audit fixes (P10): Privacy and governance documents

[BigSimmo]

Summary

Audit remediation package P10 — Privacy and governance documents, from docs/audit/full-repository-audit-2026-09-02.md (PR #2573). Findings fixed: M7, M2, L103, L104, L7, L4. Each fix landed test-first as its own commit.

• b66395f privacy: describe the shared public corpus on /privacy (M7)
• 955cd98 docs: record browser answer-thread and recent-query storage in the PIA (M2)
• 23296b0 docs: correct the retention attestation for the 2026-09-01 schedule migration (L103)
• 678e6f8 docs: label the unmeasured SLO thresholds in observability-slos (L104)
• 3e04b2e calculators: label the internal governance record as provenance, not a clinical source (L7)
• fa624a3 care-plan: record a re-verification cadence for the real WA crisis numbers (L4)
• 3efba0a privacy: state that public-corpus files also mint signed links (M7, follow-up)

Findings in this package not fixed here, with reasons:

• L5 — Cannot be completed inside the owned files. public/brand/preview.html is owned, but tests/developer-hub-panels.test.ts asserts it is byte-identical to docs/brand/preview.html (not owned, not generated by any script), so editing only the owned copy would fail that test, and weakening a test is prohibited. The X-Robots-Tag noindex header for /brand/:path* also lives in next.config.ts (not owned). Exact change for the owner, applied identically to both HTML copies: delete the fonts.googleapis.com and fonts.gstatic.com preconnect links and the Google Fonts stylesheet link (the proxy CSP already blocks the stylesheet, so the page already renders in fallback fonts), and add <meta name="robots" content="noindex, nofollow">.
• L103 (readiness-register half) — The PIA half is fixed. The privacy readiness register entry whose externalEvidenceReference still describes migration 20260901033250 as a staging-only change is outside the package's owned file list, so it was left untouched.

Decisions needed from the owner:

• L5: apply the fonts/noindex change to both public/brand/preview.html and docs/brand/preview.html (byte-identity is pinned by tests/developer-hub-panels.test.ts), and decide whether to add /brand/:path* to the X-Robots-Tag noindex block in next.config.ts.
• L103: amend the privacy readiness register's externalEvidenceReference so it no longer describes migration 20260901033250 as staging-only, and cite the post-merge live-drift run for the merge that applied it.
• L103: if a current job-id attestation is wanted, an operator must run the provider-backed live cron.job read (confirmation required); the PIA now deliberately records job names and schedules instead.
• M7: confirm the reworded /privacy access section is acceptable to the pending privacy-adviser review (PRIV-LEGAL-APP1-APP5-NOTICE), since it now states publicly that the shared corpus is searchable without signing in.
• L104: decide whether to wire latency p95, source-gap rate and unsupported rate into answerSloSnapshot with their own OPS_* codes, or leave them as the manual-SQL targets they are now labelled.

RAG impact: none

Verification

• npm run verify:pr-local — result: - completed: check:runtime, check:installed-lock-parity, format:changed, check:diff-integrity, sitemap:check, check:repo-awareness-snapshot, docs:check-index, docs:check-inventory, docs:check-scripts, docs:check-links, check:branch-review-ledger, check:outstanding-issues, check:ledger-write-discipline, lint, typecheck, test, build, check:rag:fixtures, check:medication-interactions, check:medication-lexicon-report · - failed: (none) · - not reached: (none) · Test Files 1127 passed | 1 skipped (1128) · Tests 14964 passed | 2 expected fail | 3 skipped (14969) (the gate runner recorded exit code 0)
• npm run check:diff-integrity — [diff-integrity] PASS — 2 changed test file(s), 22 -> 24 test case(s), against base 51ddfcd83.
• Package gate notes: npm run verify:pr-local (heavy)

Verification not run: npm run verify:ui — browser proof left to CI (the pinned Chromium is not installed in this container); no narrowed browser run is claimed as the full gate.
Verification not run: npm run verify:release — no release or handoff confidence is claimed.
Verification not run: provider-backed gates (check:production-readiness, every eval:*) — nothing here touches OpenAI, Supabase, Railway or Sentry at run time; all work was offline.

Risk and rollout

• Risk: medium — privacy-facing copy and one presentation-only clinical-reference change; the two behaviour-visible changes (M7, L7) are each pinned by a new test that was confirmed failing before its fix. Residual risk stated by the implementer: five of the six changes are copy or documentation only and cannot alter runtime behaviour; the one code change (L7) is presentation-only and makes citation more conservative, not less — the governance record is still linked, just under its own "Governance reference:" label, and no scoring, ranking, retrieval or source-governance logic was touched. RAG impact: none. The main residual risk is accuracy of the new claims rather than breakage: the M7 rewording asserts a two-tier access model verified statically from the promotion migrations, owner-scope.ts and the /api/search public path but not confirmed against the live database, and the L103 note states that merging 20260901033250 re-created the pg_cron jobs on production, as the merge-deploys-within-seconds rule implies — no replacement job id was recorded, because reading live cron.job is provider-backed. L104's automation labels were derived from the complete OPS_* code list in scripts/lib/operational-alerts.mjs, so if alerting exists elsewhere (host-native or Sentry) those labels understate coverage. L4 changed comments only, so a stale crisis number still fails silently after the stated 2027-08-20 due date; the finding's suggested aging assertion was not added because no care-plan test file is in this package's owned list.
• Rollback: revert this PR's commits; each commit is one finding and reverts independently.
• Provider or production effects: None.
• RAG impact: none

Clinical Governance Preflight

Each item confirmed against this package's diff (findings M7, M2, L103, L104, L7, L4). The checked line is the exact policy item; the note beneath it is the evidence.

• Source-backed claims still require linked source verification before clinical use
  no change to source verification or citation requirements.
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
  none introduced or expanded.
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
  no Supabase env value, migration target or configured project changes.
• Service-role keys and private document access remain server-only
  no client exposure of service-role credentials; private access paths unchanged or tightened.
• Demo/synthetic content remains clearly separated from real clinical sources
  unchanged.
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
  unchanged or made more conservative.
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed
  reviewed; the changes correct reference rendering defects the 2026-09-02 audit recorded and do not add decision-support behaviour.

Notes

• Files touched: src/lib/privacy-page-content.tsx, tests/privacy-page.dom.test.tsx, docs/privacy-impact-assessment.md, docs/observability-slos.md, src/components/calculators/calculator-evidence.ts, src/components/calculators/search-detail.tsx, tests/calculators-clinical-safety.dom.test.tsx, src/components/care-plan/mockups/fixtures.ts, docs/care-plan/patient-facing-sheets/README.md, docs/design-system/adoption.md (regenerated by the pre-commit hook on the M7, L7 and L4 commits)
• Review status: this package's round-1 adversarial review never completed (its workflow stopped), unlike the other packages in this programme. An independent clinical-governance review of the whole diff was run before publication; its verdict is posted as a comment on this PR. Treat that comment, not this line, as the review record.
• One owner per file across the remediation programme: this package's files are edited by no other open remediation PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DHSyfuC6mS98ystWFiitAR

---

Generated by Claude Code

---

Note

Medium Risk
Medium risk from privacy-facing copy that asserts public corpus access and signed-link behavior, plus calculator citation labeling; changes are mostly documentation with two UI/copy paths covered by new tests and no retrieval or clinical scoring changes.

Overview
Audit remediation P10 aligns privacy/governance docs and user-facing copy with how the product actually behaves, without changing RAG or scoring logic.

Privacy and PIA: /privacy now states a two-tier access model—operator-published shared public corpus (searchable including without sign-in) versus owner-scoped uploads and logs—and that signed URLs can cover public-corpus files. The PIA adds browser sessionStorage (12-hour answer threads, recent queries) to data classification and retention, documents stale pg_cron job ids after migration 20260901033250, and expands shared-workstation residual risk.

Observability docs: docs/observability-slos.md clarifies that only hybrid-RPC error rate and degraded answer rate are repo-computed and alerted (answerSloSnapshot / OPS_*); latency p95, source-gap, and unsupported thresholds are manual SQL targets, not monitoring. The deep health probe is documented as returning up to four blocks including spend.

Calculators (presentation): partitionEvidenceSources splits internal_governance_record from clinical validation sources; Score and clinical-considerations panels show “Governance reference:” separately while keeping links—pinned by a new DOM test.

Care-plan prototype: Docs and fixture comments add a 12-month re-verification cadence (next due 20 Aug 2027) for real WA crisis numbers in fixtures.ts, with correction only in fixtures—not rendered sheets.

^{Reviewed by Cursor Bugbot for commit c40cfd0. Configure here.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 089e5cb7-5693-453a-94fe-5350f9146541

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_32ec3404-ae4d-41c3-9b19-d0551ca48ed3)