Harden RAG retrieval and answer reliability - #1288
Conversation
…-51e6fd # Conflicts: # docs/outstanding-issues.md
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 35223466 | Triggered | Bearer Token | 235974d | tests/profile-retrieval-rpcs.test.ts | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secret safely. Learn here the best practices.
- Revoke and rotate this secret.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Updates to Preview Branch (codex/rag-reliability-51e6fd) ↗︎
Tasks are run on every commit but only new migration files are pushed.
View logs for this Workflow Run ↗︎. |
BigSimmo
commented
Jul 27, 2026
Superseded by #1289. The replacement preserves the reviewed final tree in a clean one-commit branch so the token-shaped redaction fixture is absent from every PR commit; no force-push or branch deletion was used. |
Summary
#019admission/discharge source loss and#029review-fallback stubs, with a zero-tolerance quality gate for recurrence.RAG impact: behaviour change — canary pair
output/rag-retrieval-post-final.json-> exact current-head post canary pending before mergeThe protected retrieval change uses the expanded chunk query only for the measured clozapine blood-count action shape. Discharge and other red-section document lookups retain raw intent terms. Ranking scores, comparator order, clamps, and semantic reranking are unchanged.
Verification
npm run verify:cheap— PASS: 25 gates, including the full unit suite.npm run test:coverage— PASS: 399 files; 4,062 passed, 2 skipped; RAG coverage 86.83% statements and 90.79% lines.npm run eval:rag:offline— PASS: 36 cases, 21 suites, 560 assertions.npm run check:production-readiness— PASS: 8 checks, no blockers; two isolated-worktree environment-location warnings.npm run check:migration-role— PASS.npm run verify:pr-local— merge gate. It passed on the pre-upstream-merge implementation tree; exact reconciled-head rerun is waiting for the repository's current exclusive browser lease and install alignment.npm run eval:retrieval:quality— merge gate. Prior 36-case live evidence passed with document/content recall 1.0 and zero per-case reciprocal-rank regressions; exact current-head canary remains pending.npm run eval:rag -- --limit 15+npm run eval:quality -- --rag-only— superseded by the recorded full 44-case answer gate above; no weaker sample is claimed.npm run verify:ui— UI verification not run: no UI, routing, styling, or browser-rendering surface changed.npm run verify:release— not run: it includes additional provider-backed release work; exact-head PR-local, the protected retrieval canary, and hosted required checks are the scoped merge gates.npm run check:production-readiness— result recorded above.npm run check:deployment-readiness— not run: deployment startup and hosting configuration were unchanged.Earlier
npm run typecheckpassed before the final narrowed chunk-query patch; exact-head typechecking is included in the pendingverify:pr-localrerun.Risk and rollout
mainwill follow the repository's normal application/worker auto-deploy path.Migration
20260727010000_bmj_third_party_source_attestation.sqlis a separate, deliberate operator step and must not be applied automatically. Until applied, legacy owner-scoped review behavior remains available and v2-only public/attestation requests fail closed with503 source_review_v2_unavailable.Clinical Governance Preflight
Clinical KB Database(sjrfecxgysukkwxsowpy)Notes
33a69d4dbf7818e896c42bf58f1967a1652c2530.clinical_validation_status=unverified; qualified human review, hosted apply, attestation, and warning-rate remeasurement remain#022.#023.#018.