[Programcode]

Review rules and lint checks drawn from every review comment on PRs #5 to #106.

What changed

Review standards. CODING_STANDARDS.md gives a reviewer its steps and links seven area files in docs/standards/. Each rule links the review thread it came from. Rules a tool can enforce became checks instead of prose. .coderabbit.yaml points CodeRabbit at the files (with inheritance: true, so the organization settings still apply). The Codex review brief in the global codex-review skill now reads them too.

New checks in npm run lint, so CI and local verify both run them:

• Type-aware no-floating-promises and no-misused-promises for src/ (skipping test files). navigate() is allowed, and so are async JSX handlers and nullable-promise conditionals.
• waitForTimeout is rejected in browser tests. The seven existing uses are observation windows (a period in which something must not happen), and each now has a disable comment that says what must not happen.
• knip: unused files, unused or unlisted dependencies. Exports are left alone (77 hits, mostly shadcn re-exports).
• scripts/check-repo-rules.mjs:
  • Workflows need a top-level permissions: block, SHA-pinned actions, and persist-credentials: false on checkout.
  • pgTAP rejects a positive has_*_privilege call with a privilege list, since a list means "any of".
  • squawk runs on migrations newer than 20261001100000. Its style rules are excluded because they don't fit Supabase migrations.
• Vitest unstubGlobals and unstubEnvs.

Existing violations fixed:

• Six positive pgTAP privilege lists in current_debates_test.sql, debate_context_pins_test.sql and demo_access_codes_rls_test.sql passed if the role held any one privilege. They now check each one.
• The workspace reconnect and the native app-URL handler could reject with nobody listening. Both now catch.
• Five async calls whose functions already catch their own errors are now marked with void, as is i18n's init, which can't reject.

Measured and skipped: eslint-plugin-jsx-a11y (it would have caught none of the past accessibility findings, and it adds about 2,000 lockfile lines) and zizmor (it needs Python; the repo-rules script covers the same workflow rules).

npm run lint now takes about 40 s instead of 12 s, mostly from type-aware linting.

Verification

Local only; GitHub Actions refused every job because of the billing block.

• npm run verify at a0a3715 exited 0: docs, lint (every new check), typecheck, 27 unit files (273 tests), collaboration (30), 318 Edge tests, build, service-worker smoke, 29 Playwright smoke tests.
• Each repo rule fails on throwaway workflows, pgTAP files and migrations covering every case raised in review, and passes on the real tree.
• Eight Codex review rounds. The last, at a0a3715, found nothing; the comments below list every finding and its fix or dismissal.
• Pending at the time of writing: the pgTAP database gate for the six expanded privilege checks, and the verify-debatelab account recipe, whose only change is a comment. Both wait for the shared Supabase lock.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Workspace editing now reports an offline save status if reconnecting fails.
  • Errors while handling opened app links are now logged rather than left unhandled.

• Documentation

  • Added coding and review standards covering security, accessibility, testing, database changes, and other development practices.

• Developer Tooling

  • Expanded lint and repository checks for promise handling, unused code, workflow security, database privileges, and migrations. Test stubs are now reset after each test.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
debate-navigator	Ready	Preview	Oct 6, 2026 8:55am UTC
debatelab-staging	Ready	Preview	Oct 6, 2026 8:55am UTC

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Free
• Run ID: 7fcc7170-a750-48ee-94d7-bc3807c4b499

📥 Commits

Reviewing files that changed from the base of the PR and between c204ae6 and a0a3715.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (5)

• docs/standards/ui.md
• docs/testing.md
• knip.json
• package.json
• scripts/check-repo-rules.mjs

🚧 Files skipped from review as they are similar to previous changes (1)

• docs/testing.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request adds coding and review standards, expands lint and repository checks, updates privilege tests and Vitest cleanup, and changes application code to explicitly handle or discard selected promises.

Changes

Review standards and lint enforcement

Layer / File(s)	Summary
Coding and review standards .coderabbit.yaml, CODING_STANDARDS.md, docs/README.md, docs/standards/*	Adds project review instructions and area standards for async state, input boundaries, databases, reviews, security, tests, and UI behavior. Links the standards from the documentation and configures CodeRabbit to use them.
Lint and repository checks eslint.config.js, knip.json, package.json, scripts/check-repo-rules.mjs, docs/testing.md	Adds promise lint rules, Knip, workflow and SQL checks, and Squawk migration checks. Updates the lint script and documents the checks.
Test and check alignment supabase/tests/*, vitest.config.ts, e2e/*, .claude/skills/verify-debatelab/recipes/account.spec.ts	Updates privilege assertions and Vitest stub cleanup settings. Adds comments identifying test observation windows.
Application promise handling src/components/features/debate/CurrentDebateMenu.tsx, src/components/features/workspace/WorkspaceEditor.tsx, src/i18n.ts, src/lib/supabase/AuthProvider.tsx, src/native-app-url-listener.ts, src/pages/*	Adds explicit promise discards at selected call sites. Handles rejected workspace connection and native URL handling promises. Changes the debate navigation callback to a braced arrow function.

Estimated code review effort: 3 (Moderate) | ~25 minutes

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}

[Programcode]

CodeRabbit and Copilot are out of quota, so the Codex reviewer (gpt-6.1-sol, high) reviewed c204ae6. All six findings were real, and all are fixed in 6805d2c:

1. Workflows ending in .yaml skipped every check. The check now reads .yml and .yaml.
2. Quoted keys or values defeated the line matcher, which missed 'uses': and wrongly flagged a quoted pinned SHA. Workflows now go through the yaml parser, which is now a declared devDependency.
3. persist-credentials was searched for in the text after the step, so an env block scalar could satisfy it, and a with: placed before uses: failed. The check now reads the step's own with mapping.
4. NOT (has_table_privilege(..., 'SELECT,INSERT')) was flagged. Negation is now looked up past parentheses and comments.
5. 'SELECT,INSERT'::text slipped through. The check now reads each call's last string argument.
6. Broad knip entry globs turned dead helpers into entry points. The entries now name only real entry points, and the Vitest and Playwright plugins find the tests. A throwaway unreferenced helper in services/collaboration/src, e2e/helpers and src/test is now reported.

Each case was reproduced with throwaway files before the fix and passes after it. npm run lint passes at 6805d2c. A second review round is running.

[Programcode]

Codex re-review of 6805d2c found one real problem: a quoted word inside a SQL comment could stand in for a privilege call's last argument and hide a list, and a commented-out example failed lint. Fixed in 1e354ba. Comments are now blanked out, keeping string literals and line numbers, before calls are scanned. Probes cover a comment inside the call, commented-out examples, NOT in parentheses or across a comment, a ::text cast, a column-privilege list, and an escaped quote before --. npm run lint passes. Re-reviewing the new head.

[Programcode]

Codex re-review of 1e354ba found two more scanner gaps, both fixed in 787cb70. First, a dollar-quoted $$/*$$ opened a false comment that hid later checks; dollar-quoted bodies are now copied as-is, and privilege calls inside them are still checked. Second, nested block comments ended at the first */; comments now track depth as PostgreSQL does. Probes for every case so far pass, and npm run lint passes.

[Programcode]

Codex re-review of 787cb70 raised two findings. Both are false positives: the check flags correct SQL. Neither lets a weak check through, so I'm dismissing both:

• A commented-out privilege list inside a $$ body is flagged. Correct SQL would almost never contain this, and it fails loudly, never silently.
• has_table_privilege(..., 'INSERT,UPDATE') = false is a valid negative check, but it is flagged. The check recognizes NOT has_*_privilege(...), which every negative check in supabase/tests/ already uses. Teaching it every way to say "false" would turn a small lint into a SQL parser.

The check deliberately errs toward flagging. As of fc713aa, the error message and docs/testing.md say to write negative checks with NOT. Each later round so far only found edge cases in the scanner; nothing reached app code or the expanded pgTAP checks.

[Programcode]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Programcode]

Codex re-review of fc713aa found one false negative: a dollar-quoted privilege list ($$SELECT,INSERT$$) passed. Fixed in 090c4df. Dollar-quoted strings now count as arguments, and their parentheses (as in $$public.f(text)$$) no longer end the argument scan. Probes pass, and npm run lint passes.

[Programcode]

Codex re-review of 090c4df found two more ways to spell a privilege list that passed: a dollar tag with a digit ($priv1$) and adjacent-string concatenation ('SELECT,' 'INSERT'). Rather than chase each spelling, 01b4155 inverts the rule. A positive call's privilege argument must be one quoted word or a per-row column (the bool_and(... privilege) pattern two existing tests use), and anything else is flagged, including || concatenation. Probes cover every case from rounds 1 to 6. npm run lint passes.

[Programcode]

Codex re-review of 01b4155 found two gaps, both fixed in a0a3715. First, docker:// actions skipped pinning; they now need an @sha256: digest (no current workflow uses one). Second, a schema-qualified or quoted call (pg_catalog."has_table_privilege"(...)) escaped the match; the match now takes an optional schema and quotes, so NOT before a qualified call still counts as negation. Probes pass, and npm run lint passes.

[Programcode]

Codex re-review (gpt-6.1-sol, high) of a0a3715: no findings. It ran lint, docs check, 81 focused tests and the scanner probes. It noted two constructions that only deliberate evasion would produce: double negation around a list, and an unmatched /* inside a digit-tagged dollar string. I'm leaving both as notes, since the check deliberately errs toward flagging and targets mistakes, not evasion. Still to run before merge: the pgTAP database gate for the expanded privilege checks, and the verify-debatelab account recipe (comment-only change). Both wait for the shared Supabase lock another thread holds.

[Programcode]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Programcode]

Database evidence for the expanded pgTAP privilege checks. The locked db-gate.sh couldn't run: another thread's verify stack has held the shared Supabase lock for over two hours, and my lock wait hit its limit. In its place, I ran the six expanded assertions as plain SELECTs in a BEGIN READ ONLY … ROLLBACK transaction, against that running local database. It has exactly main's 39 migrations, ending at 20261001100000; the other thread's branch has no migration diff.

• current_debates_test.sql: authenticated holds SELECT, INSERT, UPDATE and DELETE on debates, current_debates and crossfires: true
• debate_context_pins_test.sql: authenticated holds SELECT, INSERT and DELETE: true; service_role holds all four: true
• demo_access_codes_rls_test.sql: service_role holds all four: true

So the stricter checks pass on the current schema. The full pgTAP run was not repeated. The verify-debatelab account recipe was not driven either: its only change is an added comment, and the stack it needs is behind the same lock.