Bind publication approval to immutable reviewed state by BigSimmo · Pull Request #1081 · BigSimmo/Database

BigSimmo · 2026-07-22T11:24:09Z

Summary

Bind public-document approval to a canonical SHA-256 digest of the reviewed document, metadata, artifacts, and generation state.
Revalidate the digest while the document and all relevant artifact rows are locked during publication, preventing review-to-publication races.
Reject publication while ingestion or indexing-v3 work is active or retryable, so a worker cannot change public content after approval.
Add the forward-only 20260722190000_bind_publication_approval_to_reviewed_state.sql migration, regenerate schema/types/drift evidence, and update promotion/audit tooling.
Preserve historical nullable approvals while requiring a digest for all new approvals and transitions.
RAG impact: no retrieval behaviour change — publication governance only.

Verification

Risk and rollout

Risk: publication becomes fail-closed when reviewed content/governed artifacts change after approval or background ingestion remains active. A missed canonical field could weaken the binding; focused schema tests and the transactional SQL fixture cover governed tables, mutation rejection, generation-gate parity, and active-job rejection.
Rollback: before production migration, revert this PR. After application, use a new forward rollback migration to relax the new requirements; never edit or delete the applied migration. Existing historical approval rows remain valid and nullable.
Provider or production effects: none yet. No live Supabase, OpenAI, Railway, or RAG command ran. Production Supabase rollout remains a separate controlled operation after merge.

Clinical Governance Preflight

Source-backed claims still require linked source verification before clinical use
No patient-identifiable document workflow was introduced or expanded without explicit governance approval
Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
Service-role keys and private document access remain server-only
Demo/synthetic content remains clearly separated from real clinical sources
Source metadata, review status, and outdated/unknown-source behavior remain conservative
Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed — no clinical decision-support behavior changed.

Notes

Review remediation commit 202c10eeb aligns the approval digest with the union of artifacts visible through current SQL and application readers.
Review remediation commit 79dadbc46 locks/checks ingestion_jobs and indexing_v3_agent_jobs in both publication paths and fails closed on lock contention or active/retryable work.
This is a new forward-dated migration. The stale archived 20260719055622 migration was not reused.
The archived patch was evidence only; its stale 19-file patch was not replayed.

Summary by CodeRabbit

Bug Fixes
- Strengthened public document publication approvals by binding approval evidence to the exact reviewed document state via a reviewed-state digest.
- Publication is now blocked when reviewed-state evidence is missing/mismatched, when expected state digest data is invalid, or when a document changes after approval.
- Tightened publish/transition validation and aligned batch promotion and auditing with the reviewed-state digest.
Tests
- Added coverage for required expected state digests, format validation, post-approval mutation failures, and verification that reviewed-state digest checks (including lock ordering) are enforced during publish/transition flows.

supabase · 2026-07-22T11:24:21Z

Updates to Preview Branch (codex/reconcile-publication-approval) ↗︎

Deployments	Status	Updated
Database	✅	Wed, 22 Jul 2026 11:58:22 UTC
Services	✅	Wed, 22 Jul 2026 11:58:22 UTC
APIs	✅	Wed, 22 Jul 2026 11:58:22 UTC

Tasks are run on every commit but only new migration files are pushed.
Close and reopen this PR if you want to apply changes from existing seed or migration files.

Tasks	Status	Updated
Configurations	✅	Wed, 22 Jul 2026 11:58:23 UTC
Migrations	✅	Wed, 22 Jul 2026 11:58:25 UTC
Seeding	✅	Wed, 22 Jul 2026 11:58:27 UTC
Edge Functions	✅	Wed, 22 Jul 2026 11:58:28 UTC

View logs for this Workflow Run ↗︎.
Learn more about Supabase for Git ↗︎.

coderabbitai · 2026-07-22T11:24:34Z

📝 Walkthrough

Walkthrough

Publication approvals now bind documents to a canonical reviewed-state digest. Database functions validate unchanged content during transitions and publishing, while manifests, promotion scripts, audits, generated types, schema metadata, and verification tests propagate and validate the digest.

Changes

Publication integrity

Layer / File(s)	Summary
Reviewed-state digest contract `src/lib/publication-manifest.ts`, `src/lib/supabase/database.types.ts`, `supabase/migrations/...`, `supabase/schema.sql`, `supabase/drift-manifest.json`	Adds the required manifest digest, approval column, canonical state-digest function, insert trigger, format constraints, and generated database declarations.
Transition and publish enforcement `supabase/migrations/...`, `supabase/schema.sql`	Publication guards and `publish_approved_documents` match reviewed digests, lock related artifacts, recompute current state, reject post-review changes, and persist reviewed-state metadata.
Promotion and audit integration `scripts/promote-public-documents-batch.ts`, `scripts/audit-public-document-approvals.ts`	Promotion validates expected state digests, stores and deduplicates reviewed approval evidence, passes expected digests to publishing, and audits digest matches.
Digest validation fixtures and tests `scripts/sql/verify-publication-approval.sql`, `tests/publication-manifest.test.ts`, `tests/supabase-schema.test.ts`	Adds canonical digest fixtures, validates required manifest fields, and verifies post-review mutation rejection and locking behavior.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
participant PromotionScript
participant SupabaseRPC
participant ApprovalLedger
participant PublishFunction
PromotionScript->>SupabaseRPC: Request document_publication_state_digest
SupabaseRPC-->>PromotionScript: Return current state digest
PromotionScript->>ApprovalLedger: Insert reviewed_state_digest approval
PromotionScript->>PublishFunction: Pass expected_state_digest
PublishFunction->>ApprovalLedger: Match approved reviewed-state evidence
PublishFunction->>SupabaseRPC: Recompute current state digest
SupabaseRPC-->>PublishFunction: Return current state digest
PublishFunction-->>PromotionScript: Publish result or changed-after-review error

Possibly related PRs

BigSimmo/Database#640: Related committed-generation handling used by reviewed-state digest computation and publication guards.
BigSimmo/Database#715: Introduced the approval audit script updated here to validate reviewed-state digest evidence.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise and accurately summarizes the main change: binding publication approval to reviewed state.
Description check	✅ Passed	The description matches the template well, covering summary, verification, risk/rollback, governance preflight, and notes.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/reconcile-publication-approval

_{Comment @coderabbitai help to get the list of available commands.}

cursor

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 659e417. Configure here.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:659e417a08

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

BigSimmo · 2026-07-22T11:29:20Z

@codex resolve actionable Codex review findings for this pull request and current head using the repository instructions. This is the pull request's single automatic repair pass: do not perform a fresh review, create new standalone findings, or request another review. Work only the existing unresolved Codex threads on the current head. Always fix P0 and P1 findings. For P2 and lower findings, fix only clear, scoped, low-risk issues; otherwise disposition them with a concise reason. After fixing or dispositioning a thread, reply in that thread with as the first line, followed by a concise summary; that marker authorizes the workflow to close that exact thread. If human input or new authorization is required, do not use the marker and leave the thread open with the blocker. Finish only after every actionable thread is fixed or dispositioned and closed, or explicitly left open for a human decision. Do not update the branch from main, address unrelated reviews, broaden scope, or create more than one scoped fix commit. Do not use external APIs, paid services, credentials, dependency changes, or broad refactors unless explicitly authorized. Add targeted tests where behavior changes and run the narrowest relevant validation.

chatgpt-codex-connector · 2026-07-22T11:32:33Z

Summary

Added fail-closed active-ingestion protection to both publication paths: direct owner→public transitions and publish_approved_documents now lock matching ingestion_jobs rows with pending/processing status before digest revalidation and reject publication while those jobs remain active. supabase/migrations/20260722190000_bind_publication_approval_to_reviewed_state.sqlL198-L214 supabase/migrations/20260722190000_bind_publication_approval_to_reviewed_state.sqlL310-L322
Kept the canonical schema snapshot aligned with the migration change in supabase/schema.sql.
Extended the publication approval SQL fixture with an active-ingestion document, matching approval evidence, a processing ingestion_jobs row, and a negative publication assertion. scripts/sql/verify-publication-approval.sqlL9-L33 scripts/sql/verify-publication-approval.sqlL86-L103
Strengthened schema regression coverage to assert active ingestion jobs are checked before reviewed-state digest recomputation in both guarded publication paths. tests/supabase-schema.test.tsL1211-L1225
Committed the scoped fix on the current branch: 627b614 fix(db): block publication during active ingestion.
Created PR metadata via make_pr with title: Block publication while ingestion jobs are active.

Testing

✅ npm exec vitest run tests/supabase-schema.test.ts — passed, 68 tests.
✅ npm run check:migration-role — passed.
✅ npm run check:function-grants — passed.

Note: I did not call external provider/GitHub APIs to post a review-thread reply directly; the required disposition marker and summary were included in the generated PR body for the repair pass.

View task →

coderabbitai

🧹 Nitpick comments (1)

supabase/migrations/20260722190000_bind_publication_approval_to_reviewed_state.sql (1)
11-13: 🗄️ Data Integrity & Integration | 🔵 Trivial | 💤 Low value
Use NOT VALID for this CHECK — ADD CONSTRAINT ... CHECK holds an ACCESS EXCLUSIVE lock while it validates existing rows; NOT VALID defers that scan and shortens the blocking window. If document_publication_approvals stays a tiny append-only ledger, the current form is acceptable.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@supabase/migrations/20260722190000_bind_publication_approval_to_reviewed_state.sql`
around lines 11 - 13, Update the document_publication_approvals constraint
document_publication_approvals_reviewed_state_digest_format to add it with NOT
VALID, deferring validation of existing rows while preserving CHECK enforcement
for new or updated rows.
Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In
`@supabase/migrations/20260722190000_bind_publication_approval_to_reviewed_state.sql`:
- Around line 11-13: Update the document_publication_approvals constraint
document_publication_approvals_reviewed_state_digest_format to add it with NOT
VALID, deferring validation of existing rows while preserving CHECK enforcement
for new or updated rows.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 9cc43968-d775-432d-9682-8d940e7590ee

📥 Commits

Reviewing files that changed from the base of the PR and between 6976aae and 659e417.

📒 Files selected for processing (10)

scripts/audit-public-document-approvals.ts
scripts/promote-public-documents-batch.ts
scripts/sql/verify-publication-approval.sql
src/lib/publication-manifest.ts
src/lib/supabase/database.types.ts
supabase/drift-manifest.json
supabase/migrations/20260722190000_bind_publication_approval_to_reviewed_state.sql
supabase/schema.sql
tests/publication-manifest.test.ts
tests/supabase-schema.test.ts

fix(db): bind publication approval to reviewed state
659e417

cursorBot reviewed Jul 22, 2026
View reviewed changes

Comment threadsupabase/migrations/20260722190000_bind_publication_approval_to_reviewed_state.sql

chatgpt-codex-connectorBot reviewed Jul 22, 2026
View reviewed changes

Comment threadsupabase/migrations/20260722190000_bind_publication_approval_to_reviewed_state.sql

coderabbitaiBot reviewed Jul 22, 2026
View reviewed changes

BigSimmo added 2 commits July 22, 2026 19:47

fix(db): align approval digest with served artifacts
202c10e

fix(db): block publication during active ingestion
79dadbc

BigSimmo merged commit a00638a into mainJul 22, 2026
37 of 38 checks passed

BigSimmo deleted the codex/reconcile-publication-approval branch July 22, 2026 12:01

Navigation Menu

Bind publication approval to immutable reviewed state - #1081

Bind publication approval to immutable reviewed state#1081
BigSimmo merged 3 commits into
mainfrom
codex/reconcile-publication-approval

BigSimmo commented Jul 22, 2026•
edited by coderabbitai Bot
Loading

Uh oh!

supabaseBot commented Jul 22, 2026•
edited
Loading

Uh oh!

coderabbitaiBot commented Jul 22, 2026•
edited
Loading

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

cursorBot left a comment

Uh oh!

Uh oh!

chatgpt-codex-connectorBot left a comment

Uh oh!

Uh oh!

BigSimmo commented Jul 22, 2026

Uh oh!

chatgpt-codex-connectorBot commented Jul 22, 2026

Uh oh!

coderabbitaiBot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

BigSimmo commented Jul 22, 2026• edited by coderabbitai BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Risk and rollout

Clinical Governance Preflight

Notes

Summary by CodeRabbit

Uh oh!

supabaseBot commented Jul 22, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitaiBot commented Jul 22, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

cursorBot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

chatgpt-codex-connectorBot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

BigSimmo commented Jul 22, 2026

Uh oh!

chatgpt-codex-connectorBot commented Jul 22, 2026

Summary

Uh oh!

coderabbitaiBot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

BigSimmo commented Jul 22, 2026•
edited by coderabbitai Bot
Loading

supabaseBot commented Jul 22, 2026•
edited
Loading

coderabbitaiBot commented Jul 22, 2026•
edited
Loading