Security and compliance: bot auto-merge gate, worker scan window, TGA limbs (d) and (e)

Merged
BI
21d ago
+212-11

Requested by Josh Ā· project thread

Summary

Four changes. The owner approved each one on 21 Oct 2026, first with "Go ahead with all recommendations please" and then the quote cards and reseal with "Go ahead with, 2 and 3 and 4 5 and 6". On 22 Oct the owner also approved them on this PR in his own words, including the reseal.

  • Bot auto-merge gate (#YF0XSQ). PR policy now fails a clinical-risk PR while auto-merge is armed by any account other than the repository owner. This enforces the 2026-10-20 decision that Gitar never arms clinical-risk PRs. On 13 Oct, gitar-bot armed PR 3507 and it merged on bot approvals alone. Turning auto-merge off re-runs the check and it passes. If the check can't identify the account that armed it, it fails closed. docs/agents/pull-request-workflow.md records this.
  • Worker image scan advisory until 4 Nov 2026, on main only. HIGH and CRITICAL findings in the worker image no longer fail the image scan on main until 4 Nov. A red worker scan was holding up production deploys under Railway's Wait for CI while #3701 is finished. Release branches, dispatches from any other ref, app image findings and unassessed scans still fail, and the window ends by itself. Decision: docs/decisions/2026-10-21-worker-scan-advisory-until-4-nov.md.
  • TGA exemption limb (d). Both answer prompts gain one line: do not make the diagnosis or the treatment decision for a specific patient, and leave that to the treating clinician. The legacy prompt-cache revision rolled. The response cache is keyed by prompt version with a 5-minute default TTL, so stale answers age out within minutes. Decision: docs/decisions/2026-10-21-answers-leave-diagnosis-to-clinician.md.
  • TGA exemption limb (e): exact quotes at medium trust. Medium-trust answers now carry up to 2 exact quote cards. High trust still carries 3, and low trust carries none. A medium answer that is authority-capped still carries none, so an unverified-authority source never gets exact-quote presentation. The only live surface is the source drawer's cited passage, which now shows the exact quote rather than the snippet. A local screenshot check found no visible difference with demo content.
  • docs/clinical-hazard-controls.json was resealed (833f34b) after the owner's approval. That records the reviewed digests for src/lib/answer-render-policy.ts and its test and removes the temporary drift exceptions.

Areas touched: Delivery and assurance, Knowledge and records, Answers

RAG impact: behaviour change. The answer prompt text and the render caps changed, but retrieval and ranking did not. The owner approved one before and after eval canary pair, capped at US$2. The canary only runs from main, so the before run goes on main before merge and the after run follows the merge. A regression in the after run means an immediate revert of this PR.

Verification

  • Checks run: node scripts/pr-policy.mjs --self-test passed, including five new cases. npx vitest run tests/pr-policy*.test.ts passed 39 tests. tests/trivy-image-scan.test.ts, tests/container-ci-contract.test.ts and tests/ci-audit-contracts.test.ts passed 148 tests, including the advisory-window and main-only cases. tests/answer-render-policy.test.ts passed. The prompt and answer tests (rag-prompt-injection, rag-answer-composition-prompt, rag-answer-fallback) passed. The client payload, clinical safety, trust, dashboard helper, demo boundary and decision tests passed. check:clinical-hazard-controls passed after the reseal. check:env-parity and check:repo-awareness-snapshot passed. The pre-push static guard (lint and typecheck) passed.
  • Verification not run: the eval canary pair after merge. The before run, 39630009061, is green and recorded on this PR. The after run is provider-backed and runs from main only.

Risk and rollout

  • Risk: medium. The prompt change can alter answer wording for patient-scenario questions, which the canary pair checks. The worker scan window lowers a security gate for 14 days, for the worker image on main only. The auto-merge gate affects only clinical-risk PRs that a non-owner arms.
  • Rollback: revert this PR. The worker window also ends by itself on 4 Nov 2026.
  • Provider or production effects: none from the PR itself. Merging changes production answer prompts and medium-trust rendering once Railway deploys. The canary pair is one approved, capped run.

Clinical Governance Preflight

  • Source-backed claims still require linked source verification before clinical use
  • No patient-identifiable document workflow was introduced or expanded without explicit governance approval
  • Supabase target remains PsychSift Production (sjrfecxgysukkwxsowpy)
  • Service-role keys and private document access remain server-only
  • Demo/synthetic content remains clearly separated from real clinical sources
  • Source metadata, review status, and outdated/unknown-source behavior remain conservative
  • Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

The prompt line and the quote cards keep the amended TGA exemption limbs (d) and (e) from 1 Nov 2026. See docs/clinical-hazard-analysis.md, "Amended exemption from 1 November 2026".

šŸ¤– Generated with Claude Code

https://claude.ai/code/session_01W7EHqBKdEqicWVBdYqv4W5