Compact Answer source and safety support UI

[BigSimmo]

Summary

• Compact Source-only and Review due into one subtle source-status row while preserving expandable stale-source details and cited-page navigation.
• Move Evidence gaps and Report a problem beside Copy with sources as neutral answer utilities.
• Reduce Safety findings to a focused priority row and place Also in your library directly beneath the safety/evidence stack.
• Add responsive, keyboard, reduced-motion, forced-colors, and synthesized stale-answer regression coverage.

Verification

• npm run verify:pr-local
  • Partial: runtime, installed-lock parity, formatting, documentation, ledger guards, lint, and typecheck passed.
  • Full unit result: 11,656 passed, 75 skipped, 6 failed. All six failures are the unchanged Windows tests/claude-cloud-profile.test.ts harness returning exit 127; this PR does not touch that test or its provisioner.
  • The wrapper stopped at unit tests, so the unreached selected checks were run separately below.
• npm run verify:ui when UI, routing, styling, browser behavior, reduced-motion, or forced-colors behavior changed
  • Broad Chromium run during implementation: 624 passed, 6 skipped, 5 failed because assertions still expected the controls in their old locations. The five corrected cases then passed 5/5.
  • Final synchronized-head targeted Chromium journey: 1/1 passed across 320, 390, 639, 768, 1440, and 1920px, keyboard focus, reduced motion, forced colors, and overflow.
• npm run verify:release before release or handoff confidence claims
  • Not run: release confidence and provider-backed checks were not requested.
• npm run eval:retrieval:quality (must stay 36/36) when retrieval, ranking, selection, chunking, or scoring behavior changed
  • Not run: retrieval, ranking, selection, chunking, and scoring behavior are unchanged.
• npm run eval:rag -- --limit 15 + npm run eval:quality -- --rag-only when answer generation, the synthesis prompt, or answer post-processing changed
  • Not run: generation, prompts, and post-processing are unchanged.
• npm run check:production-readiness when clinical workflow, privacy, environment, Supabase, source governance, or deployment behavior changed
  • npm run check:production-readiness:ci — READY; structural privacy requirements 11/11 passed.
  • Full release-mode command remains blocked by pre-existing pending/partial provider, legal, and clinical evidence statuses.
• npm run check:deployment-readiness when deployment startup, hosting, or rollout behavior changed
  • Not run: deployment behavior is unchanged.

Additional local evidence:

• node scripts/run-vitest.mjs run --reporter=dot tests/answer-source-marks.dom.test.tsx — 13/13 passed.
• npm run check:design-system-contract — passed; 55 components, 84 adoption roots, and 7 design-sync guidelines checked.
• npm run build — passed; compilation, TypeScript, 1,998 routes, and client bundle secret scan completed.
• npm run eval:rag:offline — 26 files and 628 tests passed; 36 golden cases validated.
• npm run eval:rag:adversarial:offline — 25/25 passed across 24 synthetic cases.
• Medication interaction index and lexicon report checks passed.
• Physical Safari and installed-PWA device testing were not run.

Risk and rollout

• Risk: Low presentation risk. The primary residual risk is visual behavior on physical Safari/PWA; Chromium covers the implemented responsive and accessibility states.
• Rollback: Revert the feature and review-record commits; no migration, stored data, retrieval configuration, or provider state is involved.
• Provider or production effects: GitHub branch and pull request only. No Supabase, OpenAI, deployment, migration, or production-data action was performed.
• RAG impact: no retrieval behaviour change — this PR changes source/status presentation and interaction placement only.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Notes

• The branch was synchronized with current origin/main before final verification.
• Review due remains an expandable source-level warning; Source-only and stale synthesized answers both retain explicit regression coverage.

---

Note

Low Risk
Presentation and control placement only; no retrieval, auth, or data-path changes—residual risk is layout/regression on physical Safari/PWA outside Chromium coverage.

Overview
Compact answer source and safety UI on the live clinical answer surface: source-currency warnings sit in one row with neutral utilities, while safety stays a single priority strip.

NaturalLanguageAnswer now renders Source-only and Review due (RetrievalStateBanner) side by side in answer-source-status-row when applicable, with stable useId-backed disclosure controls and a responsive tweak hiding “· verify passages” on very narrow widths. Stale synthesized answers can show review-due in that row via new answerState / onOpenStateSource props; the live turn hides inline copy (showCopyAction={false}) because copy moved up-stack.

AnswerCard gains optional retrievalStatePlacement ("header" | "content") so the dashboard can render stale status beside Source-only without duplicating the header banner; ready answers force "content", degraded cards use "content" only for stale_evidence.

Answer utilities are split from the safety card: new AnswerUtilityActions hosts Copy with sources, Evidence gaps, and Report a problem in the quiet chatMicroAction row. AnswerSupportSummaryCard is trimmed to the safety/priority row only; it mounts when priority is set, not for gaps/feedback alone.

RetrievalStateBanner typography and hit targets align with compact-meta (smaller text, min-h-compact-meta). Cross-mode “Also in your library” moves above follow-up suggestions to close the evidence/safety stack before the next conversational turn.

Design-sync (AnswerCard DTS props), adoption manifest, and tests/smoke specs follow the new hierarchy and behaviors.

^{Reviewed by Cursor Bugbot for commit 888649d. Configure here.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ba027da8-6a6c-4abd-8001-dc5b271d9ceb

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-31T02:37:49.272492Z	888649d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_0046a67c-b73c-4dd6-a228-48c8c91722ca)