fix(ci): bump checkout/setup-node/cache actions to v5 by BigSimmo · Pull Request #231 · BigSimmo/Database

BigSimmo · 2026-07-03T08:35:31Z

Summary

Bumps actions/checkout, actions/setup-node, and actions/cache from v4 to v5 across ci.yml and secret-scan.yml, clearing the post-merge deprecation annotations GitHub adds for these versions.
Scoped to exactly what's flagged — actions/upload-artifact@v4 and denoland/setup-deno@v2 are untouched.

Context

Mined out of an old uncommitted codex/fix-ci-annotations branch that had drifted far behind main. That branch's other changes (dead-import cleanup in evidence-panels.tsx/ClinicalDashboard.tsx/answer-content.tsx, and a duplicate "Add generated sitemap audit" commit) turned out to be stale — the dead-code cleanup was valid for an old snapshot of those files but would delete functionality (EvidenceGapPanel, AnswerInsightBar, EvidenceVerificationStrip, etc.) that main has since gained, and the sitemap-audit work already merged separately via #224. This action-version bump is the one piece that's still valid and not yet on main.

Test plan

Diffed against the original commit to confirm this reproduces exactly the same scoped change, re-applied cleanly on current main
Full file read-through to confirm YAML structure/indentation is intact
CI itself will confirm the workflow still runs correctly

🤖 Generated with Claude Code

Clears the post-merge deprecation annotations GitHub adds for these action versions. Scoped to exactly the actions flagged: checkout, setup-node, and cache. Leaves upload-artifact@v4 and setup-deno@v2 untouched — not flagged. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

These came out of the DS V2 wave with no ledger row and would otherwise have evaporated with the session: the stale PR-J governance review record, the COMPONENTS.md section 0 drift plus the undocumented optionality-marker contract change, the undocumented answer-copy-payload module, the missing ADOPTION.md section 7 proof shots, and the two orphan builder branches and leftover dev servers. The sixth residual, visual baselines staying zero and advisory, is already ledger #118 and was deliberately not duplicated. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…o states that need one (#1612) * docs(issues): record #230 live answer generation timeout Production triage 2026-08-04 measured the live failure: OpenAI generation overruns OPENAI_ANSWER_TIMEOUT_MS and the answer degrades to source-only, while retrieval passes its gate with 12 candidates across 5 documents. The 2026-08-04 handover's four ranked hypotheses (query embedding, Supabase RPC, source governance, corpus) are all ruled out by that evidence. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * feat(ds): let EmptyState carry a heading, and adopt the two states that need one EmptyState rendered its title as a <p>, so any empty state that owns a region of the page could not adopt it without losing its heading. /dsm/search lost exactly that when it adopted the primitive (#224), and the main document-search empty state stayed hand-rolled because ui-smoke pins a heading role on it (#217). Add an opt-in headingLevel prop. It is deliberately un-defaulted: most adopted call sites sit inside a card that already owns its region's heading, and promoting every title would inject an outline level the page never declared. - /dsm/search passes headingLevel={2}, restoring the heading it had before. - The document-search empty state adopts EmptyState with headingLevel={3}, which also converts it from a bespoke centred card to the shared state surface and gives it the polite live region every other adopted empty state has. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(issues): correct #230 — the fast route budget binds, not the env timeout The first row named OPENAI_ANSWER_TIMEOUT_MS as the constraint. It is not, and production does not set it. The query routes fast, so answerRouteBudgetMs.fast (25s) is the ceiling and generationRequestTimeoutMs holds back the 2s recovery reserve on top; the measured 24.7s is that budget being spent. Also records the half with clinical consequence: answerRouteResultCanBeCached excludes a route-deadline-exceeded answer but not one degraded by the OpenAI request timing out, so a generation_fallback answer can be cached and re-served after the provider recovers. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(ledger): record the PR #1612 review Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(issues): capture the five Wave 5 close-out residuals (#231-#235) These came out of the DS V2 wave with no ledger row and would otherwise have evaporated with the session: the stale PR-J governance review record, the COMPONENTS.md section 0 drift plus the undocumented optionality-marker contract change, the undocumented answer-copy-payload module, the missing ADOPTION.md section 7 proof shots, and the two orphan builder branches and leftover dev servers. The sixth residual, visual baselines staying zero and advisory, is already ledger #118 and was deliberately not duplicated. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(issues): archive #217 and #224 completed by EmptyState headingLevel PR #1612 added the opt-in headingLevel prop and adopted the DSM and document-search empty states that needed it. Close both ledger rows so /issues stops treating finished work as outstanding. * docs(issues): correct #231 summary to name the binding fast-route budget The detail already established that OPENAI_ANSWER_TIMEOUT_MS is not the binding ceiling — answerRouteBudgetMs.fast = 25000 is. Align the summary so triage does not raise a non-binding setting, and backtick the src/lib/rag/** path so markdownlint MD037 stays quiet. * ci: retrigger Production UI after known Services viewport-shrink flake Production UI (1) failed once on ui-phone-scroll-page-owned:577 (Services results re-settle after viewport shrink) — same signature as the 2026-07-31 flake noted in the branch-review ledger. Unrelated to EmptyState headingLevel; shards 2/3 and critical passed. Cannot rerun-failed via this token (403), so retrigger the pull_request run. --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com>

Add #237–#239 from the fastest-wins planning session, repair mislabeled queue rows (#201/#202 vs #183/#185), remove archived #182 from the queue, and enqueue every previously open-but-unqueued item including P1s #207, #226, and #231. Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017SncTkA9eTQfRE6dL462xZ

…ate PR #1861 - scripts/probe-generation-quality.ts: one cache-bypassed live answer reporting the structured generation_quality_gate_reasons (provider-backed, refuses demo mode, never caches or logs the probe) - ledger: record the #1861 adjudication (superseded for phase 1, close recommended; numeric-retry half deferred to phase 2 pending probe evidence) - issues #231: operator approvals recorded; probe blocked in this container (no provider env), ready-to-run command documented Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017SncTkA9eTQfRE6dL462xZ

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DuYJz8hauCsCdx8r4fXiZU

… queue text (#1890) * docs(issues): retire 22 non-actionable ledger rows and correct the #231 queue text A yield review of all 114 open rows against current main. The queue had become roughly 60 tasks and 50 notes; this removes the notes and fixes two places where the ledger was actively misdirecting. The correction that matters most: the recommended-queue entry for #231, the top clinical P1, told every session to "measure and fix the fast-route budget / generation timeout" — an approach #231's own detail records as tested and rejected, because the decisive 40-second probe completed generation in 25.272s with route_deadline_exceeded=false and still failed quality. The session-start hook prints the queue, not the row, so the refuted text was the text agents read. Closed 22 rows: - #304 was already done on main (commit d182844 refreshed the ranking snapshot; generatedAt is 0 days old, not 2026-07-20), yet sat in the queue advertising a freshness fuse that is not armed. - #241 #244 #272 #294 #300 #257 were standing cautions whose own text says "no action". Each one's knowledge now lives in the code it protects, so closing the row loses nothing. - #196-#200 are five steps of the disaster-recovery checklist that is canonical in docs/operator-backlog.md, with no trigger until a restore. - #86 #188 were index rows over children that are individually findable. - #250 #253 #254 were superseded; #250 and #253 say so themselves. - #156 #301 #152 #236 #260 merged into #168, #292 and #169 respectively — each pair or group was one problem recorded two to four times. Demoted 20 rows with a stated reason (premature ops for a single-user prototype, upstream-blocked, measurement-gated, or design-system adoption competing with an open clinical P1). The Pri cell is unchanged because the writer has no --pri flag — which is now #313. Added three rows for mechanism gaps this sweep exposed: rows outliving their own completion (#312), the missing --pri flag (#313), and the queue being able to contradict the row it cites with no guard (#314). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DuYJz8hauCsCdx8r4fXiZU * docs(ledger): record the ledger yield review handoff Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DuYJz8hauCsCdx8r4fXiZU * Keep recovery work visible and pin forced colors --------- Co-authored-by: Claude <noreply@anthropic.com>

…l cannot misdirect The recommended-queue entry for #231, the top clinical P1, told every session to "measure and fix the fast-route budget / generation timeout". #231's own detail records that approach as tested and rejected: the decisive 40-second probe completed generation in 25.272s (27.237s total) with route_deadline_exceeded false and still failed generation quality, so the budget is not the binding cause. The queue and the row had drifted, and the queue is the copy that gets read — .claude/hooks/issues-surface.sh prints it at every session start and scripts/issues-report.mjs serves it to /issues, while the corrected row detail is only seen by someone who opens the file. Re-correcting the cell was tried and cannot land. The ledger inbox has no request type that reaches the queue's Outcome cell, and check:ledger-write-discipline rejects a direct canonical edit, so the correction is unlandable by construction — verified by committing it and watching the gate refuse. SKIP_LEDGER_WRITE_GUARD only bypasses the pre-push hook, not the CI check, so that route pushes but can never merge. So the duplication is removed instead of re-synced, which is what #314 argued for: both consumers now take each queue row's prose from the cited row's own Detail cell. The queue keeps order, acuity, capability, when and estimate — the metadata that exists nowhere else. A composite ID(s) row has no single row to speak for it and keeps its own text. This fixes the whole class, not just #231: no future edit to a row's detail can leave the surfaced text behind, because there is no longer a second copy. The hook needed two passes over the file. The queue table is printed BEFORE "## Open items", so the obvious single forward pass reads every queue row while the lookup is still empty and silently falls back to the stale cell — which it did, on the first attempt, and looked like a working change. tests/issues-report.test.ts pins both halves and was mutation-tested: reverting the derivation fails it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DuYJz8hauCsCdx8r4fXiZU

…s instrument now exists Four corrections, queued as immutable inbox requests. #235, #237 and #238 each had a `done` queued in PR #1940 and cancelled on review. The cancellations were right: all three ask for visual or browser proof and were closed on executable evidence. Each row now records the attempt, the reason it was refused, and a Stop rule naming the evidence class that must not be used again — so the next reader does not repeat it: - #235: section 7.1 opens with "records executable evidence RATHER THAN committing image baselines", so the section that looks like the evidence says in its first line that it is not - #237: jsdom does not lay out text, so a 320px assertion proves the string is present, not that it fits - #238: the risk is ancestor-scoped CSS/contain/transform on five specific host surfaces, which no Sheet component test can see All three also drop their IN FLIGHT do-not-start prefix; PRs #1841 and #1842 have merged, so the warning was blocking rather than protecting. #231's "Next: instrument and reproduce" is stale — commit a3bc4da added scripts/probe-generation-quality.ts and adjudicated PR #1861 as superseded for phase 1. The row now says so, so nobody reviews #1861 as the live fix or rebuilds the probe. Next is running it where credentials exist. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017paT42ZVMf8jaLtkjFxdy5

docs(issues): record why three closures were rejected, and that #231's instrument now exists

…s + one combined update CI (docs:check-links -> ledger-inbox planner) rejected two pending #231 updates: this branch's incident-evidence update and main's instrument-exists update (7f5e6922). Both are cancelled with reasons and replaced by a single combined update carrying the earlier text verbatim plus the 2026-08-14 incident addendum, so no queued content is lost. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JpjrUp4fYmiDGfc6NBqACX

…be evidence (#316, #231) Fills the 2026-08-14 owner-authorized incident evidence into the live-drift forensics record: Phase 1.1 migration-history fingerprint (20260705180000 executed with 14 statements; the two trigram indexes existed at the 2026-08-04 guard and were dropped by 2026-08-09), Phase 1.3 partial inventory, Phase 4 partial restore (CREATE INDEX CONCURRENTLY, both indisvalid/indisready), and Phase 5 before/after probes (supabase_rpc_latency_ms 31610 -> 1535 text / 8519 hybrid). Carries the PR #1939 review ledger record and queues merge-safe issue updates for #316 and #231. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JpjrUp4fYmiDGfc6NBqACX

…hvja docs(audit): 2026-08-14 incident forensics and live index restore evidence (#316, #231)

… nit) Covers the modified numeric-token path directly per CodeRabbit review: the bolded dose yields the same normalized 200mg/day token as the unformatted source text. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…S1) (#2022) * fix(rag): stop verification rejecting verbatim-faithful answers (#231 S1) Two measured text-normalization artifacts made the deterministic quality gates discard answers whose figures were present verbatim in their cited chunks, degrading dosing queries to source-only: - Markdown emphasis (including the pipeline's own high-yield bolding) split clinical value atoms: "**200 mg**/day" extracted a bare 200mg atom while the cited source's "200 mg/day" carried the per-day denominator, so the exact atom-key match failed. Atom and numeric token extraction now fold emphasis markers first. - Claim-support segmentation split source sentences at PDF visual line wraps, so no single segment carried every atom of a claim restating a wrapped sentence. Segmentation now rejoins bounded visual wraps, joining only visible sentence continuations (lowercase/digit/paren starts) so separate capitalized source lines cannot manufacture support. Evidence: 8 pre-fix live probes on healthy latency (post index restore) attributed fallbacks to numeric_faithfulness_gap (3), claim_support_ high_risk_gap (1), provider_timeout (3); both artifacts reproduced deterministically offline. Post-fix, the sertraline maximum-dose probe returns grounded model_synthesis. Residuals (strong-retry timeout inside the fast route budget; directive-normativity and topic-overlap strictness) are recorded in the PR body for follow-up. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: record S1 PR #2022 in the HANDOVER status row and review ledger Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(rag): assert extractNumericTokens folds emphasis (#231 S1 review nit) Covers the modified numeric-token path directly per CodeRabbit review: the bolded dose yields the same normalized 200mg/day token as the unformatted source text. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: supersede S1 review record after CodeRabbit nit fix Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…6u1mik fix(rag): route the medication_dose_risk class to the strong route before the deadline (A1 R1, #231)

…ade, 3 new recs, 2 duplicate closures (#2130)

PR #2260's review raised that queue row 1 still presents `#231` as A1 "Immediate approved live investigation" into retrieval binding the fast route, while the #231 Open-items row this PR updates records the P1 -> P2 re-grade and the measurement that closed that cause. The finding is correct, and the row itself asks for the queue entry to be re-graded "AT RECONCILE". It cannot be honoured here, for structural reasons rather than oversight: - `updateIssue` edits only Open-items columns; the sole queue-touching function is `pruneResolvedIdFromQueue`, which runs on `done` and only deletes the row. Nothing can re-grade one. - A hand edit of the canonical ledger is refused by `check:ledger-write-discipline` — its self-test asserts that accepting a manual canonical edit is a failure. - Creating a request on this branch and applying it in the same transaction is refused: the applied batch must equal the base inbox exactly. So this files the gap as a pending inbox request for the next serialized reconcile, which is the one shape the guard accepts, rather than editing the canonical ledger. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ApB8NBygQn9cosxCQ8omk9

…te E answers (#2264)

…2301) Packet 2 of #231 (PR #2285, ledger #NPQJKP) added the `guidance_wrapper_fragment` predicate, which rejects two answer shapes that read as sentences without being sentences. Canary run 32589154243 confirmed it on the live corpus: `source_backed_review_fallback_count` went to 2, both carrying `final_quality_gate:guidance_wrapper_fragment` — exactly the two answers the predicate was built for — with retrieval flat against baseline 32111839806 and zero per-case reciprocal-rank regressions. The run was red only because `ragSourceBackedReviewFallbackCount` was 0. That threshold encoded an assumption this change disproves: that any answer degrading to its sources is a defect. Degradation is the safe outcome when the written answer cannot be checked against the documents behind it, and it only stayed at 0 while the quality gates were missing answers they should have caught. A weekly canary that is permanently red teaches us to ignore it. Raise it to 2 as an allowance for the two named conversions, not as a rate. A third fallback still blocks: a rise beyond the cases we can account for is the signal the threshold exists to carry. Also queues two ledger requests: the canary outcome against #NPQJKP, and a new item for the antipsychotic metabolic-monitoring case, which now returns a source-backed stub. That case names an authoritative document and must not be relaxed with `acceptSourceOnly` — the failing score is a true signal that the answer path cannot answer a routine question. Claude-Session: https://claude.ai/code/session_01M4Xx767QUvVbdauUpmLDLG Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: BigSimmo <87357024+BigSimmo@users.noreply.github.com>

BigSimmo merged commit f0b4bb5 into mainJul 3, 2026
4 checks passed

BigSimmo deleted the claude/bump-ci-actions-v5 branch July 5, 2026 11:43

CopilotAI mentioned this pull request Aug 4, 2026
feat(ds): give EmptyState an optional heading level, and adopt the two states that need one #1612
Merged
3 tasks

This was referenced Aug 12, 2026
Prevent generation fallbacks from sticking in answer cache #1831
Merged
Fix PR body sync scope and root-portable handoff test #1830
Merged
fix(rag): retry unverified numeric answers safely #1861
Closed

chatgpt-codex-connectorBot mentioned this pull request Aug 13, 2026
docs: reviewed and updated Clinical RAG Improvement Programme guide #1895
Merged
6 tasks

BigSimmo mentioned this pull request Aug 13, 2026
feat(rag): record the structured generation-quality verdict on fallback (#231 phase 1) #1899
Merged
7 tasks

BigSimmo pushed a commit that referenced this pull request Aug 13, 2026
docs(ledger): record#231phase 1 review row
d864cae
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017SncTkA9eTQfRE6dL462xZ

BigSimmo pushed a commit that referenced this pull request Aug 13, 2026
docs(ledger): record the#231queue-misdirection fix handoff
bf94072
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DuYJz8hauCsCdx8r4fXiZU

BigSimmo added a commit that referenced this pull request Aug 14, 2026
Merge pull request#1957from BigSimmo/claude/correct-rejected-closures
b58a235
docs(issues): record why three closures were rejected, and that #231's instrument now exists

BigSimmo added a commit that referenced this pull request Aug 14, 2026
Merge pull request#1960from BigSimmo/claude/live-drift-forensics-ln…
7679dfa
…hvja docs(audit): 2026-08-14 incident forensics and live index restore evidence (#316, #231)

This was referenced Aug 14, 2026
chore(issues): reconcile the four rejected-closure corrections #1959
Merged
fix(rag): stop verification rejecting verbatim-faithful answers (#231 S1) #2022
Merged

BigSimmo mentioned this pull request Aug 17, 2026
fix(rag): route the medication_dose_risk class to the strong route before the deadline (A1 R1, #231) #2035
Merged
13 tasks

BigSimmo added a commit that referenced this pull request Aug 17, 2026
Merge pull request#2035from BigSimmo/claude/s1b-rag-dosing-routing-…
92f7618
…6u1mik fix(rag): route the medication_dose_risk class to the strong route before the deadline (A1 R1, #231)

BigSimmo added a commit that referenced this pull request Aug 18, 2026
docs(issues): queue 7 ledger requests — DP6M3G resolution,#231re-gr…
f55e440
…ade, 3 new recs, 2 duplicate closures (#2130)

chatgpt-codex-connectorBot mentioned this pull request Aug 21, 2026
docs(issues): reconcile 19 queued ledger requests into the canonical ledger #2260
Merged
6 tasks

chatgpt-codex-connectorBot mentioned this pull request Aug 21, 2026
docs(issues): reconcile 19 queued ledger requests and close #316 #2261
Merged
3 tasks

BigSimmo added a commit that referenced this pull request Aug 22, 2026
docs(rag): re-scope#231— the timeout premise is falsified by the Ga…
00cdfa8
…te E answers (#2264)

claudeBot mentioned this pull request Aug 22, 2026
fix(rag): reject the laundered "guidance is that" wrapper at the answer-quality gate #2285
Merged
8 tasks

BigSimmo mentioned this pull request Aug 23, 2026
Harden maturity release evidence and governance checks #2305
Merged
22 tasks

Navigation Menu

fix(ci): bump checkout/setup-node/cache actions to v5 - #231

fix(ci): bump checkout/setup-node/cache actions to v5#231
BigSimmo merged 1 commit into
mainfrom
claude/bump-ci-actions-v5

BigSimmo commented Jul 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

BigSimmo commented Jul 3, 2026

Summary

Context

Test plan

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant