chore(governance,org,tests,deps): seal hazard controls, resolve classifier & untested code debt, clear npm audit

Merged
BI
1mo ago
+415-42

User description

Summary

Completes the four repository health and documentation-pipeline recommendations (Issues 1, 3, 4, and 5) on top of origin/main (679d2bfeb8fb2082a09ae75009bc07d454731276) and docs/maintain-followup-20261017 (#3610):

  1. Issue 1 — Re-review & seal the 12 expiring clinical hazard drift exceptions (docs/clinical-hazard-controls.json & data/hazard-register-snapshot.json):
    • Audited the diffs across all 12 drifted paths since ff57ec6d0903ead5647db968436be911a744567d.
    • Updated reviewedCommit to 679d2bfeb8fb2082a09ae75009bc07d454731276, reviewedAt to 2026-10-17, and reviewExpiresAt to 2027-01-17.
    • Ran npm run governance:seal-hazard-controls (CLINICAL_HAZARD_CONTROLS_SEALED paths=30) and npm run snapshot:hazards, clearing all 12 expiring driftExceptions (review-dates.mjs now reports 0 expiring/lapsed entries).
  2. Issue 3 — Fix map-vs-classifier disagreements & Windows spawn ENAMETOOLONG bug (scripts/organisation/weekly/classifier-disagreements.mjs, docs/organisation/systems/*.json, scripts/maintain-docs-system.mjs):
    • Lowered CHUNK = 400 to CHUNK = 100 in scripts/organisation/weekly/classifier-disagreements.mjs so spawning scripts/ci-change-scope.mjs with ~400 paths never exceeds Windows' 32 KB command-line limit (spawn ENAMETOOLONG).
    • Reconciled placement of src/app/(search-app)/{open-shifts,roster}/**, src/app/admin/pilot/pilot-client.tsx, src/lib/{deep-memory-preparation,ingestion-generation-evidence,ingestion-provider-egress}.ts, and tests/sql/enrichment-repair.sql, and recorded supabase/functions/indexing-v3-agent/auth.ts alongside its 3 sibling edge-function files in docs/organisation/classifier-baseline.json.
    • Updated scripts/maintain-docs-system.mjs so classifyRepositoryPath agrees with the canonical system manifests (0 new disagreements, 0 unavailable).
  3. Issue 4 — Add focused unit/DOM tests for all 42 untested new code files (scripts/organisation/weekly/untested-code.mjs):
    • Added tests/dashboard-kit-primitives.dom.test.tsx, tests/weekly-untested-lib-and-scripts.test.ts, and tests/weekly-untested-ui-surfaces.dom.test.tsx (16 tests across 3 files).
    • untested-code.mjs now reports 0 of 807 new code files unreached by any test.
  4. Issue 5 — Clear transitive npm audit advisories (package.json & package-lock.json):
    • Added "braces": "npm:brace-expansion@^1.1.21" and "argparse": "^2.0.1" to "overrides" in package.json and regenerated package-lock.json, resolving the micromatch/braces (CVE-2024-4068) and mammoth/argparse/sprintf-js advisories (npm audit reports 0 vulnerabilities).

Clinical Governance Preflight

  • Clinical safety & hazard register: Re-reviewed and sealed all 30 cited clinical hazard control paths at 679d2bfeb8fb2082a09ae75009bc07d454731276; no clinical behavior, retrieval ranking, or source content was altered.
  • RAG impact: none

Verification

  • node scripts/check-clinical-hazard-controls.mjs --release -> CLINICAL_HAZARD_CONTROLS_PASS hazards=7 decisions=5 review-dates=strict expired-not-blocking=0
  • npm run docs:maintain:check -> exit 0 across all 13 documentation & organisation gates (10,379 files: 10,374 placed, 4 shared, 1 ignored, 0 not yet placed, 0 unplaced)
  • npx vitest run tests/dashboard-kit-primitives.dom.test.tsx tests/weekly-untested-lib-and-scripts.test.ts tests/weekly-untested-ui-surfaces.dom.test.tsx tests/maintain-docs-system.test.ts tests/clinical-hazard-controls.test.ts tests/organisation-weekly-report.test.ts -> 87 passed (87)
  • Weekly report sections (untested-code, classifier-disagreements, review-dates, map-hygiene, suggested-homes) -> 0 of 807 untested, 0 new disagreements, 0 expiring review dates, 0 unplaced
  • npm audit --package-lock-only --json -> 0 vulnerabilities

Summary by cubic

Resolves classifier-disagreement and untested-code debt, clears the remaining transitive npm audit advisories, and routes domain-specific tests/* paths to their owning systems. The hazard-control seal is no longer part of this branch: per owner decision it was reverted, the 12 drift exceptions remain, and resealing is deferred to a separate step.

Key changes

  • Lowered the classifier-disagreements chunk size from 400 to 100 to stop Windows spawn ENAMETOOLONG crashes, and routed domain-specific tests/* paths to their owning systems in maintain-docs-system.mjs; ambiguous work-* tests stay unplaced for explicit ownership.
  • Restored the Roster and Open shifts page folders to Personal practice per the recorded docs/organisation/README.md exception, ahead of the (search-app) App experience rule, with a classifier test pinning the boundary.
  • Added tests across three new files (dashboard-kit primitives, untested lib/scripts, untested UI surfaces) so all new-code files are reached. Post-review hardening removed reach-only stubs and namespace-only export checks, enforced compare-and-swap predicates in the fake Supabase, and pinned the preview-smoke URL-validation failure to exit status 1 with its exact stderr.
  • Added braces (^3.0.3) and argparse overrides in package.json to clear the micromatch/braces (CVE-2024-4068) and mammoth/argparse/sprintf-js advisories; their rationale is recorded in docs/framework-dependency-modernization-checklist.md. npm audit now reports 0 vulnerabilities.
  • Re-verified PR #3544 as squash-merged with zero content diff and recorded it in the branch-review ledger.
  • Tightened AGENTS.md Supabase/Railway token-scope guidance and restored owner-in-chat attribution in decision documents.

CodeAnt-AI Description

Prevent Windows classifier failures and improve test ownership and coverage

What Changed

  • Weekly path checks use smaller batches to avoid Windows command-line length failures.
  • Domain-specific test paths are assigned to their owning areas; ambiguous work-* tests stay unassigned unless an exact rule identifies their owner.
  • Add tests for dashboard components, selected UI surfaces, sharing preferences, and worksheet parsing.
  • Deployment guidance now recommends project-scoped Railway tokens for deploys and logs, reserving workspace tokens for listing or linking projects.

Impact

✅ Fewer Windows classifier failures
✅ Domain tests appear under the correct owners
✅ Earlier detection of UI and utility regressions

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Summary by CodeRabbit

  • Documentation
    • Clarified guidance for Supabase permissions, tokens, project checks, and migration roles.
    • Updated Railway guidance on token scopes, database responsibilities, and preview environments.
    • Expanded repository ownership and path-classification documentation.
  • Tests
    • Added coverage for dashboard components, UI surfaces, path classification, and selected library and command-line behaviors.
  • Chores
    • Updated review records and repository metadata; adjusted dependency overrides and test-classification batch size.