Repository navigation
fix: remediate full-deep audit findings and retain release holds (rebuild of #3640) - #3653
Conversation
Clean rebuild of PR #3640 (head 83a49c5) as one commit on main 1837b0b, with identical final code (the tree equals merging main into that head). Rebuilt because qodo-code-review[bot] commits in #3640's history (577dc4f, a62fc95) touch protected paths and fail the bot-authored-sensitive-commits PR policy, and history rewrites are banned. Those bot changes appear here only as they stood at 83a49c5 and need owner review in this PR. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018UBtJDgQZJ3eBsxLWte9r4
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
📒 Files selected for processing: 116
✨ Finishing Touches
Comment |
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
#3650 merged into the old #3640 branch after this rebuild was cut. This applies exactly that branch's new changes, so the tree now equals the old branch merged with main. Includes migration 20261018095804 and its seal entry, which the owner approved by name. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018UBtJDgQZJ3eBsxLWte9r4
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
BigSimmo has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Claude encountered an error after 2s —— View job I'll analyze this and get back to you. |
Resolves the four overlaps: seal file keeps all four new entries in date order, schema.sql appends this PR's projections after #3652's, the drift manifest is a three-way merge of both generated manifests (no object changed on both sides) with schema_sha256 matching schema.sql, and the site-content baseline is regenerated from the merged sources. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018UBtJDgQZJ3eBsxLWte9r4
There was a problem hiding this comment.
BigSimmo has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
|
This PR stays in draft on purpose until #3652 merges, because #3652's migrations are dated earlier. After that, main gets merged into this branch, which also brings in #3652's later review fixes. That push re-runs the full CI, so no re-run is needed on this head. Generated by Claude Code |
There was a problem hiding this comment.
BigSimmo has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
Brings in the review fixes (expired offer drain, booked-slot withdrawal, NICE authority form) and the owner-approved cue exposure therapy wording. The site-content baseline is regenerated from the merged sources. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018UBtJDgQZJ3eBsxLWte9r4
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3471b1f6c1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…to claude/rebuild-3640-20261018
The merge-base changed after approval.
There was a problem hiding this comment.
BigSimmo has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
Code Review ✅ Approved 1 closed / 1 findings🔴 High risk · Production SQL changes to private-evidence cleanup, team authorization, and clinical RAG cache freshness could mishandle records or leave stale guidance available. Remediation of the full-deep audit findings across account isolation, roster alerts, PDF extraction, CI, and RAG cache governance, with release holds retained. No open findings remain; the uncached full-scope revision RPC performance item was closed without a fix in this PR. ✅ 1 closedClosed: Performance: Uncached full-scope revision RPC now runs many times per RAG request
VerificationRules No rules evaluated Functional validation Not enabledAuto-approval Approved For more verification details, comment OptionsAuto-apply is off → Gitar will not commit updates to this branch. Comment with these commands to change the behavior for this request:
Important Your trial ends in 3 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
Requested by Josh · project thread
#3650 (RAG cache evidence revision) was merged into the old #3640 branch by the owner after this rebuild was cut. Its changes, including migration
20261018095804and its seal entry (approved by the owner by name), are now carried here too, so this tree equals the old branch merged with main. Merge this after #3652, because #3652's migrations are dated earlier. Its own description and evidence are on #3650.Summary
Areas touched: App experience; Personal practice; Data platform and access; Answer engine; Source intake and indexing; Delivery and assurance; Knowledge and records.
RAG impact: behaviour change — cache governance/freshness, revocation, fallback, request coalescing and evidence-revision invalidation. Provider-backed before/after canary evidence is not available; it remains an owner-authorized acceptance condition.
Verification
docs/audit/2026-10-17-full-deep-remediation-results.md. It is not hosted proof for this combined head.bracesadvisory have no fixed upstream release and remain open.Risk and rollout
Merge only inside the owner's specifically approved production database window. This PR contains
supabase/migrations/20261018082910_audit_durable_recovery_pairing_and_cache_fences.sqlandsupabase/migrations/20261018095804_rag_cache_scope_evidence_revision.sql; merging to main automatically applies migrations to the live clinical database within seconds. This work did not alter owner-controlled auto-merge state.Clinical Governance Preflight
PsychSift Production(sjrfecxgysukkwxsowpy)Physiological calculators and staff activation remain held. No qualified clinical, legal, privacy or provider sign-off was fabricated. The cache revision is now a clinical-evidence hazard control that the owner should review; no hazard control is sealed here.
🤖 Generated with Claude Code
https://claude.ai/code/session_018UBtJDgQZJ3eBsxLWte9r4
Summary by Gitar
roster_offer_alert_outboxedge_recovery_needs_reviewwork_revoke_supervisors_on_team_moveThis will update automatically on new commits.
Summary by CodeRabbit
Bug Fixes
Documentation