Repository navigation
Conversation
|
Warning Review limit reachedYour organization has reached its usage spending cap. Adjust your spending cap in the billing tab. Next included review available in 8 minutes. View limit details
Comment |
|
Updates to Preview Branch (codex/full-deep-audit-remediation-20261018) ↗︎
Tasks are run on every commit but only new migration files are pushed.
❌ Branch Error • Sun, 18 Oct 2026 10:26:08 UTC View logs for this Workflow Run ↗︎. |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
BigSimmo has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
|
Skipping CodeAnt AI review — this PR changes more than 100 files, which usually means a migration, codemod, or vendored drop. Line-level review on diffs this large produces duplicate findings on the same rewrite pattern and drowns out anything that actually matters. If you still want a review, comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
PR Summary by QodoRemediate audit findings while retaining clinical release holds
AI Description
Diagram
High-Level Assessment
Files changed (109)
|
|
Auto-fix isn't included in your plan ↗ |
Code Review by Qodo
1. Cached answers survive evidence edits
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
🏁 CodeAnt Quality Gate ResultsCommit: ✅ Overall Status: PASSEDQuality Gate Details
|
- Make per-document recovery atomic - Include review metadata in cache revisions
Qodo Fixer✅ Committed (5) · ☑ Fixed (5) Commits pushed directly to this PR — no separate fix PR opened. Process — 5 fixed
|
# Conflicts: # supabase/applied-migration-hashes.json # supabase/drift-manifest.json # supabase/schema.sql
…a.sql The snapshot is the clean three-way merge of this branch's and main's manifests; schema_sha256 is recomputed with the repo's normalizedSchemaSha256. CI's 'Regenerate and verify drift manifest freshness' step verifies the full manifest (Docker is unavailable on this box); its artifact replaces this if it differs.
Reverts a62fc95. That automated commit edited the already-sealed draft migration after review: it changed rag_cache_scope_revision_v1 and added a duplicate-job close-out to recover_ingestion_job. The owner approved resealing only the reviewed bytes (f0667fed9f0294c1f5ba40252d11ee66e6de07be340a1ec789e0503a1192f2ac); approval relayed by Grok Bot at 16:17 AWST 2026-10-18, option (b) confirmed at 16:33 AWST. The matching src/lib/ingestion-recovery.ts change skipped sibling supersedes on the assumption that the new SQL performs them, so it is reverted too. The retry close-out can come back as a separate reviewed PR.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
… alert In --once mode the run loop wraps claim and health failures in WorkerAbortError, so the outer error carries no code and the failure webhook always said errorCode=unclassified. Read the allowlisted code from the wrapped cause as well. contentFreeErrorDetails only ever returns a fixed class or known code, so no message content reaches the alert. Add a test that the code is reported and the private text is not. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V2VWJXoHMnr3XnAhrREN8V
|
Code review by qodo was updated up to the latest commit 3e8d2e9 |
|
Splitting the work with the active Claude session (
I'll push once this branch has been quiet for 15 minutes, after fetching and integrating your commits; I won't force-push. Auto-merge stays off, because the owner chooses the production database window. |
Renames 20261017221129_audit_durable_recovery_pairing_and_cache_fences.sql to 20261018082910_audit_durable_recovery_pairing_and_cache_fences.sql so it sorts after main's newest migration (20261018062736). The bytes are unchanged: normalized SHA-256 f0667fed9f0294c1f5ba40252d11ee66e6de07be340a1ec789e0503a1192f2ac. Resealed with `npm run migrations:reseal`, with MIGRATION_RESEAL_OWNER_APPROVAL="the owner, relayed by Grok Bot in chat at 16:17 AWST 2026-10-18 (rename and reseal the reviewed migration f0667fed; option (b) confirmed at 16:33 AWST 2026-10-18)". The only manifest change is that the old name is removed and the new name added with the same hash. The schema.sql projection header and the runbook reference now use the new name, and the projection matches the migration byte for byte. The drift manifest's schema_sha256 follows schema.sql; CI's freshness step verifies the full manifest. No SQL was applied. No clinical sign-off is recorded.
|
Update to the split with the Claude session: I'm taking on only the migration rename and reseal, the drift manifest, and the failing PR policy check. That check fails on My files are limited to |
|
Code review by qodo was updated up to the latest commit f70929e |
Adds draft migration 20261018095804_rag_cache_scope_evidence_revision.sql. It is stacked on #3640 and must merge after it, because it replaces #3640's rag_cache_scope_revision_v1. - public.document_evidence_revisions holds a per-document counter. Statement-level triggers on document_table_facts and document_images bump it in the writing transaction when a fact or image row is inserted, deleted or changed. Every column except created_at/search_tsv counts; a no-op update does not bump it. - rag_cache_scope_revision_v1 keeps its signature, digest shape and grants, and each document's row hash now also carries that counter. The revision stays one pass over documents plus a keyed join, with no per-request scan of facts or images (gitar's cost concern). - tests/sql/rag-cache-scope-evidence-revision.sql runs on the replayed chain in CI. It shows that a fact threshold edit and image caption, relevance and searchability edits change the revision, that a no-op update and an edit on another document do not, and that deleting the document still cascades. - tests/rag-cache-governance-revocation.test.ts shows that a counter bump rejects local and shared cached answers and searches. Sealed with the append-only `npm run migrations:seal`. The owner approved this migration at 17:55 AWST 2026-10-18, relayed by Grok Bot. The drift manifest's schema_sha256 follows schema.sql; the full manifest comes from CI's regenerated artifact. No SQL applied; no clinical or hazard sign-off recorded.
|
Supabase Preview note: the owner approved marking |
Code Review ✅ Approved 2 closed / 2 findings🔴 High risk · The migration and account-authority/RAG changes could mis-scope staff access, strand private evidence, or serve stale clinical answers. Remediates full-deep audit findings across account isolation, CME cleanup, ingestion recovery, and RAG cache fencing, with content-free upload and worker diagnostics. Resolved: the new migration's date ordering relative to migrations already on main has been corrected. No open findings remain; the scope-revision RPC corpus-hashing concern was closed without a fix in this PR. ✅ 2 closed✅ Bug: New migration is dated before migrations already on main (out-of-order)
Closed: Performance: Scope-revision RPC hashes whole corpus several times per RAG request
VerificationRules No rules evaluated Functional validation Not enabledAuto-approval Approved For more verification details, comment OptionsAuto-apply is off → Gitar will not commit updates to this branch. Comment with these commands to change the behavior for this request:
Important Your trial ends in 3 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
|
Superseded by #3653: a clean one-commit rebuild with identical final code (head Generated by Claude Code |
#3650 merged into the old #3640 branch after this rebuild was cut. This applies exactly that branch's new changes, so the tree now equals the old branch merged with main. Includes migration 20261018095804 and its seal entry, which the owner approved by name. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018UBtJDgQZJ3eBsxLWte9r4
fix: remediate full-deep audit findings and retain release holds (rebuild of #3640)
Summary
Areas touched: App experience; Personal practice; Data platform and access; Answer engine; Source intake and indexing; Delivery and assurance; Knowledge and records.
RAG impact: behaviour change — cache governance/freshness, revocation, fallback and request coalescing. Provider-backed before/after canary evidence is not available; it remains an owner-authorized acceptance condition.
Verification
83a49c5fac0945613114255a4e672a05a5aec3d0. Its parent integration53ac94091f6072c9b93ac596ce06a45f40447f64, preserving prior PR headf70929e5306413bab2f90348fb68f9ddec8cf450and merging fetched main807ce0cb2b8f0850e6c41f04b0b00e856bd585fbonce, without conflicts.Required in-scope PR checks passed.It tested f70929e into base9ba5, not the new candidate; skipped release-browser/provider checks are not passes.Remote migration versions not found in local migrations directory.Read-only comparison retained both complete322-version sets: only remote20261017221129versus only local20261018082910. Documented preview recreation is prepared but not approved/executed; it deletes preview-only state and may incur compute charges.bracesnpm advisory GHSA-vfj7-8cjw-p6xm also has no patched upstream version; it remains development-only via Next's ESLint chain. No alert dismissal, invented version or incompatible alias was used. Earlier blocked Python advisory lookup is retained as failed evidence; the exact two repository alerts are now identified.See
docs/audit/2026-10-17-full-deep-remediation-results.mdfor dated source boundaries, actual failed/passing evidence and the rapid follow-through. Private raw artifacts remain session-local; this PR does not publish them.Risk and rollout
Merge only inside the owner's specifically approved production database window. This PR contains
supabase/migrations/20261018082910_audit_durable_recovery_pairing_and_cache_fences.sql; merging to main automatically applies migrations to the live clinical database within seconds. This continuation did not alter owner-controlled auto-merge state. The exact draft hash remainsf0667fed9f0294c1f5ba40252d11ee66e6de07be340a1ec789e0503a1192f2ac.Clinical Governance Preflight
PsychSift Production(sjrfecxgysukkwxsowpy)Physiological calculators and staff activation remain held. No qualified clinical, legal, privacy or provider sign-off was fabricated. The four pending/partial privacy conditions, reserved-creator platform repair and candidate-matched hosted Auth/Storage/RAG/cache/performance/rollout evidence remain open. The unchecked classification item is not represented as satisfied.
Notes
This PR publishes the remediation with current-main integration and explicit remaining conditions. It is not a release-readiness assertion, a new repository score, a deployment record or permission to merge. The original
/workspace/PsychSiftworking tree is preserved.Summary by cubic
Remediates full-deep audit findings: stale account requests and rollbacks can no longer mutate another user's favourites, roster, sharing, or calendar state; CME removal is transactional and durable; ingestion recovery is atomic per document with lease-based expiry; and RAG cache hits are fenced by an authoritative database scope revision instead of the latest-indexed-document stamp. Upload and worker diagnostics are now content-free, with superseded-object release failures reported as structured
{ stage, code }pairs that never carry raw provider or database messages; worker fatal alerts now read the allowlisted code from the wrapped cause so they report the real failure code instead ofunclassified. Request coalescing is isolated in its own module, and physiological calculators, sick-call access, and staff activation remain withheld pending clinical and provider review.A post-review automated edit to the sealed draft migration was reverted; the migration was resealed to the owner-reviewed bytes and renamed to sort after main's newest migration without changing its hash. The duplicate-job retry close-out and cache-revision metadata change are deferred to a separate reviewed PR.
Rollout
main; CI regenerates and verifies it since Docker is unavailable locally.Verification
Written for commit 83a49c5. Summary will update on new commits.