Harden backend ownership, ingestion and data lifecycles

BI
2d ago
+14340-1145

Summary

Prevents private OnCall callbacks from crossing account boundaries and makes document maintenance preserve the current evidence generation until replacement is durable. Adds stale-write and concurrency controls for OnCall, CPD, Teaching and hospital lifecycles; fixes permanent private-evidence deletion, monitoring, recovery verification, request budgets and local build/document tooling.

  • Includes nine new forward SQL migrations (20261106164443 corrects the snapshot fences in replace_document_maintenance_artifacts; 20261106224403 skips malformed stored booking times in the overlap check); all 349 historical migrations are unchanged. Merge only after the owner's own yes to these nine migrations, pressed by hand; do not apply live SQL or enable auto-merge. Merging migrations would change the live database automatically.
  • Patches the three inspected installed NPM advisory candidates using compatible Sentry/rimraf updates and two reviewed consumer-scoped minimatch overrides.
  • Records every audit disposition in the published handoff: 67 classifications mapped to 19 remaining work packages, not 67 new bugs. Seventeen immutable issue-inbox requests add 10 tasks, extend six existing issues and qualify the existing SF01 pending-add; two existing packages are reused. The protected canonical issue ledger is unchanged.

Areas touched: authentication/private state, OnCall, CPD, Teaching, document ingestion/worker, database integrity and lifecycle, Clinical Ask contracts, operations/recovery, dependencies and documentation/task intake.

RAG impact: evidence-generation preservation, source-admission refusal, governed section headings and request budgets changed. Retrieval ordering, ranking thresholds, protected goldens and activation holds were preserved. No provider-backed evaluation or clinical approval is claimed.

Verification

Implementation evidence is from 33f6478c63aedf9c2d79effd9890951035f552b2 and its recorded earlier constituent revisions. The subsequent publication commit adds only the handoff and validated issue-inbox records.

  • Four earlier disjoint native unit partitions: 2,152 files; 34,453 passed, zero failed, two existing conditional skips. This is not a full rerun on the final dependency graph.
  • Fresh affected changes: 94 React commit-phase cases, 47 build-runner cases, then 203/203 tests across 15 final dependency-related files. Overlapping per-file reconciliation is 34,459 passes/two skips; it is explicitly not a new native full-run report.
  • Final graph: whole lint, whole typecheck, normal and isolated production builds, default/selected-output client marker scans, installed-lock parity and normal lifecycle-enabled locked installation pass.
  • Actual PostgreSQL role/policy/transaction and lock-contention fixtures, seven-draft fresh/upgrade parity, small synthetic database/Vault and byte recovery, native dependency-consumer probes and private POSIX document-copy controls pass within their recorded scope.
  • Six exploratory Chromium 151 guest scenarios pass at desktop/phone widths. Required pinned Chromium 156 download is blocked; this is not real Auth, physical Safari/PWA or accessibility-conformance acceptance.
  • Additional publication-turn formatting, readiness suites and hosted CI observation: not run, following the explicit bare-publication policy. No checks are represented as passed by omission. Normal draft/event-scoped GitHub checks remain the hosted verification surface.

Follow-up fixes (6 November 2026)

  • 2131b953: refreshed data/repo-awareness-snapshot.json, which was the failing Static PR checks step.

  • 53ee0ff4: new forward migration 20261106164443_audit_fix_maintenance_snapshot_fence_aliases.sql. In 20261105144251, the four unnest(...) id ... x.id=id fence checks resolved the bare id to the inner table's own column, so they always passed. That let summary sources, visual units and label deletions reference off-generation or missing rows. The fix aliases the unnest as s(id). 20261105144251 keeps its sealed bytes. schema.sql mirrors the new file, and drift-manifest.json carries the updated schema_sha256 and function def_hash. The def_hash method was checked by reproducing the existing value for the old body on PostgreSQL 16; the full Docker replay was not run here. tests/sql/ingestion-maintenance.sql adds a refusal case for an off-document image id.

  • Fresh local evidence for these commits: migration immutability (357 unchanged), migration role, function grants, repo-awareness snapshot, 75 migration-inspecting unit files (1,529 passed, 2 skipped) and drift/mirror/push-guard tests (121 passed). The SQL fixture and migration replay need Docker and run in CI. The seven-draft parity evidence above predates the eighth migration.

  • The migration-change and Supabase preview cost were approved by the owner in this session. Merging still needs the owner's own yes and a manual merge.

  • Review threads (7542290e, 15c4f838, merged as b13d6ae9): all 19 resolved with fixes and tests. That includes the new migration 20261106224403_audit_overlap_skip_malformed_booking_times.sql, the drift manifest now committed from CI's Docker replay (b3b1be52), and the roster SQL fixture dates made relative to today (4c2de641).

Risk and rollout

  • Risk: coordinated schema/app/worker compatibility, legacy writer/handler draining, source-admission authority, audio/read policy, historic deletion, model/image compatibility and hosted/domain acceptance remain open. The bare-image historical chain fails at existing SF01; the stronger synthetic continuation is conditional and does not establish faithful CLI/hosted replay.
  • Rollback: review the nine draft migrations and roll-forward/application compatibility together before any rollout; do not repair history, widen drift allowlists, reverse applied data changes blindly or revive unfenced writers.
  • Provider or production effects: none performed or authorised by this PR. No main merge, deployment, live migration, activation, messages or paid evaluations. Draft state skips the configured automatic Claude review; no manual workflow dispatch or review bot is requested.

Clinical Governance Preflight

  • Source-backed claims retain linked-source verification requirements before clinical use.
  • No patient-identifiable document workflow was introduced or expanded; unsupported new backend intake refuses before persistence.
  • Live Supabase target identity: source selectors were preserved; no current live-project verification was performed.
  • Service-role/private document operations retain server-side boundaries within the inspected source and local checks.
  • Demo/synthetic content remains separate from real sources.
  • Source metadata/review-state and missing/outdated-source behavior remain conservative within the changed contracts.
  • Specialist deployment classification, clinical authority and privacy/legal acceptance remain pending; no sign-off is inferred from local tests.

Notes

Remaining task ownership/status is maintained in the existing PsychSift canonical task ledger; repository issue updates use the established immutable inbox and are reconciled only after the relevant PR lands. Existing privacy, source-rights, scanner, re-index, deployment-policy and specialist holds are preserved. The detailed local audit archive stays with the owner; this PR publishes a sanitised summary and crosswalk rather than raw logs, credentials or production data.

Summary by CodeRabbit

  • New Features
    • Added paginated teaching-link history with a load-more option.
    • Added offline tools to compare restored storage files with a source manifest.
    • Added safeguards against overwriting newer CME edits and closing records with changed inputs.
  • Bug Fixes
    • Improved handling of account changes and stale data during On Call updates and verification.
    • Improved cancellation, input validation, and error reporting across several workflows.
    • Missing Sentry credentials now fail the health-check workflow instead of appearing as a warning.

Generated by Claude Code