Skip to content

Fix confirmed documentation drift from the audit review, reset First Nations letter on region change, queue ledger requests - #3522

Merged
gitar-bot[bot] merged 28 commits into
mainfrom
claude/psychsift-audit-doc-fixes
Oct 13, 2026
Merged

gitar-bot[bot] merged 28 commits into
mainfrom
claude/psychsift-audit-doc-fixes

Conversation

@BigSimmo

@BigSimmo BigSimmo commented Oct 13, 2026 •

Copy link
Copy Markdown
Owner

User description

Summary

Fixes the simple, confirmed items from the review of 16 audit reports. Every claim was re-checked against main (4382217) before editing; the audits themselves were partly wrong, so nothing was applied from their suggested text without re-deriving it.

  • Operator runbooks.
    • The DR runbook and db-maintenance.md named a database setting that does not exist (app.indexing_agent_url). The real one is app.indexing_v3_agent_base_url, which falls back to the production host when unset.
    • The DR checklist told the operator to re-create the ingestion cron job that 20260926041000 retired.
    • The DR runbook's undated 102-migration count is now a dated measurement.
    • launch-operator-runbook.md says "at least" instead of "exactly" for the retention jobs.
    • observability-slos.md calls the ops digest daily, with a note that the scheduled run cannot meet the three-contiguous-hour page rule.
    • deployment-architecture.md names dockerfilePath in railway.worker.json instead of a non-existent RAILWAY_DOCKERFILE_PATH.
    • reindex-runbook.md gains the active_agent_enrichment bullet.
    • operations-runbook.md points at the real query locations and page size (1000).
  • Gate claims. branch-review-ledger.md and branch-review-archival-policy.md said their check runs in verify:cheap; it is a verify:full step. docs/testing.md explains the old 70-minute timeout as historical (matrix legs are now capped at 45). README.md states the real scope of release-browser-matrix and that it is not part of pr-required, and the test:focused example now uses <paths>.
  • Design-system and governance prose. ADOPTION.md counts, GATES.md tap-floor ratchet, SPEC.md "planned" checks that ship, .design-sync/conventions.md tap size / radius map / --command colour, and the Supabase label in clinical-governance.md (:67 only; the dated 2026-06-28 section is left alone).
  • Agent instructions. The design-review agent and audit skill now use ledger:lookup / ledger:append instead of hand-editing the ledger.
  • Code (one line). src/components/first-nations/where-is-home.tsx clears the letter when the region changes, so Copy cannot paste region A's service numbers while region B is shown.
  • Ledger. 13 immutable add requests under docs/outstanding-issues-inbox/ for the confirmed issues not fixed here. They are not reconciled, as the /issues skill requires.

Areas touched: Knowledge and records, Data platform and access, Design system, Delivery and assurance, App experience, Clinical reference content, Source intake and indexing

RAG impact: none. No ranking-protected file is touched and no retrieval behaviour changes.

Verification

  • Checks run:
    • prettier --check on all 19 changed files: "All matched files use Prettier code style!" (3.9.9, same result as before the edits).
    • node scripts/check-docs-links.mjs: "docs link check passed: 5764 repo path references resolve."
    • node scripts/check-docs-script-refs.mjs: "docs script-ref check passed: 851 npm-run reference(s) resolve to real scripts."
    • check-instructions.mjs: "retired-rules: pass"; instruction-budget: pass (AGENTS.md 23,977 of 24,000 bytes, unchanged by this PR).
    • check-codebase-index-coverage.mjs: "coverage OK"; update-docs-inventory.mjs --check: within tolerance.
    • check-outstanding-issues.mjs: "passed: 858 rows (141 open, 717 archived)"; check-ledger-write-discipline.mjs: "passed for 4382217..HEAD".
  • Not run: typecheck, unit tests, verify:cheap, verify:full, any browser test. Dependencies are not installed in the environment this was prepared in, so the where-is-home.tsx change is unverified beyond reading it. CI is the first real run of it. No DOM test was added for it.
  • scripts/organisation/decisions.mjs reports one warning about docs/decisions/2026-08-22-automated-review-coverage.md; it is present on main without this change.

Risk and rollout

  • Risk: low. All changes are documentation except the one-line state reset. The doc edits that touch operator instructions (DR runbook, db-maintenance.md) narrow or correct existing steps and add no new action.
  • Rollback: revert the commit.
  • Provider or production effects: None. No migration, no workflow, no deployment, no provider call.

Notes

  • Deliberately not changed: docs/outstanding-issues.md (canonical ledger; its corrupted arrow on line 15 is recorded in a ledger request instead), the privacy-document encoding repair, script header comments under scripts/**, and anything needing a migration (e.g. the display.revoke NULL guard) or an owner decision.
  • Findings this PR does not address are queued as ledger requests: PDF extractor prose-into-table-row, display.revoke guard, listOwnerTeams N+1, InboxRecord cast, the "Top match" test and its duplicate render, test-deletion guard blind spots, On Call identifier-guard coverage, Roster overlap check, week-strip / all-day / holiday gaps, sast.yml and eslint-rules, safety-document line anchors, script-header claims, and remaining doc drift.

🤖 Generated with Claude Code

https://claude.ai/code/session_013fpAhwc33X7YgFkDu3pa18

Generated by Claude Code


Summary by cubic

Fixes confirmed documentation drift from the audit review, resets the First Nations contact letter when the home region changes, and queues the remaining confirmed issues in the ledger.

Operator runbooks and gates

  • Runbooks now name the real settings and steps, including the retired ingestion cron job and invoke_indexing_v3_agent; restore steps run ALTER DATABASE ... SET as postgres and verify via pg_db_role_setting or a new connection.
  • Both restore docs redeploy every function in supabase/config.toml, verify OPENAI_API_KEY by name, and warn that a POST to site-content-sync claims queued outbox events rather than serving as a health probe; a new test asserts each one has a deploy command.
  • Gate claims are corrected: ledger checks run in verify:full, the 70-minute timeout is documented as historical, release-browser-matrix is not part of pr-required, and the daily ops digest cannot meet the three-contiguous-hour RPC page condition on its own.
  • Design-system, governance, and agent prose corrected, and the design-review agent and audit skill now use ledger:lookup / ledger:append.

Code and ledger

  • where-is-home.tsx clears the letter on a region switch but keeps it on same-region reselect, covered by a new DOM test.
  • 13 immutable ledger add requests queue the confirmed issues not fixed here, including the migration-gated display.revoke guard and owner-decision items.

Written for commit e62d72f. Summary will update on new commits.

View guided diff Turn on auto-fix


CodeAnt-AI Description

Clear regional letters on region changes and correct recovery guidance

What Changed

  • Switching home regions clears the contact letter so copied service numbers cannot come from the previously selected region; reselecting the same region keeps the letter.
  • Database recovery instructions now identify the current schedules and edge functions, explain how to verify the endpoint before enabling the indexing schedule, and warn against probing a function that processes queued events.
  • Corrected guidance on CI checks, design-system requirements, operational queries, and current project configuration.
  • Recorded confirmed audit findings that still need follow-up.

Impact

✅ Prevents copying contact numbers for the wrong region
✅ Reduces risk of misdirected indexing requests after a restore
✅ Clarifies which checks block a merge

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

…d queue ledger requests

Documentation (each claim re-checked against main 4382217 before editing):
- DR runbook: correct the GUC name (app.indexing_v3_agent_base_url) and its production-host fallback,
  stop telling the operator to re-create the retired ingestion cron job, drop the undated 102-migration count
- db-maintenance, launch-operator, observability-slos (digest is daily), deployment-architecture
  (dockerfilePath, not RAILWAY_DOCKERFILE_PATH), reindex-runbook (active_agent_enrichment),
  operations-runbook (real query locations and page size)
- verify:cheap -> verify:full for branch-review-ledger and branch-review-archival-policy
- testing.md and README.md (matrix scope, test:focused example)
- design-system ADOPTION/GATES/SPEC prose, .design-sync/conventions.md, clinical-governance label
- design-review agent and audit skill now use ledger:lookup / ledger:append

Code: First Nations "Where is home" clears the letter when the region changes.
Not run: typecheck and unit tests (no installed dependencies in this environment).

Ledger: 13 immutable add requests under docs/outstanding-issues-inbox for the confirmed issues
that are not fixed here. Not reconciled.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013fpAhwc33X7YgFkDu3pa18
@supabase

supabase Bot commented Oct 13, 2026

Copy link
Copy Markdown

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.


Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

@coderabbitai

coderabbitai Bot commented Oct 13, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

Warning

Review limit reached

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

Next included review available in 5 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available. Your 62 included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Team
  • Run ID: 4e9fb032-58c2-4816-aac6-e5a3ea1353c0
📥 Commits

Reviewing files that changed from the base of the PR and between f6f1822 and e62d72f.

📒 Files selected for processing: 34
  • .agents/skills/audit/SKILL.md
  • .cursor/agents/design-review.md
  • .design-sync/conventions.md
  • README.md
  • docs/branch-review-archival-policy.md
  • docs/branch-review-ledger.md
  • docs/clinical-governance.md
  • docs/db-maintenance.md
  • docs/deployment-architecture.md
  • docs/design-system/ADOPTION.md
  • docs/design-system/GATES.md
  • docs/design-system/SPEC.md
  • docs/disaster-recovery-runbook.md
  • docs/launch-operator-runbook.md
  • docs/observability-slos.md
  • docs/operations-runbook.md
  • docs/outstanding-issues-inbox/144345ea-d294-494d-a768-5b911c028306.json
  • docs/outstanding-issues-inbox/29314f51-76ca-451c-a478-ee5d47ef109b.json
  • docs/outstanding-issues-inbox/2b3d5fda-8ce9-4996-8634-8b1b50d34476.json
  • docs/outstanding-issues-inbox/2b7a5ade-0197-41e7-baaa-6b089cedf636.json
  • docs/outstanding-issues-inbox/3344a3a9-1a81-4a6a-85b3-3141ddc90c1c.json
  • docs/outstanding-issues-inbox/334f4e12-2bb6-4545-8318-ce9e86f0b933.json
  • docs/outstanding-issues-inbox/6f0eb676-57af-4a30-9338-3f4f0f6dfbfc.json
  • docs/outstanding-issues-inbox/a3510f93-98e4-423b-b336-8b7394a294a2.json
  • docs/outstanding-issues-inbox/ad367416-8819-4bc4-89b8-999c5a7d6ef3.json
  • docs/outstanding-issues-inbox/bd1a2627-a534-4714-bdf9-f79c44c9f535.json
  • docs/outstanding-issues-inbox/cc5a466d-68c6-4c38-86e7-b3f520afbc74.json
  • docs/outstanding-issues-inbox/d2785add-72d1-47db-9e4b-32be1a8729e9.json
  • docs/outstanding-issues-inbox/f1bd7d17-da23-4984-bdeb-f2905a49748b.json
  • docs/reindex-runbook.md
  • docs/testing.md
  • src/components/first-nations/where-is-home.tsx
  • tests/first-nations-where-is-home.dom.test.tsx
  • tests/restore-edge-function-docs.test.ts

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Team
  • Run ID: 07e0786d-102d-452f-b965-757a3fa4c298
📥 Commits

Reviewing files that changed from the base of the PR and between f46b290 and d4d47c8.

📒 Files selected for processing (4)
  • docs/db-maintenance.md
  • docs/disaster-recovery-runbook.md
  • docs/observability-slos.md
  • tests/restore-edge-function-docs.test.ts
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

Summary by CodeRabbit

  • Bug Fixes

    • Improved region selection: reselecting the current region preserves the prepared letter, while switching regions clears it. Selection changes also clear the copy-status note.
  • Documentation

    • Updated design guidance, CI details, and operational and recovery procedures to reflect current practices and checks.
    • Added records of outstanding audit findings and proposed follow-up actions.
    • Clarified review, deployment, and monitoring guidance.
    • Added a reminder to wait for active enrichment to finish before reindexing selected documents.

Walkthrough

The PR changes region selection so that reselecting the active region retains the prepared letter, while switching regions clears it. It also updates repository guidance, design-system and operational documentation, and adds outstanding-issue records.

Changes

Region selection

Layer / File(s) Summary
Shared region selection
src/components/first-nations/where-is-home.tsx, tests/first-nations-where-is-home.dom.test.tsx
Map and button selections use shared behavior. Reselecting the active region retains the prepared letter; switching regions clears it. Tests cover both cases.

Repository guidance

Layer / File(s) Summary
Ledger review procedure
.agents/skills/audit/SKILL.md, .cursor/agents/design-review.md
Review instructions use ledger:lookup to check prior reviews and ledger:append to record completed reviews.
Verification and CI guidance
docs/branch-review-archival-policy.md, docs/branch-review-ledger.md, README.md, docs/testing.md
Documentation updates link-check verification, release browser matrix triggers, the focused-test example, and Playwright timeout history.

Design-system documentation

Layer / File(s) Summary
Design-system guidance and status
.design-sync/conventions.md, docs/design-system/ADOPTION.md, docs/design-system/GATES.md, docs/design-system/SPEC.md
The conventions, adoption counts, gate evidence, and specification are updated. The specification identifies two contract checks as shipped.

Operational documentation

Layer / File(s) Summary
Restore and indexing procedures
docs/db-maintenance.md, docs/disaster-recovery-runbook.md, docs/launch-operator-runbook.md, docs/reindex-runbook.md, tests/restore-edge-function-docs.test.ts
Runbooks update indexing-agent endpoint configuration, cron-job recovery checks, restore timing, and the instruction to wait for active enrichment before reindexing. A test checks Edge Function deployment instructions against configured function names.
Query and alert procedures
docs/operations-runbook.md, docs/observability-slos.md
The operations runbook updates pagination and EXPLAIN examples. Alert documentation updates digest timing and describes how manual runs relate to the hybrid-RPC paging condition.
Deployment and preflight references
docs/deployment-architecture.md, docs/clinical-governance.md
Documentation updates the worker Dockerfile setting and the Supabase target name in the preflight checklist.

Outstanding-issue records

Layer / File(s) Summary
Added issue records
docs/outstanding-issues-inbox/*.json
New inbox records describe reported issues, audit provenance, priorities where supplied, and proposed follow-up actions.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: 🔵 Low · up to d4d47

The change is mostly documentation corrections plus a small region-reset behavior change. Several earlier documentation concerns are still open, such as the retired ingestion cron steps, the endpoint check query and the alert cadence. They can mislead operators but do not endanger runtime behavior. Resolve or accept them before merge.

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

  • Ignore

Failed Failed checks (1 error)

Check name Status Explanation Resolution
Verification Claims Error The PR description still claims, “Every claim was re-checked against main (4382217) before editing,” but it does not name an exact audit command or check and its result. The separate Verification sect… Add the exact audit command or check and its result, for example Ran <exact audit/check command>: passed or found <specific result>. If no reproducible audit check was run, state Not run: <reason> and remove the unsupported claim.
Passed Passed checks (10 passed)
Check name Status Explanation
Title check Passed The title clearly identifies the three main changes: documentation corrections, First Nations letter reset behavior, and ledger request queuing. It is somewhat long but remains specific and relevant.
Description check Passed The description includes the required Summary, Verification, Risk and rollout, and Notes sections. It documents changed areas, verification results, skipped checks, risk, rollback, and production effe…
Docstring Coverage Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 70.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files. (3 skipped: 3 …
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Generated And Sensitive Files Passed No prohibited sensitive or local/generated artifact was introduced. The changed-file inventory contains documentation, source, tests, and 13 small docs/outstanding-issues-inbox/*.json records. Those…
Risky Git Or Deployment Actions Passed No changed instruction recommends force-push, hard reset, destructive clean, branch deletion, or shared-branch rebase. The new deployment commands in docs/db-maintenance.md:106-111 require an explic…
Supabase Project And Schema Safety Passed No custom-check failure is introduced. The only project-identity change corrects docs/clinical-governance.md to PsychSift Production while preserving the established ref sjrfecxgysukkwxsowpy. Th…
Runtime And Package Manager Integrity Passed PASS. The pull request does not change package.json, package-lock.json, .node-version, .nvmrc, or .npmrc. The head still declares npm@11.17.0, Node >=24.15.0 <25, npm 11.x, and engine-strict=true. Add…
Api Route Failure Handling Passed No API route, server action, RAG, search, ingestion, or provider integration implementation changes are present. The production code change is local React state handling in `src/components/first-natio…
Full details: Verification Claims

Explanation

The PR description still claims, “Every claim was re-checked against main (4382217) before editing,” but it does not name an exact audit command or check and its result. The separate Verification section names several commands with results and marks other checks as not run, but it does not substantiate this audit re-check claim.

✨ Finishing Touches
✨ Simplify code
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@codeant-ai

codeant-ai Bot commented Oct 13, 2026 •

Copy link
Copy Markdown

🏁 CodeAnt Quality Gate Results

Commit: e62d72ff
Scan Time: 2026-10-13 22:46:03 UTC

✅ Overall Status: PASSED

Quality Gate Details

Quality Gate Status Details
Secrets ✅ PASSED 0 secrets found
Duplicate Code ✅ PASSED 0.0% duplicated
SAST ✅ PASSED No security issues
Bugs ✅ PASSED Rating S: No bugs
IAC ✅ PASSED No IAC issues

View Full Results

@codspeed

codspeed Bot commented Oct 13, 2026 •

Copy link
Copy Markdown

Merging this PR will not alter performance

⚠️ 3 benchmarks spent significant time in system calls

System calls cannot be consistently instrumented, so they are not included in the measure, which understates the real cost. Please switch to the Walltime instrument to accurately measure system calls.

Measurement and system calls

✅ 8 untouched benchmarks


Comparing claude/psychsift-audit-doc-fixes (e62d72f) with main (b921fc2)

Open in CodSpeed

@BigSimmo
BigSimmo marked this pull request as ready for review October 13, 2026 09:00
@codeant-ai

codeant-ai Bot commented Oct 13, 2026 •

Copy link
Copy Markdown

🤖 CodeAnt AI — Review Status

Status Commit Started (UTC) Finished (UTC)
✅ Incremental review completed e62d72f Oct 13, 2026 · 22:23 22:23
✅ Incremental review completed 5b28ce8 Oct 13, 2026 · 20:53 20:54
✅ Incremental review completed 2e5b0a3 Oct 13, 2026 · 19:21 19:21
✅ Incremental review completed 08bde79 Oct 13, 2026 · 18:05 18:06
✅ Incremental review completed eb44ba1 Oct 13, 2026 · 17:02 17:03

@codeant-ai

codeant-ai Bot commented Oct 13, 2026

Copy link
Copy Markdown

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

@greptile-apps greptile-apps Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

BigSimmo has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 13, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-13T09:03:27.621049Z d48406a Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@claude

claude Bot commented Oct 13, 2026 •

Copy link
Copy Markdown
Contributor

Claude encountered an error after 2s —— View job


I'll analyze this and get back to you.

@codeant-ai codeant-ai Bot added the size:L This PR changes 100-499 lines, ignoring generated files label Oct 13, 2026
@qodo-code-review

Copy link
Copy Markdown
Contributor

PR Summary by Qodo

Correct audit-confirmed guidance and clear stale First Nations letters

🐞 Bug fix 📝 Documentation 🕐 40+ Minutes

Grey Divider

AI Description

• Correct operator, gate, design-system, and agent guidance against current repository behavior.
• Clear the First Nations letter when a different region is selected, preventing stale numbers from
 being copied.
• Queue 13 verified, unresolved audit findings as immutable ledger requests without reconciling
 them.
Diagram

graph TD
  A["Audit reports"] --> B["Verified findings"] --> C["Runbooks and gates"] --> D["Operators"]
  B --> E[("Issue inbox")] --> F["Future reconciliation"]
  B --> G["Region selection"] --> H["Letter state"]
Loading
High-Level Assessment

The focused approach is appropriate: correct claims that were verified, fix the isolated stale-letter behavior, and queue findings needing separate decisions. Bulk-applying audit suggestions or reconciling the ledger in this PR would obscure which claims were confirmed and expand its operational risk.

Files changed (32) +231 / -37

Bug fix (1) +3 / -0
where-is-home.tsxClear letter when changing home region +3/-0

Clear letter when changing home region

• Resets the assembled letter on a region-button selection so its Copy action cannot retain the previous region's service numbers.

src/components/first-nations/where-is-home.tsx

Documentation (31) +228 / -37
SKILL.mdUse ledger lookup for audit history +1/-1

Use ledger lookup for audit history

• Directs audits to check prior reviews through ledger:lookup rather than inspecting the ledger table directly.

.agents/skills/audit/SKILL.md

design-review.mdUse ledger commands in design reviews +3/-3

Use ledger commands in design reviews

• Requires ledger:lookup before repeat reviews and ledger:append to record completed reviews instead of hand-editing the table.

.cursor/agents/design-review.md

conventions.mdAlign design conventions with current tokens +5/-4

Align design conventions with current tokens

• Corrects the radius map, 48px tap target, and dark-slate v2 command colour.

.design-sync/conventions.md

README.mdClarify browser-matrix scope and focused-test example +4/-3

Clarify browser-matrix scope and focused-test example

• Explains when release-browser-matrix runs, distinguishes it from the PR merge gate, and replaces the concrete focused-test path with a placeholder.

README.md

branch-review-archival-policy.mdCorrect archival link-check gate +1/-1

Correct archival link-check gate

• Identifies docs:check-links as a verify:full step rather than a verify:cheap step.

docs/branch-review-archival-policy.md

branch-review-ledger.mdCorrect ledger-check gate +1/-1

Correct ledger-check gate

• Identifies check:branch-review-ledger as a verify:full step rather than a verify:cheap step.

docs/branch-review-ledger.md

clinical-governance.mdCorrect production Supabase label +1/-1

Correct production Supabase label

• Names the production project PsychSift Production while retaining its project identifier.

docs/clinical-governance.md

db-maintenance.mdCorrect database setting recovery guidance +1/-1

Correct database setting recovery guidance

• Names the indexing-v3 agent setting and warns that an unset value falls back to the production host while hosted Supabase denies ALTER DATABASE.

docs/db-maintenance.md

deployment-architecture.mdCorrect Railway worker Dockerfile configuration +3/-3

Correct Railway worker Dockerfile configuration

• Points to build.dockerfilePath in railway.worker.json instead of a nonexistent service variable.

docs/deployment-architecture.md

ADOPTION.mdCorrect adoption route and root counts +3/-2

Correct adoption route and root counts

• Updates production route and scanned-root counts and identifies the generated table as authoritative if the prose drifts.

docs/design-system/ADOPTION.md

GATES.mdCorrect tap-floor ratchet evidence +1/-1

Correct tap-floor ratchet evidence

• Updates the documented interactive tap-floor baseline and per-path count from five across four files to four across three.

docs/design-system/GATES.md

SPEC.mdIdentify shipped shadow checks +3/-2

Identify shipped shadow checks

• Replaces a planned-check claim with the names of the shipped, ratcheted edge-ownership and shadow-spread checks.

docs/design-system/SPEC.md

disaster-recovery-runbook.mdCorrect restore checklist and migration measurement +6/-5

Correct restore checklist and migration measurement

• Dates the migration replay measurement, excludes the retired ingestion-worker cron, and corrects the indexing-agent setting and hosted-database caveats.

docs/disaster-recovery-runbook.md

launch-operator-runbook.mdClarify retention-job expectation +1/-1

Clarify retention-job expectation

• Says the named retention jobs must be present, not that they are the only active retention jobs.

docs/launch-operator-runbook.md

observability-slos.mdClarify daily digest paging limitation +1/-1

Clarify daily digest paging limitation

• Describes the daily schedule and explains why its scheduled windows cannot satisfy the three-contiguous-hour RPC paging rule.

docs/observability-slos.md

operations-runbook.mdMatch indexing guidance to current queries +9/-6

Match indexing guidance to current queries

• Corrects source locations, shows the paged document query, and uses its 1,000-row page size in example plans.

docs/operations-runbook.md

144345ea-d294-494d-a768-5b911c028306.jsonQueue stale clinical safety anchors +14/-0

Queue stale clinical safety anchors

• Adds a P2 request to repair incorrect file-and-line references in clinical hazard and RAG injection documents.

docs/outstanding-issues-inbox/144345ea-d294-494d-a768-5b911c028306.json

29314f51-76ca-451c-a478-ee5d47ef109b.jsonQueue roster and teaching display defects +14/-0

Queue roster and teaching display defects

• Adds a P3 request covering shift-kind display, all-day next-session handling, and public-holiday data ending in 2028.

docs/outstanding-issues-inbox/29314f51-76ca-451c-a478-ee5d47ef109b.json

2b3d5fda-8ce9-4996-8634-8b1b50d34476.jsonQueue owner-team query fan-out +14/-0

Queue owner-team query fan-out

• Adds a P2 request to replace per-service counts that can produce up to 401 queries per request.

docs/outstanding-issues-inbox/2b3d5fda-8ce9-4996-8634-8b1b50d34476.json

2b7a5ade-0197-41e7-baaa-6b089cedf636.jsonQueue SAST and lint gate gaps +14/-0

Queue SAST and lint gate gaps

• Adds a P3 request for an owner decision on advisory repo-wide SAST and for linting eslint-rules.

docs/outstanding-issues-inbox/2b7a5ade-0197-41e7-baaa-6b089cedf636.json

3344a3a9-1a81-4a6a-85b3-3141ddc90c1c.jsonQueue PDF table-recovery safety defect +14/-0

Queue PDF table-recovery safety defect

• Adds a P1 request to prevent prose beneath a table from becoming a recovered table row and to test the markdown rebuild path.

docs/outstanding-issues-inbox/3344a3a9-1a81-4a6a-85b3-3141ddc90c1c.json

334f4e12-2bb6-4545-8318-ce9e86f0b933.jsonQueue ineffective duplicate-badge assertion +14/-0

Queue ineffective duplicate-badge assertion

• Adds a P2 request to strengthen the UI assertion and investigate the underlying duplicate render.

docs/outstanding-issues-inbox/334f4e12-2bb6-4545-8318-ce9e86f0b933.json

6f0eb676-57af-4a30-9338-3f4f0f6dfbfc.jsonQueue inbox parsing resilience defect +14/-0

Queue inbox parsing resilience defect

• Adds a P2 request to validate inbox records individually so one malformed JSON file cannot empty the displayed inbox.

docs/outstanding-issues-inbox/6f0eb676-57af-4a30-9338-3f4f0f6dfbfc.json

a3510f93-98e4-423b-b336-8b7394a294a2.jsonQueue teaching-link revocation authorization defect +14/-0

Queue teaching-link revocation authorization defect

• Adds a P1 request to address a nullable creator ID that can bypass a non-organiser revocation guard, subject to an approved migration window.

docs/outstanding-issues-inbox/a3510f93-98e4-423b-b336-8b7394a294a2.json

ad367416-8819-4bc4-89b8-999c5a7d6ef3.jsonQueue missing own-shift conflict checks +14/-0

Queue missing own-shift conflict checks

• Adds a P2 request to detect overlapping doctor shifts during roster import and manual entry.

docs/outstanding-issues-inbox/ad367416-8819-4bc4-89b8-999c5a7d6ef3.json

bd1a2627-a534-4714-bdf9-f79c44c9f535.jsonQueue On Call identifier-guard investigation +14/-0

Queue On Call identifier-guard investigation

• Adds a P2 request to test all six free-text sections and establish whether identifier warnings block or merely report transmission.

docs/outstanding-issues-inbox/bd1a2627-a534-4714-bdf9-f79c44c9f535.json

cc5a466d-68c6-4c38-86e7-b3f520afbc74.jsonQueue remaining gate-script comment drift +14/-0

Queue remaining gate-script comment drift

• Adds a P3 request to correct verify:cheap membership claims and a stale advisory-test exemption comment in scripts.

docs/outstanding-issues-inbox/cc5a466d-68c6-4c38-86e7-b3f520afbc74.json

d2785add-72d1-47db-9e4b-32be1a8729e9.jsonQueue remaining documentation and instruction drift +14/-0

Queue remaining documentation and instruction drift

• Adds a P2 request covering encoding damage, worktree and RAG guidance, a superseded decision, and other documented claim mismatches.

docs/outstanding-issues-inbox/d2785add-72d1-47db-9e4b-32be1a8729e9.json

f1bd7d17-da23-4984-bdeb-f2905a49748b.jsonQueue test-deletion guard blind spots +14/-0

Queue test-deletion guard blind spots

• Adds a P2 request for owner decisions on table-driven case counts, uncovered test languages, and mass-skip detection.

docs/outstanding-issues-inbox/f1bd7d17-da23-4984-bdeb-f2905a49748b.json

reindex-runbook.mdDocument active enrichment reindex block +1/-0

Document active enrichment reindex block

• Adds guidance to wait for selected documents' agent-enrichment pass when reindex health reports active_agent_enrichment.

docs/reindex-runbook.md

testing.mdDate the browser-matrix timeout claim +1/-1

Date the browser-matrix timeout claim

• Clarifies that the cited 70-minute timeout was historical and that current per-engine legs are capped at 45 minutes.

docs/testing.md

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d48406a3a1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread docs/db-maintenance.md Resolved
Comment thread docs/disaster-recovery-runbook.md Resolved
@qodo-code-review

qodo-code-review Bot commented Oct 13, 2026 •

Copy link
Copy Markdown
Contributor

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

Grey Divider


Action required

No findings for this group


Remediation recommended

No findings for this group


Informational

No findings for this group

Grey Divider


Resolved findings

1. Site sync probes can mutate live data ✗ Dismissed
Description
The site-content-sync sanity check calls for health probes without mutating data, but that
function has no read-only health endpoint: it accepts only POST and then records an invocation and
claims queued events. If an operator probes the newly redeployed function with POST, the check can
process pending work; a GET instead returns 405 and does not establish service health.
Code

docs/db-maintenance.md[111]

+- **Sanity check:** Verify both `indexing-v3-agent` and `site-content-sync` are present and active via `supabase functions list` and run health probes without mutating data.
Relevance

●●● Strong

A mutating-only endpoint cannot support the promised non-mutating health probe; operational runbook
accuracy is consistently enforced.

PR-#2213
PR-#2504

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The deploy skill calls for checking deployment health and treating hosted deployment actions as
approval-required. The changed runbook instructs a non-mutating probe, while the function rejects
non-POST requests and a POST records an invocation before claiming events.

docs/db-maintenance.md[104-111]
supabase/functions/site-content-sync/index.ts[273-307]
Skill: deploy

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The restore procedure promises a non-mutating health probe for `site-content-sync`, but its only functional request can claim and process queued events.
## Fix Focus Areas
- docs/db-maintenance.md[106-111]
## Recommended Fix
Replace the generic health-probe instruction with a specific read-only verification of the function's deployment and site-sync readiness. State that invoking the function with POST is an operational action requiring separate approval, not a health probe.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


2. Restores leave site sync offline ✗ Dismissed
Description
The post-restore edge-function procedure deploys only indexing-v3-agent and omits the separately
required site-content-sync function. When operators follow the checklist after a schema restore,
the site_content_sync_events outbox is left without its service-role consumer, so site-content
synchronization remains unavailable even though the indexing path is deployed.
Code

docs/db-maintenance.md[106]

+- **Procedure:** Redeploy required edge functions (`indexing-v3-agent`; the ingestion-worker function is retired) with the Deno v2.x toolchain in an explicitly approved change window:
Relevance

●●● Strong

Genuine inconsistency: sibling disaster-recovery-runbook.md (edited same PR) lists site-content-sync
but db-maintenance.md omits it.

PR-#3521
PR-#2789

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The changed checklist replaces the retired ingestion-worker entry with only indexing-v3-agent,
while the repository inventory and disaster-recovery requirements identify site-content-sync as a
separate service-role Edge Function that must also be deployed after restore. The cited maintenance
procedure, disaster-recovery runbook, and supabase/config.toml therefore show that the recovery
steps omit a required component and its post-recovery verification.

docs/db-maintenance.md[103-109]
docs/disaster-recovery-runbook.md[114-122]
docs/db-maintenance.md[106-108]
docs/disaster-recovery-runbook.md[123-124]
docs/disaster-recovery-runbook.md[152-157]
docs/codebase-index.md[1018-1024]
supabase/config.toml[1-6]
Skill: recovery
Skill: operations

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The post-restore Edge Function procedure lists only `indexing-v3-agent`, but `site-content-sync` remains a required Edge Function that processes the `site_content_sync_events` outbox. Update the recovery checklist so operators cannot complete a restore with site-content synchronization unavailable, while continuing to exclude the retired ingestion-worker function.

## Fix Focus Areas
- docs/db-maintenance.md[106-108]
- docs/disaster-recovery-runbook.md[114-122]
- docs/disaster-recovery-runbook.md[152-157]
- supabase/config.toml[1-6]

## Recommended Fix
Update the Edge Functions procedure, sanity-check or verification text, and post-deployment checks to require redeploying both `indexing-v3-agent` and `site-content-sync`, while continuing to state that the retired ingestion-worker function must not be redeployed. Keep the commands and checks consistent with the disaster-recovery runbook, preserve the explicitly approved change-window requirement, and verify both functions with the CLI status check.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


3. Restores can verify a stale endpoint ✓ Resolved
Description
Both restore procedures use pg_settings to verify app.indexing_v3_agent_base_url after `ALTER
DATABASE postgres SET`, but the database-level change does not update the current operator session.
If that session’s old value looks correct while the new setting is wrong or absent, the check can
permit activation of invoke_indexing_v3_agent, which sends Vault credentials to the wrong endpoint
or the production fallback.
Code

docs/disaster-recovery-runbook.md[150]

+   - Re-set custom parameters (e.g. `app.indexing_v3_agent_base_url`) by running `ALTER DATABASE postgres SET ...` as the project owner (`postgres`) in an operator session; the `schema.sql` statement skips with a notice when its role lacks the privilege, so do not rely on it. If the value is left unset, `invoke_indexing_v3_agent` falls back to the hardcoded production host (`supabase/schema.sql`, `invoke_indexing_v3_agent`) and would send the Vault secret there, so confirm the value with the `pg_settings` check below before activating that job (step 1).
Relevance

●●● Strong

Accepted: stale-session GUC verification is a concrete recovery safety gap, and the PR explicitly
intends actionable database restore guidance.

PR-#2201
PR-#2250

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
Both procedures make a pg_settings check the prerequisite for activating the indexing cron job,
but neither requires a new connection after ALTER DATABASE. The check can therefore read the
operator session’s old value rather than the value a new cron session will receive; the invoker
reads its effective GUC when called, falls back to the production URL if it is absent, and sends its
Vault secret in the request.

docs/disaster-recovery-runbook.md[144-151]
docs/db-maintenance.md[96-101]
supabase/migrations/20260926041100_indexing_v3_agent_cron_sends_jwt.sql[34-70]
docs/disaster-recovery-runbook.md[150-151]
docs/db-maintenance.md[96-100]
supabase/schema.sql[4986-5002]
Skill: recovery

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The restore instructions can validate a stale operator-session endpoint setting instead of the database-level setting a new indexing cron session will receive.

## Fix Focus Areas
- docs/disaster-recovery-runbook.md[150-151]
- docs/db-maintenance.md[96-101]

## Recommended Fix
In both procedures, require the operator to open a new database connection after `ALTER DATABASE` and check that connection’s effective `app.indexing_v3_agent_base_url` before activating the indexing cron job. Keep the job inactive if the value is absent or does not match the non-production restore target.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


View resolved (5)
4. The staging recovery check cannot pass ✗ Dismissed
Description
The revised cron step says to create the indexing job inactive on a non-production target, but its
immediate sanity check requires that job to be active. Before step 3 verifies the endpoint, an
operator must either fail the check or activate a job that can fall back to the production host.
Code

docs/disaster-recovery-runbook.md[144]

+   - Re-create the `invoke_indexing_v3_agent` schedule (create it inactive on a non-production target and activate it only after step 3 confirms its endpoint GUC) and the telemetry retention jobs (`purge-expired-rag-queries`, `purge-rag-retrieval-logs`, `purge-rag-query-misses`, `purge-rag-response-cache`). Do **not** re-create `invoke_ingestion_worker`: it was retired by `20260926041000` and the container worker owns ingestion.
Relevance

●●● Strong

Accepted: adjacent checklist steps require inactive and active states before endpoint verification,
directly contradicting the stated recovery sequence.

PR-#2200
PR-#2406

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The two adjacent checklist instructions demand opposite job states before the endpoint check. The
invoked function uses a production URL when its endpoint setting is absent.

docs/disaster-recovery-runbook.md[144-150]
supabase/schema.sql[4986-4995]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The non-production cron step requires the indexing job to remain inactive until endpoint verification, while its immediate sanity check requires the job to be active.
## Fix Focus Areas
- docs/disaster-recovery-runbook.md[144-150]
## Recommended Fix
Split the checks by phase: require the non-production indexing job to be inactive during step 1, then verify its endpoint in step 3 before activating it and confirming its active state.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


5. Map switches keep the wrong numbers ✓ Resolved
Description
WhereIsHomePanel clears letter in the region-button handler but passes bare setRegionId to
WaLineMap, so map selection does not reset the letter or note. After adding one region’s services
to the letter, selecting another region by map click or keyboard leaves the first region’s letter
visible beneath the new selection, and Copy still copies its numbers.
Code

src/components/first-nations/where-is-home.tsx[163]

+                setLetter([]);
Relevance

●●● Strong

Recent accepted findings favor resetting stale selection-dependent state; this directly matches the
PR’s stated correctness intent.

PR-#3155
PR-#3506

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The map invokes its onSelect callback on click or keyboard activation, and the panel supplies
setRegionId directly. The added reset runs only in the separate region-button handler; because the
letter and Copy action render whenever letter remains nonempty, map selection leaves the previous
region’s copyable content in place.

src/components/first-nations/where-is-home.tsx[145-163]
src/components/first-nations/where-is-home.tsx[226-245]
src/components/first-nations/where-is-home.tsx[85-101]
src/components/first-nations/where-is-home.tsx[151-164]
src/components/first-nations/where-is-home.tsx[225-242]
Skill: clinical
Skill: ui

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Selecting a region through the map bypasses the letter reset in the region-button handler, leaving the previous region’s service numbers visible and available to copy.

## Fix Focus Areas
- src/components/first-nations/where-is-home.tsx[85-104]
- src/components/first-nations/where-is-home.tsx[148-164]

## Recommended Fix
Create one region-selection handler that updates the selected region, clears the note, and empties the letter. Use it for both the map and region buttons. Add a focused interaction test that creates a letter, switches regions through each route, and confirms the old letter and Copy action are gone.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


6. Restored site sync fails without its key ✗ Dismissed
Description
The new site-content-sync deploy step does not restore or verify the Edge Function’s
OPENAI_API_KEY, although its embedding path requires that secret. On a fresh Supabase project, the
checklist can pass its function-list check while the first event needing a new embedding fails as
provider_failure.
Code

docs/db-maintenance.md[109]

+  supabase functions deploy site-content-sync --project-ref <PROJECT_REF>
Relevance

●●● Strong

Restore documentation must include required function secrets; historical reviews accept missing
environment and readiness controls.

PR-#2742
PR-#2776

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The added command deploys the worker, but the restore checklist's secret steps name Vault secrets
and app keys rather than the Edge Function's OpenAI key. The worker reads OPENAI_API_KEY when an
event needs an embedding and records a provider failure if that work throws; listing the deployed
function cannot establish that the key is present.

docs/db-maintenance.md[85-111]
supabase/functions/site-content-sync/index.ts[43-51]
supabase/functions/site-content-sync/index.ts[98-115]
supabase/functions/site-content-sync/index.ts[207-229]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The added site-content-sync restore step can deploy successfully without the Edge Function's provider key, leaving new or changed content unable to sync.
## Fix Focus Areas
- docs/db-maintenance.md[104-111]
- docs/disaster-recovery-runbook.md[152-158]
## Recommended Fix
Add a names-only check that the restored Supabase project's Edge Function environment contains `OPENAI_API_KEY` before declaring site-content-sync healthy. Direct operators to restore the secret through the approved secret-management procedure without printing its value.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


7. Restores lack an approval checkpoint ✗ Dismissed
Description
The disaster-recovery checklist instructs operators to copy a live project's cron command and create
or activate invoke_indexing_v3_agent without requiring an approved change window or recording
ownership, rollback, and evidence. Because cron.schedule mutates Supabase state and production
activation can send the Vault JWT to the configured endpoint, an unapproved or miscopied restore can
create an unsafe live job.
Code

docs/disaster-recovery-runbook.md[144]

+   - Re-create the `invoke_indexing_v3_agent` schedule (the schedule row is live-only, so copy its `jobname`, `schedule` and `command` from the source project with `SELECT jobname, schedule, command, active FROM cron.job WHERE jobname = 'invoke_indexing_v3_agent';` and re-create it with `SELECT cron.schedule(<jobname>, <schedule>, <command>);`; on a non-production target immediately run `SELECT cron.alter_job(<jobid>, active := false);` and activate it with `active := true` only after step 3 confirms its endpoint GUC) and the telemetry retention jobs (`purge-expired-rag-queries`, `purge-rag-retrieval-logs`, `purge-rag-query-misses`, `purge-rag-response-cache`). Do **not** re-create `invoke_ingestion_worker`: it was retired by `20260926041000` and the container worker owns ingestion.
Relevance

●●● Strong

Recent precedents accept adding approved-window and ownership controls to operational runbooks
involving production changes.

PR-#2201
PR-#2250
PR-#3123

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The changed checklist directly introduces cron.schedule creation and production activation
instructions. The recovery skill requires live restores and Supabase or production operations to be
approval-required, with checkpoints, rollback, and audit evidence.

docs/disaster-recovery-runbook.md[144-144]
Skill: recovery

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

Issue description
The restore checklist adds mutating Supabase cron creation and production activation but does not identify an approval gate, owner, rollback command, or required evidence for those operations. Recovery guidance must keep live restore actions approval-required and reproducible.

Fix Focus Areas
- docs/disaster-recovery-runbook.md[144-144]
- docs/disaster-recovery-runbook.md[150-150]

Recommended Fix
Add an explicit approved-change-window prerequisite before the cron step, name the operator/owner, require recording the source schedule and returned job ID, and document the rollback command (for example, unscheduling the newly created job). Keep non-production jobs inactive until the endpoint check passes, and require post-restore evidence showing the expected schedule state and endpoint configuration before production activation.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


8. Manual runs are required for paging ✗ Dismissed
Description
docs/observability-slos.md misstates the condition around updateHybridRpcHourlyEvidence: it
treats manual observations as available while also saying the scheduled path cannot page, although
the workflow’s daily schedule shares persisted hourly history with manual runs. When operators
dispatch runs that populate the preceding contiguous buckets, the next scheduled run can create the
third bucket and emit the hybrid-RPC page alert; without those dispatches, the daily schedule alone
cannot do so.
Code

docs/observability-slos.md[412]

+`scripts/lib/operational-alerts.mjs` is the provider-neutral policy owner for the §2 answer SLOs. The daily (22:00 UTC) digest emits stable alert codes with owner, escalation owner and this runbook, and publishes `alerting`, highest `severity`, and a compact JSON summary to the workflow. Missing SLO telemetry and a zero-query denominator are `unknown`, never healthy. Each authorised deep probe returns only safe internal hybrid-RPC identifiers and counts. The workflow stores the last three identity-only hourly observations in the GitHub Actions cache, then pages `OPS_HYBRID_RPC_ERROR_RATE_PAGE` only when the same RPC has a nonzero count in all three contiguous UTC-hour buckets. The digest runs once a day (`.github/workflows/ops-digest.yml`), so each scheduled run measures a single 60-minute window and consecutive windows are a day apart: this three-contiguous-hour condition needs one successful run in each of three consecutive UTC-hour buckets; scheduled and manual runs both count, so in practice manual dispatches supply at least two of them (a second run in the same bucket replaces that hour's observation rather than adding one), and the scheduled path cannot page it. A missing, evicted, malformed, incomplete, or non-contiguous history is never promoted to a page. Degraded answers page independently and immediately only above the documented 50% hourly threshold.
Relevance

●●● Strong

Recent documentation precedents accept correcting stale operational claims when workflow behavior
provides directly verifiable contrary evidence.

PR-#2200
PR-#2298
PR-#2789

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The documentation describes manual dispatches as supplying observations, while
.github/workflows/ops-digest.yml defines only a daily schedule plus optional manual dispatch. Both
execution paths restore and save the same cache-backed hourly history, and
updateHybridRpcHourlyEvidence requires three contiguous hourly entries; the alert policy then
pages when repeated RPC names and a nonzero current rate are present. Therefore, two deliberate
manual runs can populate the preceding buckets and allow the next scheduled run to emit the page
alert, whereas the daily schedule by itself cannot produce the required three observations.

docs/observability-slos.md[412-412]
.github/workflows/ops-digest.yml[9-18]
.github/workflows/ops-digest.yml[11-20]
.github/workflows/ops-digest.yml[124-142]
scripts/ops-digest.mjs[85-105]
scripts/lib/operational-alerts.mjs[130-140]
Skill: review

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Clarify the hybrid-RPC paging documentation so it does not imply that optional manual dispatches occur automatically or categorically claim that a scheduled run can never page. The daily schedule cannot produce three observations by itself, but a scheduled run can complete the third contiguous hourly bucket when prior manual runs have populated the preceding buckets; repeated observations within one bucket replace rather than accumulate.

## Fix Focus Areas
- docs/observability-slos.md[412-412]
- .github/workflows/ops-digest.yml[9-18]
- .github/workflows/ops-digest.yml[124-142]
- scripts/ops-digest.mjs[85-105]
- scripts/lib/operational-alerts.mjs[130-140]

## Recommended Fix
Replace the categorical or misleading wording with a precise explanation: the daily schedule cannot satisfy the three-contiguous-hour rule on its own, but it can trigger paging after operators deliberately dispatch runs that populate the preceding contiguous UTC-hour buckets. Do not imply that manual observations are supplied unless those dispatches occur, and preserve the explanation that repeated observations within a single bucket replace rather than accumulate.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Grey Divider

Context sources
✅ Compliance rules (platform): 9 rules
✅ Cross-repo context — repo relationships
✅ REVIEW.md
Review mode: Auto: 🚀 Fast: Localized runbook corrections with operational impact, but no code or broad logic.
✅ Fix-loop round: fix loop

Grey Divider

Tip of the day
💡 Did you know, you can turn these tips off under Display > Comment parts

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Grey Divider

Qodo Logo

@codeant-ai

codeant-ai Bot commented Oct 13, 2026

Copy link
Copy Markdown

CodeAnt Nitpicks

2 code suggestions

1. This calls 28px the chip text size, but --chip-height is 28px and chip labels use 12px text; readers may create oversized labels.

Docstring mismatch · .design-sync/conventions.md:44


2. This promises every new sub-floor control in src/** fails, but the checker only inspects native elements and Link; custom component controls can bypass it.

Comment mismatch · docs/design-system/GATES.md:168

@qodo-code-review

Copy link
Copy Markdown
Contributor

Qodo Fixer

✅ Committed (1) · ☑ Fixed (1)

Grey Divider

Commits pushed directly to this PR — no separate fix PR opened.

Process — 1 fixed
  • ☑ Fixed: Map switches keep the wrong numbers

@gitar-bot
gitar-bot Bot enabled auto-merge (squash) October 13, 2026 09:08
gitar-bot[bot]
gitar-bot Bot previously approved these changes Oct 13, 2026

@gitar-bot gitar-bot Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Gitar has auto-approved this PR (configure)

Comment thread docs/db-maintenance.md Resolved
Comment thread docs/db-maintenance.md Resolved
@qodo-code-review

Copy link
Copy Markdown
Contributor

Code review by qodo was updated up to the latest commit 3dfbe5b

@gitar-bot gitar-bot Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Gitar has auto-approved this PR (configure)

@qodo-code-review

Copy link
Copy Markdown
Contributor

Code review by qodo was updated up to the latest commit 032fb8e

@cubic-dev-ai

cubic-dev-ai Bot commented Oct 13, 2026 •

Copy link
Copy Markdown
Contributor

Auto-fix: 1 flaky check. View session →

  • CodSpeed Performance Analysis: Flaky. The regressed benchmark (`catalog-search: rankCatalogRecords`) runs code this PR doesn't touch: the PR's only change in `src/` is `where-is-home.tsx`, which the benchmark never imports. CodSpeed itself flagged different runtime environments between baseline and head, and local `npm run bench` runs showed head and base within the same noise range, so this looks like measurement noise. It should pass on a rerun, or can be acknowledged on CodSpeed.

coderabbitai[bot]
coderabbitai Bot previously requested changes Oct 13, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pre-merge checks failed. Please resolve the failing checks before merging.

@cubic-dev-ai

cubic-dev-ai Bot commented Oct 13, 2026 •

Copy link
Copy Markdown
Contributor

Auto-fix: 2 checks fail without this pull request. View session →

  • Lighthouse budget: Fails without this pull request. The baseline was measured with HeadlessChrome 153 and CI now runs 156, so the budget script refuses to grade the run ("evidence incomplete"). `main`'s latest Lighthouse budget run fails with the identical message. A maintainer needs to run the "Refresh Lighthouse baseline" workflow_dispatch (refresh_lighthouse_baseline) on main; nothing in this PR causes or can fix it.
  • PR required: Fails without this pull request. PR required fails only because it aggregates `lighthouse-budget result was failure`; every other upstream job succeeded. That Lighthouse failure is the baseline browser-version drift already failing on `main`, so this clears once the Lighthouse baseline is refreshed.

@qodo-code-review

qodo-code-review Bot commented Oct 13, 2026 •

Copy link
Copy Markdown
Contributor

No code changes since the last review — review skipped

Qodo Logo

@gitar-bot

gitar-bot Bot commented Oct 13, 2026

Copy link
Copy Markdown
Contributor
Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Clearing contacts on region switches may discard a draft, while revised restore steps could misconfigure cron or database settings if misapplied.

Resets the First Nations service letter when the home region changes in src/components/first-nations/where-is-home.tsx, so Copy can no longer paste the previous region's service numbers, and corrects operator runbooks and gate-claim docs. Map region selection that kept the stale letter has been addressed. No open issues remain.

✅ 1 closed
✅ Bug: Map region selection still keeps the stale letter

📄 src/components/first-nations/where-is-home.tsx:151 📄 src/components/first-nations/where-is-home.tsx:158-164
The reset was only added to the region buttons. The WaLineMap on line 151 still passes onSelect={setRegionId}, so clicking a map path or pressing Enter/Space on it switches to region B without clearing the letter. The 'For the letter' Copy action then still pastes region A's service numbers while region B is on screen, which is the exact failure the PR says it fixes. Move the reset into one shared handler and use it for both the map and the buttons. A DOM test that selects the region through the map would catch a regression here.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

Auto-approval Approved

For more verification details, comment gitar display:verbose.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply Compact
gitar auto-apply:on         
gitar display:verbose         

Was this helpful? React with 👍 / 👎 | Gitar

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

🔴 Large blast radius size:L This PR changes 100-499 lines, ignoring generated files 🕐 40+ Minutes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants