docs: full repository audit 2026-09-02 (audit only, nothing acted on)

[BigSimmo]

Summary

• Add docs/audit/full-repository-audit-2026-09-02.md: a full repository audit covering every tracked path, including the closed-off and gated sub-projects (Ward Flow, Care Plan, Caring Contacts live workspace and mockup, developer hub, the mockup corpus, dormant Clinical Ask, Therapy Compass). Method: 25 finder lanes with fixed scope and probes, every finding independently verified by a skeptic (one skeptic per lane group after the three-per-finding design hit the session usage limit — stated plainly in §3 of the report), dedup, one completeness-critic round (its findings verified the same way), and a Stage-5 adversarial review (red team, blue team, verification-router — one reviewer wearing three lenses, stated in §3) appended verbatim as §15. That review raised 37 corrections: its ten same-defect merges (173 entries → 162 distinct findings) and its corrections to orchestrator-written text were applied in place; its corrections to a finding's own text stand as blockquotes under the finding with the skeptic's grade unchanged.
• Result: 162 distinct findings survived verification (High 3, Medium 30, Low 129), 25 corroborations of open ledger rows (several shown to be stale), 7 refuted. The three High findings are clinical-reference correctness defects: a medication hero badge that shows a tenfold-wrong strength for decimal and mg/mL formulations, a documented LOW-severity interaction that composes into the green "No alert found" headline, and a clinical table cleaner that drops header cells without dropping body cells so values shift under the wrong heading.
• Machine evidence gathered offline before any finder ran: 68 fast static gates, lint, typecheck, the full unit suite (951 files / 12,227 tests), the Caring Contacts database suite (213 tests on a local PostgreSQL 16), npm audit (one high: browserslist, fix available), Semgrep 1.168.0 with the open-source rule repository (the proxy blocks the registry packs), check:stale-docs and check:dead-code-candidate on full history.
• Register the report in docs/README.md; regenerate data/repo-awareness-snapshot.json (its documentation list includes docs/audit/* and the review records).
• Second commit: eleven one-line documentation corrections, each CONFIRMED by a skeptic and re-checked against the code, listed with before/after text in the report's §11.1 (app-mode count 16 not 15, the removed Ward Flow Tools-catalogue entry, bed-release fixture count, scripts-index coverage claim and retired merge driver, tenancy review path, interaction-coverage figure, two supersession banners, machine-local paths). The completeness critic caught two flaws in the first version of those corrections; both were fixed before this push.
• Last commit: this branch's own immutable review record, written by npm run ledger:append (never by hand), and the snapshot regeneration that record forces.

Audit only. No code, migration, script, workflow, gate, test, ledger table or inbox request is changed by this PR; the only review record added is this branch's own ledger:append entry. Nothing under src/, supabase/, worker/, scripts/ or .github/ is touched. Findings that deserve a ledger row are listed in §16 of the report for the owner to triage; none was filed, by the owner's decision.

RAG impact: no retrieval behaviour change — no file under src/lib/rag/, no retrieval RPC, ranking surface, golden fixture or eval harness file is touched; the RAG lane read those files and wrote about them, nothing more.

Verification

• npm run verify:pr-local — heavy plan, 20 steps, run on the final content commit 4a05322: closing summary failed: (none) / not reached: (none); Test Files 951 passed (951) / Tests 12230 passed | 2 skipped (12232); format:changed inside the run: All matched files use Prettier code style!
• npm run format:check — repository-wide on the final tree: All matched files use Prettier code style!
• npm run docs:check-links — docs link check passed: 5433 repo path references resolve.
• npm run check:repo-awareness-snapshot — [repo-awareness] in step with data/repo-awareness-snapshot.json (204 pages, 583 documents, 2665 reviews)
• npm run check:branch-review-ledger and npm run check:ledger-write-discipline after the ledger record — Branch review ledger guard passed: 880 live table records + 1206 archived + 580 immutable … / Ledger write discipline passed for d1e4ae742945..HEAD.

Gate selection, for the record: this branch is not docs-only. data/repo-awareness-snapshot.json is a route-payload input for the scope classifier, so verify:pr-local chose the heavy plan (20 steps including lint, typecheck, the full unit suite and a production build, all offline). While the PR is a draft, CI runs static-pr, PR Policy and PR mergeability; safety, coverage, build, ui-critical(-fast) and caring-contacts-db run once it is marked ready for review.

Machine evidence recorded in the report (§4), all run offline in the audit session on d1e4ae7 before the report was written: npm run lint — [gate-receipts] recorded a pass for "lint:internal" (6073 input files).; npm run typecheck — [gate-receipts] recorded a pass for "typecheck:internal" (6073 input files).; npm run test — Test Files 951 passed (951) / Tests 12227 passed | 5 skipped (12232); four approved read-only network operations also ran (git fetch --deepen, npm audit twice, the Semgrep install and rule-repository clone); npm run caring-contacts:db:test — Test Files 2 passed (2) / Tests 213 passed (213).

Verification not run: npm run verify:ui — documentation and a regenerated snapshot only; no UI, routing, styling or browser behaviour changed, and the pinned Chromium is not installed in the audit container (check:playwright-browser-revision says so); CI runs the browser suite it decides to run.
Verification not run: npm run verify:release — no release or handoff confidence is claimed.
Verification not run: npm run check:production-readiness (its offline-tolerant :ci variant was not run either) and every eval:* — provider-backed; nothing in this PR changes clinical workflow, privacy, environment, Supabase, source governance or deployment behaviour.

No provider-backed gate was run. Nothing touching OpenAI, Supabase, Railway, Sentry or live CI was executed. The only network actions were the owner-approved git fetch --deepen, a Semgrep install and rule-repository clone, and npm audit.

Risk and rollout

• Risk: low — one new document under docs/audit/, one README bullet, a regenerated snapshot produced by its committed generator, eleven prose corrections in maintained documents, and one review record. No gate changes behaviour; docs:check-links excludes docs/audit/ by default and the default gate passes with the new file resolving.
• Rollback: revert the branch's commits (the report and its two checkpoint assemblies, the documentation corrections, and the ledger record); nothing reads the report and the snapshot regenerates from the tree.
• Provider or production effects: None.
• RAG impact: no retrieval behaviour change — no protected path touched.

Clinical Governance Preflight

This PR is documentation only. It is classified clinical-risk solely because it regenerates data/repo-awareness-snapshot.json, which the path classifier treats as clinical data; that regeneration is the mechanical output of the committed generator, required because the tree gains one document and one review record. Each item below is confirmed against the diff.

• Source-backed claims still require linked source verification before clinical use — no answer-path, source-rendering or citation code is touched.
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval — no workflow code is touched; the audit reads about Caring Contacts and reports on it.
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy) — no Supabase env value, migration or configured Supabase project/target changes.
• Service-role keys and private document access remain server-only — no src/ file changes; service-role credentials stay server-side only.
• Demo/synthetic content remains clearly separated from real clinical sources — no demo or synthetic content changes; the report documents the separation it found.
• Source metadata, review status, and outdated/unknown-source behavior remain conservative — untouched; §6 of the report records one Medium finding about unknown status for the owner to action.
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed — no clinical decision-support behaviour changed; the SaMD/TGA assessment is unaffected (one documentation figure in the SaMD note was corrected to the recomputed value).

Notes

• The audit report is large (about 790 KB) by design: every surviving finding carries the finder's evidence and the skeptic's verdict, and the Low tier is in an appendix. §5 is the two-minute read; §14 is the fix order; §16 is the suggested ledger entries.
• Stale open ledger rows the audit found (#A95DRY, #9P4XAE, #HDCF2B, #100, #W98GR7, the four hub rows) are listed in §9 for closure through npm run issues:done, never by editing the ledger; #B0530F and #27TWKM already have pending done requests in the inbox from PR Close two stale CI-coverage rows, add browser evidence for the activation wizard, and schedule the bundle-budget measurement #2527, so they must not be filed again.
• Merge only when the owner has read §5–§6; nothing in this PR is time-sensitive.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FSPY4VSqg7WVukCvmHQP9t

---

Generated by Claude Code

---

Note

Low Risk
Documentation, snapshot regeneration, and prose corrections only; no runtime, auth, RAG, or clinical workflow behavior changes.

Overview
Adds docs/audit/full-repository-audit-2026-09-02.md, a point-in-time full-repo audit (25 finder lanes, skeptic verification, completeness critic, Stage-5 review) recording 162 distinct findings (3 High, 30 Medium, 129 Low) for owner triage—no application code, migrations, gates, or inbox filings in this PR.

Indexes and housekeeping: registers the report in docs/README.md, regenerates data/repo-awareness-snapshot.json (new doc entry, updated revision metadata and counts, review-record history), and appends an immutable branch review record via the ledger workflow.

Small doc fixes (called out in the audit, including in the partial diff): 16 app modes in CLAUDE.md, corrected audit/tenancy-defense-in-depth-review.md path in README.md, plus other one-line corrections across maintained docs (e.g. codebase index, scripts index, ward-flow/SaMD/RAG notes) aligned with the tree as of the audit.

^{Reviewed by Cursor Bugbot for commit 24f0537. Configure here.}

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 7c4713fe-ac78-42a6-95e2-3a91e064a507

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_ee85db27-6ac6-438a-8e3c-5688b2237b58)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T20:35:27.117707Z	24f0537	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.