fix(eval): default golden retrieval eval owner to public sentinel

[BigSimmo]

Summary

• Default the golden retrieval eval's owner to the public-owner sentinel 00000000-0000-0000-0000-000000000000 (DEFAULT_EVAL_OWNER_ID in scripts/eval-retrieval.ts), applied as the final fallback after env/CLI/email resolution — so no future session has to set RAG_EVAL_OWNER_ID by hand.
• Rationale: since the 2026-07-06 public promotion the live corpus is entirely owner_id = NULL, and owner-scoped retrieval fail-closes on a null owner (privacy hardening). The old RAG_EVAL_OWNER_ID (2bac05f1-…) now owns 0 documents, so eval:retrieval:quality returned 0/36 with every retrieval layer empty. retrieval_owner_matches maps the public sentinel to NULL-owner rows, mirroring anonymous production search — this is the fix the retrieval-correctness workstream (Retrieval correctness: repair #325 golden regression, corpus-grounded finding #11 fix, RC9 confidence hardening #343) established and the runbook already recommended.
• An explicit RAG_EVAL_OWNER_ID / LOCAL_NO_AUTH_OWNER_ID / RAG_EVAL_OWNER_EMAIL (and --owner-id / --owner-email) still overrides the default; the email-lookup path is preserved.
• Scope is localized to eval config + docs. Retrieval, ranking, selection, and app runtime code are untouched. Also updates docs/retrieval-quality-runbook.md and records the change + confirming eval result in docs/process-hardening.md.

Verification

• npm run verify:cheap — green (check:runtime, sitemap:check, lint 0 errors / 8 pre-existing warnings, typecheck, unit tests 1251 passed / 3 skipped)
• npm run verify:ui — N/A (no UI, routing, styling, or browser behavior changed)
• npm run verify:release — not run (no release/handoff claim)
• npm run format:check — Prettier clean on changed files
• npm run eval:retrieval:quality — 36/36, failed_cases=0 ✅ (ran live against Clinical KB Database / sjrfecxgysukkwxsowpy with the new default owner, no RAG_EVAL_OWNER_ID set). This also settles the refactor(rag): decompose rag.ts part 2 (extractive-answer, retrieval-variants, cache) — move-only #347 part-2 eval debt (the behavior-preservation proof the rag.ts decomposition owed). Summary:

Golden retrieval eval summary:
cases=36
document_recall@5=1
content_recall@5=1
top_k_hit_rate=1
mrr@10=0.8148
content_mrr@10=0.9244 (over 36 content-term case(s))
median_latency_ms=3898
p90_latency_ms=19088
retrieval_strategy_counts={"text_fast_path":25,"document_lookup_fast_path":1,"hybrid":10}
force_embedding_case_count=10
force_embedding_failure_count=0
failed_cases=0
latency_failed_cases=0

Also confirmed live via npm run check:supabase-project (live mode) and a read-only DB probe: all 2,065 documents have owner_id = NULL; the old eval owner owns 0.

• npm run eval:rag / eval:quality --rag-only — N/A (answer generation unchanged by this PR)
• npm run check:production-readiness — N/A (no clinical/privacy/env/Supabase/governance runtime change)
• npm run check:deployment-readiness — N/A

Clinical Governance Preflight

This change touches only the eval harness's owner configuration, not ingestion, answer generation, search/ranking runtime, source rendering, document access, privacy, production env, or clinical output. The safe invariants below are unaffected:

• Source-backed claims still require linked source verification before clinical use (unchanged)
• No patient-identifiable document workflow introduced or expanded
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy) — no Supabase config touched, reads only
• Service-role keys and private document access remain server-only (unchanged; secrets used for the eval were kept in gitignored .env.local, never committed)
• Demo/synthetic content remains clearly separated from real clinical sources (unchanged)
• Source metadata, review status, and outdated/unknown-source behavior remain conservative (unchanged)
• Deployment classification/TGA SaMD impact — no clinical decision-support behavior changed

Notes

• The public-owner sentinel already exists across the codebase (PUBLIC_OWNER_FILTER_SENTINEL in src/lib/owner-scope.ts, the retrieval_owner_matches SQL predicate, scripts/check-retrieval-owner-migration.ts). This PR does not import from runtime code — it defines a local DEFAULT_EVAL_OWNER_ID constant in the eval script to keep the change minimal and confined to eval config.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BdP9DwsGdvtEvyVh3juYZ5

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.