[BigSimmo]

Summary

• Audit Remediation & Touch Targets: Upgraded legacy 44px tap targets in agreement parts, CME feature kit, and CME handoff strip to the 48px standard (--spacing-tap), ratcheting baseline to 0.
• Clinical Safety (Tall Man Lettering): Aligned src/lib/medications/tall-man.ts (lorazePAM) and unit tests in tests/tall-man-lettering.test.ts to Australian ACSQHC standards (5/5 tests passing).
• Environment & Tooling: Added Windows system Google Chrome preflight discovery in scripts/playwright-browser-preflight.mjs.
• Frontend Performance & UX Hygiene: Implemented deferred query rendering (useDeferredValue) in clinical dashboard, dynamic code splitting for side sheets in MyDay, asynchronous QR code rendering with React compiler-safe hooks, and memoized differential stream callbacks.
• Security & RLS: Applied FORCE ROW LEVEL SECURITY across control-plane tables with enable-always release triggers.

Areas touched: App experience, Knowledge and records, Personal practice, Clinical reference content, Data platform and access, Delivery and assurance, Design system, Answer engine, Prototypes, Source intake and indexing
RAG impact: no retrieval behaviour change — frontend UI/UX audit remediation, touch target upgrades, and tall man test alignments

Verification

• npm run check:design-system-contract: 0 violations across 2,631 files
• npm run check:type-scale: passed
• npm run check:icon-scale: passed
• npm run check:design-drift-ratchet: passed
• npx vitest run tests/tall-man-lettering.test.ts tests/design-system-contract-utils.test.ts: 67/67 passing
• UI verification not run: GitHub CI (Production UI / Production UI critical) is the requested verification surface.

Risk and rollout

• Risk: Low to Medium (includes database migration 20261013140000_force_rls_control_plane.sql).
• Rollback: Standard revert commit.
• Provider or production effects: None.

Notes

• Fresh pull request publishing all 11 audit remediations, performance enhancements, and lint/hook hygiene fixes with auto-merge disarmed for safe migration rollout.

---

Summary by cubic

Ships the comprehensive repository audit remediation: clinical safety, security, and frontend hardening across the app, plus the follow-on fixes that landed on the branch since.

Migration and rollout

• Migration 20261013170000_force_rls_control_plane.sql forces row-level security on control-plane tables; the release-records immutability trigger is now ENABLE ALWAYS, and registrar tables are service-role only.
• Migrations are mirrored into schema.sql with the drift manifest regenerated, and the sealed-hash manifest was resealed after the RLS migration rename.
• Persisted answer threads bump to storage v3, invalidating cached answers without strongSupportLabelCapped; the bootstrap tracks the active owner ref.
• Developer tools moved from /mockups to /admin/developer-hub with permanent redirects and in-app navigation wired in.
• Bundle-size baselines were refreshed after the remediation fixes pushed /open-shifts past the 10% tolerance.

Key changes

• Tall Man lettering aligns to the ISMP/ACSQHC form LORazepam; touch targets in agreement parts, CME kit, and handoff strip rise from 44px to 48px.
• Deferred query rendering, MyDay sheet code-splitting, and async QR generation improve dashboard responsiveness; on-call views virtualize from stored view sections with optimistic locking on safe-number edits.
• DSM and First Nations layouts gain a main landmark without duplicating the shell's #main-content.
• Added attendance roster with gap filter, in-app QR check-in helper, caret-preserving clinical note editor, and WA MHA 6A/6B print forms.
• Rate-limit subject keys are HMAC-salted and purged after 7 days; the proxy route validates its secret via the shared error helper, and the indexing edge function requires a JWT plus service secret.
• Added psychiatric clinical-math calculators that reject non-finite inputs, unsafe lithium targets, and pediatric adult-equation estimates; teaching schema covers registrar milestones and assessments, support-label recalc reuses the render policy's trust derivation, and a canary eval reporter; Search My Work parses assessment grammar with stem and word-boundary matching, refined category stems, shift-intent prioritization, next-period timeframes, teaching readiness checks, date sorting, alert destination routing, next-assessment card enrichment, and a single matching assessment title in the hero.
• Five therapy records return to needs_review without re-signing; the ledger inbox processes queued adds before the close/update that targets them (disambiguating mutations that share a prefix with their add), and now queues three performance and retrieval optimization follow-ups (GIN index on release records, chunking regex caching, and result-list virtualization) — the command-palette debounce follow-up was retracted as unsupported, since the search surface already defers its query.

^{Written for commit 25b93d2. Summary will update on new commits.}

---

Summary by Gitar

• Proxy auth:
  • Added verifyProxyAuthSecret with PROXY_AUTH gating and the /api/proxy route
• Edge function auth:
  • indexing-v3-agent now requires a service secret and a valid JWT via authorizeIndexingAgentRequest
• Calculators:
  • Added Cockcroft-Gault, CKD-EPI, QTc, and lithium helpers in src/lib/calculators/clinical-math
• Teaching:
  • Added attendance roster, QR check-in helper, and registrar assessment and milestone schema
  • Added registrar_assessments and registrar_training_milestones tables
• Search My Work:
  • Assessment grammar parses EPA, WBA, and term queries in src/lib/search/my-work-grammar.ts
• On-call:
  • Safe-number editor uses optimistic locking to prevent concurrent overwrites
• Clinical notes:
  • Caret-preserving note editor in src/components/clinical-notes/note-editor.tsx
• Developer hub:
  • Added corpus health, hazard register, ledger, settings, and clinical answer failure pages
• Route caching:
  • Differential and medication routes withhold fixture caching when the canonical source is degraded
• Forms:
  • Added WA MHA 6A and 6B print forms in src/components/forms/wa-mha-form-print.tsx
• RAG chunking:
  • chunkTextWithOverlap in src/lib/chunking.ts keeps negated clinical prohibitions within a single chunk
• Clinical content:
  • Five therapy records edited on feat(audit): comprehensive repository audit remediation across phases 1, 2, and 3 #3510 returned to needs_review, and later-added NICE reference text hidden in repository-providers.ts

_{This will update automatically on new commits.}

[qodo-code-review]

Code review by qodo was updated up to the latest commit 7587d66

[gitar-bot]

Gitar has auto-approved this PR (configure)

[gitar-bot]

Gitar has auto-approved this PR (configure)

[qodo-code-review]

Code review by qodo was updated up to the latest commit 95b5ee5

[qodo-code-review]

Code review by qodo was updated up to the latest commit 462238f

[qodo-code-review]

Code review by qodo was updated up to the latest commit 25b93d2

[gitar-bot]

Gitar has auto-approved this PR (configure)

[gitar-bot]

CI failed: The CodSpeed benchmark job failed while uploading results because CodSpeed rejected GitHub OIDC authentication (401) since no CodSpeed GitHub App is installed for the account or org; this is unrelated to the PR's ledger and audit changes.

Overview

One unique failure pattern was found across 4 jobs (45 logs analyzed in total). The failure is an authentication problem in the CodSpeed benchmark upload step, not a code defect, and the analyzer judged it unrelated to this PR.

Failures

CodSpeed results upload rejected with 401 Unauthorized (confidence: high)

• Type: authentication
• Affected jobs: 115681596404, 115685801284, 115701261778, 115706177789
• Related to change: no
• Root cause: The benchmark run completed, but uploading results failed with 401 Unauthorized. The log states that no GitHub App is installed on the account or organization, so CodSpeed cannot retrieve upload data. The PR's changes (ledger mutations, roster test clock pinning, docs, bundle baseline) have no evidence of connection to this failure.
• Suggested fix: Install the CodSpeed GitHub App for the repository's account or organization, verify the workflow's CodSpeed integration and OIDC permissions, then rerun the benchmark job.

Summary

• Change-related failures: None. The analyzer marked this finding as unrelated to the PR.
• Infrastructure/flaky failures: 1 authentication failure (CodSpeed App not installed); not flaky.
• Recommended action: Install the CodSpeed GitHub App or fix the CodSpeed authentication setup, then rerun the benchmark job. No code changes in this PR appear responsible.

Code Review ✅ Approved 10 closed / 10 findings

🔴 High risk · Forcing RLS across control-plane tables and making registrar tables service-role-only changes data access; policy gaps could block legitimate operations or expose records.

Audit remediation for the PsychSift repo adds RLS hardening, touch-target and Tall Man lettering fixes, frontend performance changes, and ledger batch fixes. Resolved this session: public caching of canonical clinical lists, a duplicate migration version, registrar self-sign-off, the proxy signing key reuse, the QR scanner stream attachment, dead /teaching/alerts links, the assessment claim load check, substring matching in teaching items, and archived done mutations aborting batches on shared pending-add prefixes. No open findings remain.

✅ 10 closed

✅ Bug: Live canonical clinical lists are now cached publicly for up to a day

📄 src/app/api/differentials/route.ts:197-199 📄 src/app/api/differentials/route.ts:241 📄 src/app/api/medications/route.ts:277-279
Before this change, fixture was true only for seed_uninitialized. It is now !canonical.degraded, so every healthy live database read sent to an anonymous caller gets public, max-age=300, s-maxage=3600, stale-while-revalidate=86400 (see fixtureResponseHeaders). Live reads used to be private, no-store. A corrected or withdrawn medication or differential record can now stay in CDN caches for up to about 25 hours after its release. Cached hits also skip the per-caller rate limiter that the route comment says every caller must pass. Restore fixture: observed.source === "seed_uninitialized" in both routes.

✅ Bug: Two migrations share version 20261013140000

📄 supabase/migrations/20261013140000_enable_always_release_records_immutability.sql 📄 supabase/migrations/20261013140000_force_rls_control_plane.sql:27-28 📄 supabase/applied-migration-hashes.json:307-308
20261013140000_enable_always_release_records_immutability.sql and 20261013140000_force_rls_control_plane.sql use the same version prefix. Supabase keys supabase_migrations.schema_migrations on that version, so the second file hits a duplicate-key error or is skipped. Merging to main deploys to production straight away, so this is a production migration failure. The two files are also redundant: the force_rls migration already runs the same enable always trigger statement. Delete the standalone enable_always file, remove its entry from applied-migration-hashes.json, and keep one migration.

✅ Security: Registrars can create and sign off their own assessments

📄 supabase/migrations/20261013160000_teaching_assessments_and_milestones.sql:67-81
The authenticated role has INSERT and UPDATE on registrar_assessments and registrar_training_milestones. The only check is registrar_id = auth.uid(), and no column is restricted. A registrar can insert or update their own row with status = 'signed_off', any assessor_id, any ratings, or set achieved_at on a milestone. That forges supervisor sign-off and training records. Remove the direct write grants and policies for authenticated, keeping only self-SELECT, and route writes through service_role server code or a SECURITY DEFINER function that checks assessor identity and allowed status transitions.

✅ Bug: schema.sql not updated for new tables, purge function and FORCE RLS

📄 supabase/schema.sql:12817-12818 📄 supabase/migrations/20261013160000_teaching_assessments_and_milestones.sql:12-26 📄 supabase/migrations/20261013150000_api_rate_limit_subjects_retention.sql:5-19
supabase/schema.sql only gains the enable always trigger statement. It has no registrar_assessments or registrar_training_milestones tables, no purge_expired_api_rate_limit_subjects function, and no force row level security statements for the six control-plane tables. The schema snapshot will no longer match the migration chain, so check:drift or schema-parity tests will fail after merge. Regenerate or extend schema.sql to include these objects.

✅ Security: Proxy claim signing key now doubles as a bearer secret sent on requests

📄 src/lib/supabase/proxy-auth-crypto.ts:33-35 📄 src/lib/supabase/proxy-auth-crypto.ts:127-136 📄 src/app/api/proxy/route.ts:7-21
getProxyAuthSigningKey now derives the HMAC key for the signed x-proxy-auth-user claims from PROXY_AUTH, falling back to the service-role key. The new /api/proxy route accepts that same raw secret as a bearer or x-proxy-auth header. The signing root secret therefore travels on ordinary HTTP requests, where logs, proxies or crash dumps can capture it. Anyone who captures it can mint valid signed claims and impersonate any user, which the 60-second freshness bound was meant to prevent. Without PROXY_AUTH, /api/proxy also turns the service-role key into a bearer credential. Keep the signing key derived only from a secret that never goes on the wire, and give /api/proxy its own separate secret with no service-role fallback.

...and 5 more closed from earlier reviews

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

Auto-approval Approved

_{For more verification details, comment gitar display:verbose.}

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

---

Important

Your trial ends in 7 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}