Complete high-yield reliability safeguards

[BigSimmo]

Summary

• Complete six high-yield ledger items with minimal, scoped changes: clear Services filters from both UI state and the URL; normalize private client bearer identity; parse dash-prefixed branch-ledger values; remove the stale narrow results-header breakpoint; strengthen the design-system ErrorState contract; and verify the full installed dependency tree plus structural reuse stamps.
• Add focused regression coverage for each changed contract and preserve existing architecture and dependencies.
• Ledger scope completed: #149, #273, #274, #289, #298, and #303.

RAG impact: no retrieval behaviour change - this PR changes UI query cleanup, client auth-header normalization, design-system contracts, ledger parsing, and local dependency verification only.

Verification

• npm run verify:pr-local - partial on exact integrated head 76f8b4e6a5742700ed3ed77b45e591062111e111: runtime, installed-lock parity (755 package locations / 51,732 files), changed-file formatting, npm-ci dry run, sitemap/docs checks, both ledger checks, lint, and typecheck passed. Full Vitest then stopped on 16 Windows-baseline failures in bundle-budget.test.ts and pr-handoff-stop.test.ts; build and RAG fixtures were not reached.
• Focused unit/contract tests for installed-lock parity, design-system contracts, auth, repository hygiene, setup, and results-header behavior passed.
• Focused Chromium browser proof passed: document-results width sweep from 320-540 px (1 passed) and the Services phone Clear-filter URL flow (1 passed).
• The same 16 Vitest failures were reproduced on an untouched cached-main worktree: 2 test files failed, 16 tests failed, and 22 passed in the targeted baseline comparison.
• npm run check:production-readiness - local Node and query-hash boot-guard safeguards passed, but the isolated worktree has no copied .env.local; Supabase/OpenAI provider configuration was therefore environment-gated and the command exited 1.

UI verification not run: the broad npm run verify:ui gate was not run because the two directly affected Chromium journeys passed focused proof; the change does not alter shared UI foundations.

Verification not run: npm run verify:release was not run because this is a draft PR handoff, not a release-confidence claim. Live retrieval/answer evaluations were not run because retrieval, ranking, synthesis, and clinical answer behavior are unchanged.

Risk and rollout

• Risk: Low-to-medium. Client authentication now derives the bearer identity through one shared helper, and dependency reuse validation scans the complete installed tree; regressions would appear as private-client authorization failures or slower/stricter local setup validation.
• Rollback: Revert commit 8374c3b66 (or the PR merge) to restore the prior behavior; there is no schema migration, dependency version change, or persisted-data transformation.
• Provider or production effects: None. This handoff only pushes a Git branch and opens a draft PR; it does not deploy, migrate, access clinical records, or call Supabase/OpenAI providers.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Notes

• Opened as draft because the final PR-local gate is partial on Windows and provider readiness is unavailable in this isolated worktree.
• Ledger item #296 and ledger-file mutations remain deferred because the original checkout contains overlapping concurrent edits; they are intentionally not included here.

Summary by CodeRabbit

• Bug Fixes

  • Improved mobile search-result layouts so inline controls remain usable on narrow screens without awkward wrapping.
  • Clearing service filters now consistently resets the search and returns to the unfiltered Services page.
  • Standardized authorization handling across document and signed-image requests for more reliable access.

• Quality Improvements

  • Enhanced validation for failed-state messaging and installed dependency integrity.
  • Expanded automated coverage for responsive layouts, filtering behavior, authorization, and dependency checks.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR adds complete installed-tree parity checks, extends design-system contract auditing, centralizes authorization-header handling, refines mobile search layouts and clearing, and improves branch-review flag parsing.

Changes

Installed dependency parity

Layer / File(s)	Summary
Installed tree parity checker scripts/check-installed-lock-parity.mjs	The checker compares lockfile metadata, package locations, file inventories, tracked file sizes, and trusted stamps.
Installation workflow integration package.json, scripts/setup-codex-worktree.mjs, scripts/phone-chrome-plan.mjs	Postinstall writes the parity stamp. Worktree setup uses complete-tree parity. The plan text reflects this validation.
Parity validation tests/installed-lock-parity.test.ts, tests/setup-codex-worktree.test.ts	Fixtures and tests cover nested drift, missing or empty files, ignored caches, and stamped installations.

Design-system contract checks

Layer / File(s)	Summary
Error-state contract analyzers scripts/design-system-contract-utils.mjs	New analyzers detect count-bearing ErrorState props and result counts rendered in failure branches.
Contract reporting and baseline scripts/check-design-system-contract.mjs, scripts/design-system-contract-baseline.json, docs/design-system/GATES.md, docs/design-system/adoption-manifest.json	The checker records and reports the new metrics. The baseline and adoption manifest include the new contract coverage.
Analyzer tests tests/design-system-contract-utils.test.ts	Tests cover literal and dynamic counts, TSX filtering, failure branches, and valid non-failure messages.

Authorization identity normalization

Layer / File(s)	Summary
Shared authorization helper src/lib/authorization-header.ts, src/lib/supabase/client.tsx	The exported helper normalizes lowercase and uppercase authorization headers and handles missing headers.
Request consumers and tests src/components/DocumentViewer.tsx, src/components/clinical-dashboard/use-signed-image-url.ts, tests/private-client-auth.test.ts	Document and signed-image requests use the shared helper. Tests cover header variants and absence.

Mobile search behavior

Layer / File(s)	Summary
Search-header responsive layout src/components/clinical-dashboard/search-results-header-band.tsx, tests/search-results-header-band.dom.test.tsx, tests/ui-smoke.spec.ts	Inline controls remain on one row at phone widths, while the tests check truncation and viewport containment.
Service-query clearing src/components/services/services-navigator-page.tsx, tests/ui-tools.spec.ts	Desktop and mobile clear actions reset local state and navigate to the unfiltered services route.

Branch review flag parsing

Layer / File(s)	Summary
Flag parser behavior scripts/branch-review-ledger.mjs, tests/repo-hygiene.test.ts	parseFlags is exported and supports inline assignments, boolean flags, and values beginning with --.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• BigSimmo/Database#1279: Directly shares the installed lock-parity checker, setup workflow, package scripts, tests, and phone-chrome plan.
• BigSimmo/Database#897: Directly shares the design-system contract checker, utilities, baseline, and tests.
• BigSimmo/Database#596: Shares repository-hygiene tooling and parseFlags test coverage.

Suggested reviewers:claude

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 18.75% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the PR’s broad focus on reliability safeguards across UI, auth, dependency validation, and design-system contracts.
Description check	✅ Passed	The description is complete and covers the summary, verification results, risks, rollback, provider effects, governance checks, and deferred work.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/chat-ledger-quick-wins-ledger-quick-wins

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install failed: dependency version conflict. Check your lock file or package.json.

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:76f8b4e6a5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BigSimmo]

@codex resolve actionable Codex review findings for this pull request and current head using the repository instructions. This is the pull request's single automatic repair pass: do not perform a fresh review, create new standalone findings, or request another review. Work only the existing unresolved Codex threads on the current head. The only repository destination is BigSimmo/Database, and the only branch destination is the pull request head branch codex/chat-ledger-quick-wins-ledger-quick-wins at starting commit 76f8b4e; never publish fixes to a detached or synthetic work branch and never create a stacked pull request. Use the authenticated GitHub connector to commit each approved fix to BigSimmo/Database:codex/chat-ledger-quick-wins-ledger-quick-wins, then verify that the pull request head contains the published commit before reporting success. Always fix P0 and P1 findings. For P2 and lower findings, fix only clear, scoped, low-risk issues; otherwise disposition them with a concise reason. For a fixed thread, reply with as the first line and as the second line. For a no-code disposition, use followed by . These result markers authorize the workflow to close that exact thread only after it verifies a fixed commit is the pull request head; a local-only commit is not a fix. If publication or verification fails, do not use either result marker, do not claim success, and leave the thread open with the blocker. If human input or new authorization is required, do the same. Finish only after every actionable thread is fixed or dispositioned and closed, or explicitly left open for a human decision. Do not update the branch from main, address unrelated reviews, broaden scope, or create more than one scoped fix commit. Do not use external APIs, paid services, credentials, dependency changes, or broad refactors unless explicitly authorized. Add targeted tests where behavior changes and run the narrowest relevant validation.

[chatgpt-codex-connector]

Summary

• Preserved the explicitly cleared Services query across both the source and destination URL states, preventing the default “Best fit” query from reappearing after navigation to /services. src/components/services/services-navigator-page.tsxL558-L571src/components/services/services-navigator-page.tsxL613-L625
• Strengthened installed dependency reuse validation by hashing every installed file’s contents and each symlink target, with a new stamp schema to invalidate older structural-only stamps. scripts/check-installed-lock-parity.mjsL2-L10scripts/check-installed-lock-parity.mjsL121-L161scripts/check-installed-lock-parity.mjsL217-L226
• Added a regression test proving that a same-length mutation to an ordinary dependency implementation invalidates installed-tree parity. tests/installed-lock-parity.test.tsL121-L134
• Updated failed-state result-count detection to determine condition polarity and inspect false conditional branches and else branches, including negated failure conditions. scripts/design-system-contract-utils.mjsL1424-L1451scripts/design-system-contract-utils.mjsL1455-L1496
• Added false-branch and negated-condition contract regressions. tests/design-system-contract-utils.test.tsL52-L72
• Strengthened the Services browser assertion to verify the cleared input, restored catalogue, and absence of “Best fit” after the URL changes. tests/ui-tools.spec.tsL1048-L1062
• Created scoped commit 62ba109bab624f8655cb583676e0365eceaff136 on local branch codex/chat-ledger-quick-wins-ledger-quick-wins.
• Publication is blocked:git push could not authenticate, and gh has no authenticated session. The remote PR head remains 76f8b4e6a5742700ed3ed77b45e591062111e111, so I did not post resolution markers, close the review threads, claim a fixed remote head, or create a conflicting stacked PR.

Testing

• ✅ npm run format
• ✅ npm run postinstall — regenerated the schema-2 trusted stamp for 51,566 installed files.
• ✅ node ./node_modules/eslint/bin/eslint.js src/components/services/services-navigator-page.tsx scripts/check-installed-lock-parity.mjs scripts/design-system-contract-utils.mjs tests/installed-lock-parity.test.ts tests/design-system-contract-utils.test.ts tests/ui-tools.spec.ts --max-warnings 0 --no-error-on-unmatched-pattern
• ✅ npm run test -- --run tests/installed-lock-parity.test.ts tests/design-system-contract-utils.test.ts — 46 tests passed across 2 files.
• ✅ git diff --check
• ✅ npm run ensure
• ⚠️npm run test:e2e -- tests/ui-tools.spec.ts --project=chromium --grep "phone bottom-dock search keeps the command results sheet hidden" — the repository Playwright coordinator remained blocked behind an orphaned earlier invocation and produced no completed test result; both task-owned invocations were terminated.
• ❌ git push origin HEAD:codex/chat-ledger-quick-wins-ledger-quick-wins — failed because HTTPS GitHub credentials were unavailable.
• ❌ gh pr view 1814 --repo BigSimmo/Database --json number,url,headRefName,headRefOid,title — failed because GitHub CLI is unauthenticated.

View task →

[BigSimmo]

Unblock sweep snapshot: PR is at head �6e716e7d5d554e343f91f38af57a111e7aa9b7d, compare-to-main status �head 4 / behind 0 (merge-tree clean, no merge conflicts), snapshot mergeable MERGEABLE with mergeStateStatus=BLOCKED before/after a no-code sync check. Required checks all green: PR required, PR mergeability, PR policy, Build, Change scope, Static PR checks, and Production UI ((1)/(2)/(3) + critical) are pass. No unresolved review threads found that block merge/required CI. No blocker-fix commit was needed; state is cleared for required-CI mergeability. Residual risk: merge is still blocked by repo policy/state (mergeStateStatus=BLOCKED) despite green checks; I left that to you to arm/complete merge from your side.

[coderabbitai]

Actionable comments posted: 5

🧹 Nitpick comments (5)

tests/private-client-auth.test.ts (1)

34-39: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Cover the declared header precedence.

The helper prioritizes authorization over Authorization, but the test only checks each key separately. Add a case with conflicting values so the request-identity contract cannot regress.

Proposed regression assertion

 expect(authorizationIdentity({ authorization: "Bearer lower" })).toBe("Bearer lower");
expect(authorizationIdentity({ Authorization: "Bearer upper" })).toBe("Bearer upper");
+ expect(+ authorizationIdentity({+ authorization: "Bearer lower",+ Authorization: "Bearer upper",+ }),+ ).toBe("Bearer lower");
expect(authorizationIdentity({})).toBe("");

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tests/private-client-auth.test.ts` around lines 34 - 39, Add a
conflicting-header assertion to the authorizationIdentity test, providing
different values for authorization and Authorization and verifying the lowercase
authorization value is returned. Keep the existing casing and missing-header
assertions unchanged.

tests/installed-lock-parity.test.ts (1)

121-129: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add coverage for the two stamp-invalidation branches.

The cache test is correct. Two branches of installedTreeParity carry no coverage, and both are central to the stamp trust model:

• The schema check at scripts/check-installed-lock-parity.mjs line 206.
• The lock-digest check at scripts/check-installed-lock-parity.mjs line 209, which rejects a stamp that belongs to a different package-lock.json.

The lock-digest branch is the guard that stops a copied donor node_modules from validating against a different lockfile. scripts/setup-codex-worktree.mjs depends on it at line 237.

💚 Proposed tests

it("rejects a stamp that belongs to a different package-lock.json",()=>{constroot=treeFixture();writeFileSync(path.join(root,"package-lock.json"),JSON.stringify({lockfileVersion: 3,packages: {"node_modules/direct": {version: "1.0.0"},"node_modules/direct/node_modules/transitive": {version: "2.0.0"},},name: "changed",}),);expect(installedTreeParity(root)).toEqual(expect.objectContaining({ok: false,reason: "install stamp belongs to a different package-lock.json"}),);});it("rejects an unsupported stamp schema",()=>{constroot=treeFixture();conststampPath=path.join(root,"node_modules",".codex-installed-tree.json");conststamp=JSON.parse(readFileSync(stampPath,"utf8"));writeFileSync(stampPath,JSON.stringify({ ...stamp,schema: 99}));expect(installedTreeParity(root)).toEqual(expect.objectContaining({ok: false,reason: "install stamp schema 99 is unsupported"}),);});

Import readFileSync and export installedTreeStampName in place of the literal file name if you prefer to avoid duplicating the constant.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tests/installed-lock-parity.test.ts` around lines 121 - 129, Add tests
covering both untested stamp-validation branches in installedTreeParity: modify
package-lock.json in a treeFixture to verify a mismatched lock digest returns
ok: false with the “install stamp belongs to a different package-lock.json”
reason, and modify the generated stamp’s schema to an unsupported value to
verify the corresponding rejection reason. Import readFileSync and reuse the
exported installedTreeStampName constant instead of duplicating the stamp
filename where applicable.

scripts/setup-codex-worktree.mjs (1)

39-50: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Consider removing the dead packageNames plumbing.

installedTreeParity validates the complete tree, so per-package filtering is obsolete. installationIsComplete now discards packageNames with void packageNames. findDependencyDonor at line 60 still accepts and forwards the parameter, and main at line 214 already omits it.

Dropping the parameter from both functions removes the dead path. This changes the exported signature, and tests/setup-codex-worktree.test.ts line 83 passes ["next"], so update the test in the same change. Defer this if you prefer to keep the signature stable for now.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/setup-codex-worktree.mjs` around lines 39 - 50, Remove the obsolete
packageNames parameter and its void discard from installationIsComplete and
findDependencyDonor, updating their callers to use the new signatures while
preserving complete-tree validation via installedTreeParity. Update the
setup-codex-worktree test to stop passing the per-package array.

tests/search-results-header-band.dom.test.tsx (1)

300-304: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Assert the new shrink-0 contract directly.

The component change at src/components/clinical-dashboard/search-results-header-band.tsx Line [449] prevents utilities from shrinking. This test does not assert that class. Add expect(utilities).toContain("shrink-0") so the focused regression test detects a return of the clipping behavior.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tests/search-results-header-band.dom.test.tsx` around lines 300 - 304, Update
the test assertions for utilities to directly verify the new non-shrinking
contract by adding a positive assertion that utilities contains "shrink-0". Keep
the existing negative utility checks and rowClass assertions unchanged.

src/components/clinical-dashboard/search-results-header-band.tsx (1)

296-301: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Move the phone ribbon height to a named token.

Line [301] uses the arbitrary min-h-[3.625rem] design value in TSX. Define the measured phone height as a Tailwind 4 @theme token or an intentionally unlayered component CSS class, then use that named value here.

As per coding guidelines, “Use Tailwind 4 @theme tokens in src/app/globals.css and the repository's intentionally unlayered component CSS rather than introducing hardcoded design values.”

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/components/clinical-dashboard/search-results-header-band.tsx` around
lines 296 - 301, Replace the arbitrary min-h-[3.625rem] value in the
inlineControls class within the search-results header component with a named
phone-ribbon height token. Define the measured 3.625rem value in the established
Tailwind 4 `@theme` section of globals.css or an intentionally unlayered component
CSS class, then reference that named utility/class here.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Line 14: Update the postinstall flow around check-installed-lock-parity.mjs
and writeInstalledTreeStamp so pruned installs with omitted dev dependencies do
not fail on the expected lockfile mismatch. Skip or gracefully handle stamping
for this case, but ensure install-git-hooks.mjs still runs and preserve the
existing full-install fallback when the stamp is absent.
In `@scripts/branch-review-ledger.mjs`:
- Line 394: Update parseFlags so equals-form values for BOOLEAN_FLAGS are
handled before generic inline assignment: convert only "true" and "false" to
booleans, and reject any other value. Apply this consistently to json,
supersede, and dry-run while preserving existing non-boolean flag parsing, and
add focused coverage for each flag.
In `@scripts/check-installed-lock-parity.mjs`:
- Around line 212-218: Update the failure handling around
installedMetadataMatches and packageFailures so location failures and
hidden-lock metadata mismatches produce separate operator-facing reasons. Report
the actual packageFailures count only when locations fail; when metadata
mismatches without location failures, use a reason identifying the metadata
mismatch instead of fabricating a location count. Preserve packageLocations in
the returned failure object.
- Around line 139-142: Update the skip condition in the walk logic so
installedTreeStampName and VOLATILE_DIRECTORIES entries are ignored only when
relativeDirectory is empty, while preserving normal traversal and inventory of
matching entries in nested dependency directories.
In `@scripts/design-system-contract-utils.mjs`:
- Around line 1383-1385: Update the count-bearing matcher used by the ErrorState
helper at scripts/design-system-contract-utils.mjs:1383-1385 to detect plain
total when paired with result nouns, including copy such as “total results,”
while preserving existing count and member-property matches. Apply the same
paired-total detection in the failure-branch JSX logic at
scripts/design-system-contract-utils.mjs:1419-1424. Add regression cases
covering plain total and .total for both helpers in
tests/design-system-contract-utils.test.ts:29-65.
---
Nitpick comments:
In `@scripts/setup-codex-worktree.mjs`:
- Around line 39-50: Remove the obsolete packageNames parameter and its void
discard from installationIsComplete and findDependencyDonor, updating their
callers to use the new signatures while preserving complete-tree validation via
installedTreeParity. Update the setup-codex-worktree test to stop passing the
per-package array.
In `@src/components/clinical-dashboard/search-results-header-band.tsx`:
- Around line 296-301: Replace the arbitrary min-h-[3.625rem] value in the
inlineControls class within the search-results header component with a named
phone-ribbon height token. Define the measured 3.625rem value in the established
Tailwind 4 `@theme` section of globals.css or an intentionally unlayered component
CSS class, then reference that named utility/class here.
In `@tests/installed-lock-parity.test.ts`:
- Around line 121-129: Add tests covering both untested stamp-validation
branches in installedTreeParity: modify package-lock.json in a treeFixture to
verify a mismatched lock digest returns ok: false with the “install stamp
belongs to a different package-lock.json” reason, and modify the generated
stamp’s schema to an unsupported value to verify the corresponding rejection
reason. Import readFileSync and reuse the exported installedTreeStampName
constant instead of duplicating the stamp filename where applicable.
In `@tests/private-client-auth.test.ts`:
- Around line 34-39: Add a conflicting-header assertion to the
authorizationIdentity test, providing different values for authorization and
Authorization and verifying the lowercase authorization value is returned. Keep
the existing casing and missing-header assertions unchanged.
In `@tests/search-results-header-band.dom.test.tsx`:
- Around line 300-304: Update the test assertions for utilities to directly
verify the new non-shrinking contract by adding a positive assertion that
utilities contains "shrink-0". Keep the existing negative utility checks and
rowClass assertions unchanged.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: f6c62da0-63af-4b3b-8140-3ceb0c13f064

📥 Commits

Reviewing files that changed from the base of the PR and between 99a365f and 1300f61.

📒 Files selected for processing (24)

• docs/design-system/GATES.md
• docs/design-system/adoption-manifest.json
• package.json
• scripts/branch-review-ledger.mjs
• scripts/check-design-system-contract.mjs
• scripts/check-installed-lock-parity.mjs
• scripts/design-system-contract-baseline.json
• scripts/design-system-contract-utils.mjs
• scripts/phone-chrome-plan.mjs
• scripts/setup-codex-worktree.mjs
• src/components/DocumentViewer.tsx
• src/components/clinical-dashboard/search-results-header-band.tsx
• src/components/clinical-dashboard/use-signed-image-url.ts
• src/components/services/services-navigator-page.tsx
• src/lib/authorization-header.ts
• src/lib/supabase/client.tsx
• tests/design-system-contract-utils.test.ts
• tests/installed-lock-parity.test.ts
• tests/private-client-auth.test.ts
• tests/repo-hygiene.test.ts
• tests/search-results-header-band.dom.test.tsx
• tests/setup-codex-worktree.test.ts
• tests/ui-smoke.spec.ts
• tests/ui-tools.spec.ts

[BigSimmo]

PR #1814 head is now at 1300f619de3f7e1a090fe86ca1ce51c1b0c00846.

Status snapshot:

• mergeable_state = CLEAN (mergeStateStatus now CLEAN).
• merge-tree / branch distance: no conflict, branch synced to main (behind-only update applied).
• required checks: all passing (PR policy, PR mergeability, PR required, Build, Static PR checks, Production UI*, Unit coverage, security/sast checks, change scope, migration replay, etc.).
• blocking threads: all unresolved non-outdated review threads on this PR have been resolved (bot suggestions).

Blockers handled:

• Sync behind-main.
• Required review thread-resolution rule via 5 unresolved review threads.

No code blocker edits were needed for mergeability at this unblock step.

Residual risk:

• Auto-merge has not fired yet; PR remains OPEN and may still need your merge action.
• If you want, I can also review if any resolved threads should actually be implemented, but mergeability now appears clear.