#3512 Refactor non-RAG assurance scripts and speed focused checks

User description

Summary

CodeScene identified large, complex assurance scripts that were difficult to maintain, while repeated parsing made selected local checks slow. This change publishes the preserved non-RAG remediation batch: eight script changes, three supporting test files, the maintained audit note and its immutable review record.

• Split adoption/provenance validation, ledger reconciliation, tenancy scanning, CI scope classification and Cloud policy checks into coherent phases while retaining their conservative refusals, diagnostics and ordering.
• Reuse bounded source/AST analysis within adoption and design checks, skip inputs that cannot match unchanged design rules, and replace expensive Cloud policy setup with a focused synthetic harness.
• Preserve the existing clinical, privacy, owner-scope and verification controls. Remaining CodeScene warnings are not presented as resolved merely because helpers were extracted.

Areas touched: Delivery and assurance, Knowledge and records, Data platform and access, Design system
RAG impact: no retrieval behaviour change — the change is confined to non-RAG assurance scripts, their tests and documentation. Deferred RAG, ingestion, answer generation and source-rendering fixes are excluded.

Verification

• Checks run:

Verification not run: this is the user's explicit bare PR publication request. No new formatting, tests, lint, typecheck, build, browser checks, CodeScene reviews, broad local gates or hosted CI observation were run. GitHub is the requested verification surface.

Historical local evidence, not rerun for this PR: the preserved candidate passed 410 tests across 14 owning suites on the October 10 integration base, 6,647 tenancy comparisons and 30,657 design-helper comparisons with zero parity differences. The recorded source hashes for all 13 published files still match that candidate. The audit note and immutable review record retain the earlier proof and its limitations. These historical receipts do not establish compatibility with today's main, hosted CI, merge or deployment readiness.

Risk and rollout

• Risk: broad internal restructuring of assurance tooling can change scanner/refusal behaviour if an integration regression occurs. Existing gates remain enabled, and the new tests preserve targeted refusal and invalidation cases. The branch starts from the preserved integration base; later main changes have not been overwritten or rebased into it.
• Rollback: revert 29fa506084d57ad72d12427728fc4d3aa8939bca as one unit.
• Provider or production effects: publishing opens the normal repository CI/review surface. No Supabase migration, application runtime change, production provider call, merge or deployment is performed by this request.

Notes

This PR publishes the bounded fixes made in the CodeScene remediation task, not all 7,364 audit findings. The full report, raw evidence and machine-local receipts remain outside the repository. RAG remediation remains paused. Local and hosted checks are unrun/unobserved for this publication request; no CI babysitting or auto-merge is requested.

Summary by cubic

Refactors non-RAG assurance scripts to address CodeScene maintainability warnings and speed up focused local checks, with no change to retrieval or answer-generation behavior. The branch now includes the current main and repairs the findings from the last assurance review pass, plus a test cleanup fix for ledger fixture directory teardown.

• Splits adoption, ledger reconciliation, tenancy scanning, CI scope classification and Cloud policy checks into coherent phases while keeping existing refusals, diagnostics and ordering.
• Reuses bounded source/AST analysis in design-system helpers, skips inputs that cannot match unchanged design rules, and gates the synthetic Cloud policy harness behind an explicit test-mode flag; tests now cover nested shell quoting.
• Adds tests for the refactored paths, publishes the audit note and immutable review record, and refreshes the repository-awareness snapshot to include the new assurance documentation.

CodeAnt-AI Description

Harden ledger and Cloud setup safeguards while speeding focused checks

What Changed

• Ledger intake rejects unsupported add priorities and types; concurrent stale-lock recovery can no longer remove a replacement live lock, and abandoned recovery claims fail closed.
• Cloud policy-only setup now requires an explicit test invocation and skips runtime checks and installation. Ordinary setup is unchanged, and policy failures avoid unnecessary runtime diagnostics.
• Design-system checks avoid repeated analysis and skip inputs that cannot contain findings, while preserving existing results. Cloud setup checks now detect MCP registrations despite quoted or escaped hashes, without flagging actual comments.

Impact

✅ Invalid ledger requests rejected before enqueue
✅ Safer concurrent ledger reconciliation
✅ Faster design-system checks
✅ Runtime-free Cloud policy tests

@codeant-ai ask: Your question here

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

@codeant-ai: Your feedback here

@codeant-ai: Do not flag unused imports.

@codeant-ai: review