feat(infra): platform and performance infrastructure improvements (#099, #JZM7RM, #KZJD4Q, #BJ80DB, #71NT23)

[BigSimmo]

Summary

This PR lands the 5 Platform & Performance Infrastructure Tasks (Group A) with adversarial safety audits and zero regressions:

1. [perf: pre-compute query phrases once per rankAnswerEvidence call #99] Cut Duplicate Auth & Cache Round-Trips:

   • src/proxy.ts & src/lib/supabase/auth.ts: Forwarded validated server authentication claims via x-proxy-auth-user header with unconditional ingress stripping to prevent header spoofing; fast-path token extraction skips duplicate remote Supabase auth lookups.
   • src/lib/api-rate-limit.ts: Short-circuited duplicate database round-trips for previously limited callers by checking the in-memory deny cache across subject and global anonymous ceiling keys upfront.
   • src/lib/rag/rag-cache.ts & src/lib/rag/rag.ts: Upfront synchronous result cloning before async cache indexing versions, converting 8 blocking setCachedSearch awaits into concurrent non-blocking dispatches (dispatchSearchCacheWrite).

2. [#JZM7RM] Dual Auto-Fixers Governance & Deduplication:

   • docs/agents-guide.md: Formalized auto-fixer governance declaring the repository GitHub Actions workflow as authoritative responder with deduplication markers and client watcher throttling.

3. [#KZJD4Q] Automated Review Coverage Levers:

   • .coderabbit.yaml: Configured path_filters to exclude documentation (!docs/**, !mockups/**, !**/*.md, !**/*.mdx).
   • docs/codex-review-protocol.md: Documented Levers 1 & 2 to prevent token burn and prohibit bookkeeping-only reviews.

4. [#BJ80DB] Windows Test Budget & Role Guard Hardening:

   • scripts/check-hosted-migration-role.mjs: Filtered out untracked worktree artifacts and nested git folders during migration file discovery on Windows Dev Drives.

5. [#71NT23] Mobile WebKit Playwright Test Matrix:

   • playwright.config.ts: Configured mobile-webkit (Mobile Safari on iPhone 14) and mobile-pwa-standalone (standalone PWA displayMode, touch, deviceScaleFactor 3) projects.

6. Immutable Ledger Transactions:

   • Queued immutable issue done receipts in docs/outstanding-issues-inbox/ for #099, #JZM7RM, #KZJD4Q, #BJ80DB, and #71NT23.
   • Regenerated data/outstanding-issues-snapshot.json.

RAG impact: no retrieval behaviour change — non-blocking concurrent cache write dispatch and dual deny cache check.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Verification

• npx tsc -p tsconfig.typecheck.json --noEmit passed cleanly (0 errors).
• npm run lint passed across 5,217 files.
• npm run check:outstanding-issues passed.
• npm run check:ledger-write-discipline passed for base to HEAD.
• npm run check:design-system-contract passed across 980 production files.
• vitest run tests/master-search-header.dom.test.tsx tests/rag-score.test.ts tests/guard-push.test.ts tests/proxy-auth.test.ts tests/api-rate-limit.test.ts passed (86/86 tests).
• npm run audit:final-merge -- --dry-run --base-ref origin/main --head-ref HEAD generated clean merge tree with 0 failures.
• npm run verify:ui not run: changes are backend and infrastructure test configuration.

Risk and rollout

• Risk: Low to medium — auth forwarding is protected by unconditional ingress header stripping and validated claims extraction; rate limit deny caching only caches negative outcomes; cache writes clone data synchronously before non-blocking dispatch.
• Rollback: Revert the PR commit to restore original sequential awaits and standard auth lookup.

[coderabbitai]

Warning

Review limit reached

Next included review available in 30 minutes.

View limit details

Limit details: You’ve used all 2 included reviews currently available. Your 56 included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 15dd8221-48de-4764-a6a6-f089ffb111ac

📥 Commits

Reviewing files that changed from the base of the PR and between 195e045 and c5d3cbb.

⛔ Files ignored due to path filters (7)

• docs/agents-guide.md is excluded by !docs/**, !**/*.md
• docs/branch-review-records/7c6bf47d40279ba2c42fd2ceee7eddc470ddbc39140abc0b1d396b34ea109004.record.md is excluded by !docs/**, !**/*.md
• docs/codex-review-protocol.md is excluded by !docs/**, !**/*.md
• docs/outstanding-issues-inbox/3648add6-bf2b-4733-a651-ec2d8ffa9f35.json is excluded by !docs/**
• docs/outstanding-issues-inbox/37fdb906-b528-4011-81ca-9303256ec927.json is excluded by !docs/**
• docs/outstanding-issues-inbox/561c9187-f8c7-4381-ad31-528b408c0669.json is excluded by !docs/**
• docs/outstanding-issues-inbox/5794387a-496b-4c9b-ab66-f710369697cd.json is excluded by !docs/**

📒 Files selected for processing (13)

• .coderabbit.yaml
• data/outstanding-issues-snapshot.json
• playwright.config.ts
• src/lib/api-rate-limit.ts
• src/lib/rag/rag-answer-telemetry-metadata.ts
• src/lib/rag/rag-cache.ts
• src/lib/rag/rag.ts
• src/lib/supabase/auth.ts
• src/lib/supabase/proxy-auth-crypto.ts
• src/proxy.ts
• tests/api-rate-limit.test.ts
• tests/private-access-routes.test.ts
• tests/proxy-auth.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

Bugbot Autofix resolved 1 of the 2 issues found in the latest run.

• ✅ Fixed: Session cookie flags dropped
  • The claims-forwarding rebuild now re-applies refreshed cookies as full cookie objects after skipping Set-Cookie during header copy, so httpOnly and path survive on the signed-in path.

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 3aa32ae. Configure here.}

[cursor]

Stale comment

Left a non-blocking comment; no approval and no reviewers assigned. Cursor Bugbot reported 2 unresolved issues, including a high-severity session-cookie-flag finding, so human review is needed.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:3aa32ae0bb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BigSimmo]

@codex resolve actionable Codex review findings for this pull request and current head using the repository instructions. This is the pull request's single automatic repair pass: do not perform a fresh review, create new standalone findings, or request another review. Work only the existing unresolved Codex threads on the current head. The only repository destination is BigSimmo/Database, and the only branch destination is the pull request head branch codex/platform-performance-infrastructure at starting commit 3aa32ae; never publish fixes to a detached or synthetic work branch and never create a stacked pull request. Use the authenticated GitHub connector to commit each approved fix to BigSimmo/Database:codex/platform-performance-infrastructure, then verify that the pull request head contains the published commit before reporting success. Always fix P0 and P1 findings. For P2 and lower findings, fix only clear, scoped, low-risk issues; otherwise disposition them with a concise reason. For a fixed thread, reply with as the first line and as the second line. For a no-code disposition, use followed by . These result markers authorize the workflow to close that exact thread only after it verifies a fixed commit is the pull request head; a local-only commit is not a fix. If publication or verification fails, do not use either result marker, do not claim success, and leave the thread open with the blocker. If human input or new authorization is required, do the same. Finish only after every actionable thread is fixed or dispositioned and closed, or explicitly left open for a human decision. Do not update the branch from main, address unrelated reviews, broaden scope, or create more than one scoped fix commit. Do not use external APIs, paid services, credentials, dependency changes, or broad refactors unless explicitly authorized. Add targeted tests where behavior changes and run the narrowest relevant validation.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit:3aa32ae0bb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Stale comment

Left a non-blocking comment; no approval and no reviewers assigned. Cursor Bugbot still has unresolved findings on this head, including the high-severity session-cookie thread, so human review is needed.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Agentic security review of the x-proxy-auth-user fast path. One new high-severity issue: the forwarded identity header is unsigned and is trusted whenever the Next.js proxy matcher does not run. An existing review thread already covers stale administrator JWT metadata, so that finding is not repeated.

_{Sent by Cursor Security Agent: Security Reviewer}

[cursor]

Stale comment

Left a non-blocking comment; no approval and no reviewers assigned. Cursor Bugbot still has unresolved findings on this head, including a high-severity session-cookie thread, so human review is needed.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Left a non-blocking comment; no approval and no reviewers assigned. Cursor Bugbot still has unresolved findings on this head, including the high-severity session-cookie thread, so human review is needed.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[github-actions]

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

• Unit coverage — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.
• PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #13554 (failure).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.

[cursor]

Approved. Cursor Bugbot is not running on this head; prior Bugbot and security findings on earlier commits are resolved, and no reviewers were assigned.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Approved. Cursor Bugbot is not running on this head; prior Bugbot findings are resolved, and no reviewers were assigned.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Approved. Cursor Bugbot is not running on this head; prior Bugbot findings are resolved, and no reviewers were assigned.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}