[BigSimmo]

Summary

Before: nothing noticed when a function in the live database had no caller left, so unused versions could pile up. The scorecard thought old search versions were unused, but every one is still called: each v2 wraps its v1, and the app falls back to v1.

After: a new offline test, tests/supabase-function-callers.test.ts, reads the function signatures in the drift manifest and fails if any function has no caller. A caller is one of these:

• code in src, worker, scripts or supabase/functions, with comments ignored
• SQL in the current supabase/schema.sql, counting only the last definition of each function
• a command that a migration scheduled with cron.schedule

The following don't count as callers: the generated database.types.ts, and SQL that names a function without calling it. That covers the function's own definition and body, drop, alter, grant and comment statements, proname = '…' checks, and quoted 'public.x(…)' identity strings.

Nineteen functions have no caller today. They are listed by name and flagged, not dropped. A second test fails if one of them gains a caller, so the list stays current.

Known limit: the check tracks functions by name, so for the 8 overloaded names it flags only when no version of the function has a caller left.

Areas touched: Data platform and access

Owner approval: the owner approved drafting this on 16 Oct (thread "Repo technical scorecard", item 2, recommended option "Add a check"). There is no database change. Dropping any function needs the owner's own named yes.

Verification

• Checks run:
  • npx vitest run tests/supabase-function-callers.test.ts: Tests 2 passed (2)
  • npx eslint --max-warnings=0 and prettier --check on the file: clean
  • npm run check:organisation -- --files tests/supabase-function-callers.test.ts: data-platform (Data platform and access)

Risk and rollout

• Risk: very low. This adds a test only, with no runtime or database change.
• Rollback: revert this PR.
• Provider or production effects: None

Notes

• Review fixes:
  • Gitar: old migration bodies and lookups by name no longer count as callers (b431d15).
  • Codex: names that appear only in code comments no longer count as callers (a6eb09b).
• The diff against main is this one file.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QevAacecJBjQqMcn5LoexE

Summary by CodeRabbit

• Tests
  • Added automated coverage to verify that database functions are referenced by supported parts of the product or explicitly tracked as exceptions.
  • The check also detects outdated exceptions and ignores comments, generated type declarations, superseded definitions, and self-references, helping keep results focused on active function usage.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Repository: BigSimmo/PsychSift/.coderabbit.yaml
• Review profile: CHILL
• Plan: Team
• Run ID: fd1acbd5-3970-46a8-8b69-d046b7f5ae2d

📥 Commits

Reviewing files that changed from the base of the PR and between 30c89e3 and a6eb09b.

📒 Files selected for processing: 1

• tests/supabase-function-callers.test.ts

+---------------------------------+
| My bunny whiskers are tingling. |
+---------------------------------+
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codeant-ai]

🏁 CodeAnt Quality Gate Results

Commit: a6eb09bf
Scan Time: 2026-10-16 14:30:15 UTC

✅ Overall Status: PASSED

Quality Gate Details

Quality Gate	Status	Details
Secrets	✅ PASSED	0 secrets found
Duplicate Code	✅ PASSED	0.0% duplicated
SAST	✅ PASSED	No security issues
Bugs	✅ PASSED	Rating S: No bugs
IAC	✅ PASSED	No IAC issues

View Full Results

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[greptile-apps]

BigSimmo has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	96c4c96	Oct 16, 2026 · 14:10	14:15

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T14:15:14.705726Z	0e8cb2f	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[qodo-code-review]

PR Summary by Qodo

Flag database functions with no repository callers

🧪 Tests 🕐 20-40 Minutes

AI Description

• Add an offline test that flags manifest-listed database functions with no repository caller.
• Track six known caller-less functions without dropping them or changing the database.

Diagram

graph TD
  Manifest["Drift manifest"] --> Scan["Caller scan"] --> Uncalled["Uncalled names"] --> Checks["Vitest assertions"]
  Code["Repository code"] --> Scan
  Migrations["Migration SQL"] --> Scan
  Known["Known exceptions"] --> Checks

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Inspect database dependencies directly

• ➕ Could identify dependencies that a repository text scan misses.
• ➖ Requires database access or provisioning in CI.
• ➖ Would not by itself identify application-level callers.

Recommendation: Keep the offline manifest-and-repository check: it covers application callers without database access and introduces no production change. Treat its results as candidates for owner review, not proof that a function is safe to drop.

Files changed (1) +93 / -0

Tests (1) +93 / -0

supabase-function-callers.test.tsDetect uncalled database functions offline +93/-0

Detect uncalled database functions offline

• Adds a Vitest check that compares drift-manifest function names with references in code and migration SQL, excluding generated types, SQL comments, and function self-references. Two assertions flag newly uncalled functions and require the six known-uncalled entries to remain current.

tests/supabase-function-callers.test.ts

[claude]

Claude encountered an error after 2s —— View job

---

I'll analyze this and get back to you.

[qodo-code-review]

Qodo Fixer

No findings are available for this PR yet. Findings appear here once Qodo has reviewed the PR.

[gitar-bot]

Gitar has auto-approved this PR (configure)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0e8cb2f267

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[codeant-ai]

CodeAnt Nitpicks

2 code suggestions

1. Overloads are collapsed by name, so a caller for one signature makes every live overload appear used even when another has no caller.

Api mismatch · tests/supabase-function-callers.test.ts:44-45

---

2. This scans historical migrations as current SQL; references from an old function body remain after a later replacement or drop, hiding now-uncalled live functions.

Stale reference · tests/supabase-function-callers.test.ts:58-62

[codeant-ai]

CodeAnt PR Risk: Medium Risk

• The PR needs attention before merging because its new caller test can treat a name mention as proof of a real call.
• Both source scanning and SQL matching can count names in comments or string literals, allowing an uncalled database function to pass.

Assessed commit: a293ce61025b

[gitar-bot]

Gitar has auto-approved this PR (configure)

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Adds regex-based caller detection that could misclassify references, producing misleading CI failures or overlooking unused database functions.

Adds an offline test, tests/supabase-function-callers.test.ts, that flags database functions with no remaining caller across src, worker, scripts, supabase/functions, current supabase/schema.sql, and scheduled cron.schedule commands. Name lookups and old migration bodies are no longer counted as callers, so the earlier false negatives are addressed. No issues found.

✅ 1 closed

✅ Bug: Name lookups and old migration bodies are counted as callers

📄 tests/supabase-function-callers.test.ts:56-63 📄 tests/supabase-function-callers.test.ts:65-72 📄 tests/supabase-function-callers.test.ts:79-82
The SQL side of the check counts any bare mention of a function name anywhere in the migration history as a call. Only -- comments and the define/drop/alter/grant prefixes are stripped. So string literals, catalog lookups and bodies of superseded function versions all count. I ran the same logic against the repo and found functions that pass only because of these:

• stamp_document_deep_memory_version is named only inside to_regprocedure('public.stamp_document_deep_memory_version(uuid, text)') (20260622000000…:314).
• create_uploaded_document_with_ingestion_job appears only in a proname='…' preimage check and a JSON string (20261013075944…:44, 20261014164220…:85).
• document_summary_text is called only by older bodies of retrieval functions that later migrations replaced.

When I scan the current supabase/schema.sql instead of the full history, 19 functions have no caller, against the 6 listed. So this test can pass while dead functions remain, which defeats its purpose. KNOWN_UNCALLED and the PR description understate the real set. One fix is to look for callers in the current schema (supabase/schema.sql) plus cron/trigger setup, not in every historical migration. Another is to strip catalog lookups (to_regprocedure(...), proname=, identity/name JSON strings) before matching.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

Auto-approval Approved

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

---

Important

Your trial ends in 5 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

No findings for this group

No findings for this group

No findings for this group

Resolved findings

1. Unused database overloads stay hidden ✗ Dismissed

Description

expectedFunctionNames() strips every manifest signature down to a bare function name and
deduplicates it before the caller scan. When one overload is called, the shared name makes every
other overload appear called, including overloads that have no matching caller in the repository.

Code

tests/supabase-function-callers.test.ts[R57-58]

+  const names = manifest.snapshot.functions.map((fn) => fn.signature.split("(")[0]!.replace(/^public\./, ""));
+  return [...new Set(names)].sort();

Relevance

●●● Strong

Recent accepted precedent requires exact function signatures because name-only checks let overloads
evade validation.

PR-#3556

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The manifest contains three distinct commit_document_index_generation signatures, but the new test
converts them to one name and checks only whether that name appears. The worker calls one overload
through the RPC mutation helper, while the other overload definitions in the schema have no
corresponding repository call, so the test cannot flag those unused overloads.

tests/supabase-function-callers.test.ts[53-59]
tests/supabase-function-callers.test.ts[130-138]
supabase/drift-manifest.json[18838-18856]
worker/main.ts[469-477]
supabase/schema.sql[1978-2025]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The caller audit collapses overloaded database functions to bare names, so a caller for one overload incorrectly covers every overload with that name and leaves unused live functions undetected.

## Fix Focus Areas
- tests/supabase-function-callers.test.ts[53-59]
- tests/supabase-function-callers.test.ts[130-138]
- worker/main.ts[469-477]
- supabase/schema.sql[1978-2025]

## Recommended Fix
Preserve each manifest function signature as a distinct audit item and make caller detection signature-aware rather than using only the bare function name. Ensure the worker's eight-argument call is associated only with its matching overload, while the nine- and eleven-argument `commit_document_index_generation` overloads remain uncalled unless a matching repository call exists; update the known-uncalled entries and regression coverage accordingly.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 9 rules

✅ Skills: 6 invoked

  gates

  supabase

  testing-review

  drift

  code-quality-review

  review

✅ Cross-repo context — repo relationships

✅ REVIEW.md

Review mode: Auto: 🚀 Fast: Localized offline test logic with no runtime or database behavior changes.

Tip of the day

💡 Did you know, you can pick a display mode instead of tweaking every Display option by hand

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗