docs: activate universal repository task ledger - #1109
Conversation
…r-security-followup-082afe
This pull request has been ignored for the connected project Preview Branches by Supabase. |
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (8)
📝 WalkthroughWalkthroughThe universal task ledger is now the canonical source for recommended work, open-item status, and execution order. The ChangesUniversal task ledger
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant SessionStart
participant issues-surface.sh
participant outstanding-issues.md
SessionStart->>issues-surface.sh: Trigger session-start or context-reset surfacing
issues-surface.sh->>outstanding-issues.md: Read recommended queue and open items
outstanding-issues.md-->>issues-surface.sh: Return ordered tasks and priority counts
issues-surface.sh-->>SessionStart: Print recommendations and universal counts
Possibly related PRs
Suggested labels: ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 3996b86. Configure here.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:3996b866ca
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Uh oh!
There was an error while loading. Please reload this page.
…followup-082afe' into codex/universal-ledger-security-followup-082afe # Conflicts: # .claude/hooks/issues-surface.sh
…r-review-integration-a51f19
…r-security-followup-082afe
…followup-082afe' into codex/universal-ledger-security-followup-082afe
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:a57b86a7dd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Uh oh!
There was an error while loading. Please reload this page.
CI triageCI failed on this PR. Automated classification of the 2 failed job(s):
Compared with main CI run #4583 (success). Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:52da7d1e47
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| | ---------- | -------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ||
| | 2026-07-24 | PR #1106 / `codex/task-ledger-final-11318f` | `5d128a2844c2298d0da36df64e5e2f7dda11e14b` + reviewed follow-up diff | Universal task-ledger workflow and protected-main merge readiness | APPROVE after follow-up. `docs/outstanding-issues.md` is the single durable task ledger, with retained work carrying order, acuity, timing, capability, effort, dependencies, success criteria, verification and stop rules. Four actionable review findings were fixed: filtered `/issues` reads now apply the filter to open items before rendering queued and non-queued results; the session hook excludes queued IDs from its priority summary; `#030` is consistently P2/A2 in the canonical open table and queue; and the sole A1/P1 blocker is first while `#052` is explicitly the first code task. No other actionable review thread remains in the reviewed scope. | Protected CI at the initial reviewed head passed policy, static, safety/config, unit coverage, Semgrep, Gitleaks, GitGuardian and the required aggregate; UI, build, migration replay and release browser matrix were correctly skipped for the docs/workflow scope. Follow-up proof: scoped Prettier; hook syntax/runtime plus exact ID-deduplication, P2-count and A1-first assertions; docs links (1,136 references); canonical skill catalog (32 skills, 8 aliases); `git diff --check`. Exact-head hosted CI remains required after the follow-up push. No OpenAI, Supabase, Railway, deployment or production-data operation ran. | | ||
| | 2026-07-24 | `codex/supabase-document-change-trigger` | `9c7d9edf509a51478f5bebbabcca64e3926dc877` + reviewed working diff | Document-change ingestion trigger migration, schema mirror, grants, privacy and fail-safe delivery | APPROVE. No P0-P2 finding. The trigger is update-only, acts solely on a strict JSON boolean false/absent-to-true transition, sends only the receiver's allowlisted owner-scoped fields, fails open for document writes when Vault/GUC/pg_net is unavailable, and revokes execution from public/anon/authenticated. No production URL fallback exists. Highest residual risk is deliberate pg_net at-most-once delivery; the clear-then-flip recovery and data-preserving rollback are documented, and the trigger remains inert until both the Vault secret and environment base-URL GUC are configured. | Disposable Supabase Postgres `17.6.1.127` schema replay and drift-manifest regeneration passed (16s; scratch container removed); focused schema/drift/receiver Vitest 89/89; migration-role, function-grant (30 SECURITY DEFINER functions) and owner-scope guards; production-readiness CI mode READY with expected secretless-worktree warnings; offline RAG 21 suites/307 tests; `verify:cheap` 365 files, 3,241 passed/1 skipped; static trace of receiver payload, authoritative owner-scoped reload and idempotent enqueue path. No live provider mutation or migration apply. | | ||
| | 2026-07-24 | PR #1109 / `codex/universal-ledger-security-followup-082afe` | `3996b866ca69fa8dfc171fe51f41832eb269006c` + reviewed working diff | Universal task ledger, `/issues` lifecycle and SessionStart surfacing | READY AFTER FIXES. Two P2 lifecycle defects were confirmed and corrected before merge: the SessionStart hook now preserves a non-empty recommended queue when the wider open table is empty, and every active queue package has a durable open-item ID so `/issues done` can archive it without leaving stale recommendations. The ledger provenance was also advanced to the actual merged `origin/main` base. Highest residual risk is human maintenance drift between the queue and open table; the documented mutation contract and invariant check are the current guardrails. | Bash syntax and live SessionStart execution passed (33 recommended, 45 open); queue order is contiguous and unique; every queue source contains only tracked open IDs; `docs:check-links` passed (1,142 references); `docs:check-index` passed (42 modules/routes plus all schema tables); `docs:check-scripts` passed (334 npm script references); `check:skills` passed (32 canonical skills, 8 aliases); Prettier and `git diff --check` passed. No live application, OpenAI, Supabase, Railway, deployment, or production-data action. | |
There was a problem hiding this comment.
Adding this new PR #1109 record replaced the existing PR #1106 / codex/task-ledger-final-11318f row instead of appending, so a future review request for that already-reviewed branch/head can no longer match the ledger and will be repeated unnecessarily. Keep the old row and append this one as a separate record so the throttle still works for both PRs.
AGENTS.md reference: AGENTS.md:L122-L127
Useful? React with 👍 / 👎.
| | 9 | `#059` | Set a unique 32+ character `OPENAI_SAFETY_IDENTIFIER_SECRET` per environment with `OPENAI_API_KEY`, never in Git/output. | A2 / Standard local + Operator hosted | Local now; hosted approved window | 15–30 min local; 30–60 min/env | Secret manager; hosted approval | Presence-only readiness passes, HMAC pseudonymity remains, secret scans clean. Stop if governance rejects stable identifiers. | | ||
| | 10 | `#060` | Reconcile query-hash, deep-probe, Supabase/OpenAI, project identity, and schedules using read-only presence checks before setting anything. | A2 / Operator platform | Next approved readiness window | 1–2 hours | Provider approval, env owners | Record status, never values; set only confirmed gaps; identity/readiness pass. Stop on target ambiguity or cross-env key reuse. | | ||
| | 11 | `#022` | Decide auditable BMJ reference policy, then review the ten highest-impact local WA documents. | A2 / Operator governance + Specialist | Decision-ready | 1–2 hours policy; 0.5–1 day reviews | Clinical authority; live writes/canary approval | Preserve third-party/unverified provenance; record reviewer/evidence/time/rationale. Stop after ten and remeasure debt. | | ||
| | 12 | `#051` + `#023` | Compare run `30018289898` with the scheduled 2026-07-26 canary/browser/label artifacts; disposition residuals without rerun. | A2 / Specialist evaluation | About 2026-07-27 02:00 AWST plus runtime | 2–4 hours | Approval to read hosted artifacts; no dispatch | Record tree/run, content/provider/latency, browser, and labeling outcomes. Stop without spend or archived lithium changes. | |
There was a problem hiding this comment.
Fresh evidence beyond the prior ID-tracking fix: this active queue row still binds two independent open items in one Source cell. When /issues done #051 is later used after the canary-stabilization task completes, the skill's lifecycle rule removes the recommendation row; that either drops still-open #023 from the active queue or leaves completed #051 surfaced as active work. Use one queue row per closable open item, or create a single durable open item for the combined recommendation.
Useful? React with 👍 / 👎.
Summary
docs/outstanding-issues.mdthe repository's single universal task ledger/issuesand the SessionStart hookReview fixes
#058–#065, including separate SLO-alert ownershiporigin/mainSHAValidation
npm run docs:check-links— passed (1,142 references)npm run docs:check-index— passed (42 modules/routes and all schema tables)npm run docs:check-scripts— passed (334 npm script references)npm run check:skills— passed (32 canonical skills, 8 aliases)git diff --check— passedverify:cheap— not repeated: the isolated worktree has no local dependency installation; clean-install hosted checks are required before mergeRisk and rollback
Low risk: documentation and agent-workflow changes only; no application runtime, migrations, provider configuration, secrets, production data, or deployment behavior changes. Roll back by reverting the PR merge commit.
RAG impact: no retrieval behaviour change — documentation and task-tracking only.
Clinical governance preflight: not applicable; no ingestion, answer generation, search/ranking, source rendering, access, privacy implementation, production environment, or clinical output code changes.
Summary by CodeRabbit
New Features
Documentation
/issuesbehavior, task lifecycle, queue ordering, and update rules.