feat(therapy): ship Therapy in production with its review state disclosed

[BigSimmo]

Summary

• Therapy now appears in the modes in production, instead of being hidden behind three separate gates. Only the first of the three was visible: devOnly: true in src/lib/app-modes.ts removed Therapy from every mode list; the /therapy-compass route layout returned a not-found response in production; and therapyRecordsForEnvironment filtered out every record whose reviewStatus was not reviewed — all 205 of them — so each detail, brief and patient-sheet route, plus every universal-search therapy result, 404'd for real users while working normally in local development. Removing only the first gate would have shipped a Therapy mode onto an empty library, so all three are removed together.
• The review state is now disclosed rather than used to hide the library. The gates existed because the therapy catalogue awaits qualified-clinician sign-off. That remains true and is now stated to the reader: a new TherapyReviewNotice sits above the Therapy home hero, non-interactive and not dismissible, reading "Awaiting clinician review. No therapy record in this library has completed clinician review yet. Records are shown so they can be read and checked against their cited sources — verify each one before using it clinically."
• The notice cannot drift away from the data.scripts/build-therapies-index.mjs now emits needsReviewCount into the generated catalogue summary and compares it in its existing check mode, so the wording changes to "N of 205 therapy records have not completed clinician review yet" on its own as records are signed off, and the notice disappears entirely once none remain.
• Every per-record review badge is retained. Result cards, detail pages, briefs, patient sheets, comparisons, pathways, and the universal-search "Needs source review" badge all continue to render from reviewStatus. therapyNeedsReview survives as the label source only; it no longer gates reachability anywhere.
• The offline bypass is retired with the gate it served.PLAYWRIGHT_OFFLINE_MODE handling in the Therapy route layout and in src/lib/therapies.ts existed only to let offline UI verification reach the gated route. A bypass left behind an absent gate is how a half-restored gate passes locally and 404s in production, so it goes with the gate.
• The contracts that pinned the old behaviour now pin the new one, so neither half can be silently undone: reachability in tests/app-modes.test.ts, the catalogue notice and the per-record badges in tests/therapy-review-regressions.test.ts, and the retired bypass in tests/therapy-pr-unblocking-contract.test.ts.

Verification

• npm run verify:pr-local
• npm run format over the whole tree, with the result committed.
• Focused contracts, re-run after formatting: tests/app-modes.test.ts, tests/therapy-review-regressions.test.ts, tests/therapy-ranking.test.ts, tests/therapy-pr-unblocking-contract.test.ts, tests/therapy-compass-mode-wiring.test.ts, tests/therapy-source-governance.test.ts, tests/route-reachability.test.ts — 7 files passed, 77 tests passed.
• Full offline unit suite: 669 files passed, 7255 tests passed. Three failures appeared in that parallel run, in tests/codex-cloud-setup.test.ts and tests/http-readiness.test.ts — both unrelated to this diff (a Codex Cloud environment contract and a local HTTP socket-timing check). Both files were then re-run in isolation twice: they pass at the pre-change HEAD and they pass with this change applied, so those three were load-related timing flakes rather than damage from this work.
• npx tsc --noEmit clean, and ESLint clean across all twelve changed files.
• npm run design-system:adoption:update — manifest unchanged (54 components, 67 roots).
• Checked against the running app: /therapy-compass, /therapy-compass/cognitive-behavioural-therapy-cbt, /therapy-compass/search and /therapy-compass/review all return 200; the new notice renders above the hero with the correct warning design tokens and no horizontal overflow; and the record page resolves its title server-side through findTherapyRecord, which is the exact call the old production filter used to fail.

UI verification not run: npm run verify:ui was not run. Another worktree held the repository coordinator's exclusive heavy lock for a long Chromium run throughout this session, and preempting another session's Playwright run to take that lock is precisely what the coordinator exists to prevent. The affected journey was proven directly against the running app as described above, and CI's Production UI job covers the shared Chromium gate for this PR.

Note on the visual baseline: tests/__screenshots__/linux/therapy-compass-home.png will show legitimate pixel drift, because the new review notice genuinely changes that page. Per tests/__screenshots__/README.md that comparison is advisory — it produces a workflow warning rather than a failed check, it runs post-land, weekly or manually rather than on pull requests, and only linux/ baselines gate anything, so it cannot be refreshed from this Windows workstation. The baseline should be refreshed from the visual-baseline-<run_id> CI artifact after this lands.

Risk and rollout

• Risk: 205 therapy records that have not completed qualified-clinician review become reachable to users in production, where they were previously absent entirely. This is a deliberate, owner-approved change of posture — from hiding unreviewed clinical content to disclosing its review state — and it is the substantive risk in this PR. It is mitigated by disclosure at two levels, both now covered by contract tests: a catalogue-wide notice that cannot be dismissed, and a per-record badge on every surface that renders a record, including discovery outside the mode. No record is presented as reviewed, validated, or clinically endorsed. The application's standing framing as a clinical reference prototype rather than validated clinical decision support is unchanged.
• Rollback: revert this single commit. That restores devOnly: true, the route-layout not-found gate, and the production review filter together, returning Therapy to hidden in production. No data migration or other cleanup is required.
• Provider or production effects: None. No Supabase, OpenAI, or other provider-backed command was run for this change, and no provider configuration, credential, schema, or environment value is touched.

Clinical Governance Preflight

This section is included deliberately. classifyPullRequestFiles reports clinicalRisk: false for this file set, because the clinical-risk patterns match the therapy data files and public catalogue assets rather than the modules changed here, so policy does not require this section. The change nevertheless governs whether clinical content reaches users at all, which is squarely the judgement this checklist exists to record.

• Source-backed claims still require linked source verification before clinical use
  • Stated more explicitly than before, both in the new catalogue notice ("checked against their cited sources — verify each one before using it clinically") and in the strengthened Therapy home footer, which now reads "check each record's review status and cited sources before clinical use".
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
  • No patient data path, upload path, or identifiable-content workflow is touched by this change.
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
  • Unchanged. No Supabase configuration, migration, or environment value is touched.
• Service-role keys and private document access remain server-only
  • Unchanged. No key handling, authorization, or owner-scoping code is touched. The therapy catalogue is public static content and was already served from /therapy-compass-data in production.
• Demo/synthetic content remains clearly separated from real clinical sources
  • Unchanged. This change does not alter demo-mode detection or the synthetic corpus, and the therapy catalogue is real source-grounded content in both modes.
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
  • Review status is preserved end to end and is now surfaced more prominently than before. What changes is that an unreviewed record is disclosed as unreviewed rather than removed; nothing is upgraded, defaulted, or inferred to "reviewed", and therapyNeedsReview still returns true for any record whose status is not exactly reviewed.
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed
  • Checked. No decision-support logic, ranking, scoring, or recommendation behaviour changes here; the diff changes reachability and disclosure only. Therapy records remain reference material that the reader must verify against cited sources, and the product's existing classification framing is unchanged by this PR.

RAG impact: no retrieval behaviour change — the diff touches no protected RAG surface. classifyPullRequestFiles reports ragRanking: false. src/lib/therapies.ts changes only which records are handed to the existing local catalogue scorer; rankTherapyCandidates itself and the ordering it produces are untouched, as are src/lib/rag/**, clinical-search, retrieval-selection, answer-ranking, ranking-config, the eval harness and the golden fixture. tests/therapy-ranking.test.ts continues to assert that catalogue ordering and universal-discovery ordering agree for the same queries.

Notes

• The three gates were added together while the catalogue awaited sign-off, and they are removed together for the same reason. The detail worth keeping for a future reader is that they were independent: only the mode-list flag was visible, and removing it alone would have produced a mode that opens onto an empty library with every record 404ing.
• docs/codebase-index.md records the decision, the three gates it replaced, and where each half of the disclosure is pinned.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your current included review allowance is based on your included PR review attempts over the past 7 days.

Next review available in:59 minutes

Limit details: You’ve used the included review currently available. Your 102 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 8b4b68d8-e601-4551-bc62-3d944e57cedd

📥 Commits

Reviewing files that changed from the base of the PR and between 6801932 and d8619ab.

📒 Files selected for processing (13)

• docs/branch-review-records/730c1139a3494d1af3269ee1091efae428933fc910dc3da951590bdc62190344.record.md
• docs/codebase-index.md
• scripts/build-therapies-index.mjs
• src/app/(search-app)/therapy-compass/layout.tsx
• src/components/therapy-compass/data/generated-assets.ts
• src/components/therapy-compass/screens/home-screen.tsx
• src/components/therapy-compass/therapy-review-notice.tsx
• src/lib/app-modes.ts
• src/lib/therapies.ts
• tests/app-modes.test.ts
• tests/therapy-pr-unblocking-contract.test.ts
• tests/therapy-ranking.test.ts
• tests/therapy-review-regressions.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

• Lighthouse budget — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.
• PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #12332 (cancelled).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.