Add governed clinical Sources catalogue

[BigSimmo]

Summary

• Add a read-only Sources application mode with catalogue, Topics, Publishers, Method, and source-detail routes.
• Aggregate clinical references from all 11 registered production source owners and owner/public-scoped document metadata into stable, client-safe catalogue entries.
• Add deterministic quality bands, conservative review-debt handling, Australian preference, source usage traceability, governed outbound URL policy, accessibility coverage, and synchronized route documentation.

Verification

• npm run verify:pr-local
  • FAILED/PARTIAL at format:changed; runtime and installed-lock parity passed, and later stages did not run. Formatting was repaired and passed separately, but this broad gate was not rerun.
• npm run verify:ui when UI, routing, styling, browser behavior, reduced-motion, or forced-colors behavior changed
  • Not run. Focused Chromium proof passed before final hardening: node scripts/run-playwright.mjs tests/ui-sources.spec.ts --project=chromium — 3 passed. No post-hardening browser rerun.
• npm run verify:release before release or handoff confidence claims
  • Not run; no release-confidence claim.
• npm run eval:retrieval:quality (must stay 36/36) when retrieval, ranking, selection, chunking, or scoring behavior changed
  • Not applicable: the catalogue rating is presentation-only and no retrieval/RAG ranking path changed.
• npm run eval:rag -- --limit 15 + npm run eval:quality -- --rag-only when answer generation, the synthesis prompt, or answer post-processing changed
  • Not applicable: answer generation and synthesis were unchanged.
• npm run check:production-readiness when clinical workflow, privacy, environment, Supabase, source governance, or deployment behavior changed
  • Not run; connected production-readiness checks were outside the authorized local implementation scope.
• npm run check:deployment-readiness when deployment startup, hosting, or rollout behavior changed
  • Not run; deployment behavior was unchanged.

Focused evidence:

• node scripts/run-vitest.mjs run tests/source-url-policy.test.ts tests/source-catalogue-core.test.ts tests/source-catalogue-providers.test.ts tests/sources-mode.dom.test.tsx — 86 passed.
• npm run check:source-catalogue — passed; 1,529 references, 692 canonical sources, 692 D-band review-debt entries, 0 invalid current provider dates.
• Earlier focused Sources domain suite — 14 files, 213 tests passed.
• npm run docs:check-index, npm run docs:check-inventory, npm run sitemap:check, and npm run check:repo-awareness-snapshot — passed.
• Three independent final reviews — passed with no Critical, Important, or Minor findings.

Risk and rollout

• Risk: Source identity, presentation-only quality ranking, document metadata visibility, and Sources route/navigation behavior changed. Current catalogue entries remain conservatively D-band because upstream metadata has review debt. Final-head browser and large-catalogue performance evidence remain limited.
• Rollback: Revert this PR. It adds no migration, hosted write, ingestion job, provider activation, or deployment configuration.
• Provider or production effects: None. No live Supabase audit, provider call, hosted mutation, deployment, or production configuration change was performed.
• RAG impact: no retrieval behaviour change — Sources organises existing metadata in a separate read-only catalogue and does not modify RAG, search ranking, retrieval RPCs, prompts, or answer generation.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Notes

• Automatic capture covers new references added within the 11 registered source-bearing schemas. A genuinely new schema, source host, or query form requires explicit adapter/security review and fails closed until registered.
• Hosted owner/public visibility is proven through injected local fixtures only; hosted completeness and RLS acceptance remain unverified.
• No migration, push beyond this branch publication, deployment, or production action was performed.

---

Note

Medium Risk
New routes expose aggregated source metadata and document visibility rules; mistakes could leak private document identity or misrepresent governance, though the design is read-only with server assembly and conservative review-debt handling.

Overview
Introduces a read-only Sources application mode at /sources with catalogue, Topics, Publishers, Method, and per-source detail routes. The catalogue is assembled on the server from registered production content providers plus owner/public-scoped indexed document metadata, then normalized into client-safe entries with deterministic quality bands, filters, and usage traceability.

Navigation and compatibility: Sources is wired as the 16th app mode (functional home at /sources, sidebar “More modes”, secondary nav Catalogue · Topics · Publishers · Method). /dictionary/sources becomes a query-preserving redirect to /sources?usedBy=dictionary instead of a Dictionary-only page.

Supporting changes: New src/lib/sources/ stack (catalogue core/view, repository providers, document loader), npm run check:source-catalogue, DOM and tests/ui-sources.spec.ts browser proof, and updates to repo-awareness snapshot, site map, design-system adoption contract, and codebase index. Presentation-only catalogue rating; RAG/retrieval paths are not modified in this diff.

^{Reviewed by Cursor Bugbot for commit 3561ce5. Configure here.}

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T15:17:54.206148Z	a83e424	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_7cc92270-782c-4e7d-a9d6-6b4ab2aa6c86)

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: a4a50887-e9f4-4728-b156-ab98f113c135

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a83e4245f3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_36548b20-d0b0-4185-a347-4961f3a28f24)

[BigSimmo]

PR unblock summary

• Head: 69d121e3b35a16c44b4b251e3a199dadd59880e3; base: 410f59650862e93c2454f363846940bc92e8e164; mergeable.
• Restored the three reviewed source-catalogue fixes after an independent branch rewrite: metadata-compatible canonicalisation with stable IDs; official OCP Forms PDF/register coverage; OCP authority/governed-host support. Also fixed the Sources design-system contract and removed the duplicate live result-count announcement.
• Refreshed the repository-awareness snapshot; resolved all actionable review threads.
• Local decisive checks passed: 116 focused DOM/source tests, source coverage, design-system contract/adoption/sync checks, snapshot freshness, lint/formatting, and source type-check.
• Exact-head CI: Secret Scan, SAST, Build, Safety/config, and Caring Contacts database are green. Unit coverage, Static PR checks, Lighthouse budget, Production UI, and container jobs are still running; advisory-only jobs are skipped.
• Auto-merge was not changed. The PR was not merged.