feat: public corpus promotion and retrieval-owner verification tooling

[BigSimmo]

Summary

Adds operational scripts for the public access rollout follow-up:

• npm run check:retrieval-owner — validates live Supabase has retrieval_owner_matches, reports indexed public document count, and confirms hybrid RPCs accept the public sentinel (00000000-0000-0000-0000-000000000000).
• npm run promote:public-documents — dry-run by default; --apply promotes indexed locally_reviewed / approved documents to owner_id IS NULL and clears owner on related tables.

Live verification (Clinical KB Database)

Ran against sjrfecxgysukkwxsowpy:

Check	Result
retrieval_owner_matches sentinel	✅ true
Indexed public documents	1935
match_document_chunks_text with sentinel	✅ 5 results
Promotion candidates (default owner)	0 (corpus already promoted)

Usage

npm run check:retrieval-owner
npm run promote:public-documents          # dry-run
npm run promote:public-documents -- --apply
npm run promote:public-documents -- --owner-id <uuid> --limit 10 --apply

Notes

• Promotion is idempotent when no candidates remain.
• --apply mutates production data; dry-run first.
• App layer must still send the public sentinel in production RAG paths (separate rollout).

  

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy due to reaching the limit of concurrent preview branches.
Go to Project Integrations Settings ↗︎ if you wish to update this limit.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[BigSimmo]

Organizing open PRs (Jul 6): Main already has public corpus promotion via merged #274. This branch appears to include mixed commits from several other stacks — recommend rebasing the unique verification-script work onto main as a fresh PR, or closing if fully superseded.

[BigSimmo]

Closing as superseded by merged work on \main:

• feat: complete public access rollout with migrations and public corpus promotion #274 — public access rollout, migrations, public corpus promotion
• fix: restore anonymous production setup-status for psychiatry.tools #277 — anonymous /api/setup-status\
• fix: treat Supabase project warning as ready in setup-status #287 — setup-status project \warning\ →
  eady\

Production is live with these fixes. Any remaining unique commits should be cherry-picked onto a fresh branch from current \main.