diff --git a/data/repo-awareness-snapshot.json b/data/repo-awareness-snapshot.json index 8f05ef5f7a..a157348620 100644 --- a/data/repo-awareness-snapshot.json +++ b/data/repo-awareness-snapshot.json @@ -4973,6 +4973,11 @@ "section": "root", "catalogued": true }, + { + "path": "docs/audit/2026-10-18-merged-pr-resolution.md", + "section": "audit", + "catalogued": true + }, { "path": "docs/archive/codex-cloud-legacy-profile-2026-10-16.md", "section": "archive", @@ -13263,6 +13268,14 @@ "outcome": "Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip.", "checks": "Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks." }, + { + "date": "2026-10-18", + "ref": "fix/merged-pr-review-20261018", + "head": "5acc2553e1df16c57bf7b47dd2ccc0a29575284c", + "scope": "Bounded correction review of full-suite fixture and metadata-budget findings", + "outcome": "Two independent reviewers accepted the corrections; no remaining actionable source finding. Three draft database assertions remain blocked; no clinical or production acceptance.", + "checks": "Fresh lint/typecheck and production build passed; Teaching/current-manifest scope 2169 passed in77files; corrected budget scope10passed. Prior full run32330passed24failed2skipped;21nonDBfailures addressed by focused evidence, no green full rerun claimed." + }, { "date": "2026-08-19", "ref": "gemini/safe-workflow-guards-and-motion-contracts", @@ -21311,6 +21324,14 @@ "outcome": "No remaining high-confidence P0–P2. PR description sync + `verify:ui` evidence keep PR policy green; hosted Production UI / PR required green on exact head.", "checks": "Local: align Vitest 5/5; ui-overlap 12/12; differentials fold Playwright 1/1. Hosted: Production UI, Advisory UI, Static, Unit, Build, PR policy, PR required, Sync PR policy body all pass." }, + { + "date": "2026-10-18", + "ref": "fix/merged-pr-review-20261018", + "head": "b6419f98f826170993a4f2f7dc0b2efec8747179", + "scope": "Independent adversarial review of merged-PR remediation; bounded correction verification", + "outcome": "Confirmed Teaching stale GET and metadata pagination defects corrected; obsolete scope suites and CET claims repaired. No remaining actionable source finding; draft only, migration/browser/live acceptance blocked.", + "checks": "Read-only source review by two independent reviewers; focused correction suite 61 passed in eight files; newer main worker and schema integration checked. Full handoff gate in progress; no production acceptance." + }, { "date": "2026-08-18", "ref": "claude/development-index-page (PR #2135)", @@ -27287,6 +27308,14 @@ "outcome": "PR #3570 squash-merged as fa526775c6; stable patch-id 87375f76eaf matches branch tip d8eefbb91e with zero orphaned commits", "checks": "gh pr view 3570 MERGED; 1-parent squash; git patch-id --stable match" }, + { + "date": "2026-10-18", + "ref": "claude/reconcile-ledger-20261016", + "head": "fa526775c6ca0751f9609e4fc5133190efa19c16", + "scope": "PS-044 provenance correction for PR #3570", + "outcome": "Corrects the branch label in a7be2760026da4bc040fa90bf847382bdcded2a8a7510ceaf7be4ac49c042211.record.md: the supplied review identifies claude/reconcile-ledger-20261016, final head d8eefbb91e9e623fcdb9029fade9f3eda661091e and merge fa526775c6ca0751f9609e4fc5133190efa19c16. Original immutable record retained. This correction does not re-run or extend its landed proof.", + "checks": "Compared supplied PS-044 correction with the local immutable receipt; no new GitHub request, patch-id execution, CI or deployment verification." + }, { "date": "2026-08-05", "ref": "cursor/soft-mark-ungrounded-copy-ec26", diff --git a/docs/audit/2026-10-18-merged-pr-resolution.md b/docs/audit/2026-10-18-merged-pr-resolution.md new file mode 100644 index 0000000000..aff01d8a89 --- /dev/null +++ b/docs/audit/2026-10-18-merged-pr-resolution.md @@ -0,0 +1,105 @@ +# Merged-PR review: investigation and local remediation + +Task source: `PsychSift-Merged-PR-Review-2026-10-18-051421UTC.md`, supplied by the owner. Baseline: branch `work`, commit `5704fe8b7b30e993709e4b9ea161624cf9c5dae6` (PR #3630), initially clean. The initial checkout preceded the report's final two merges (#3631 and #3632); PR preparation subsequently rebased the complete patch onto `b12f3d4b3` (#3633), retaining the newer accessibility and scoped worker-claim fixes. The findings below were checked against this checkout; the report's historical and already-fixed records are not newly reproduced defects. + +This is a local source repair and evidence receipt. The source fixes are committed on `fix/merged-pr-review-20261018` for draft PR publication. Nothing was merged, deployed, reconciled into the canonical ledger, or applied to a hosted database. No clinical, legal, cultural, security-image, physical-device or live-provider acceptance is supplied. Canonical Notion lifecycle reconciliation is unsynced; this receipt does not replace it. + +## Disposition of all 30 open findings + +| Finding | Verification and action | Remaining boundary | +| ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| PS-001 | Confirmed: the answer-quality recovery read selection-wide relevance and structure signals. Recovery now reads signals only from sources matching both the cited chunk and document IDs, and preserves low confidence. Missing cited sources cannot leave phantom citations on this failure path. Added uncited-source and valid-cited-source controls. | Local synthetic proof; no live answer evaluation. | +| PS-003 | The assessment-scroll test and its unchanged 2px tolerance exist. The report explicitly retains mixed historical evidence, including a later passing matrix. No current deterministic failure or causal CSS repair is established here. | Browser executables are absent; the installation CDN returned HTTP 403 `Domain forbidden`. Keep acceptance open; do not apply the historical 8px-reserve hypothesis without reproduction. | +| PS-005 | Confirmed profile ordering. The full inherited-provider scrub now precedes nvm loading and runtime selection. Added an nvm sentinel which rejects inherited synthetic provider names. | Local shell fixture; no installed-host activation proof. | +| PS-007 | Confirmed active hook/API mismatch. The actually imported dashboard hook now sends sequential batches of at most ten, totals successful/failed results, and refreshes successfully queued work even if a later batch fails. Tests cover 10/11/23 selections and partial failure. | Local hook tests; no real reindex request. | +| PS-008 | Confirmed limitation: one successful device marks the whole opening delivered, and the claim is process-local. No delivery-guarantee change was made: changing only the aggregate success predicate would resend already-delivered alerts without providing durable per-device retry state. | Still open. A complete repair needs durable device-level delivery records, atomic expiring claims, a retry consumer and explicit at-least-once semantics for the send/ack crash window. Existing real-staff release controls remain. | +| PS-009 | Confirmed edited lithium metadata retained the September attestation. Withdrew the stale attestation, changed validation to `unverified`, retained candidate disposition and recorded why re-review is needed. | No replacement signature or clinical approval was invented. | +| PS-010 | Confirmed early replay bypassed cleanup after a committed recovery sibling. Durable replay now retries release of the intended path against the path in the committed admission, reusing the existing scoped/equal-path fences and cleanup-ledger fallback. | Recovery is replay-driven; no claim of autonomous cleanup if the caller never retries. | +| PS-012 | Confirmed fixture mechanisms. Replaced the Windows-invalid null-config device with a repository empty-config fixture; native-Windows synthetic-checkout fixtures explicitly bind their Git shim. | Native Windows execution is unavailable; Linux fixtures cannot close Windows acceptance. | +| PS-025 | Confirmed successful metadata RPC payloads omit the stamps required to validate summaries. Related metadata now always reads source rows and checks their committed generation. Indexed-parent, owner and explicit-public-corpus admission are retained. Staged/hidden rows and unadmitted parents cannot supply metadata; legacy unstamped rows remain compatible. | No live database/RPC execution. | +| PS-026 | Confirmed the trigger can overwrite the caller's timestamp. Enqueue reads `updated_at` back from the queue UPDATE and uses that stored value for compensation. Statement-level tests model a replacing trigger, both collision branches and an intervening newer write. | No production race reproduced. Read-back fixes the reported caller/trigger mismatch, not every queue-insertion atomicity concern. | +| PS-027 | Confirmed SQL equality excluded legacy NULL generations before the 40-row cap. The query now admits NULL or the committed generation before ordering/limiting; wrong stamped generations remain rejected. | Local query/summary fixtures; no corpus reindex. | +| PS-029 | Confirmed the extractor intentionally admits ambiguous lowercase/bullet/numeric continuations and some multi-column bands. The report itself documents the opposing risk of dropping real continuations (PS-028). | Still open as a bounded extraction limitation. No general geometry change without representative native PDFs and table/text-retention acceptance; a note-phrase blacklist would not repair row association generally. | +| PS-034 | Confirmed 120s shared transport cap and 30s data-write callbacks. The default transport budget now covers configured control/data budgets (240s by default); explicit operator overrides remain explicit caps. Image/managed-terminal RPC callbacks select the control or data budget by RPC identity. | No live worker/provider execution. | +| PS-035 | Confirmed runbook table/column mismatch, plus invalid document-status update examples. Feedback queries now use `rag_answer_feedback`; quarantine uses the existing transactional `record_source_review` RPC and metadata governance fields. Railway service names match repository deployment instructions. | SQL examples were checked against repository contracts, not executed against production. | +| PS-036 | Confirmed unbounded fallback and discarded exit status. Missing GNU timeout now fails with an actionable prerequisite error; tool acceptance requires a successful bounded probe before version parsing. Added failed-tool, missing-timeout and printed-version/timeout controls. | Shell fixtures cover version probes, not full host installation. | +| PS-037 | Confirmed Today-rule ledger/runtime mismatch. Ledger classification now calls the runtime fatigue/CPD `ruleGate` and `mhaTimerGate`. Added stale-hash, unapproved-signer and future-time controls. | Classification changes grant no sign-off authority. | +| PS-043 | Confirmed wording-only mismatch. The collision diagnostic derives its reviewed-twin list from `CROSS_SURFACE_NAME_TWINS`. | No validator policy changed. | +| PS-044 | Confirmed the supplied #3570 branch label disagrees with the immutable local receipt. Appended a correction identifying the supplied proper branch and the unchanged head/merge SHAs, preserving the original receipt and its historical proof boundary. | Partial: no fresh GitHub metadata or complete replay of all historical landed proofs. The wider provenance task remains open. | +| PS-047 | Confirmed separate CME/mirror writes. Drafted `mutate_owner_training_milestone`, a service-role-only transaction for create/update/delete, with owner locking, row-limit checks and registrar-only record preservation. Production clients use the RPC and never fall back to two writes after an RPC error. Table-only legacy test doubles retain their separate-write fixture path. | **Database draft, not applied. Merge only after explicit owner approval of this database change/window.** Local PostgreSQL/PGlite rollback/tenancy tests passed. Full pinned Supabase replay and drift-manifest regeneration are blocked by Docker-daemon storage exhaustion; the existing manifest has deliberately not been resealed or hand-forged. | +| PS-048 | Confirmed unfiltered EPA attainments. Only attainments inside the current rotation and no later than today count; undated records remain in progress. With no current rotation, historical attainments receive no current-rotation credit. Added date-boundary controls. | No training policy/minimum changed. | +| PS-049 | Confirmed automatic withdrawal lacked a stale-state fence. It now requires the original open DB status and `updated_at`. A statement-level interleaving test books the published slot before withdrawal and verifies that booking survives. | Local concurrency simulation; no hosted incident reproduced. | +| PS-050 | Confirmed NICE classification used incidental publisher text/links. Explicit citation authority now governs classification; PubMed/RANZCP citations mentioning NICE remain generic references. Added mixed-authority controls. | Source designation is not evidence appraisal or clinical approval. | +| PS-051 | Confirmed the 2025 review has no authors/title/stable identifier. Removed that unverifiable citation, its attributed efficacy conclusions and its trial-count claims from CET, and recorded the exclusion pending bibliographic verification. Regenerated the catalogue and content-addressed browser asset. | CET remains `needs_review`; no substitute reference or clinical appraisal was invented. | +| PS-055 | Confirmed native-disabled actions prevented focus on their described reasons. EPA submit, inbox send and reminder controls now retain keyboard focus with `aria-disabled`; their handlers block activation. Tests verify focus, accessible reasons and blocked actions. | DOM proof; no assistive-technology/physical-device acceptance. The explicit local handler guards also remain compatible with #3632's shared Button guard, now included through the fresh-base rebase. | +| PS-056 | Confirmed identical Teaching URLs used raw fetches. Teaching reads now use the existing account-epoch-aware shared GET transport, retaining independent cancellation and no persistent cache. Added coalescing/cancellation proof and retained account-switch tests. | No production request-count measurement. | +| PS-057 | Confirmed ambient Git selectors reached mutating smoke commands. All fixture/bootstrap children now drop Git selectors and use an isolated real config file plus `GIT_CONFIG_NOSYSTEM`. A regression supplies repository/index/config redirection and verifies the caller index survives. | Local smoke fixture; no native Windows/host forwarding acceptance. | +| PS-062 | Confirmed canonical clinical-completion prose contradicts the reset source, and the archived non-outcome update will not reopen it. Queued cancellation of that ineffective pending update, a current-fingerprint reopen of NZ4X41, and a Z3GZ5P correction retaining DID as pending and the count at 515. | Queued only. Canonical reconciliation requires its serialized fresh-base workflow; the canonical ledger was not directly edited. | +| PS-063 | Confirmed prefix-collision identity gap. Reopen rejects an explicit display ID owned by another ULID before lookup can rewrite it. Full-ULID CLI targets resolve the actual extended row ID. Added a two-row collision regression. | Local synthetic ledger; no canonical reconciliation executed. | +| PS-064 | Confirmed present-tense completion claim. The WFYDV6 decision now describes the reopen/fold-back as queued and pending reconciliation. | The forms' owner/legal/clinical hold remains. | +| PS-067 | Confirmed overbroad retired-rule matcher. It now targets the obsolete missing-reference rationale and permits a current pending-owner-signature hold. Added positive/negative wording controls. | Clinical hold unchanged. | + +## Validation and handoff + +Fresh results (2026-10-18); the runs overlap and must not be summed as independent tests: + +| Check | Result | +| ------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Focused behavioral suite, 32 files | **855 passed**. | +| Final affected RAG/shell files, after adding the cited-required-signal control | **261 passed**, overlapping the preceding suite. | +| Trusted-admission and cleanup helpers | **36 passed**. | +| TypeScript compilation | **Passed**, fresh run covering the changed type contracts. | +| Repository ESLint, zero warnings allowed | **Passed**, fresh run; the initial unused RPC type warning was fixed. | +| PostgreSQL/PGlite transaction fixture | **13 scenarios passed**. | +| Migration role, function grants and owner-scope checks | **Passed**; no hosted calls. | +| Clinical hazard controls | **Passed with the existing 12 drift exceptions retained**, not renewed clinical approval. | +| Offline production-readiness CI check | **Passed** for repository structure; missing live evidence/configuration remains explicitly unverified. | +| Organisation, instruction rules/budgets, branch-review ledger, outstanding-issue structure/snapshot, documentation links | **Passed**. The known ineffective old cancellation is reported; the new reopen request supplies its correction path. | +| Changed-file formatting and whitespace | **Passed**. | +| Diff integrity | **Passed**, 602 → 627 cases in 21 changed test files, including new files, against the actual starting commit `5704fe8b7`; the default command could not resolve absent local `main`/`origin/main` refs, so its documented explicit-base option was used. | +| Browser execution | **Blocked**: no installed executables; browser CDN denied downloads. | +| Full pinned Supabase schema replay / drift-manifest generation | **Blocked**: image extraction exhausted Docker-daemon storage; the required image is not cached. The existing drift manifest is stale against the draft schema and was left unchanged. | +| Migration immutability/sealing gate | **Blocked on the new, unsealed draft migration only**. Existing migration hashes are unchanged. No sealing/production authorization is inferred from this task. | + +Earlier failed runs were diagnostic, not passing evidence. At the initial local handoff, hosted CI, provider canaries and production/device acceptance had not been run; later PR-stage evidence is recorded below. Commit/PR ledger-write discipline was not presented as passing: that gate requires committed refs, whereas all task changes are intentionally uncommitted. + +The final citation-metadata follow-up also passed **25 tests in two files**, overlapping the 32-file suite and covering explicit mixed NICE/PubMed/APA authority markers. The final lint run passed after that edit. + +The PostgreSQL/PGlite fixture used a fresh in-memory database, the table definitions extracted from the repository migrations and the actual new migration. It exercised failed mirror inserts/updates/deletes rolling back CME state, foreign-owner mutation rejection, successful create/update/delete, registrar-only code/stage preservation the row-limit guard, cross-owner mirror-ID collision rollback and authenticated-role denial. Harness: `/tmp/psychsift-pg-validation/validate.mjs`; output: `/tmp/psychsift-pg-validation.log`. This is real PostgreSQL execution through PGlite, not the pinned Supabase image, full migration-chain replay or a two-session race. + +The pinned Supabase image pull failed while registering a layer (`no space left on device`). Docker reported no retained images, containers or volumes afterward. No unrelated Docker cleanup was performed. The browser CDN explicitly denied downloads, so neither scroll acceptance nor browser accessibility is claimed. + +The database draft must not merge while its schema mirror/drift manifest replay remains incomplete. No historical migration hash, drift allowlist, clinical signature, or immutable review receipt was rewritten. + +The task-started local development server was stopped after browser installation was denied. No task-owned server or container remains running. The source changes are committed on the publication branch; the private checkpoint and receipt handoff remain local and do not update Notion. + +## Adversarial review follow-up + +Two independent reviewers inspected the complete source patch, split between data/transaction boundaries and behavior/UI/tooling. They found two introduced defects: Teaching refreshes could join a GET started before a successful write, and direct metadata reads could silently truncate at the API row cap. They also identified two affected suites still asserting the retired RPC contract, and clinical prose still quoting the excluded 2025 review. + +Corrections invalidate shared reads after all three successful Teaching mutation forms; deterministically page labels, summaries and admitted parent documents with cancellation and a fail-closed bound; replace obsolete RPC mocks with scope-aware statement fixtures; and withdraw the remaining explicitly attributed 2025 claims. EPA filtering and display now use the work-zone date for timestamps crossing UTC midnight. New regression cases cover the stale-read sequence, hidden/staged labels occupying two pages, owner/public/indexed admission and the date boundary. + +The focused correction run passed 61 tests in eight files before the final CET and EPA assertions were added. Both reviewers completed bounded correction reviews with no remaining actionable finding. Source review does not replace the database, browser, clinical or live-provider acceptance requirements below. + +The broad handoff run on `193f7be7b` reported **32,330 passed, 24 failed and 2 skipped across 1,986 files**. Twenty-one failures were stale fixture/contract assumptions exposed by the source changes: missing client methods/admitted parent rows, pending shared reads surviving test cleanup, changed sign-off counts, asset ownership, historical-versus-current manifest input, intentional RPC retirement and exact query budgets. Corrections retained successful-response, owner-scope, rollback, authorization/digest and non-N+1 assertions. The first targeted rerun passed 496 cases with four budget expectations remaining; the measured budget update then passed all 10 tests in those three files. Both reviewers accepted these bounded corrections. This does not turn the original broad run into a green result. + +The three database readiness failures are retained: two migration-sealing assertions and one stale drift-manifest assertion. The new migration remains a draft; applied history and the drift manifest were not forged. The existing `get_related_document_metadata_v2` RPC is now intentionally unused because it cannot supply summary generation stamps; it is documented in the known-uncalled inventory pending owner-approved database retirement, without manufacturing a caller or dropping deployed SQL. + +Metadata admission has an explicit measured cost: the answer fixture moves 12 → 16 database queries, search-core 10 → 12, and the search route 15 → 19. Each former metadata RPC becomes batched label, stamped-summary and admitted-parent reads. Exact table shapes and equal one/five-document counts remain pinned; live latency and provider acceptance remain unverified. + +Catalogue CLI planning tests now build a temporary manifest from current source exports. CI's expected-catalogue manifest is refreshed separately when asset lineage changes; every frozen epoch-zero migration remains untouched. These tests do not publish the revised clinical corpus. + +Draft publication requires the repository's documented `SKIP_DRIFT_GUARD=1` push override because pinned replay is unavailable. This is a disclosed publication exception only: the stale-drift and unsealed-migration checks remain failing, with no auto-merge or merge authority. + +Final local handoff evidence on the completed source revision `5acc2553e1df16c57bf7b47dd2ccc0a29575284c`: + +- Fresh repository lint with zero warnings and complete source/test typecheck passed after the fixture corrections. +- Complete Teaching ownership scope plus current-manifest CLI suite: **2,169 tests passed in 77 files**. +- Production build passed: optimized webpack compilation, generated-route TypeScript checks, **2,047 generated pages**, and the client-bundle secret-surface check. Its temporary pending-issue snapshot was restored by postbuild. +- Ledger-write discipline and repository-awareness snapshot checks passed. Diff integrity passed: **828 → 856 cases in 33 changed test files**, with its 27/27 self-tests. +- The broad unit run remains a recorded failed run. The 21 non-database failures were addressed with the targeted passing evidence above; the two migration-sealing assertions and stale drift assertion remain blocked. A second full run was not claimed or performed. +- All original unresolved scroll, alert-delivery, PDF, native-device, historical-provenance, canonical-ledger and clinical/provider acceptance boundaries remain explicit. + +After draft PR publication, main advanced to `57b2cd052` (#3636), creating one real append conflict in the schema mirror. The branch merged that main commit and resolved the mirror as the complete latest-main schema followed by exactly the atomic milestone draft. The applied-hash and drift manifests are byte-identical to latest main; their newly inherited values belong to its already-merged worker repair, not a reseal of this draft. Application, worker and script source remain byte-identical to the build-verified PR revision, so their passing build/type evidence is reused rather than rerun. The draft's sealing and replay gates remain blocked. + +Hosted CI caught a remaining expected-catalogue fixture mismatch after publication. The checked-in `static-manifest-baseline.json` is CI's mutable current-catalogue contract, not the immutable epoch-zero database seed. Regenerated it through the manifest builder: 1,081 records, no added/removed IDs, and 205 therapy lineage changes caused by the new content-addressed asset. Validation status, source status, eligibility and exclusion reasons are unchanged for every record; CET remains excluded. The synthetic release-evidence fixture, applied migrations, clinical attestations and production corpus were not changed. The exact hosted static/synthetic-freshness commands passed, and all 216 site-content/ownership cases passed in 17 files, including the epoch-zero freeze checks. An independent bounded review confirmed that only the 205 lineage digests changed and no eligibility or content hash changed. diff --git a/docs/branch-review-records/837eb3931dd62dd05a2ac276fb997a16d9d73ce4ed7bada001cb3bef680a2632.record.md b/docs/branch-review-records/837eb3931dd62dd05a2ac276fb997a16d9d73ce4ed7bada001cb3bef680a2632.record.md new file mode 100644 index 0000000000..f3d4137cb5 --- /dev/null +++ b/docs/branch-review-records/837eb3931dd62dd05a2ac276fb997a16d9d73ce4ed7bada001cb3bef680a2632.record.md @@ -0,0 +1 @@ +| 2026-10-18 | fix/merged-pr-review-20261018 | 5acc2553e1df16c57bf7b47dd2ccc0a29575284c | Bounded correction review of full-suite fixture and metadata-budget findings | Two independent reviewers accepted the corrections; no remaining actionable source finding. Three draft database assertions remain blocked; no clinical or production acceptance. | Fresh lint/typecheck and production build passed; Teaching/current-manifest scope 2169 passed in77files; corrected budget scope10passed. Prior full run32330passed24failed2skipped;21nonDBfailures addressed by focused evidence, no green full rerun claimed. | diff --git a/docs/branch-review-records/8ab59556f1b1143dbcea904e06017be7f65d6937573e0412b1d874a1744360c2.record.md b/docs/branch-review-records/8ab59556f1b1143dbcea904e06017be7f65d6937573e0412b1d874a1744360c2.record.md new file mode 100644 index 0000000000..207affe61f --- /dev/null +++ b/docs/branch-review-records/8ab59556f1b1143dbcea904e06017be7f65d6937573e0412b1d874a1744360c2.record.md @@ -0,0 +1 @@ +| 2026-10-18 | fix/merged-pr-review-20261018 | b6419f98f826170993a4f2f7dc0b2efec8747179 | Independent adversarial review of merged-PR remediation; bounded correction verification | Confirmed Teaching stale GET and metadata pagination defects corrected; obsolete scope suites and CET claims repaired. No remaining actionable source finding; draft only, migration/browser/live acceptance blocked. | Read-only source review by two independent reviewers; focused correction suite 61 passed in eight files; newer main worker and schema integration checked. Full handoff gate in progress; no production acceptance. | diff --git a/docs/branch-review-records/e2c104cc7dff402a6ff932a489e08f2d3f2bb4f33a3a4af98f30357f5e95995e.record.md b/docs/branch-review-records/e2c104cc7dff402a6ff932a489e08f2d3f2bb4f33a3a4af98f30357f5e95995e.record.md new file mode 100644 index 0000000000..42d5059851 --- /dev/null +++ b/docs/branch-review-records/e2c104cc7dff402a6ff932a489e08f2d3f2bb4f33a3a4af98f30357f5e95995e.record.md @@ -0,0 +1 @@ +| 2026-10-18 | claude/reconcile-ledger-20261016 | fa526775c6ca0751f9609e4fc5133190efa19c16 | PS-044 provenance correction for PR #3570 | Corrects the branch label in a7be2760026da4bc040fa90bf847382bdcded2a8a7510ceaf7be4ac49c042211.record.md: the supplied review identifies claude/reconcile-ledger-20261016, final head d8eefbb91e9e623fcdb9029fade9f3eda661091e and merge fa526775c6ca0751f9609e4fc5133190efa19c16. Original immutable record retained. This correction does not re-run or extend its landed proof. | Compared supplied PS-044 correction with the local immutable receipt; no new GitHub request, patch-id execution, CI or deployment verification. | diff --git a/docs/branch-review-records/ef28f82b25701938b2b595accd50c2ded8f678a535b6aa9e9ea92d1630a1189a.record.md b/docs/branch-review-records/ef28f82b25701938b2b595accd50c2ded8f678a535b6aa9e9ea92d1630a1189a.record.md new file mode 100644 index 0000000000..af6a015525 --- /dev/null +++ b/docs/branch-review-records/ef28f82b25701938b2b595accd50c2ded8f678a535b6aa9e9ea92d1630a1189a.record.md @@ -0,0 +1 @@ +| 2026-10-18 | fix/merged-pr-review-20261018 | e3b3f15774dbef5ecaeedcb38d8d6880128faccb | Bounded independent review of hosted catalogue-manifest correction | Accepted: 1081 IDs preserved; 205 therapy lineage digests alone changed. Eligibility, governance and content hashes unchanged; frozen database seeds untouched. | 216 site-content and ownership cases passed in 17 files, including epoch-zero freeze checks; exact hosted static and synthetic freshness commands passed. Synthetic evidence is not live acceptance. | diff --git a/docs/decisions/2026-10-17-wfydv6-stays-open-until-sign-off.md b/docs/decisions/2026-10-17-wfydv6-stays-open-until-sign-off.md index 1fd994b802..cd7bfcca9f 100644 --- a/docs/decisions/2026-10-17-wfydv6-stays-open-until-sign-off.md +++ b/docs/decisions/2026-10-17-wfydv6-stays-open-until-sign-off.md @@ -7,9 +7,10 @@ PR #3609 archived ledger issue #WFYDV6 (the unwired `src/components/forms/wa-mha unverified statutory text) without the legal and clinical sign-off the issue required. The owner decided on 17 Oct 2026 at 21:37 AWST that the issue stays open and the form stays unwired until that sign-off is recorded. The Form 6A/6B wording still needs owner, legal and clinical sign-off; nothing in this decision signs it off. At first the ledger tooling had no reopen action, so the issue was tracked again as a new open P1 row -(#Z12CBC). Once the reopen action landed (#3627), a ledger inbox `reopen` request moved #WFYDV6 itself back to the -open table as a P1 with its original ID and ULID. #Z12CBC, and the duplicate sign-off tracker #BDFFYF, were closed as -folded into it, so the issue keeps one identity. A reconciliation must not archive #WFYDV6 again without the recorded owner, legal and clinical sign-off, or the deletion of the file after the +(#Z12CBC). Once the reopen action landed (#3627), inbox requests were queued to reopen #WFYDV6 as a P1 +with its original ID and ULID and fold #Z12CBC and #BDFFYF back into it. These requests have not +yet been reconciled: the canonical ledger still archives #WFYDV6 and keeps the duplicate trackers open. +The queued fold-back is a pending transaction, not completed work. A reconciliation must not archive #WFYDV6 again without the recorded owner, legal and clinical sign-off, or the deletion of the file after the 30-day dead-code window (13 Nov 2026). If this summary and the source ever differ, the source wins. diff --git a/docs/governance-incident-runbooks.md b/docs/governance-incident-runbooks.md index 9a35b2dad7..d8a23ab7c4 100644 --- a/docs/governance-incident-runbooks.md +++ b/docs/governance-incident-runbooks.md @@ -1,6 +1,6 @@ # Clinical governance incident runbooks -Last reviewed: 2026-10-16 +Last reviewed: 2026-10-18 (repository contracts; not live execution) These are short operator checklists. Preserve evidence and identifiers, but do not copy patient-identifying question or answer prose into tickets or chat. @@ -14,23 +14,28 @@ These are short operator checklists. Preserve evidence and identifiers, but do n 1. Record the answer interaction ID, feedback category, cited source IDs, time, and affected workflow: ```sql - SELECT id, created_at, feedback_category, cited_document_ids, config_posture_version - FROM public.rag_query_feedback - WHERE id = ''; + SELECT id, interaction_id, created_at, feedback_category, cited_source_ids, source_ids + FROM public.rag_answer_feedback + WHERE interaction_id = ''::uuid; ``` 2. If harm is plausible, disable the affected answer mode or narrow its source scope; keep direct source browsing available: ```bash # Switch answer generation to deterministic offline/source-only mode immediately - railway variables --service clinical-kb-app --set "RAG_PROVIDER_MODE=offline" + railway variables --service PsychSift --set "RAG_PROVIDER_MODE=offline" # Pause background worker ingestion/enrichment claims if source mutation is in flight - railway variables --service clinical-kb-worker --set "WORKER_PAUSED=true" + railway variables --service worker --set "WORKER_PAUSED=true" ``` 3. Quarantine an implicated source through a `decommissioned` or `superseded` source-review event when appropriate: ```sql - UPDATE public.documents - SET source_review_status = 'decommissioned', - updated_at = timezone('utc', now()) - WHERE id = ''; + -- The reviewer must own the document. This existing RPC locks the row, + -- appends source_review_events, and updates its governance metadata atomically. + SELECT public.record_source_review( + p_document_id => ''::uuid, + p_reviewer_id => ''::uuid, + p_decision => 'decommissioned', + p_reason => '', + p_evidence_references => ARRAY[''] + ); ``` 4. Reproduce with a synthetic or minimised fixture, add a regression test, and identify whether retrieval, generation, rendering, or copy caused the defect: ```bash @@ -45,31 +50,21 @@ These are short operator checklists. Preserve evidence and identifiers, but do n ```sql BEGIN; - INSERT INTO public.document_governance_events ( - document_id, - event_type, - review_status, - reason, - replacement_document_id - ) VALUES ( - '', - 'quarantine', - 'decommissioned', - '', - NULLIF('', '') + -- The reviewer must own the document. This existing RPC locks the row, + -- appends source_review_events, and updates its governance metadata atomically. + SELECT public.record_source_review( + p_document_id => ''::uuid, + p_reviewer_id => ''::uuid, + p_decision => 'decommissioned', + p_reason => '', + p_evidence_references => ARRAY[''] ); - - UPDATE public.documents - SET source_review_status = 'decommissioned', - updated_at = timezone('utc', now()) - WHERE id = ''; - COMMIT; ``` 2. If immediate containment is required, disable the affected answer mode or narrow its source scope; do not treat review status alone as a retrieval exclusion: ```bash - railway variables --service clinical-kb-app --set "RAG_PROVIDER_MODE=offline" - railway variables --service clinical-kb-worker --set "WORKER_PAUSED=true" + railway variables --service PsychSift --set "RAG_PROVIDER_MODE=offline" + railway variables --service worker --set "WORKER_PAUSED=true" ``` 3. Confirm answer caches for the owner are invalidated after the transaction commits: ```sql @@ -77,18 +72,18 @@ These are short operator checklists. Preserve evidence and identifiers, but do n WHERE owner_id = '' OR payload::text LIKE '%%'; ``` -4. Before declaring containment, verify the source remains directly browsable (`source_review_status = 'decommissioned'`), that retrieval exclusion is active (`RAG_PROVIDER_MODE=offline` or zero active retrieval chunks for the quarantined `document_id`), and that `rag_response_cache` contains zero entries referencing the quarantined document: +4. Before declaring containment, verify the source remains directly browsable (`metadata->>'governance_disposition' = 'decommissioned'`), that retrieval exclusion is active (`RAG_PROVIDER_MODE=offline` or zero active retrieval chunks for the quarantined `document_id`), and that `rag_response_cache` contains zero entries referencing the quarantined document: ```sql SELECT d.id, d.title, - d.source_review_status, + d.metadata->>'governance_disposition' AS governance_disposition, d.metadata->>'rag_indexed' AS rag_indexed, (SELECT count(*) FROM public.document_chunks c WHERE c.document_id = d.id) AS chunk_count, (SELECT count(*) FROM public.rag_response_cache r WHERE r.payload::text LIKE '%' || d.id::text || '%') AS cached_answer_count FROM public.documents d WHERE d.id = ''; ``` - Confirm via `railway variables --service clinical-kb-app` (or a probe query against `/api/ask`) that the quarantined `document_id` is not returned in retrieval citations before lifting `RAG_PROVIDER_MODE=offline`. + Before lifting `RAG_PROVIDER_MODE=offline`, require retrieval evidence rather than the containment setting itself: `chunk_count` above must be `0`, or the restored retrieval path must be shown to exclude the quarantined `document_id` from the `sources` it returns (a non-offline staging probe; the answer's `citations` are not enough, because retrieved results reach answer generation whether or not they are cited). An `/api/ask` probe made while offline, or reading the Railway variable, only confirms the temporary containment. To read that one setting, print only it (`railway variables --service PsychSift --kv | grep '^RAG_PROVIDER_MODE='`), never the whole service environment, which contains credentials. 5. Re-run source-governance and focused answer tests. Live data repair or migration requires explicit approval (if the primary owner is unavailable, the backup operator must leave the source quarantined and `rag_response_cache` purged until explicit approval is obtained): ```bash npm run audit:source-governance @@ -106,12 +101,12 @@ These are short operator checklists. Preserve evidence and identifiers, but do n ``` 2. Disable provider generation or switch to the source-only path if external processing must stop: ```bash - railway variables --service clinical-kb-app --set "RAG_PROVIDER_MODE=offline" - railway variables --service clinical-kb-worker --set "WORKER_PAUSED=true" + railway variables --service PsychSift --set "RAG_PROVIDER_MODE=offline" + railway variables --service worker --set "WORKER_PAUSED=true" ``` 3. If raw query persistence, answer persistence, or provider response storage is enabled, disable the affected path. Verify all three controls are off before proceeding: ```bash - railway variables --service clinical-kb-app \ + railway variables --service PsychSift \ --set "RAG_PERSIST_RAW_QUERY_TEXT=false" \ --set "RAG_PERSIST_ANSWER_TEXT=false" \ --set "OPENAI_STORE_RESPONSES=false" @@ -130,8 +125,8 @@ These are short operator checklists. Preserve evidence and identifiers, but do n 1. Revert or disable the smallest affected generation or ranking feature while retaining source browsing and deterministic source-only answers: ```bash - railway variables --service clinical-kb-app --set "RAG_PROVIDER_MODE=offline" - railway variables --service clinical-kb-worker --set "WORKER_PAUSED=true" + railway variables --service PsychSift --set "RAG_PROVIDER_MODE=offline" + railway variables --service worker --set "WORKER_PAUSED=true" ``` Verify `/api/health` (`deploymentCommitSha`) and worker `/health` (`claimLoopPaused: true`, `deploymentCommitSha`) confirm the active release and paused worker loop: ```bash diff --git a/docs/organisation/retired-rules.json b/docs/organisation/retired-rules.json index d47b42de7a..e1e28866da 100644 --- a/docs/organisation/retired-rules.json +++ b/docs/organisation/retired-rules.json @@ -85,7 +85,7 @@ "id": "wake-therapy-needs-review-hold", "retired": "2026-10-17", "summary": "Wake therapy (sleep deprivation / chronotherapy) now carries governed clinical references in src/data/therapies-source.json, so the hold until it had references no longer applies. Its 17 Oct sign-off was reset by owner ruling (17 Oct 2026 22:12 AWST; docs/decisions/2026-10-17-agent-recorded-therapy-and-did-sign-offs-reset.md), so it is needs_review only until the owner signs it with therapy:review.", - "pattern": "wake-therapy-sleep-deprivation-chronotherapy[^.\\n]{0,80}(must remain|stays|held in) `?needs_review`?", + "pattern": "wake-therapy-sleep-deprivation-chronotherapy[^.\\n]{0,80}(must remain|stays|held in) `?needs_review`?[^.\\n]{0,120}(missing references|no references|lacks references|until (it has (governed |clinical )?references|references (are|have)))", "allowedContext": "no longer|retir(ed|ement)|removed|formerly|previously|superseded|dropped|replaced|historical|rather than", "decision": "docs/decisions/2026-10-17-remaining-therapy-compass-sign-offs.md" }, diff --git a/docs/organisation/systems/knowledge.json b/docs/organisation/systems/knowledge.json index 27116c2c38..2e766dc391 100644 --- a/docs/organisation/systems/knowledge.json +++ b/docs/organisation/systems/knowledge.json @@ -139,6 +139,7 @@ "tests/cursor-mcp-contract.test.ts", "tests/database-skills.test.ts", "tests/docs-*", + "tests/fixtures/empty.gitconfig", "tests/github-shell-access.test.ts", "tests/instruction-continuation-guards.test.ts", "tests/issues-report.test.ts", diff --git a/docs/organisation/systems/personal-practice.json b/docs/organisation/systems/personal-practice.json index f2238d8732..7e93311eb2 100644 --- a/docs/organisation/systems/personal-practice.json +++ b/docs/organisation/systems/personal-practice.json @@ -106,6 +106,7 @@ "tests/ui-cme-phone.spec.ts", "tests/ui-on-*", "tests/ui-teaching.spec.ts", + "tests/work-bookings-concurrent-*", "tests/work-calendar-booking-feed.test.ts", "tests/work-calendar-entries.test.ts", "tests/work-page-favourite-visibility.dom.test.tsx", diff --git a/docs/outstanding-issues-inbox/14e2a5cd-4d1e-4c1b-8b85-f5e573fb6be7.json b/docs/outstanding-issues-inbox/14e2a5cd-4d1e-4c1b-8b85-f5e573fb6be7.json new file mode 100644 index 0000000000..0d7a14c096 --- /dev/null +++ b/docs/outstanding-issues-inbox/14e2a5cd-4d1e-4c1b-8b85-f5e573fb6be7.json @@ -0,0 +1,10 @@ +{ + "version": 2, + "id": "14e2a5cd-4d1e-4c1b-8b85-f5e573fb6be7", + "createdOn": "2026-10-18", + "action": "cancel", + "payload": { + "requestId": "2f15ec99-d824-4c5c-99e2-0801f58522d7", + "reason": "PS-062: superseded by a correction that includes the full prior worklist/detail as dated history, rather than replacing it with a short summary." + } +} diff --git a/docs/outstanding-issues-inbox/2f15ec99-d824-4c5c-99e2-0801f58522d7.json b/docs/outstanding-issues-inbox/2f15ec99-d824-4c5c-99e2-0801f58522d7.json new file mode 100644 index 0000000000..3026e96a2d --- /dev/null +++ b/docs/outstanding-issues-inbox/2f15ec99-d824-4c5c-99e2-0801f58522d7.json @@ -0,0 +1,13 @@ +{ + "version": 2, + "id": "2f15ec99-d824-4c5c-99e2-0801f58522d7", + "createdOn": "2026-10-18", + "action": "update", + "payload": { + "id": "#Z3GZ5P", + "summary": "DSM-5-TR specifier catalogue: 515 of 585 items await clinician review, including the reset DID possession-form item", + "detail": "PS-062 correction verified 2026-10-18: the owner reset the DID possession-form sign-off under docs/decisions/2026-10-17-agent-recorded-therapy-and-did-sign-offs-reset.md. The previous statement that all 71 written disorder-specific items were signed is superseded: 70 remain signed and one written DID item plus 514 unwritten placeholders await review (515 pending). The 18 universal specifiers remain separate. Preserve all earlier worklist and clinician-only acceptance requirements; no new clinical approval is supplied.", + "baseRowFingerprint": "4d06e751ebc35fa92082f662f62fdf7b5d000d3e6bacf75bce1ed246e93dc09b", + "targetUlid": "01M1XS1N1YZ3GZ5PDNEACPWDY8" + } +} diff --git a/docs/outstanding-issues-inbox/3d33317d-4a51-4a3f-ac76-5a85aa0c036e.json b/docs/outstanding-issues-inbox/3d33317d-4a51-4a3f-ac76-5a85aa0c036e.json new file mode 100644 index 0000000000..0f28fb6bbe --- /dev/null +++ b/docs/outstanding-issues-inbox/3d33317d-4a51-4a3f-ac76-5a85aa0c036e.json @@ -0,0 +1,16 @@ +{ + "version": 2, + "id": "3d33317d-4a51-4a3f-ac76-5a85aa0c036e", + "createdOn": "2026-10-18", + "action": "reopen", + "payload": { + "id": "#NZ4X41", + "pri": "P2", + "detail": "PS-062 verified against the 2026-10-18 checkout: 179 therapies remain reviewed and 26 were reset to needs_review under the owner ruling recorded in docs/decisions/2026-10-17-agent-recorded-therapy-and-did-sign-offs-reset.md. The previous completion described all 205 as signed; that outcome is superseded. Governed references are present, but the 26 need genuine owner review through therapy:review. Clinical approval, corpus refresh and loaded-client revocation are not established.", + "source": "PS-062 supplied merged-PR review; canonical therapies-source.json and reset decision, inspected 2026-10-18", + "baseRowFingerprint": "443d1f1bbc33c4bd4036c922e109c0c80400342c910618c8fa8b9b79ac35ff32", + "allowArchived": true, + "targetTable": "archive", + "targetUlid": "01M488JH90NZ4X41FZT2339F40" + } +} diff --git a/docs/outstanding-issues-inbox/82706397-5f18-49eb-904d-a308e9251b07.json b/docs/outstanding-issues-inbox/82706397-5f18-49eb-904d-a308e9251b07.json new file mode 100644 index 0000000000..6f81b80c8f --- /dev/null +++ b/docs/outstanding-issues-inbox/82706397-5f18-49eb-904d-a308e9251b07.json @@ -0,0 +1,13 @@ +{ + "version": 2, + "id": "82706397-5f18-49eb-904d-a308e9251b07", + "createdOn": "2026-10-18", + "action": "update", + "payload": { + "id": "#Z3GZ5P", + "summary": "DSM-5-TR specifier catalogue: 515 of 585 items await clinician review, including the reset DID possession-form item", + "detail": "PS-062 correction verified 2026-10-18: the owner reset the DID possession-form sign-off under docs/decisions/2026-10-17-agent-recorded-therapy-and-did-sign-offs-reset.md. The previous statement that all 71 written disorder-specific items were signed is superseded: 70 remain signed and one written DID item plus 514 unwritten placeholders await review (515 pending). The 18 universal specifiers remain separate. Preserve all earlier worklist and clinician-only acceptance requirements; no new clinical approval is supplied. PRIOR DETAIL retained as superseded historical context (its all-signed/514-pending prose is corrected above): UPDATE 2026-10-17: All 71 written disorder-specific specifier items and 18 universal specifiers are signed off by Psych Sift with SHA-256 content pins (including the updated Dissociative Identity Disorder possession-form specifier wording); 514 unwritten catalog placeholders remain. PRIOR DETAIL (restored 2026-10-09, an earlier update replaced it wholesale): UPDATE 2026-09-25 (offline traversal of data/specifiers-content.json; no provider access). Two corrections to this row's own headline, both reproducible from the committed file. FIRST: '71 source-verified' overstates the work. 57 of the 71 restate their own label, matching 'For ,