Preserve PDF evidence and reject unsupported RAG source claims

.env.example

@@ -95,6 +95,8 @@ OPENAI_TRANSCRIPTION_MODEL=gpt-4o-mini-transcribe
 OPENAI_EMBEDDING_MODEL=text-embedding-3-small
 # Must match vector(N) in supabase/schema.sql. Do not change without a migration.
 EMBEDDING_DIMENSIONS=1536
+# Keep control values until the separately approved comparison and activation.
+# At activation, set all three answer values below to gpt-6.1-sol.
 OPENAI_ANSWER_MODEL=gpt-5.6-terra
 OPENAI_FAST_ANSWER_MODEL=gpt-5.6-terra
 OPENAI_STRONG_ANSWER_MODEL=gpt-5.6-sol
@@ -277,6 +279,16 @@ WORKER_CONCURRENCY=1
 # Optional comma-separated claim allowlists; both must match when set.
 # Requires the scoped claim RPC migration; blank means unrestricted.
 WORKER_ALLOWED_DOCUMENT_IDS=
+# Optional finite, server-only policy for owner-internal native-text PDF builds.
+# Disabled when absent. JSON keys: allowedDocumentIds (max 100 UUIDs),
+# approvalReferenceSha256 (explicit approval hash), issuedAt/expiresAt (UTC, max 24h).
+# Actual current admin admission and original bytes are rechecked for every use.
+# Never combine with WORKER_ADMIN_SOURCE_RUNTIME_MODULE; see worker-deploy-runbook.md.
+# WORKER_INTERNAL_ADMIN_BUILD_POLICY_JSON=
+# Alternative for inspected tables/images/OCR and current legacy-library readmission.
+# Same four finite policy keys and claim subset; mutually exclusive with both modes above.
+# Requires the new readmission/full-PDF migrations. Keep WORKER_PAUSED=true until rollout.
+# WORKER_INTERNAL_RICH_PDF_BUILD_POLICY_JSON=
 WORKER_ALLOWED_FILE_TYPES=
 WORKER_MAX_ATTEMPTS=3
 WORKER_STALE_AFTER_MINUTES=45

.github/workflows/ci.yml

@@ -766,8 +766,19 @@ jobs:
           npm install --prefix "$bootstrap_npm_home/npm" --ignore-scripts --no-save --package-lock=false --no-audit --no-fund "npm@$bootstrap_npm_version"
           echo "home=$bootstrap_npm_home" >> "$GITHUB_OUTPUT"
 
-      - name: Install deterministic Python PDF test prerequisite
-        run: python3 -m pip install --disable-pip-version-check "PyMuPDF==1.28.0"
+      - name: Install deterministic Python PDF and OCR test prerequisites
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends python3-venv tesseract-ocr tesseract-ocr-eng
+          # The held renderer intentionally sets PYTHONNOUSERSITE=1. A runner's
+          # implicit --user install is therefore invisible to its subprocess.
+          pdf_python_home="$RUNNER_TEMP/unit-pdf-python"
+          python3 -m venv "$pdf_python_home"
+          "$pdf_python_home/bin/python" -m pip install --no-user --disable-pip-version-check "PyMuPDF==1.28.0" "Pillow==13.0.0" "pytesseract==0.3.13"
+          echo "PYTHON_BIN=$pdf_python_home/bin/python" >> "$GITHUB_ENV"
+          echo "$pdf_python_home/bin" >> "$GITHUB_PATH"
+          PYTHONNOUSERSITE=1 "$pdf_python_home/bin/python" -c "import pymupdf, PIL, pytesseract"
+          tesseract --version
 
       - name: Start coverage diagnostic timing
         run: >-

data/repo-awareness-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": "repo-awareness-snapshot-v3",
   "captured_revision": {
-    "committed_at": "2026-11-05"
+    "committed_at": "2026-11-06"
   },
   "routes": {
     "modes": [
@@ -1697,6 +1697,10 @@
         "path": "/api/differentials/presentations/[slug]",
         "file": "src/app/api/differentials/presentations/[slug]/route.ts"
       },
+      {
+        "path": "/api/images/[id]/content",
+        "file": "src/app/api/images/[id]/content/route.ts"
+      },
       {
         "path": "/api/roster/rotations/[roundId]",
         "file": "src/app/api/roster/rotations/[roundId]/route.ts"
@@ -2595,6 +2599,11 @@
         "section": "decisions",
         "catalogued": true
       },
+      {
+        "path": "docs/decisions/2026-11-01-ingestion-preparation-only.md",
+        "section": "decisions",
+        "catalogued": true
+      },
       {
         "path": "docs/archive/forward-codify-retrieval-rpcs-workorder-2026-10-20.md",
         "section": "archive",
@@ -3975,6 +3984,11 @@
         "section": "decisions",
         "catalogued": true
       },
+      {
+        "path": "docs/decisions/2026-11-03-defer-legal-review-for-internal-build.md",
+        "section": "decisions",
+        "catalogued": true
+      },
       {
         "path": "docs/prompts/codex-documentation-ownership-ultra-review.md",
         "section": "prompts",
@@ -4405,6 +4419,11 @@
         "section": "root",
         "catalogued": true
       },
+      {
+        "path": "docs/reindex-unlock-plan.md",
+        "section": "root",
+        "catalogued": true
+      },
       {
         "path": "docs/specifier-definition-worklist-2026-09-18.md",
         "section": "root",
@@ -4630,6 +4649,11 @@
         "section": "superpowers",
         "catalogued": true
       },
+      {
+        "path": "docs/decisions/2026-10-27-sol61-answer-candidate.md",
+        "section": "decisions",
+        "catalogued": true
+      },
       {
         "path": "docs/agents/codex-reasoning-effort.md",
         "section": "agents",
@@ -5030,6 +5054,11 @@
         "section": "decisions",
         "catalogued": true
       },
+      {
+        "path": "docs/decisions/2026-11-01-administrator-source-unscanned-exception.md",
+        "section": "decisions",
+        "catalogued": true
+      },
       {
         "path": "docs/decisions/2026-10-26-sign-in-keeps-signed-out-shift-work.md",
         "section": "decisions",

docs/README.md

@@ -306,6 +306,7 @@ Every remaining tracked document in this category (process, plus the `agents/` r
 
 ## Plans and workstreams (living)
 
+- [reindex-unlock-plan.md](reindex-unlock-plan.md) — current ingestion unlock and controlled rollout checkpoint
 - [maturity-backlog-workorders.md](maturity-backlog-workorders.md) — actionable work orders tracking the repository-maturity audit backlog
 - [no-unchecked-indexed-access-migration-plan.md](no-unchecked-indexed-access-migration-plan.md) — staged multi-PR rollout for the `noUncheckedIndexedAccess` TypeScript flag (ledger `#211`)
 - [pr-handoff-stop-cross-agent-gap.md](pr-handoff-stop-cross-agent-gap.md) — why the PR-babysit budget is hook-enforced for Claude Code but prose-only for Codex and Cursor, and what parity would require (ledger `#258`)

docs/audit/tenancy-defense-in-depth-review.md

@@ -464,10 +464,11 @@ guard until it is reviewed. Entries live in `DERIVED_QUERY_INVENTORY` in
 | `src/app/api/clinical-quality/route.ts`           | `rag_visual_eval_runs` | `loadClinicalQualitySnapshot` (×2), `verifyQualitySignal` | reviewed-indirect                    | Same administrator-gated aggregate; eval pass/fail counters.                                                                                                                                                                                                                                                                                                                                |
 | `src/app/api/clinical-quality/route.ts`           | `document_chunks`      | `loadClinicalQualitySnapshot`                             | reviewed-indirect                    | Reads only `id,document_id` for chunk ids already named by feedback rows, to map a signal back to its document. No chunk content is selected.                                                                                                                                                                                                                                               |
 | `src/app/api/documents/[id]/cover/route.ts`       | `document_images`      | `GET` (×2)                                                | owner-pinned-document-id (`id`)      | Both cover lookups filter `.eq("document_id", id)` for the id `withOwnerReadScope` resolved earlier; 404 before either query otherwise.                                                                                                                                                                                                                                                     |
-| `src/app/api/documents/[id]/reindex/route.ts`     | `ingestion_jobs`       | `POST`                                                    | owner-pinned-document-id (`id`)      | Competing-job diagnostic for the document already loaded with `.eq("owner_id", user.id)`.                                                                                                                                                                                                                                                                                                   |
+| `src/app/api/documents/[id]/reindex/route.ts`     | `ingestion_jobs`       | `POST`                                                    | parent-document-verified             | Parent resolves through `withOwnerReadScope`; readmission validates actual scope and returns before diagnostics, while legacy diagnostics additionally require the caller owns the parent.                                                                                                                                                                                                  |
 | `src/app/api/documents/[id]/search/route.ts`      | `document_chunks`      | `GET`                                                     | owner-pinned-document-id (`id`)      | ILIKE fallback used only when the owner-filtering `search_document_chunks` RPC is unavailable; reads chunks for the id `withOwnerReadScope` resolved above.                                                                                                                                                                                                                                 |
 | `src/app/api/documents/[id]/table-facts/route.ts` | `document_images`      | `PATCH` (×2)                                              | owned-document-helper (`id`)         | Both the source-image read and the review-metadata write are constrained to `.eq("document_id", id)` where `loadOwnedDocument` proved that document belongs to the requesting administrator. The write carried no document constraint until 2026-09-02 and was declared `reviewed-indirect`; restating it turned the repo's narrowest derived-tier write into a mechanically checked proof. |
 | `src/app/api/eval-cases/route.ts`                 | `document_chunks`      | `ownedChunkReference`                                     | reviewed-indirect                    | Read-then-verify: selects only `id,document_id`, then calls `ownedDocumentId` on the returned `document_id` and returns null unless it belongs to the requester.                                                                                                                                                                                                                            |
+| `src/app/api/images/[id]/content/route.ts`        | `document_images`      | `GET`                                                     | parent-document-verified             | Parent passes `withOwnerReadScope` and committed-generation checking before the service-only exact image/document/generation artifact read; inaccessible parents return 404 before bytes are read.                                                                                                                                                                                          |
 | `src/app/api/images/[id]/signed-url/route.ts`     | `document_images`      | `GET`                                                     | parent-document-verified             | Image row fetched by id, then its parent document resolved through `withOwnerReadScope`; 404 and nothing signed unless the parent is visible.                                                                                                                                                                                                                                               |
 | `src/app/api/images/signed-urls/route.ts`         | `document_images`      | `POST`                                                    | parent-document-verified             | Batch form of the same pattern (`/api/documents/images/batch` is a bare re-export of this module); only images whose parent survived `withOwnerReadScope` are signed.                                                                                                                                                                                                                       |
 | `src/app/api/ingestion/jobs/route.ts`             | `ingestion_jobs`       | `GET` (×3)                                                | reviewed-indirect                    | Administrator-only. All three chains join `documents!inner` and allow the administrator's own documents or shared public-library documents (`owner_id.eq.<user>,owner_id.is.null`); widened 2026-10-25 (ING-S-N7).                                                                                                                                                                          |