fix: remediate full-deep audit findings and retain release holds

Closed
BI
25d ago
+8953-1356

Summary

  • Prevent stale account requests and rollback from updating a different user's favourites, roster, sharing and calendar state; correct pay-history loading and selected-timezone conversions.
  • Make CME cleanup and ingestion recovery durable and transactional; minimize upload/worker diagnostics, harden RAG cache revocation/freshness and request coalescing, and preserve calculator/staff release holds.
  • Add an explicit isolated rootless catalog replay backend while retaining Docker as the default, preserve all existing migration seals, and document the audit findings, implementation and outstanding acceptance conditions.

Areas touched: App experience; Personal practice; Data platform and access; Answer engine; Source intake and indexing; Delivery and assurance; Knowledge and records.

RAG impact: behaviour change — cache governance/freshness, revocation, fallback and request coalescing. Provider-backed before/after canary evidence is not available; it remains an owner-authorized acceptance condition.

Verification

  • Final candidate: 83a49c5fac0945613114255a4e672a05a5aec3d0. Its parent integration 53ac94091f6072c9b93ac596ce06a45f40447f64, preserving prior PR head f70929e5306413bab2f90348fb68f9ddec8cf450 and merging fetched main 807ce0cb2b8f0850e6c41f04b0b00e856bd585fb once, without conflicts.
  • Fresh local integration proof: all 314/314 selected complete owning tests and 15/15 Codex hook fixture tests passed. The owned report was formatted, the normal pre-commit synchronization hook passed, and the normal guarded push succeeded without bypasses or force. No full local suite rerun is claimed. The subsequent test-only result-readiness correction passed 5/5 repeated cases and 16/16 complete owning Chromium mockup cases with retries disabled, on the offline local development server. Independent source review confirmed the positive and exact-count assertions remain intact; its normal guarded push also passed.
  • Exact prior-head CI run 39115639624 passed selected unit coverage, lint/types, build, containers, local migration/schema/manifest, Chromium UI and offline RAG checks: Required in-scope PR checks passed. It tested f70929e into base9ba5, not the new candidate; skipped release-browser/provider checks are not passes.
  • Integration53 core CI 39117859413 completed success at10:24UTC: migration replay/schema/drift, unit coverage, production UI, static checks, builds and containers passed. Advisory UI retained one actual count-before-readiness failure; the final83 test-only correction addresses it with the local evidence above. Final83 CI is separately pending, not covered by the earlier core pass.
  • Supabase Preview is not verified: its first new-head check failed, a later same-suite check skipped with an association error while fresh provider inventory still lists the failed preview. The retained failure is: Remote migration versions not found in local migrations directory. Read-only comparison retained both complete322-version sets: only remote 20261017221129 versus only local 20261018082910. Documented preview recreation is prepared but not approved/executed; it deletes preview-only state and may incur compute charges.
  • The earlier exactly approved postgres staging default repair remains effective; reserved-creator defaults remain open. No production SQL, new live database change, paid provider evaluation or deployment occurred in this continuation.
  • Exact GitHub high alerts are #24 and #27: NLTK3.10.3 in the worker and cloud Python locks, GHSA-8mgp-746c-j5xp. The authorized existing Composio/GitHub connection resolved the alert-capability gap; PyPI latest is3.10.3 and no fixed upstream release exists. Static call-path review found no caller-controlled model path into the affected persistence APIs, which bounds demonstrated reachability but does not fix/dismiss the alerts.
  • The separate high braces npm advisory GHSA-vfj7-8cjw-p6xm also has no patched upstream version; it remains development-only via Next's ESLint chain. No alert dismissal, invented version or incompatible alias was used. Earlier blocked Python advisory lookup is retained as failed evidence; the exact two repository alerts are now identified.

See docs/audit/2026-10-17-full-deep-remediation-results.md for dated source boundaries, actual failed/passing evidence and the rapid follow-through. Private raw artifacts remain session-local; this PR does not publish them.

Risk and rollout

  • Risk: High. This crosses account isolation, recovery state, private-document cleanup, clinical holds and RAG cache boundaries. Fetched main807ce0cb is now merged and locally verified; later remote drift and new-head hosted CI still require their own evidence. Qualified clinical/privacy/provider approvals and candidate-matched hosted verification remain unmet.
  • Rollback: Revert application changes in a reviewed commit while retaining clinical/privacy holds. SQL and durable queue/state changes need a separately reviewed compatibility and data-recovery plan; reverting TypeScript alone does not undo database effects.
  • Provider or production effects: Creating/updating this PR may trigger configured GitHub CI and the existing Supabase preview-branch integration. No paid RAG evaluation, Railway deployment, production SQL application or merge is authorized by this publication. The earlier approved staging-only default-grant operation is documented separately.

Merge only inside the owner's specifically approved production database window. This PR contains supabase/migrations/20261018082910_audit_durable_recovery_pairing_and_cache_fences.sql; merging to main automatically applies migrations to the live clinical database within seconds. This continuation did not alter owner-controlled auto-merge state. The exact draft hash remains f0667fed9f0294c1f5ba40252d11ee66e6de07be340a1ec789e0503a1192f2ac.

Clinical Governance Preflight

  • Source-backed claims still require linked source verification before clinical use
  • No patient-identifiable document workflow was introduced or expanded without explicit governance approval
  • Supabase target remains PsychSift Production (sjrfecxgysukkwxsowpy)
  • Service-role keys and private document access remain server-only
  • Demo/synthetic content remains clearly separated from real clinical sources
  • Source metadata, review status, and outdated/unknown-source behavior remain conservative
  • Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Physiological calculators and staff activation remain held. No qualified clinical, legal, privacy or provider sign-off was fabricated. The four pending/partial privacy conditions, reserved-creator platform repair and candidate-matched hosted Auth/Storage/RAG/cache/performance/rollout evidence remain open. The unchecked classification item is not represented as satisfied.

Notes

This PR publishes the remediation with current-main integration and explicit remaining conditions. It is not a release-readiness assertion, a new repository score, a deployment record or permission to merge. The original /workspace/PsychSift working tree is preserved.

Summary by cubic

Remediates full-deep audit findings: stale account requests and rollbacks can no longer mutate another user's favourites, roster, sharing, or calendar state; CME removal is transactional and durable; ingestion recovery is atomic per document with lease-based expiry; and RAG cache hits are fenced by an authoritative database scope revision instead of the latest-indexed-document stamp. Upload and worker diagnostics are now content-free, with superseded-object release failures reported as structured { stage, code } pairs that never carry raw provider or database messages; worker fatal alerts now read the allowlisted code from the wrapped cause so they report the real failure code instead of unclassified. Request coalescing is isolated in its own module, and physiological calculators, sick-call access, and staff activation remain withheld pending clinical and provider review.

A post-review automated edit to the sealed draft migration was reverted; the migration was resealed to the owner-reviewed bytes and renamed to sort after main's newest migration without changing its hash. The duplicate-job retry close-out and cache-revision metadata change are deferred to a separate reviewed PR.

Rollout

  • The migration is a draft; merging applies it to the live clinical database automatically, so merge only inside the owner's approved window.
  • Reverting the TypeScript alone does not undo the SQL and durable queue changes; they need a separately reviewed compatibility and recovery plan.
  • The drift manifest was three-way merged against main; CI regenerates and verifies it since Docker is unavailable locally.

Verification

  • No hosted CI run or provider-backed RAG canary evidence is claimed; earlier local test selection passed on the pinned candidate, not on current main.
  • Newly added suites wait for search results before asserting rendered counts, so evaluation of the revised RAG paths does not flake on rendering timing.