From b2c03451065cc977533d68f9d45c0beb5236c90f Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Sat, 18 Jul 2026 23:06:04 +0800 Subject: [PATCH 1/5] fix(ci): preserve high-risk routing across renames --- .../codex-autofix-review-comments.yml | 26 ++++++++++++--- scripts/check-codex-autofix-workflow.mjs | 5 +++ tests/codex-autofix-workflow.test.ts | 32 +++++++++++++++++++ 3 files changed, 58 insertions(+), 5 deletions(-) diff --git a/.github/workflows/codex-autofix-review-comments.yml b/.github/workflows/codex-autofix-review-comments.yml index 7e86106a6..a5cb49f53 100644 --- a/.github/workflows/codex-autofix-review-comments.yml +++ b/.github/workflows/codex-autofix-review-comments.yml @@ -56,11 +56,13 @@ jobs: const highRiskPathPatterns = [ /^supabase\//, /^src\/app\/api\//, + /^src\/data\//, /^src\/(?:lib|app|components)\/.*(?:auth|permission|privacy|security|rag|retriev|rank|search|answer|clinical|citation|source|document|upload|download|billing|payment|quota|job|worker)/i, /^src\/(?:proxy|instrumentation(?:-client)?)\.ts$/, /^src\/lib\/(?:env|client-env|security-headers)\.ts$/, /^scripts\/.*(?:ingest|reindex|migration|governance|production|deploy|drift|supabase)/i, - /^\.github\/workflows\//, + /^scripts\/(?:check-(?:codex-autofix-workflow|github-action-pins)|github-action-pins)\.mjs$/, + /^\.github\/(?:actions|workflows)\//, /^(?:package|package-lock)\.json$/, /^(?:next|playwright|vitest)(?:\..+)?\.config\.[cm]?[jt]s$/, /^(?:Dockerfile|railway\.json|nixpacks\.toml)$/, @@ -156,19 +158,33 @@ jobs: throw error; } + const normalizeChangedPath = (value) => + (value || "").replaceAll("\\", "/").replace(/^\.\/+/, ""); const normalizedFiles = changedFiles.map((file) => ({ ...file, - filename: (file.filename || "").replaceAll("\\", "/").replace(/^\.\/+/, ""), + filename: normalizeChangedPath(file.filename), + previous_filename: normalizeChangedPath(file.previous_filename), })); + const changedFilePaths = (file) => + [file.filename, file.previous_filename].filter(Boolean); const routeableFiles = normalizedFiles.filter( - (file) => !excludedAutomaticRoutePathPatterns.some((pattern) => pattern.test(file.filename)), + (file) => + changedFilePaths(file).some( + (filePath) => + !excludedAutomaticRoutePathPatterns.some((pattern) => pattern.test(filePath)), + ), ); const highRiskFiles = routeableFiles.filter((file) => - highRiskPathPatterns.some((pattern) => pattern.test(file.filename)), + changedFilePaths(file).some((filePath) => + highRiskPathPatterns.some((pattern) => pattern.test(filePath)), + ), ); const changedSourceFiles = routeableFiles.filter( (file) => - sourcePathPattern.test(file.filename) && sourceExtensionPattern.test(file.filename), + changedFilePaths(file).some( + (filePath) => + sourcePathPattern.test(filePath) && sourceExtensionPattern.test(filePath), + ), ); const sourceChurn = changedSourceFiles.reduce( (total, file) => total + (file.additions || 0) + (file.deletions || 0), diff --git a/scripts/check-codex-autofix-workflow.mjs b/scripts/check-codex-autofix-workflow.mjs index 99b84b3da..7f3aa1306 100644 --- a/scripts/check-codex-autofix-workflow.mjs +++ b/scripts/check-codex-autofix-workflow.mjs @@ -212,8 +212,13 @@ const requiredRiskRoutingChecks = [ 'const skipReviewLabel = "skip-codex-review"', "labels.has(skipReviewLabel)", "github.rest.pulls.listFiles", + "previous_filename: normalizeChangedPath(file.previous_filename)", + "changedFilePaths(file).some", "excludedAutomaticRoutePathPatterns.some", "highRiskPathPatterns.some", + "/^src\\/data\\//", + "/^\\.github\\/(?:actions|workflows)\\//", + "check-(?:codex-autofix-workflow|github-action-pins)", "changedSourceFiles.length >= complexSourceFileThreshold", "sourceChurn >= complexSourceChurnThreshold", "if (routeReasons.length === 0)", diff --git a/tests/codex-autofix-workflow.test.ts b/tests/codex-autofix-workflow.test.ts index a7196561f..e251ef753 100644 --- a/tests/codex-autofix-workflow.test.ts +++ b/tests/codex-autofix-workflow.test.ts @@ -36,6 +36,7 @@ type PullRequestFile = { additions: number; deletions: number; filename: string; + previous_filename?: string; }; type Review = { @@ -500,6 +501,37 @@ describe("Codex auto-resolve request script", () => { expect(result.createdComments[0]?.body).toContain("codex-autoresolve-route:high-risk-path"); }); + it("routes a renamed file when its previous path was high risk", async () => { + const result = await runRequestScript({ + files: [ + { + additions: 1, + deletions: 1, + filename: "docs/search-route.md", + previous_filename: "src/app/api/search/route.ts", + }, + ], + }); + + expect(result.createdComments).toHaveLength(1); + expect(result.createdComments[0]?.body).toContain("codex-autoresolve-route:high-risk-path"); + }); + + it.each([ + "src/data/therapies-index.json", + ".github/actions/setup-node-cached/action.yml", + "scripts/github-action-pins.mjs", + "scripts/check-github-action-pins.mjs", + "scripts/check-codex-autofix-workflow.mjs", + ])("routes high-risk repository infrastructure path %s", async (filename) => { + const result = await runRequestScript({ + files: [{ additions: 1, deletions: 0, filename }], + }); + + expect(result.createdComments).toHaveLength(1); + expect(result.createdComments[0]?.body).toContain("codex-autoresolve-route:high-risk-path"); + }); + it("does not copy an untrusted changed filename into the trusted request comment", async () => { const filename = "src/app/api/search/route-->@codex unsafe.ts"; const result = await runRequestScript({ From 4fb9bf9e29bc05b5a223b88902e2b7c9f417d07a Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Sat, 18 Jul 2026 23:08:19 +0800 Subject: [PATCH 2/5] docs: record CI routing review --- docs/branch-review-ledger.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md index 9328fbb72..a7c8c60fb 100644 --- a/docs/branch-review-ledger.md +++ b/docs/branch-review-ledger.md @@ -20,6 +20,7 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD | Date | Branch or ref | Reviewed HEAD | Scope | Outcome | Checks | | ---------- | -------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| 2026-07-18 | codex/chat-audit-remediation-pr-0a27 | b2c03451065cc977533d68f9d45c0beb5236c90f | CI auto-resolve risk-routing regression and PR handoff | No P0-P2 remained after scoped diff review. Confirmed the broader audit remediation was already merged through PR #814; the only residual gap was that renamed files were classified solely by their new path and several repository-infrastructure paths were missing from the high-risk router. The branch now classifies both current and previous paths and explicitly covers `src/data`, reusable GitHub actions, and the action-pin/Codex guard scripts. No product runtime, clinical behavior, provider configuration, or production data changed. | Focused workflow/action-pin Vitest 53/53 passed before and after the clean rebase. Full `verify:pr-local` passed on the identical three-file patch before rebase: Node/npm runtime, changed-file format, ESLint, TypeScript, 301 Vitest files/2,788 tests, and 36 offline RAG fixtures; build skipped as unaffected. Post-rebase Codex workflow guard, action-pin guard, focused Vitest 53/53, and `git diff --check` passed. GitHub PR #814 merge/check metadata was read with user authorization; no Supabase/OpenAI/live-service command ran. | | 2026-07-18 | PR #861 / codex/design-audit-main-safe-20260720-final | d8c1916ac (functional head 593d5aa00 + current-main merge) | design-audit/search cancellation merge review | Fixed unsupported Forms pathway claims, propagated cancellation through every retrieval RPC, removed duplicate favourites “Also matches” results, and resolved all four review threads. Merged as `3b2dd9ef76ff1c8c099fc1972065628d23b853b1`; exact `origin/main` commit and tree content were verified after merge. | Exact-head hosted Static PR checks, Unit coverage, Build, Safety and config checks, Production UI, Advisory UI, Migration replay, PR required, PR policy, Semgrep, Gitleaks, and GitGuardian checks passed. No Supabase, OpenAI, or other product-provider call ran. | | 2026-07-18 | PR batch screenshot queue → #853 / cursor/pr-queue-land-3084 | 11ec0122f (tip of cursor/pr-queue-land-3084) | open-PR review + merge babysit | Reviewed screenshot PRs #833/#837/#845–#852 + Communication #19. #852/#848 already merged. Closed superseded/unsafe: #833/#837 (empty vs main), #845 (clinical-search over-expand; fixed in #853), #846/#847/#849 (Production UI red design-audit dupes), #850 (CONFLICTING), #851 (schema-test regressions), #726 (CONFLICTING CodeRabbit UTG). Unique safe fix landed in #853: agitation chart expansion without bare table/management over-trigger. Communication #19 inaccessible (repo not resolvable). | Focused Vitest clinical-search 42/42. Local verify:cheap unit suite hit pre-existing pdf-extraction-budget failures also on main (2 tests). Hosted #853 required checks green (Static/Unit/Build/PR required/policy/Semgrep/Gitleaks/GitGuardian). Squash-merged to main. Also closed follow-on dupes #854 (same failing tip as #851) and #855 (Clinical KB H1 reverts #814 Clinical Guide contract; Static/PR policy red). Communication #19 inaccessible. No OpenAI/live Supabase writes. | | 2026-07-18 | PR batch screenshot queue → #808/#812/#814 | 44555ab9e414f615981eb444f46a62333c28ec18 | open-PR review + merge babysit | Screenshot PRs #784–#789 closed as superseded. Unique residual work landed via #808 and #812. Design-audit/Playwright stack landed via #814 after Production UI fixes (Clinical Guide H1, service mocks, reduced-motion dock asserts), presentations empty-query fallback, and CodeRabbit thread resolution (RightRail remount, IS DISTINCT FROM, no-op dropped trigram migration). #783 already merged. Communication #17 inaccessible from this token. | Hosted #808/#812/#814 required checks green including Production UI; migration replay green on #814. No OpenAI/live Supabase writes. | From 4bea60e9fc5c181fee33b2af27a4b6e3176eac27 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Sat, 18 Jul 2026 23:16:19 +0800 Subject: [PATCH 3/5] fix(ci): keep rename exclusions path-scoped --- .../workflows/codex-autofix-review-comments.yml | 15 ++++++++------- scripts/check-codex-autofix-workflow.mjs | 3 ++- tests/codex-autofix-workflow.test.ts | 16 ++++++++++++++++ 3 files changed, 26 insertions(+), 8 deletions(-) diff --git a/.github/workflows/codex-autofix-review-comments.yml b/.github/workflows/codex-autofix-review-comments.yml index a5cb49f53..958ff8328 100644 --- a/.github/workflows/codex-autofix-review-comments.yml +++ b/.github/workflows/codex-autofix-review-comments.yml @@ -167,21 +167,22 @@ jobs: })); const changedFilePaths = (file) => [file.filename, file.previous_filename].filter(Boolean); + const routeableFilePaths = (file) => + changedFilePaths(file).filter( + (filePath) => + !excludedAutomaticRoutePathPatterns.some((pattern) => pattern.test(filePath)), + ); const routeableFiles = normalizedFiles.filter( - (file) => - changedFilePaths(file).some( - (filePath) => - !excludedAutomaticRoutePathPatterns.some((pattern) => pattern.test(filePath)), - ), + (file) => routeableFilePaths(file).length > 0, ); const highRiskFiles = routeableFiles.filter((file) => - changedFilePaths(file).some((filePath) => + routeableFilePaths(file).some((filePath) => highRiskPathPatterns.some((pattern) => pattern.test(filePath)), ), ); const changedSourceFiles = routeableFiles.filter( (file) => - changedFilePaths(file).some( + routeableFilePaths(file).some( (filePath) => sourcePathPattern.test(filePath) && sourceExtensionPattern.test(filePath), ), diff --git a/scripts/check-codex-autofix-workflow.mjs b/scripts/check-codex-autofix-workflow.mjs index 7f3aa1306..677e0ed86 100644 --- a/scripts/check-codex-autofix-workflow.mjs +++ b/scripts/check-codex-autofix-workflow.mjs @@ -213,7 +213,8 @@ const requiredRiskRoutingChecks = [ "labels.has(skipReviewLabel)", "github.rest.pulls.listFiles", "previous_filename: normalizeChangedPath(file.previous_filename)", - "changedFilePaths(file).some", + "routeableFilePaths(file).length > 0", + "routeableFilePaths(file).some", "excludedAutomaticRoutePathPatterns.some", "highRiskPathPatterns.some", "/^src\\/data\\//", diff --git a/tests/codex-autofix-workflow.test.ts b/tests/codex-autofix-workflow.test.ts index e251ef753..e5187b313 100644 --- a/tests/codex-autofix-workflow.test.ts +++ b/tests/codex-autofix-workflow.test.ts @@ -517,6 +517,22 @@ describe("Codex auto-resolve request script", () => { expect(result.createdComments[0]?.body).toContain("codex-autoresolve-route:high-risk-path"); }); + it("does not route an excluded previous test path as high risk after a docs-only rename", async () => { + const result = await runRequestScript({ + files: [ + { + additions: 1, + deletions: 1, + filename: "docs/search-route.md", + previous_filename: "src/app/api/search/route.test.ts", + }, + ], + }); + + expect(result.createdComments).toHaveLength(0); + expect(result.notices).toContainEqual(expect.stringContaining("low-risk pull request")); + }); + it.each([ "src/data/therapies-index.json", ".github/actions/setup-node-cached/action.yml", From dcd8f141a16c6f0686b68b553c1f7070412a7c89 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Sat, 18 Jul 2026 23:17:01 +0800 Subject: [PATCH 4/5] docs: record resolved CI review finding --- docs/branch-review-ledger.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md index a7c8c60fb..55059dee8 100644 --- a/docs/branch-review-ledger.md +++ b/docs/branch-review-ledger.md @@ -20,7 +20,7 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD | Date | Branch or ref | Reviewed HEAD | Scope | Outcome | Checks | | ---------- | -------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| 2026-07-18 | codex/chat-audit-remediation-pr-0a27 | b2c03451065cc977533d68f9d45c0beb5236c90f | CI auto-resolve risk-routing regression and PR handoff | No P0-P2 remained after scoped diff review. Confirmed the broader audit remediation was already merged through PR #814; the only residual gap was that renamed files were classified solely by their new path and several repository-infrastructure paths were missing from the high-risk router. The branch now classifies both current and previous paths and explicitly covers `src/data`, reusable GitHub actions, and the action-pin/Codex guard scripts. No product runtime, clinical behavior, provider configuration, or production data changed. | Focused workflow/action-pin Vitest 53/53 passed before and after the clean rebase. Full `verify:pr-local` passed on the identical three-file patch before rebase: Node/npm runtime, changed-file format, ESLint, TypeScript, 301 Vitest files/2,788 tests, and 36 offline RAG fixtures; build skipped as unaffected. Post-rebase Codex workflow guard, action-pin guard, focused Vitest 53/53, and `git diff --check` passed. GitHub PR #814 merge/check metadata was read with user authorization; no Supabase/OpenAI/live-service command ran. | +| 2026-07-18 | codex/chat-audit-remediation-pr-0a27 / PR #873 | 4bea60e9fc5c181fee33b2af27a4b6e3176eac27 | CI auto-resolve risk-routing regression and PR handoff | Confirmed the broader audit remediation was already merged through PR #814. Fixed the residual rename-routing gap by classifying both current and previous paths and explicitly covering `src/data`, reusable GitHub actions, and the action-pin/Codex guard scripts. Automated PR review then found one P2: an excluded old test path could still trigger high-risk routing when paired with a non-excluded new docs path. Fixed before handoff by deriving non-excluded paths first and using that same set for risk and complexity checks. No P0-P2 remained; no product runtime, clinical behavior, provider configuration, or production data changed. | Full `verify:pr-local` passed on the initial three-file patch: Node/npm runtime, changed-file format, ESLint, TypeScript, 301 Vitest files/2,788 tests, and 36 offline RAG fixtures; build skipped as unaffected. After the review fix, the Codex workflow guard, action-pin guard, Prettier, focused Vitest 54/54, and `git diff --check` passed. Hosted checks on the initial PR head passed; the review-fix head was pushed for a fresh check run. GitHub interactions were user-authorized; no Supabase/OpenAI/live-service command ran. | | 2026-07-18 | PR #861 / codex/design-audit-main-safe-20260720-final | d8c1916ac (functional head 593d5aa00 + current-main merge) | design-audit/search cancellation merge review | Fixed unsupported Forms pathway claims, propagated cancellation through every retrieval RPC, removed duplicate favourites “Also matches” results, and resolved all four review threads. Merged as `3b2dd9ef76ff1c8c099fc1972065628d23b853b1`; exact `origin/main` commit and tree content were verified after merge. | Exact-head hosted Static PR checks, Unit coverage, Build, Safety and config checks, Production UI, Advisory UI, Migration replay, PR required, PR policy, Semgrep, Gitleaks, and GitGuardian checks passed. No Supabase, OpenAI, or other product-provider call ran. | | 2026-07-18 | PR batch screenshot queue → #853 / cursor/pr-queue-land-3084 | 11ec0122f (tip of cursor/pr-queue-land-3084) | open-PR review + merge babysit | Reviewed screenshot PRs #833/#837/#845–#852 + Communication #19. #852/#848 already merged. Closed superseded/unsafe: #833/#837 (empty vs main), #845 (clinical-search over-expand; fixed in #853), #846/#847/#849 (Production UI red design-audit dupes), #850 (CONFLICTING), #851 (schema-test regressions), #726 (CONFLICTING CodeRabbit UTG). Unique safe fix landed in #853: agitation chart expansion without bare table/management over-trigger. Communication #19 inaccessible (repo not resolvable). | Focused Vitest clinical-search 42/42. Local verify:cheap unit suite hit pre-existing pdf-extraction-budget failures also on main (2 tests). Hosted #853 required checks green (Static/Unit/Build/PR required/policy/Semgrep/Gitleaks/GitGuardian). Squash-merged to main. Also closed follow-on dupes #854 (same failing tip as #851) and #855 (Clinical KB H1 reverts #814 Clinical Guide contract; Static/PR policy red). Communication #19 inaccessible. No OpenAI/live Supabase writes. | | 2026-07-18 | PR batch screenshot queue → #808/#812/#814 | 44555ab9e414f615981eb444f46a62333c28ec18 | open-PR review + merge babysit | Screenshot PRs #784–#789 closed as superseded. Unique residual work landed via #808 and #812. Design-audit/Playwright stack landed via #814 after Production UI fixes (Clinical Guide H1, service mocks, reduced-motion dock asserts), presentations empty-query fallback, and CodeRabbit thread resolution (RightRail remount, IS DISTINCT FROM, no-op dropped trigram migration). #783 already merged. Communication #17 inaccessible from this token. | Hosted #808/#812/#814 required checks green including Production UI; migration replay green on #814. No OpenAI/live Supabase writes. | From deaab583240fe415514b91d26b37466723be55d7 Mon Sep 17 00:00:00 2001 From: BigSimmo <87357024+BigSimmo@users.noreply.github.com> Date: Sat, 18 Jul 2026 23:22:26 +0800 Subject: [PATCH 5/5] docs: finalize CI routing handoff record --- docs/branch-review-ledger.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md index c7f4e1a07..53b1d8651 100644 --- a/docs/branch-review-ledger.md +++ b/docs/branch-review-ledger.md @@ -20,7 +20,7 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD | Date | Branch or ref | Reviewed HEAD | Scope | Outcome | Checks | | ---------- | -------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| 2026-07-18 | codex/chat-audit-remediation-pr-0a27 / PR #873 | 4bea60e9fc5c181fee33b2af27a4b6e3176eac27 | CI auto-resolve risk-routing regression and PR handoff | Confirmed the broader audit remediation was already merged through PR #814. Fixed the residual rename-routing gap by classifying both current and previous paths and explicitly covering `src/data`, reusable GitHub actions, and the action-pin/Codex guard scripts. Automated PR review then found one P2: an excluded old test path could still trigger high-risk routing when paired with a non-excluded new docs path. Fixed before handoff by deriving non-excluded paths first and using that same set for risk and complexity checks. No P0-P2 remained; no product runtime, clinical behavior, provider configuration, or production data changed. | Full `verify:pr-local` passed on the initial three-file patch: Node/npm runtime, changed-file format, ESLint, TypeScript, 301 Vitest files/2,788 tests, and 36 offline RAG fixtures; build skipped as unaffected. After the review fix, the Codex workflow guard, action-pin guard, Prettier, focused Vitest 54/54, and `git diff --check` passed. Hosted checks on the initial PR head passed; the review-fix head was pushed for a fresh check run. GitHub interactions were user-authorized; no Supabase/OpenAI/live-service command ran. | +| 2026-07-18 | codex/chat-audit-remediation-pr-0a27 / PR #873 | 4bea60e9fc5c181fee33b2af27a4b6e3176eac27 | CI auto-resolve risk-routing regression and PR handoff | Confirmed the broader audit remediation was already merged through PR #814. Fixed the residual rename-routing gap by classifying both current and previous paths and explicitly covering `src/data`, reusable GitHub actions, and the action-pin/Codex guard scripts. Automated PR review then found one P2: an excluded old test path could still trigger high-risk routing when paired with a non-excluded new docs path. Fixed before handoff by deriving non-excluded paths first and using that same set for risk and complexity checks. No P0-P2 remained; no product runtime, clinical behavior, provider configuration, or production data changed. | Full `verify:pr-local` passed on the initial three-file patch: Node/npm runtime, changed-file format, ESLint, TypeScript, 301 Vitest files/2,788 tests, and 36 offline RAG fixtures; build skipped as unaffected. After the review fix, the Codex workflow guard, action-pin guard, Prettier, focused Vitest 54/54, and `git diff --check` passed. Hosted checks on the initial PR head passed; the review fix was also verified by the focused local checks before the final main merge. GitHub interactions were user-authorized; no Supabase/OpenAI/live-service command ran. | | 2026-07-18 | PR #868 / codex/private-title-privacy-20260718 | 77482fc9e (privacy implementation + rollout-order follow-up) | title-vocabulary privacy, migration safety, and merge-readiness review | Fixed the historical private/non-indexed `document_title_words` exposure with a forward purge, exact indexed-public-title invariant, concurrency-safe `FOR SHARE` guard, constraint/ACL/RLS hardening, and a fail-closed postcondition. Review then found and fixed a P1 rollout interval by purging inside `20260717171000` before its table-backed corrector is installed, while retaining the forward migration for already-applied environments. The review thread was resolved; merged as `0df01d88ac36616a3f47e2e94e758432ef27999c` and verified on fresh `origin/main`. | Disposable Postgres replay and drift-manifest regeneration; focused schema Vitest 66/66 before the final docs-only sync; function-grant check; scoped ESLint; diff/manifest proof. Exact-head hosted Static, Unit coverage, Safety/config, Migration replay, PR required, policy, Semgrep, Gitleaks, and GitGuardian passed. Non-required Supabase Preview failed against a separate preview target and was not touched or rerun. No live Supabase/OpenAI/product-provider command or production migration apply ran. | | 2026-07-18 | PR #865 / codex/docs-migration-runbook-safety-20260718 | 78ea2ccd6 | migration runbook, rollback safety, and clinical-governance review | Replaced stale sole-pending-migration guidance, prohibited restoring the unscoped corrector, added forward-only rollback and exact migration ordering, and marked the historical WIP report superseded. Review uncovered the pre-existing private title-word P1, so the runbook now blocks live rollout until a forward purge/invariant migration is merged and verified. The review thread was resolved; merged as `ec9142628752e6d11531e20a6ebf2e95cf39f865` with exact changed blobs verified on `origin/main`. | Documentation links 915, documented scripts 299, affected Markdown Prettier, static migration-order/rollout-blocker assertions, and `git diff --check` passed. Hosted Static, PR required, policy, Semgrep, Gitleaks, and GitGuardian passed; docs-irrelevant jobs skipped. No Supabase/OpenAI/database migration/deployment/provider call ran. | | 2026-07-18 | PR #861 / codex/design-audit-main-safe-20260720-final | d8c1916ac (functional head 593d5aa00 + current-main merge) | design-audit/search cancellation merge review | Fixed unsupported Forms pathway claims, propagated cancellation through every retrieval RPC, removed duplicate favourites “Also matches” results, and resolved all four review threads. Merged as `3b2dd9ef76ff1c8c099fc1972065628d23b853b1`; exact `origin/main` commit and tree content were verified after merge. | Exact-head hosted Static PR checks, Unit coverage, Build, Safety and config checks, Production UI, Advisory UI, Migration replay, PR required, PR policy, Semgrep, Gitleaks, and GitGuardian checks passed. No Supabase, OpenAI, or other product-provider call ran. |