chore(ci): harden verification & PR policy guards (archives ledger IDs 149, 159, 167, 178, 204, 230, 252)

[BigSimmo]

Motivation

• Close several verification and policy gaps so local and CI gates fail closed on real violations rather than reporting green by skipping intended checks.
• Prevent repo-owned PR body templates from silently overwriting unrelated PR descriptions and make that sync fail-safe.
• Surface mixed-risk PRs (operational + clinical/UI) as an auditable advisory so authors notice risky bundling without introducing an immediate merge block.

Description

• Harden PR body sync so .github workflow applies PR_POLICY_BODY.md only when that file was added by the current PR head and skip otherwise (changes in .github/workflows/ci.yml).
• Strengthen the CI workflow guard to assert the PR-file diff check and require the status === "added" condition before applying the template (edited scripts/check-pr-policy-workflow.mjs).
• Add advisory mixed-risk signaling to evaluatePullRequestPolicy (edited scripts/pr-policy.mjs) and update outstanding-issues rows to mark ledger items 149, 159, 178, and 230 resolved with audits and proofs of the fixes (updated docs/outstanding-issues.md).

Testing

• npm run check:pr-policy — passed with: [pr-policy] self-test passed and PR policy workflow guard passed.
• Workflow-contract mutation-proof: weakening the PR body diff-status guard and running node scripts/check-pr-policy-workflow.mjs produced the expected failure and exit (captured output: PR policy workflow guard failed: - sync-pr-policy-body must run only when PR_POLICY_BODY.md was added by the current PR diff.; exit code 1).
• Other checks executed and passing: node scripts/check-outstanding-issues.mjs, npm run lint, npm run format.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in:28 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: ebfed727-9696-45f4-8a02-60dae394d1ce

📥 Commits

Reviewing files that changed from the base of the PR and between 452abb6 and 62a0b25.

📒 Files selected for processing (4)

• .github/workflows/ci.yml
• docs/branch-review-ledger.md
• scripts/check-pr-policy-workflow.mjs
• scripts/pr-policy.mjs

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:4d0f60e0f9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BigSimmo]

@codex resolve actionable Codex review findings for this pull request and current head using the repository instructions. This is the pull request's single automatic repair pass: do not perform a fresh review, create new standalone findings, or request another review. Work only the existing unresolved Codex threads on the current head. The only repository destination is BigSimmo/Database, and the only branch destination is the pull request head branch codex/implement-verification-policy-changes-for-multiple-tasks at starting commit 4d0f60e; never publish fixes to a detached or synthetic work branch and never create a stacked pull request. Use the authenticated GitHub connector to commit each approved fix to BigSimmo/Database:codex/implement-verification-policy-changes-for-multiple-tasks, then verify that the pull request head contains the published commit before reporting success. Always fix P0 and P1 findings. For P2 and lower findings, fix only clear, scoped, low-risk issues; otherwise disposition them with a concise reason. For a fixed thread, reply with as the first line and as the second line. For a no-code disposition, use followed by . These result markers authorize the workflow to close that exact thread only after it verifies a fixed commit is the pull request head; a local-only commit is not a fix. If publication or verification fails, do not use either result marker, do not claim success, and leave the thread open with the blocker. If human input or new authorization is required, do the same. Finish only after every actionable thread is fixed or dispositioned and closed, or explicitly left open for a human decision. Do not update the branch from main, address unrelated reviews, broaden scope, or create more than one scoped fix commit. Do not use external APIs, paid services, credentials, dependency changes, or broad refactors unless explicitly authorized. Add targeted tests where behavior changes and run the narrowest relevant validation.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit:4d0f60e0f9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Hardens PR-policy automation and records resolved verification work.

Changes:

• Restricts PR body syncing to newly added templates.
• Adds advisory mixed operational/clinical/UI risk warnings.
• Archives four outstanding-work entries.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/ci.yml	Guards PR body synchronization.
scripts/check-pr-policy-workflow.mjs	Enforces the new workflow condition.
scripts/pr-policy.mjs	Adds mixed-risk advisories and self-tests.
docs/outstanding-issues.md	Archives resolved ledger items.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.