:42:36 UTC

❌ Branch Error • Mon, 31 Aug 2026 04:45:45 UTC

failed to read project config: unexpected status 400: {"error":{"code":"bad_request","message":"Resource has been removed"}}

⚠️ Warning — Service health check failed

View logs for this Workflow Run ↗︎.
Learn more about Supabase for Git ↗︎.

supabase · 2026-08-31T04:42:45Z

Updates to Preview Branch (core_rag_security_hub) ↗︎

Deployments	Status	Updated
Database	✅	Mon, 31 Aug 2026 05:15:17 UTC
Services	✅	Mon, 31 Aug 2026 05:15:17 UTC
APIs	✅	Mon, 31 Aug 2026 05:15:17 UTC

Tasks are run on every commit but only new migration files are pushed.
Close and reopen this PR if you want to apply changes from existing seed or migration files.

Tasks	Status	Updated
Configurations	✅	Mon, 31 Aug 2026 05:15:18 UTC
Migrations	✅	Mon, 31 Aug 2026 05:15:20 UTC
Seeding	✅	Mon, 31 Aug 2026 05:15:22 UTC
Edge Functions	✅	Mon, 31 Aug 2026 05:15:25 UTC

View logs for this Workflow Run ↗︎.
Learn more about Supabase for Git ↗︎.

…0260831100000 (#2493) live-drift has been red since 2026-08-25 and its sole unexpected finding on the 2026-09-01 run was a def_hash mismatch on public.correct_clinical_query_terms(text,real): manifest e2356565 vs live 2ebaf978. The cause is a mirror gap, not a live-database problem. Migration 20260831100000 (PR #2477) redefined the function with a duplicated `and length(canonical) between 4 and 40` predicate in the canonical UNION branch, and supabase/schema.sql was never updated to match — it was still byte-identical to the earlier 20260828000000 form. The drift manifest is generated by replaying schema.sql into the pinned Postgres image, so the manifest and live disagreed even though live is exactly what the applied migration created. Codify live rather than write a migration: auto-deploy is ON, and a migration would push a change to a live clinical-search function in production for a cosmetic reason. Proven offline, with no live access: after this edit the regenerated manifest reports def_hash 2ebaf978b69f3de0c47d9d0924419c74 for that signature — exactly the live value the failing run reported. Regeneration moved that one entry and nothing else across 96 functions, 43 tables, 222 indexes, 53 policies, 207 constraints and 26 triggers. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

BigSimmo and others added 12 commits August 27, 2026 14:10

Merge origin/main into ds-hazard-1-2-sweep

50c6791

Co-authored-by: Cursor <cursoragent@cursor.com> # Conflicts: # src/components/therapy-compass/therapy-card.tsx

style: format design-system docs after merging main

fda5756

Co-authored-by: Cursor <cursoragent@cursor.com>

Merge origin/main into ds-hazard-1-2-sweep

cd73993

Merge branch 'main' into ds-hazard-1-2-sweep

c88a661

chore: refresh repo-awareness snapshot after merging main

6ac1002

Co-authored-by: Cursor <cursoragent@cursor.com>

Merge remote-tracking branch origin/ds-hazard-1-2-sweep

1365ac0

docs(design-system): pin GATES totals and v2 leading tokens

b7c7186

Keep quoted contract numbers in lockstep with the baseline JSON, and replace nested brief-duration ternaries plus leftover Lucide size={16} on screens this sweep already touched. Co-authored-by: Cursor <cursoragent@cursor.com>

style: format PR 1 design-system docs

284454e

Co-authored-by: Cursor <cursoragent@cursor.com>

chore: refresh repo-awareness snapshot after PR 1 docs

19ee085

Co-authored-by: Cursor <cursoragent@cursor.com>

fix(rag/db/hub): harden search paths, purge cache overload, rag docst…

d39db0e

…rings, bare doc guard, and developer freshness

docs(review): record immutable branch review record for PR Group 2

262bbee

BigSimmo added 2 commits August 31, 2026 11:27

Merge remote-tracking branch 'origin/main' into core_rag_security_hub

1143b21

fix(developer-hub): reconcile freshness types and ingestion error mes…

92f2baf

…saging with main

BigSimmo added 2 commits August 31, 2026 12:37

fix(rag): unblock safety and migration checks

169bfd4

Merge remote-tracking branch 'origin/main' into codex/pr-2477-repair

1ee4eea

BigSimmo closed this Aug 31, 2026

BigSimmo reopened this Aug 31, 2026

BigSimmo enabled auto-merge (squash) August 31, 2026 04:51

BigSimmo disabled auto-merge August 31, 2026 04:52

BigSimmo enabled auto-merge (squash) August 31, 2026 04:53

chore: refresh Supabase preview status

5abad12

Merge branch 'main' into core_rag_security_hub

ff7b6bd

BigSimmo merged commit 7f5aba1 into main Aug 31, 2026
29 checks passed

BigSimmo deleted the core_rag_security_hub branch August 31, 2026 05:25

This was referenced Sep 1, 2026

chore(issues): record the migration-replay vs schema.sql mirror gap on #QCNE6N #2492

Merged

fix(db): align schema.sql corrector body with the applied migration 20260831100000 #2493

Merged

BigSimmo mentioned this pull request Sep 2, 2026

test(drift): diff what the migration chain builds against schema.sql #2550

Merged

11 tasks

Navigation Menu

fix(rag/db/hub): Core RAG, Security Definer hardening, DB functions, and Developer Hub (PR Group 2) - #2477

fix(rag/db/hub): Core RAG, Security Definer hardening, DB functions, and Developer Hub (PR Group 2)#2477
BigSimmo merged 18 commits into
mainfrom
core_rag_security_hub

BigSimmo commented Aug 31, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 31, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Aug 31, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 31, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 31, 2026 •

edited

Loading

Uh oh!

BigSimmo commented Aug 31, 2026

Uh oh!

cursor Bot commented Aug 31, 2026

Uh oh!

supabase Bot commented Aug 31, 2026 •

edited

Loading

Uh oh!

supabase Bot commented Aug 31, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

BigSimmo commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Detailed changes

Verification

Risk and rollout

Clinical Governance Preflight

Notes

Uh oh!

coderabbitai Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Aug 31, 2026

Bugbot couldn't run - usage limit reached

Uh oh!

chatgpt-codex-connector Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI triage

Uh oh!

BigSimmo commented Aug 31, 2026

Uh oh!

cursor Bot commented Aug 31, 2026

Bugbot couldn't run - usage limit reached

Uh oh!

supabase Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

supabase Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

BigSimmo commented Aug 31, 2026 •

edited

Loading

coderabbitai Bot commented Aug 31, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

supabase Bot commented Aug 31, 2026 •

edited

Loading

supabase Bot commented Aug 31, 2026 •

edited

Loading