audit fixes (P21): draft the Caring Contacts hazard log and message review pack the ledger cites - #2626
Merged
Conversation
… commit contains
Audit finding M6. The P1 ledger row #1S81R8 says
`docs/caring-contacts/hazard-log.md records H-00, H-04 and H-05`. The file has
never existed in any commit reachable from this repository, so the only P1
clinical-governance blocker for a suicide-aftercare workspace could not be read,
reviewed or signed off from here.
This is a reconstruction from the code and the ledger rows, NOT a recovery. The
original wording and numbering of H-00/H-04/H-05/H-44 are lost; newly recorded
hazards therefore carry an H-C## identifier so no future reader mistakes a
2026-09-04 draft for a row from the lost 2026-08-19 log.
38 hazards recorded:
* 4 UNMITIGATED with no control cited -- H-00 (no named clinical safety
officer), H-04 (no lived-experience review of the message set), H-05 (no
Aboriginal cultural safety review) and H-44 (referral feed feasibility
unconfirmed). None blocks the synthetic build; every one blocks a pilot.
* 34 the code enforces, each with the file:line of its control, read at commit
time, and the offline test that proves it runs.
The document opens with a DRAFT block: it is a starting point assembled from the
repository, not clinical authority, and nothing in it approves a pilot. It ends
with eight claims it could not verify -- including that the Lifeline and 13YARN
numbers in the crisis-support sentence have no recorded source or verification
date anywhere in the repository, and that no production code path calls
validateGovernedMessage, so every message-content row is proof about a function
rather than about a delivered message.
Registered in docs/README.md in the same commit so docs:check-links guards it.
Verified: npm run docs:check-links, docs:check-index,
check:clinical-hazard-controls, prettier --check.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DHSyfuC6mS98ystWFiitAR
…e points at
Audit finding M6, second half. src/lib/caring-contacts/message-copy.ts:11 and
:20 name `docs/caring-contacts/message-review-pack.md` as "the lived-experience
and clinical-programme approval gate that owns final wording", and two archived
task briefs cite it the same way. The file has never existed. Hazard H-04 -- the
message set has never been read by anyone with lived experience -- is the one
pilot blocker that is ready to run today, and its facilitation material was
missing.
Reconstructed from the code, not recovered. It lists:
* the two patient-visible strings that exist (the scheduled caring contact and
the automated reply), quoted with their fragments resolved;
* the two message types that have never been authored at all -- `first` and
`closing` -- and why an implementer may not write the closing one;
* the no-reply notice, and why its previous wording became untrue;
* the crisis-support sentence, which is the owner's own words and not the
reviewer's to reword;
* 13 policy rules, each with where the check is and the test line that proves
it runs;
* the clinician-facing strings deliberately out of scope.
It states plainly that validateGovernedMessage has no production caller, so the
evidence column proves that a function refuses, not that a delivered message was
checked -- and that no message has ever been sent to any number, real or test.
DRAFT block at the top; five unverified claims listed at the bottom, including
that the Lifeline and 13YARN numbers carry no recorded source or verification
date, and that the owner's written authorisation of the crisis sentence exists
only as a source comment.
Verified: npm run docs:check-links, docs:check-index, prettier --check.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DHSyfuC6mS98ystWFiitAR
…se 1 handoff Audit finding M6, third part. phase-1-handoff.md told a recoverer that six governance documents were "intact in history" and to run `git checkout 32d408c -- docs/caring-contacts/`. Both halves are false, verified in this worktree: * `git cat-file -t 32d408c` -> fatal: Not a valid object name * `git log --all --name-only` across the full fetched history matches no path containing hazard-log, message-review-pack or referral-feasibility The instruction was worse than a dead link: it sent anyone looking for the P1 hazard record to a commit that does not exist, and told them the material was safe. Replaced with what is true -- the documents are not in git, the only copies named anywhere are the two off-machine bundles in PROGRESS-LEDGER SS3/SS8/SS9 (which SS9 records are on the same workstation and not protected by the push), nothing here can confirm those bundles contain these six documents, and two of the six have now been re-drafted from scratch rather than recovered. No number, threshold or clinical value changed. Verified: npm run docs:check-links, prettier --check. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DHSyfuC6mS98ystWFiitAR
…and when it is next due Audit finding L4. The four real public crisis numbers in the Care Plan fixtures carry verifiedOn: "2026-08-20" and a comment saying to correct them if they have changed, but nothing in the repository ages that date -- no test, no gate, no ledger row -- while the same file models its synthetic community teams as review_due after a few months. These numbers render on the printed Personal Safety Plan and Patient Plan, sheets a person is meant to take home. Adds docs/care-plan/crisis-lines-verification.md, recording per number: the number, the source used to check it (every URL already present in a repository document -- triplezero.gov.au, the WA Health MHERL and Rurallink pages), the verifiedOn date already in the fixture, every other line in fixtures.ts where the same number is printed, and a six-monthly re-verification cadence with its procedure and a history table. NO NUMBER WAS CHANGED. The only source edit is a verification-record comment above publicCrisisContacts pointing at the new document. Also recorded, deliberately not acted on: patient-plan-fixtures.ts prints invented contacts at 0491 570 210-270, above the 0491 570 156 upper bound of the block this repository treats as reserved for fiction -- the same defect sdd-ledger.md:623-627 records finding and fixing in fixtures.ts. The numeric range assertion at care-plan-domain.test.ts:444 runs over a bundle built from fixtures.ts only, so it does not see them. Five unverified claims are listed, first among them that nothing was checked online: there was no network access in this session, so this document records what the repository asserts and is not itself a verification. Verified: npm run docs:check-links, docs:check-index, prettier --check, npx tsc --noEmit, npx vitest run tests/care-plan-domain.test.ts (63 passed). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DHSyfuC6mS98ystWFiitAR
… governance documents Adds docs/caring-contacts/hazard-log.md, docs/caring-contacts/message-review-pack.md and docs/care-plan/crisis-lines-verification.md to the snapshot (853 -> 856 documents). Generated with `npm run snapshot:repo-awareness`, never edited by hand. Verified: npm run check:repo-awareness-snapshot -> in step (211 pages, 856 documents, 2692 reviews). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DHSyfuC6mS98ystWFiitAR
Contributor
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Team Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
BigSimmo
marked this pull request as ready for review
September 4, 2026 16:25
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Contributor
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_eefbb485-8a0f-4750-923d-3d9caf916624) |
BigSimmo
enabled auto-merge (squash)
September 4, 2026 16:26
BigSimmo
disabled auto-merge
September 4, 2026 16:44
# Conflicts: # data/repo-awareness-snapshot.json
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DHSyfuC6mS98ystWFiitAR
Contributor
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_1abb5787-6c95-44df-8f92-04500d739740) |
10 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Audit remediation package P21 — Clinical governance documents, from
docs/audit/full-repository-audit-2026-09-02.md(PR #2573). Findings:M6,L4.These are drafts that require the owner's clinical sign-off. They are not clinical authority and neither approves nor unblocks a patient pilot. Both new files carry that statement at the top.
M6 — outstanding-issue
#1S81R8cites a hazard log and a message review pack that exist in no commit. Both are now written, assembled only from what this repository already records: the hazard analysis documents,docs/caring-contacts/**,clinical-hazard-controls.json, and the governance and message-policy code with its tests.docs/caring-contacts/hazard-log.md— 38 hazards, 4 of them unmitigated. The four with no control cited are the three the ledger names (no named clinical safety officer, no lived-experience review of the message set, no Aboriginal cultural safety review) plus#TDKW4W's unconfirmed referral-feed feasibility. The other 34 are code-enforced, each with thefile:lineof its control and the offline test that proves the control runs. The original hazard numbering is unrecoverable, so reconstructed rows useH-C##andH-01…H-43are explicitly retired rather than reused.docs/caring-contacts/message-review-pack.md— two patient-visible strings, two never-authored message types, three governed fragments, and 13 policy rules each with its check location and test line.db70edaf6corrected a false instruction, and could not replace it with a true one. The Phase 1 handoff carried a recovery command naming commit32d408c2f;git cat-file -t 32d408c2freturnsfatal: Not a valid object name, andgit log --all --name-onlymatches nohazard-log,message-review-packorreferral-feasibilitypath. There is no real sha to substitute. The document now records the verified truth instead: those files are not in git, only in the twocaring-contacts-handoff-2026-08-2*workstation bundles that PROGRESS-LEDGER §9 records as unprotected by any push — and two of the six have now been re-drafted rather than recovered.L4 —
docs/care-plan/crisis-lines-verification.mdrecords, per printed crisis number, the source used to check it, theverifiedOndate already in the fixture, and a re-verification cadence.src/components/care-plan/mockups/fixtures.tsgains a comment pointing at it. No number and noverifiedOndate changed.RAG impact: none
Two things found while drafting that this PR does not fix
validateGovernedMessagehas no production caller.grep -rn "validateGovernedMessage" src worker scriptsreturns onlymessage-copy.tsand the module itself. Every message-content control this pack documents is therefore proof about a function, not about a delivered message. Recorded prominently in both new documents. It changes no present risk (nothing is being sent) but it should be read as blocking for a real-patient pilot alongside the three unmitigated reviews.src/components/care-plan/mockups/patient-plan-fixtures.tsprints contacts at0491 570 210–270, above the156upper bound of the block this repository treats as reserved for fiction. The range assertion attests/care-plan-domain.test.ts:444runs over a bundle built fromfixtures.tsonly, so it never sees them — the same defect classsdd-ledger.md:623-627records fixing infixtures.ts. Nothing was changed; it is written up in the crisis-lines document and needs an owner decision.What the owner must check before signing
These claims are in the new documents and could not be verified from the repository:
H-01…H-43numbering.13 11 14and 13YARN13 92 76atmessage-rules.ts:117carry no source and no verification date anywhere in the repository, and nothing ages them. Marked to verify — no network access in this session.cloud-session.md:258-259records that this was never checked.src/lib/caring-contacts/; screens, routes and the database layer were not swept the same way.Verification
npm run verify:pr-local— result:- completed: check:runtime, check:installed-lock-parity, format:changed, check:diff-integrity, sitemap:check, check:repo-awareness-snapshot, docs:check-index, docs:check-inventory, docs:check-scripts, docs:check-links, check:branch-review-ledger, check:outstanding-issues, check:ledger-write-discipline, lint, typecheck, test, build, check:rag:fixtures, check:medication-interactions, check:medication-lexicon-report·- failed: (none)·- not reached: (none)·Tests 15135 passed | 2 expected fail | 3 skipped (15140)(the gate runner recorded exit code 0)npm run check:clinical-hazard-controls—CLINICAL_HAZARD_CONTROLS_PASS hazards=6 decisions=2npm run check:repo-awareness-snapshot—[repo-awareness] in step with data/repo-awareness-snapshot.json (211 pages, 856 documents, 2692 reviews)npm run check:diff-integrity—[diff-integrity] PASS — 0 changed test file(s), 0 -> 0 test case(s), against base 33c2dc161.No test file is touched by this package.Verification not run:
npm run verify:ui— no UI surface changes; browser proof left to CI.Verification not run:
npm run verify:release, and every provider-backed gate — all work was offline, and no crisis number could be checked against its source without network access.Risk and rollout
Clinical Governance Preflight
Each item confirmed against this package's diff (findings
M6,L4). The checked line is the exact policy item; the note beneath it is the evidence.unchanged; the new documents state explicitly which of their own claims are unverified.
none introduced or expanded; these are records of existing controls.
Clinical KB Database(sjrfecxgysukkwxsowpy)no Supabase env value, migration target or configured project changes.
unchanged; no access path is touched.
reinforced — the crisis-lines document records exactly which printed numbers are real and which are fiction, and flags one fixture whose invented numbers may fall outside the reserved block.
unchanged.
reviewed; documentation only, no decision-support behaviour added.
Notes
docs/outstanding-issues.mdanddocs/branch-review-ledger.mdwere read but never edited. The follow-ups this package surfaced are queued for a later pass throughnpm run issues:add.🤖 Generated with Claude Code
https://claude.ai/code/session_01DHSyfuC6mS98ystWFiitAR
Generated by Claude Code
Note
Medium Risk
Runtime risk is minimal (one fixture comment), but the new draft hazard and crisis-line records are clinically sensitive and could be read as signed controls or verifications without owner sign-off.
Overview
Addresses audit P21 (findings M6, L4) by adding three DRAFT, unsigned governance documents the ledger and code already referenced but that were never in git, plus index and snapshot updates. No crisis numbers,
verifiedOnvalues, or Caring Contacts runtime logic change.Caring Contacts (M6): New
hazard-log.mdreconstructs 38 hazards (four UNMITIGATED governance gaps: safety officer, lived-experience message review, Aboriginal cultural safety review, unconfirmed referral feed) and 34 code-backed rows withfile:linecontrols and test evidence, using newH-C##ids because the original log is unrecoverable. Newmessage-review-pack.mdlists the two provisional patient SMS strings, unauthoredfirst/closingtypes, and policy rules with test pointers.phase-1-handoff.mdreplaces a brokengit checkout 32d408c2frecovery story with the verified fact that six governance files were never committed and only off-repo handoff paths are named.Care Plan (L4): New
crisis-lines-verification.mddocuments sources, fixture pins, re-verification procedure (proposed six-month cadence), and explicit limits (nothing agesverifiedOn).fixtures.tsgains a comment linking to that record only.docs/README.mdanddata/repo-awareness-snapshot.jsoncatalogue the new paths. Both new Caring Contacts packs prominently notevalidateGovernedMessagehas no production caller today (tests/message-copyonly).Reviewed by Cursor Bugbot for commit 2efd8c5. Configure here.