Wire the developer hub environment strip to real environment facts

[BigSimmo]

Summary

• Wire the developer hub's environment strip to real environment facts. The strip shipped in Phase 1 with demoMode, documentCount and email all null, rendering "environment unknown / document count unavailable / account unknown" on every visit. A new server-only helper, resolveHubEnvironmentFacts, gathers all three in one Supabase round trip, which makes the hub page an async Server Component. Two of its rules are load-bearing, and each is pinned by a test proven to fail without it: the count goes through the cookie-bound user client, so row-level security (documents owner read, owner_id = auth.uid()) scopes it to the caller's own documents rather than application code doing the scoping; and every failure path returns null rather than 0, so an empty corpus can never be confused with a read that failed. The Phase 2 handoff document is corrected in the same commit instead of being left claiming the strip is unwired.
• Give the two subprocess-spawning design-sync contract tests an explicit 60 s timeout. Separate commit, unrelated to the hub. Both shell out to a Node child process; the child finishes in about 7 s standalone and the tests take about 9 s and 10 s, so the global 30 s budget looks generous in isolation. It is not, under the full run: the node suite is CPU-bound on two workers across 900+ files, and the parity test exceeded 30000 ms during the verify:pr-local run for this very branch, failing the gate for a diff that touches nothing under .design-sync/**. Deliberately not quarantined: it did not fail an assertion, and a wrong time budget is a different defect from an unstable test. tests/flake-ledger.json is untouched.

Verification

• npm run verify:pr-local

Reported precisely rather than as a clean pass. The run completed check:runtime, check:installed-lock-parity, format:changed, sitemap:check, check:repo-awareness-snapshot, docs:check-index, docs:check-inventory, docs:check-scripts, docs:check-links, check:branch-review-ledger, check:outstanding-issues, check:ledger-write-discipline, lint and typecheck, then reported Tests 1 failed | 11707 passed | 75 skipped (11783). The single failure was tests/design-sync-contract.test.ts > keeps sources, entry exports, previews and published props in parity, with Error: Test timed out in 30000ms. No assertion failed, and that test reads only .design-sync/**, which this diff does not touch; it passes in isolation on the same worktree. That failure is fixed by the second commit in this PR.

Because the suite failed, the run never reached build, check:rag:fixtures, check:medication-interactions or check:medication-lexicon-report. All four were then run separately, and all four passed:

• npm run build — exit 0, Compiled successfully in 100s, Client bundle secret surface check passed. This is the gate that matters most here: making the page fetch data changes its render mode, which typecheck, lint and Vitest are all blind to. The build classifies /mockups/development as dynamic, which it already was via the layout's headers() call, so nothing regressed.
• npm run check:rag:fixtures — Offline RAG fixture and manifest validation passed (36 golden cases, 26 suites).
• npm run check:medication-interactions — data/medication-interaction-index.json is up to date (531 rows).
• npm run check:medication-lexicon-report — docs/medication-interaction-lexicon-review.md is up to date (37 catalogue terms).

Both behavioural rules in the new module were mutation-checked rather than assumed. Coercing a failed count to 0 turns "keeps an empty corpus distinct from a count it could not read" and "reports a missing count as unavailable rather than as zero" red; removing the unauthenticated early return turns "does not count anything for a request with no signed-in user" red. The new 60 s timeout was proven to be read rather than silently ignored by setting the same option to 1 ms and observing Test timed out in 1ms. Every mutated file was restored and confirmed byte-identical by SHA-256.

UI verification not run: npm run verify:ui was not run because no shared UI foundation changed — this alters the data behind one line of text on one administrator-only page, with no layout, chrome, routing or composer change. Instead the changed surface was proven directly: npm run ensure on this worktree, /api/local-project-id confirmed as this project, and /mockups/development rendered and inspected in a browser. The strip reads Demo corpus / document count unavailable / build unknown / account unknown, which is the correct local-development rendering: demo mode is detected and reported, and the three facts that genuinely cannot be read without a live signed-in session name their own gaps instead of inventing values. The signed-in email and a non-null document count cannot be exercised locally, and are covered by unit tests rather than by a browser.

• npm run verify:release not run: not a release or handoff-confidence claim.
• npm run eval:retrieval:quality not applicable: no retrieval, ranking, selection, chunking or scoring behaviour changed.
• npm run check:production-readiness not run: no clinical workflow, environment, source-governance or deployment behaviour changed. The Supabase read added here is a count of the caller's own rows through the existing user-session client, on a page that already authenticates through that same client on every request.

Risk and rollout

• Risk: Low, and confined to one administrator-only page. The realistic failure mode is a misreported document count, which the module is built to make impossible in the dangerous direction — it reports absence rather than a number it did not read. The second-order risk is the extra Supabase round trip per hub load; the page was already dynamic and already authenticated on every request, so this adds one count query, not a new render mode.
• Rollback: Revert either commit independently. Reverting the first restores the previous null props and the synchronous page; reverting the second restores the 30 s timeout. Neither leaves migration, data or configuration state behind.
• Provider or production effects: None beyond one additional owner-scoped documents count query issued at render time on /mockups/development, which is gated to a signed-in administrator in production. No migration, no schema change, no write path, no new environment variable, and no service-role usage.
• RAG impact: none.

Clinical Governance Preflight

scripts/pr-policy.mjs classifies this diff as clinicalRisk: false, operationalRisk: false, ragRanking: false, ui: true, so this section is not required. It is completed anyway, because the change reads the documents table and the signed-in account, and understating that would be the wrong instinct in this repository.

• Source-backed claims still require linked source verification before clinical use — unchanged; this touches no answer, citation or source-rendering path.
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval — no document content is read, only a row count of the caller's own documents. No title, filename, page or chunk reaches the page.
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy) — no environment or project configuration was touched.
• Service-role keys and private document access remain server-only — the new module carries import "server-only" and uses createSupabaseServerClient, the cookie-bound user client that is subject to RLS. It never imports createAdminClient, and a source assertion in tests/developer-hub-environment-facts.test.ts fails if that import or the string supabase/admin ever appears in it, because the service-role client bypasses RLS and would report every owner's total to whoever was signed in.
• Demo/synthetic content remains clearly separated from real clinical sources — improved by this change rather than merely preserved. The strip previously said "environment unknown" in both directions; it now states "Demo corpus" or "Live data", which is the one fact on it that could otherwise be actively wrong rather than merely absent.
• Source metadata, review status, and outdated/unknown-source behavior remain conservative — unchanged, and the new code follows the same principle: an unauthenticated request skips the count query entirely rather than reporting the zero rows row-level security would correctly return to it.
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed — no clinical decision-support behaviour changed. This is developer-facing environment reporting on a page that 404s for everyone but a signed-in administrator.

Notes

The two commits are bundled deliberately under the repository's PR-bundling rule: both are independently low-risk by classifyPullRequestFiles, each is a separately revertible commit, and each has its own Summary bullet. They are also causally linked — the timeout fix repairs the failure that stopped this branch's own verification run, so landing them together avoids handing the same red to the next unrelated pull request.

The second commit was made with SKIP_DOCS_SYNC_HOOK=1, which the pre-commit hook itself documents as its bypass. The hook refuses a partially staged tree, so two disjoint commits are impossible in one pass. The bypass was used only for the intermediate commit; the final commit ran the hook in full on the complete tree, regenerating docs/site-map.md, the codebase-index coverage check and the design-system adoption manifest, all of which came back unchanged.

One thing the push guard could not do: it reported static: run coordinator busy — lint and typecheck NOT run, because another worktree held the heavy-run lease. Both were run locally before the commit and both passed, and CI enforces them regardless.

---

Note

Low Risk
Changes are confined to an administrator-only developer hub page with conservative null-on-failure semantics and RLS-scoped reads; the main operational effect is one extra Supabase count query per hub load.

Overview
Wires the developer hub environment strip so demo/live mode, signed-in email, and document count come from real reads instead of always showing “unknown” placeholders.

Adds server-only resolveHubEnvironmentFacts (sync isDemoMode(), one Supabase auth + owner-scoped documents count via the user session client). The hub page becomes an async Server Component and passes those values into EnvironmentStrip. Load-bearing rules are tested: RLS-scoped count (no admin client), null on failures (not 0), and no count query without a signed-in user.

Test and docs follow-through: Phase 2 handoff marks the strip as closed; hub and in-page-nav DOM tests await the page and mock/stub the helper; new unit tests cover the resolver. Unrelated: design-sync contract subprocess tests get an explicit 60s timeout so full-suite CPU contention does not hit the global 30s limit.

^{Reviewed by Cursor Bugbot for commit fdb93a1. Configure here.}

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: e8ca6a88-ebcd-4940-a373-fdd1face73e1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_a6396642-a586-4d14-a4a2-c16913444c67)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T10:05:41.247173Z	fdb93a1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fdb93a1e9a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

• Lighthouse budget — not baselined: this job did NOT run on the main comparison below (path-scoped skip), so that run says nothing about it either way. Treat the comparison as absent, not green, and inspect the failing step.
• PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #14661 (success). That run's conclusion is an aggregate and did not exercise Lighthouse budget.

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.