feat(observability): privacy-safe @sentry/nextjs SDK setup

[BigSimmo]

Summary

• Install @sentry/nextjs and wire the Next.js recommended first-error baseline (errors + tracing) across Node, Edge, and browser runtimes.
• Keep capture fully inert without SENTRY_DSN / NEXT_PUBLIC_SENTRY_DSN (no SDK import / no egress when unset).
• Enforce the clinical privacy boundary: strip request payloads, breadcrumbs, and user identity; tunnel browser envelopes through /monitoring so CSP connect-src 'self' stays intact; do not enable Session Replay (DOM would capture clinical query text).
• Restore answer-path observability hooks for server-fault (>=500) failures and answer_generation_fallback (the GEN-C1 blind spot), with redacted exception messages and operational context only.
• Update outstanding-issue #028 to the remaining DSN / MCP verification / Railway secret steps.

RAG impact: no retrieval behaviour change — observability-only capture around existing answer/fallback paths; ranking, selection, and synthesis are unchanged.

Verification

• Focused Sentry suites: tests/error-capture.test.ts, tests/sentry-client.test.ts, tests/instrumentation.test.ts — 28/28 passed
• npm run typecheck — clean
• npx eslint on touched files — clean (--max-warnings 0)
• npm run format
• npm run check:knip — clean
• npm run check:env-parity — OK
• npm run docs:check-index — OK
• npm run test — 4660 passed, 2 failed in tests/codex-cloud-setup.test.ts (pre-existing origin-credentials environment issue; unrelated to Sentry)
• npm run verify:pr-local — dry-run selects runtime/lock/format/lint/typecheck/test/build/eval:rag:offline; full gate not re-run after the unit suite
• UI verification not run: no UI/routing/styling behaviour change beyond error-boundary capture hooks

Risk and rollout

• Risk: Optional third-party egress when DSNs are configured. Mitigated by scrubbers, same-origin tunnel, inert-without-DSN default, and no Session Replay / local-variable capture.
• Rollback: Unset SENTRY_DSN / NEXT_PUBLIC_SENTRY_DSN (immediate inert), or revert this PR.
• Provider or production effects: None until DSNs and (optionally) SENTRY_AUTH_TOKEN / org / project are set in Railway/local secrets. Source-map upload requires build-time SENTRY_AUTH_TOKEN.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed — N/A (observability only; no decision-support behaviour change)

Notes

• Sentry MCP could not authenticate in this Cloud Agent environment, so project provisioning and live event verification are blocked until the Sentry MCP is connected in Cursor desktop (or DSNs are provided).
• Follow-up once a DSN exists: set env vars, trigger a real app error, confirm the issue in Sentry, then configure production/Railway secrets + source maps.
• Session Replay, logging, profiling, and AI monitoring were deferred (first-error scope + clinical privacy).

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 644675aa-58a8-45a2-80c3-3bdfbfb4e6df

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[BigSimmo]

Temporarily closing to preserve the serialized merge queue while #1510 completes its final exact-head UI shard. This PR will be reviewed in a later queue slot.

[BigSimmo]

@cursoragent Prep this closed PR for reopen. Leave it CLOSED. Do not merge, reopen, force-push, rebase, or arm auto-merge.

Do only this, in order:

1. Snapshot

   • Branch tip, base, behind/ahead vs origin/main, mergeable state.
   • Unresolved review threads (Codex / Bugbot / Copilot / human).
   • Failing checks: on the current tip, or stale closed-PR rollup.
   • High-risk surfaces touched (auth, privacy, migrations/RLS, clinical/RAG/retrieval, workers, production/config, provider calls).
   • Run npm run ledger:lookup -- <branch> --scope "closed-PR reopen prep". If already reviewed at this HEAD and still merge-clean with no open threads, summarize and stop unless something new needs fixing.

2. Sync once

   • Fetch origin/main.
   • Use git merge-tree to tell real conflicts from behind-but-clean.
   • Merge main only if needed; resolve with the smallest correct fix.
   • For ledger/issues churn conflicts: prefer main’s shared queues, preserve this PR’s intentional notes.

3. Review the tip vs base

   • Findings-first, high-confidence only: correctness, security, privacy, auth, data loss, migrations/RLS, clinical/RAG/source behavior, production reliability, user-facing regressions.
   • For each finding: severity, file/line, failure mode, smallest fix.
   • Skip formatting/naming/speculative nits unless they are a real defect.
   • Check PR title/body still accurate for this tip (RAG impact / Clinical Governance only if this PR’s risk class requires them). Don’t rewrite for polish.

4. Threads + fixes

   • For each unresolved actionable review/Bugbot comment, or each new P0–P2 finding: implement the smallest fix, or disposition as already-fixed / not-actionable with a short reply, then resolve.
   • Ignore bot rate-limit / summary noise.
   • Do not broad-refactor.

5. Tip hygiene

   • No secrets, junk, or unrelated WIP.
   • Don’t push a tip whose only delta is a review-ledger append.

6. Confirm ready + handoff

   • merge-tree clean vs origin/main.
   • No unresolved actionable threads.
   • Push the branch. Leave closed.
   • Append ledger: npm run ledger:append for this HEAD and scope "closed-PR reopen prep".
   • Report: tip SHA, sync/conflict outcome, findings fixed or dispositioned, residual risks, and that fresh mergeability/required CI apply only after reopen.

Treat closed-PR CI as stale until reopen. Do not run local test suites CI will cover unless needed to prove a specific fix.

[cursor]

Closed-PR reopen prep is done. PR #1516 stays CLOSED (draft). No merge, reopen, force-push, rebase, or auto-merge.

Snapshot → sync → review

Item	Result
Branch tip (pushed)	77abab1f4cea394410c4849b43ab57175a38914e
Product tip (reviewed)	1b29f04bcdd22af8eb5bcf06ade0437c51d55272
vs origin/main (49aee229)	0 behind / 7 ahead; git merge-treeCLEAN
Unresolved threads	None
Closed-PR CI	Stale until reopen (API still pins closed head 2df054b9; Build failure on that rollup is not tip CI)
High-risk surfaces	Privacy scrubbing, answer/RAG observability hooks, production/config (Sentry env), optional provider egress when DSN set — no migrations/RLS/workers

Sync: Merged origin/main once. Real conflict only in docs/outstanding-issues.md — kept main’s queues, preserved this PR’s #028 notes (a6172d74).

Findings fixed

1. P1 — clinical query leak via tracing — tracesSampleRate: 0 everywhere; no router-transition spans; scrubber also strips span URL fields / redacts exception values (747371b4).
2. P2 — client capture forwarded raw errors — client path now sends a fixed "Client request failed" message (747371b4).

Focused Sentry suites: 28/28 (only proof run for those fixes). No broad local suites.

Tip hygiene / handoff

• Branch pushed: 2df054b9..77abab1f on cursor/sentry-nextjs-sdk-7cee.
• Ledger appended for product tip 1b29f04b, scope "closed-PR reopen prep", outcome ready-for-reopen (tip 77abab1f = that row only; not a ledger-only product push).
• Worktree clean; PR left CLOSED.

Residual / on reopen

• GitHub closed-PR metadata still shows head 2df054b9 while the branch is 77abab1f — expected until reopen; then fresh mergeability + required CI apply.
• PR body still says “errors + tracing”; tip is errors-only (tracing off). Closed-PR body edits are blocked here — update Summary on reopen.
• Remaining product follow-up unchanged: DSN / Sentry MCP verify / Railway secrets (#028).