Fix pending readmission provider-authority inventory

Merged
BI
5d ago
+140-8

Summary

An administrator readmission can declare a new publisher, role or status while deliberately retaining the current live ranking metadata until indexing succeeds. The provider-facts RPC still compared that live metadata with the new immutable admission, so valid embedding preparation failed with provider_authority_admission_mismatch.

The new forward migration validates the pending admission and unchanged live snapshot before comparing its pending values. Lease, source, document, owner, immutable-event and permission checks remain; live withdrawal or tampering still refuses. No live ranking metadata, queue, completion, authority digest or ACL behavior changes.

Areas touched: Source intake and indexing, Data platform and access.
RAG impact: behaviour change — restores admission-bound provider-facts reads during pending reindexing. Retrieval haystacks and live ranking metadata remain unchanged. Current-main retrieval diagnostics passed 36 cases but the financial wrapper is incomplete; no complete canary pair is claimed.

Verification

  • Source commit 2c1d54dc90 and checksum commit 9cde4de092 are based on merged main 4a368eeefd7239c7a29a8573672a07ba41d88bfd.
  • The owner approved the one-entry checksum addition in the coordinating chat. All 357 existing hashes remain unchanged; 12 focused immutability tests, base-history/role checks and documentation maintenance pass. This checksum approval supplies no production merge or SQL permission.
  • Actual synthetic SQL RED reproduced the provider-facts mismatch. GREEN covers readmission -> current leased attempt -> provider facts with changed authority and unchanged live ranking metadata, refusal of foreign/malformed/tampered/withdrawn/stale inputs, and successful reads after pending application/removal. The fixture ends with ROLLBACK.
  • Pinned Postgres schema replay and authoritative drift-manifest regeneration pass. Focused pending-authority tests 6/6 and drift tests 22/22 pass. Migration-role, full TypeScript, documentation maintenance, scoped formatting and diff checks pass. Existing documentation warnings remain; no tests or thresholds were weakened.
  • Independent SQL/security review found no remaining P1/P2 finding in the five-file fix. Hosted CI for checksum head 9cde4de092 passed: https://github.com/BigSimmo/PsychSift/actions/runs/42321732458 — eight applicable jobs succeeded, including both unit partitions, original coverage thresholds, migration replay and PR required. Thirteen out-of-scope/advisory/dispatch-only jobs were skipped; this is no main UI/image or complete canary acceptance.
  • No production application RPC, readmission, ingestion, provider generation or database mutation was performed to test this fix.

Risk and rollout

Risk: privileged source-authority validation. The new migration is 20261107001000_pending_readmission_provider_authority.sql.

Merge only after the owner's specific yes to this migration and the owner pressing Merge manually. Auto-merge stays off. Merging applies database changes to PsychSift Production within seconds; no separate SQL window is promised. Exact Supabase target: sjrfecxgysukkwxsowpy.

Keep the worker paused, scheduled worker held, source build policies off and existing control models. Do not invoke readmission as a test: it queues work. After merge, require exact-merge schema drift and migration-history checks.

Before any later activation, verify the actual app and worker revisions and the approved canary evidence. This PR authorizes no readmission, re-indexing or ingestion.

Rollback: keep prior active generations and the worker hold; compensate database changes only through a separately reviewed owner-approved forward migration. Never rewrite applied migration history.

Hosted verification uses the existing US$5 total cap. The approved PR3903 preview contained no production data and was deleted after CI; its absence was confirmed. Production and the unrelated audit preview were preserved. Tracked hosted usage/rate estimate is US$0.214, not an invoice.

Clinical Governance Preflight

  • Source-backed claims still require linked source verification before clinical use
  • No patient-identifiable document workflow was introduced or expanded without explicit governance approval
  • Supabase target remains PsychSift Production (sjrfecxgysukkwxsowpy)
  • Service-role keys and private document access remain server-only
  • Demo/synthetic content remains clearly separated from real clinical sources
  • Source metadata, review status, and outdated/unknown-source behavior remain conservative
  • Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Engineering review supplies no clinical sign-off or model-activation approval.

Summary by cubic

Fixes the provider-facts RPC so a readmission that declares a new publisher, role, or status no longer fails with provider_authority_admission_mismatch while reindexing is pending. The RPC now validates the pending admission against the immutable event and unchanged live snapshot before reading its pending values, so embedding preparation succeeds while retrieval keeps the old ranking metadata until indexing completes.

  • New forward migration 20261107001000_pending_readmission_provider_authority.sql patches read_ingestion_generation_inventory; lease, source, document, owner, immutable-event, and permission checks are unchanged.
  • Withdrawn or tampered live snapshots and foreign, malformed, or stale pending blocks still refuse.
  • Tests cover the readmission → current leased attempt → provider facts path plus rejection of bad inputs; live ranking metadata, queue, completion, authority digest, and ACL behavior are unchanged.

Migration

  • Merging applies this migration to Supabase Production within seconds. Merge manually after owner approval; preserve applied migration history.

Summary by CodeRabbit

  • New Features
    • Pending provider-authority values can be applied when they match the current metadata, while leaving live ranking metadata unchanged.
  • Bug Fixes
    • Invalid pending authority information and mismatches with current metadata are now rejected.
    • Provider details remain available after pending authority is applied.