Skip to content

chore(tooling): optimize AGENTS.md tokens, repair session worktrees, and reconcile governance runbooks - #2404

Merged
BigSimmo merged 18 commits into
mainfrom
codex/governance-tooling-workstations
Aug 27, 2026
Merged

chore(tooling): optimize AGENTS.md tokens, repair session worktrees, and reconcile governance runbooks#2404
BigSimmo merged 18 commits into
mainfrom
codex/governance-tooling-workstations

Conversation

@BigSimmo

@BigSimmoBigSimmo commented Aug 27, 2026

Copy link
Copy Markdown
Owner

Summary

  • AGENTS.md Token Optimization (#8A00R7): Modularized 7 client-specific blocks (~39.4 KB / 372 lines / ~6k tokens per turn reduction) into dedicated reference files under docs/agents/ while preserving concise markdown pointers in AGENTS.md and updating pinning tests in scripts/check-codex-cloud-setup.mjs, scripts/check-codex-autofix-workflow.mjs, and tests/setup-codex-worktree.test.ts.
  • Worktree Repair (#RVK6BJ): Verified empty Claude Code worktrees and executed node scripts/setup-codex-worktree.mjs ensuring exact-lock byte-identical parity across all session checkouts with zero errors.
  • Push Guard Validation (#TF6TPJ): Validated Guard 2 merge-base resolution logic in scripts/guard-push.mjs and added unit test in tests/guard-push.test.ts confirming merge commits exclude main-only commits from formatting/drift/static checks.
  • OpenAI ZDR Reconciliation (#HVTYAT): Reconciled Section 8 status table in docs/openai-cross-border-basis.md and docs/operator-backlog.md against ledger Harden authentication and protect sensitive tokens #53 and OpenAI DPA v.010126.
  • Supabase Preview Branch Compute Cap (#9X40BT): Documented Supabase preview branching compute cap policy (Automatic Branching limit set to 1 or disabled) and CI db-reset-verify verification net in docs/launch-operator-runbook.md §8 and docs/operator-backlog.md.
  • Shadow Extraction Diagnostics & Rollback Threshold (#1VFSYF): Created CLI utility scripts/inspect-shadow-extraction.ts, codified hard >10% timeout rollback threshold rule in docs/worker-deploy-runbook.md §3.6-§3.7, and added 40 passing unit/adversarial tests in tests/inspect-shadow-extraction.test.ts.

Verification

  • tests/inspect-shadow-extraction.test.ts (40/40 tests PASS)
  • tests/setup-codex-worktree.test.ts (6/6 tests PASS)
  • tests/session-start-hook.test.ts (13/13 tests PASS, .claude/hooks/*.sh verified mode 100755 and 0 CR bytes)
  • tests/guard-push.test.ts (56/56 tests PASS)
  • node scripts/check-codex-cloud-setup.mjs (PASS)
  • node scripts/check-codex-autofix-workflow.mjs (PASS)
  • npm run check:outstanding-issues (PASS)
  • node scripts/check-docs-links.mjs (PASS, 3,739 links resolve)
  • npm run check:repo-awareness-snapshot (PASS)
  • npm run format:changed (PASS)
  • npx tsc -p tsconfig.typecheck.json --noEmit (PASS, 0 errors)

Risk and rollout

  • Risk: Low (tooling, documentation, test fixtures, and diagnostics utility).
  • Rollback: Revert commit aaa3bc4.
  • Provider or production effects: None (offline tooling, diagnostics script, and documentation reconciliation only).
  • RAG impact: RAG impact: none

Clinical Governance Preflight

  • Source-backed claims still require linked source verification before clinical use
  • No patient-identifiable document workflow was introduced or expanded without explicit governance approval
  • Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
  • Service-role keys and private document access remain server-only
  • Demo/synthetic content remains clearly separated from real clinical sources
  • Source metadata, review status, and outdated/unknown-source behavior remain conservative
  • Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Notes

  • Closes inbox requests for #8A00R7, #RVK6BJ, #TF6TPJ, #HVTYAT, #9X40BT, and #1VFSYF.

> [!NOTE]
> Low Risk
> Mostly documentation, agent instructions, and offline diagnostics; the shadow-extraction script can query Supabase with admin credentials when run live, but PR does not change production app or auth paths.
>
> Overview
> Shrinks root AGENTS.md for agent sessions by moving long Codex/Cursor blocks (dependency shortcut, review throttling, GitHub review/auto-resolve, Cloud/Desktop worktree setup, productivity defaults) into docs/agents/*.md, leaving short pointers and BEGIN/END markers in AGENTS.md. Check scripts follow the split: check-codex-autofix-workflow.mjs now pins against docs/agents/codex-github-review.md, and check-codex-cloud-setup.mjs validates the modular Cloud section plus a single pointer section in AGENTS.md.
>
> Operational and governance docs reconcile ledger work: OpenAI DPA/ZDR status in docs/openai-cross-border-basis.md and docs/operator-backlog.md, Supabase preview branching compute cap in docs/launch-operator-runbook.md / backlog, and shadow-extraction ops via new scripts/inspect-shadow-extraction.ts (aggregates metadata.shadow_extraction, >10% timeout → ROLLBACK_RECOMMENDED, exit code 2) with runbook references in docs/worker-deploy-runbook.md.
>
> Repo hygiene: .gitignore adds Node compile/cache dir 1/; outstanding-issues snapshot/inbox records closed items (#8A00R7, #RVK6BJ, etc.); data/repo-awareness-snapshot.json picks up new docs routes and mockup page count.
>
> Separate product design deliverable: runnable mockup /mockups/favourites-phone-perfected (phone-first Favourites study, layout chrome suppressed in mockups-layout-client.tsx), documented in mockups/README.md with tests/favourites-phone-perfected-mockups.test.ts.
>
> Reviewed by Cursor Bugbot for commit aaa3bc4. Configure here.


Note

Low Risk
Documentation, agent instructions, offline diagnostics, and test-only guard validation; the new script can query Supabase with admin credentials when run live but does not change app runtime, auth, or clinical paths.

Overview
Shrinks per-turn agent context by replacing long Codex/Cursor instruction blocks in root AGENTS.md with short pointers into new docs/agents/*.md modules (dependency shortcut, review throttling/thread resolution, GitHub review/auto-resolve, Cloud environment, Desktop worktree setup, productivity defaults, Cursor Cloud). Validation follows the split: check-codex-autofix-workflow.mjs now pins against docs/agents/codex-github-review.md; check-codex-cloud-setup.mjs enforces the full Cloud section in docs/agents/codex-cloud-environment.md plus a single pointer in AGENTS.md.

Adds scripts/inspect-shadow-extraction.ts to aggregate documents.metadata.shadow_extraction, surface health metrics, and emit ROLLBACK_RECOMMENDED when timeout rate exceeds the ratified >10% threshold (exit code 2), with runbook updates in docs/worker-deploy-runbook.md and extensive tests.

Governance/docs reconciliation: OpenAI DPA/ZDR status aligned with ledger #53 in docs/openai-cross-border-basis.md and docs/operator-backlog.md; Supabase preview branching compute cap documented in docs/launch-operator-runbook.md and backlog. CI guard fix: new guard-push test ensures merge commits resolve git merge-base with origin/main so main-only files are not falsely flagged.

Housekeeping: .gitignore for Node v24 compile cache dir 1/; outstanding-issues snapshot/inbox closed items; repo-awareness-snapshot.json registers new docs/agents/ routes.

Reviewed by Cursor Bugbot for commit fe5df58. Configure here.

claudeand others added 9 commits August 26, 2026 23:14
Adds /mockups/favourites-phone-perfected — one perfected phone-first
direction for the signed-in Favourites page, drawn across the nine states
that actually occur plus a desktop reference.
Measured at 390x844 against the dev server with getBoundingClientRect():
the shipped /favourites puts the first row of the saved list at y=1141,
about 300px below the fold, behind a hint strip, an in-flow composer, a
privacy notice, a results band, a Continue card and a Recent card, and
spends 228px on each item card. Nothing of the library is on the first
screen. This direction spends 165px of chrome and 72px a row: seven rows
fully above the fold, an eighth partly.
Five decisions: one header rather than six bands; sets as the primary
navigation; one-line rows; a real control for `pinnedAt`, which has been
in the schema and the PATCH contract with no UI anywhere; and the shared
composer kept as the only input, which the one-composer contract requires
and the six existing favourites mockups each break with a second search bar.
Draws only service | form | differential | therapy, the four types
favouriteContentTypeSchema permits. The existing favourites mockups draw
saved medications, documents, quotes and searches, none of which has a
content type and none of which can be persisted.
A weighted segment track was tried first and dropped: eight sets across
390px leaves each segment about 48px, under the width a set name needs.
Phone frame geometry and both desktop grid tracks are pinned inline. On
this route --spacing-phone-frame resolved to the empty string and the frame
rendered 2661px tall with square corners, and the desktop grid collapsed to
one stacked column — the same class-generation trap mockups/README.md
records against a bare grid-cols-6.
tests/favourites-phone-perfected-mockups.test.ts pins the content-type
honesty, the controlled set vocabulary, clinical-state colour staying off
decoration, and the 48px tap knob.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QtKvCY1d3cGd5EBvGNQouv
Owner feedback on the first pass: the Continue card and the Recent card
from the shipped page are worth keeping. Measured at 390px, the three
derived cards above the list are Continue 113px, Recent 277px and Your
sets 255px — 645px of the 1141px before the first saved row. They are not
one decision, so they are not treated as one.
Continue returns, rebuilt so the strip IS the button rather than stacking
a full-width button under a title: 72px, exactly one row, pinned above the
list so it does not scroll away. It answers a different question from the
list beneath it — what was I in the middle of, not what have I saved.
Cost, measured: six saved rows above the fold instead of seven. Frame 10
draws the same library without it so the trade is visible rather than
argued.
Recent does not return. It costs 277px to show the three most recently
opened items, and the list beneath it is already sorted by recency, so
those are its first three rows.
The resumed item is drawn once. The shipped page shows it in Continue,
again in Recent and again in the table; lifting it out of the list keeps
one 72px row from being spent twice on the same thing.
Frame 11 offers the shipped Recent card's type pill in place of the
coloured type word. It scans faster down a column of mixed kinds, which is
what that card got right, and costs about 14px of the metadata line.
Two defects found while wiring this up and fixed: counting matches after
Continue was lifted out made an unfiltered library read "31 of 32 saved"
while the All chip still said 32, so the count is now taken before the
lift; and the Continue strip's icon was missing aria-hidden, which
require-lucide-icon-aria caught.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QtKvCY1d3cGd5EBvGNQouv
Frame 10 restores both shipped cards as the owner asked for them, rather
than only the compressed Continue strip: Continue with its own full-width
action, Recent with View all, type pills and a per-row Open button.
The library beneath them groups by set rather than by recency. That is
what makes the arrangement coherent — a Recent card above a recency-sorted
list repeats its own three rows, so keeping the card means the list should
be the user's own filing. Continue, Recent and the library then answer
three different questions: what was I mid-way through, what did I just
touch, and what have I organised. View all switches the list to recency,
so the control does something rather than sitting there.
The cost is measured and drawn on the frame: Continue 152px (its title
wraps at 390px where the shipped specimen's did not), Recent 271px, and
one saved row above the fold against six with the compact strip. Both
arrangements are kept because the choice is real and is the owner's.
The shipped card tints its rule and kicker with --success. TOKENS.md
scopes the clinical-state layer to source state and sanctioned urgency, and
a resume affordance is neither, so the accent carries the same visual job
inside the information layer.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QtKvCY1d3cGd5EBvGNQouv
The owner chose the Continue + Recent arrangement over the compressed
resume strip, so it stops being frame 10 and becomes the design: it leads
the study, and it is drawn across every state rather than one screen. The
strip is kept as frame 10, the record of the choice.
Drawing it across the states needed a rule, because the cards cost the
fold. This is it:
Continue and Recent are the landing surface, and nothing else. Tap a set
or type in the composer and they hand the screen back to the list.
Narrowing means you are hunting for something specific, and a resume
affordance is not what you asked for. Measured: one saved row above the
fold on arrival, seven the moment you narrow — so the cards are paid for
on the only screen where arriving, rather than searching, is the task.
That rule also fixed a defect it exposed. In the partial-load state the
failure notice plus both full cards left ZERO saved rows above the fold —
the one screen that most needs to show what survived was showing none of
it. A degraded load now falls back to the 72px strip, which puts five rows
back and keeps resume reachable.
The library groups by the user's own sets rather than by recency, since a
recency-sorted list under a Recent card is a second copy of it. Type pills
are now the default on rows; the coloured word is kept as frame 11.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QtKvCY1d3cGd5EBvGNQouv
Resolve the data/repo-awareness-snapshot.json conflict after main advanced so PR mergeability and pull_request CI can run again.
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
@supabase

supabaseBot commented Aug 27, 2026

Copy link
Copy Markdown

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.


Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

@coderabbitai

coderabbitaiBot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

Next included review available in 45 minutes.

View limit details

Limit details: You’ve used the included review currently available. Your 97 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a1d56aee-9687-4276-b371-04ec3e4c7db9

📥 Commits

Reviewing files that changed from the base of the PR and between 89f84b5 and 76efab0.

⛔ Files ignored due to path filters (21)
  • AGENTS.md is excluded by !**/*.md
  • docs/agents/codex-cloud-environment.md is excluded by !docs/**, !**/*.md
  • docs/agents/codex-dependency-shortcut.md is excluded by !docs/**, !**/*.md
  • docs/agents/codex-desktop-worktree-setup.md is excluded by !docs/**, !**/*.md
  • docs/agents/codex-github-review.md is excluded by !docs/**, !**/*.md
  • docs/agents/codex-productivity-defaults.md is excluded by !docs/**, !**/*.md
  • docs/agents/codex-review-throttling.md is excluded by !docs/**, !**/*.md
  • docs/agents/cursor-cloud.md is excluded by !docs/**, !**/*.md
  • docs/launch-operator-runbook.md is excluded by !docs/**, !**/*.md
  • docs/operator-backlog.md is excluded by !docs/**, !**/*.md
  • docs/outstanding-issues-inbox/02739a08-8671-457a-b422-a4bcb0485ae5.json is excluded by !docs/**
  • docs/outstanding-issues-inbox/2f51fee1-5eae-4230-9b26-69cc53c8865e.json is excluded by !docs/**
  • docs/outstanding-issues-inbox/6a9212fa-bd26-42d1-b412-6ddda9c66f88.json is excluded by !docs/**
  • docs/outstanding-issues-inbox/6d3d4a50-f7be-400a-969e-5dbb4dfd75e5.json is excluded by !docs/**
  • docs/outstanding-issues-inbox/a114318c-949e-46df-9b72-c9df997a72cd.json is excluded by !docs/**
  • docs/outstanding-issues-inbox/a7275b7e-ce79-4050-959b-f045a24e6f53.json is excluded by !docs/**
  • docs/outstanding-issues-inbox/b557ad9e-3663-4b7c-8296-9426b44d6d7e.json is excluded by !docs/**
  • docs/outstanding-issues-inbox/c9689169-5616-4282-bf8c-25bd5f089575.json is excluded by !docs/**
  • docs/outstanding-issues-inbox/ea5915df-befe-4c8d-81d3-3686fa9459e1.json is excluded by !docs/**
  • docs/scripts-index.md is excluded by !docs/**, !**/*.md
  • docs/worker-deploy-runbook.md is excluded by !docs/**, !**/*.md
📒 Files selected for processing (9)
  • .gitignore
  • data/outstanding-issues-snapshot.json
  • data/repo-awareness-snapshot.json
  • scripts/check-codex-autofix-workflow.mjs
  • scripts/check-codex-cloud-setup.mjs
  • scripts/inspect-shadow-extraction.ts
  • tests/guard-push.test.ts
  • tests/inspect-shadow-extraction.test.ts
  • tests/setup-codex-worktree.test.ts

Comment @coderabbitai help to get the list of available commands.

@cursor

cursorBot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_8ae7288f-fc5f-4b5b-b917-04b03848fa79)

…ing-workstations
# Conflicts:
#	AGENTS.md
#	data/outstanding-issues-snapshot.json
#	data/repo-awareness-snapshot.json
#	docs/openai-cross-border-basis.md
#	docs/scripts-index.md
@cursor

cursorBot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_ee49a747-196a-4e4f-ab7c-596a382a2d3f)

@github-actions

Copy link
Copy Markdown
Contributor

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

  • Unit coverageneeds investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.
  • PR requiredneeds investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #14109 (failure).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.

…tion cleanup
tests/test-runner-safety.test.ts flags any recursive fs.rmSync call in a test
file that skips the repo's bounded-retry wrapper (scripts/retryable-fs.mjs).
Switch the afterAll temp-dir cleanup to removePathSync to match convention
and clear the Unit coverage failure.
…ing-workstations
# Conflicts:
#	data/outstanding-issues-snapshot.json
#	data/repo-awareness-snapshot.json
#	docs/openai-cross-border-basis.md
PR #2404's own branch (aaa3bc4) and main's PR #2406 (89f84b5) independently
queued "done" requests for the same three tickets (#TF6TPJ, #HVTYAT,
#9X40BT), each against the same baseRowFingerprint. Merging both left two
pending mutations per ticket, which scripts/ledger-inbox.mjs's batch planner
correctly refuses to reconcile without an explicit cancellation (this also
made npm run docs:check-links crash, since it drives the same planner).
Cancel this branch's three duplicates in favor of main's more detailed,
already-landed versions; nothing is lost since both entries agreed on the
same "done" outcome, only the level of detail differed.
@BigSimmo
BigSimmo merged commit 5d848e0 into mainAug 27, 2026
29 checks passed
@BigSimmo
BigSimmo deleted the codex/governance-tooling-workstations branch August 27, 2026 05:18
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@BigSimmo@claude