Finish the PsychSift rename across the repository's living surfaces

[BigSimmo]

Summary

• Finishes the PsychSift rename across the repository surfaces that describe the system as it is now. The app itself was renamed in Rebuild the PsychSift mark as exact vector geometry, and use it for the site icons #2452/Rename the product to PsychSift, and let the symbol stand without a tile #2453, but the rename stopped at product code: the repo front page, the security policy, both container images' published OCI labels, and roughly twenty living reference docs still advertised the retired name.
• Corrects a genuine staleness bug in docs/worker-deploy-runbook.md, which told an operator to look for the startup log line Clinical KB worker started. worker/main.ts:2057 has emitted PsychSift worker started since the rename, so the runbook pointed at a string the worker never prints.
• Disambiguates two docs/codebase-index.md references that said "Clinical KB" but meant the Supabase project rather than the product. Both now name Clinical KB Database explicitly.
• Adds "PsychSift" to the protected-names clause in LICENSE, keeping "Clinical KB" alongside it — the former name still warrants the same no-endorsement protection.
• Extends the existing retired-name guard in scripts/list-database-skills.mjs with a userFacingProductSurfaces list covering all 34 living surfaces this rename touches, and adds Clinical KB Staging to the regex's negative lookaheads next to Clinical KB Database.
• Adds a test that enumerates Dockerfile* from disk and asserts each is guarded, so a second published image cannot be renamed again without its guard entry.

Deliberately not renamed, so the omissions do not read as misses:

• The live Supabase projects. Clinical KB Database and Clinical KB Staging are those databases' real names, pinned by AGENTS.md. Renaming them in prose would point readers at projects that do not exist.
• Dated records. Reports, plans, specs, ledgers, archives, forensics and generated snapshots keep the old name. They record what was true when they were written; rewriting history to match a later name makes the record less accurate, not more.
• LICENSE. Excluded from the guard on purpose: its protected-names clause keeps the former name alongside the current one, so guarding it would force out a name that belongs there.
• Lowercase identifiers. clinical-kb-* storage keys, cache prefixes, tool ids and directory paths are addresses, not names. Renaming the localStorage keys would silently reset saved theme, last-mode and guide-progress state for anyone already using the app.

No user-visible application behaviour changes in this PR. The app's name, icons, manifest and PWA metadata were already PsychSift on main and are already live on psychiatry.tools.

Review findings addressed

Codex raised one P2 on b4e1a67 — the guard covered the app Dockerfile while Dockerfile.worker still shipped the retired name in both published OCI labels, and the list omitted most renamed surfaces. Both parts were correct and are fixed in 0ac2621 (thread, resolved).

Root cause, recorded because it explains the shape of the miss: the original repo-wide sweep was piped through head -30, truncating output before Dockerfile.worker, and the partial list was treated as complete. Re-running it untruncated surfaced three further living surfaces the same truncation hid — CONTEXT.md, .design-sync/NOTES.md, .design-sync/conventions.md — now also renamed. The guard list is now built from the diff rather than sampled.

Verification

• npm run verify:pr-local — ran on b4e1a67; result reported honestly: EXIT=1, failed: test (exit 1). 24 of 24 static, docs, workflow, lint and typecheck gates completed clean (Test Files 3 failed | 929 passed (932), Tests 3 failed | 11718 passed | 1 skipped (11722)). build and the RAG/medication fixture checks were not reached.

The three failures are pre-existing on main, not introduced here. Verified by checking out origin/main (95b5c1b) into a clean worktree and running the same three files: identical Test Files 3 failed (3) / Tests 3 failed | 22 passed (25). They are environmental — this container holds a shallow clone, and tests/rag-plan-package-parity.test.ts fails explicitly with manifest reconciledBase is unavailable locally: f3d1a3cce2c943ad3083425ed9c7c46dbef23087; tests/clinical-hazard-controls.test.ts and tests/privacy-readiness-contract.test.ts fail from the same missing local state. GitHub's Unit coverage job runs against a full clone and is the authoritative signal for these.

Note on the exit code: the wrapper reported success while the gate itself exited 1. Exit code alone was not proof here — the decisive line was, which is why the summary above is quoted rather than summarised.

Focused evidence on the current head (0ac2621):

• npx vitest run tests/database-skills.test.ts — 13 passed (13), including the new Dockerfile* coverage assertion.
• npx vitest run tests/database-skills.test.ts tests/repo-hygiene.test.ts tests/codebase-index-coverage.test.ts — 78 passed (78).
• Negative check on the new test, with Dockerfile.worker removed from the array: AssertionError: Dockerfile.worker publishes OCI labels and must be guarded — the test fails without the fix, so it is a real guard.
• node scripts/list-database-skills.mjs --check — "Database skill system valid: 35 canonical skills, 8 aliases, 67 repository SKILL.md files across 4 surfaces."
• npm run format:changed — "All matched files use Prettier code style!"
• node scripts/check-docs-links.mjs — "docs link check passed: 4710 repo path references resolve."
• npx eslint scripts/list-database-skills.mjs tests/database-skills.test.ts — clean.

Scope note: the selector fails closed to the heavy route (lint, typecheck, full unit suite, build) because the diff touches scripts/list-database-skills.mjs and tests/database-skills.test.ts alongside the documentation. That routing is correct for executable scope and was not narrowed.

• npm run verify:ui — UI verification not run: no UI, routing, styling, browser-behaviour, reduced-motion or forced-colors change. classifyPullRequestFiles reports ui: false.
• npm run verify:release — not run: no release or handoff-confidence claim is being made here.
• npm run eval:retrieval:quality — not applicable: no retrieval, ranking, selection, chunking or scoring behaviour changed (ragRanking: false).
• npm run eval:rag / npm run eval:quality — not applicable: no answer generation, synthesis prompt or answer post-processing changed.
• npm run check:production-readiness — not run: no clinical workflow, privacy, environment, Supabase, source-governance or deployment behaviour changed. docs/privacy-impact-assessment.md and docs/clinical-governance.md are touched, but only to replace the product's retired name in prose; every assessed data flow, boundary and retention statement is byte-identical apart from that noun.
• npm run check:deployment-readiness — not run: see the container-image note under Risk below.

Risk and rollout

• Risk: low. The overwhelming majority of changed files are prose. The two executable changes are a repository-hygiene check and its test — neither runs in the application, the worker, or any request path. The one change with reach beyond documentation is six lines across Dockerfile and Dockerfile.worker: a leading comment and the org.opencontainers.image.title / image.description OCI labels in each. Labels are descriptive metadata read by registry tooling; they do not affect the build graph, layer contents, entrypoint, or runtime. No FROM, RUN, COPY, USER, EXPOSE or STOPSIGNAL instruction is touched in either file, so both produced images are functionally identical. The Container images / build-and-verify job exercises this.
• Rollback: single-commit revert, no coordination required. Nothing here is stateful, nothing migrates, and no consumer reads these strings programmatically — the OCI labels included. A revert restores the retired name and re-reddens nothing.
• Provider or production effects: None. No OpenAI, Supabase, Railway or hosted-CI call was made in preparing this change, and none is introduced by it. The one network read performed during investigation was an unauthenticated GET of the already-public psychiatry.tools HTML, manifest and icon endpoints, to confirm production already serves the PsychSift name and the current mark; it mutated nothing.
• RAG impact: none — no RAG ranking surface is touched (src/lib/rag/**, retrieval RPCs, golden fixtures and ranking tests are all outside this diff; classifyPullRequestFiles reports ragRanking: false).

Clinical Governance Preflight

Not applicable to this diff, and stated rather than left as silent unchecked boxes. classifyPullRequestFiles reports clinicalRisk: false: the change touches no ingestion, answer-generation, search/ranking, source-rendering, document-access, privacy or production-environment behaviour. Two clinical-governance documents are edited, but only to replace the product's retired name in prose — no assessed data flow, boundary, retention period, review status or conservative-failure statement is altered. Worth recording explicitly all the same:

• The Supabase target is unchanged and remains Clinical KB Database (sjrfecxgysukkwxsowpy). This PR deliberately preserves that name everywhere it appears, and the guard's negative lookaheads now protect both it and Clinical KB Staging from a future rename sweep.
• No patient-identifiable workflow is introduced or expanded; no service-role key, private-document access path, or demo/synthetic separation is touched.

Notes

The rename's original blind spot is worth naming, because it is the reason a guard now exists rather than just a corrected file. #2452/#2453 renamed the product everywhere a user reads it and added a check for the plugin metadata that skill routing matches on. Nothing covered the surfaces a reader meets first — the repo front page, the security policy, the container labels, the reference docs — so those drifted quietly for weeks, the worker runbook drifted into being actively wrong, and a published image kept the retired name in its OCI labels.

The userFacingProductSurfaces list closes that gap without overreaching into the historical record, and the Dockerfile* enumeration test closes the narrower gap that a hand-maintained list of any length can silently fall behind the thing it guards.

---

Note

Low Risk
Mostly documentation and OCI label text plus an offline skills hygiene check; no runtime, auth, data, or deployment instruction changes beyond descriptive image metadata.

Overview
Completes the PsychSift product rename on the repository surfaces readers hit first—README, agent orientation, security policy, design-sync notes, and a broad set of maintained docs—while leaving live Supabase project names (Clinical KB Database, Clinical KB Staging) and historical archives unchanged.

Container metadata on both Dockerfile and Dockerfile.worker now use PsychSift in comments and OCI title/description labels (descriptive only; no build/runtime graph changes). docs/worker-deploy-runbook.md is updated to expect the startup log PsychSift worker started, matching current worker output.

LICENSE adds PsychSift to the protected-names clause and keeps Clinical KB for no-endorsement coverage. scripts/list-database-skills.mjs gains a userFacingProductSurfaces list (34 paths) checked by npm run check:skills, with regex lookaheads so database project names are not flagged; tests/database-skills.test.ts asserts every root Dockerfile* is on that list.

Unrelated: tests/caring-contacts-contact-time-adjustment.dom.test.tsx pins fake timers for stability. No application behaviour, routing, or RAG changes.

^{Reviewed by Cursor Bugbot for commit 489fd86. Configure here.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 24108493-2358-4ca5-8e0f-4daa89ba375b

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-30T06:21:41.373613Z	b4e1a67	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_3405e0d4-c1ca-40f6-85d4-0fe90bf0e1ca)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b4e1a67db9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BigSimmo]

@codex resolve actionable Codex review findings for this pull request and current head using the repository instructions. This is the pull request's single automatic repair pass: do not perform a fresh review, create new standalone findings, or request another review. Work only the existing unresolved Codex threads on the current head. The only repository destination is BigSimmo/Database, and the only branch destination is the pull request head branch claude/psychsift-rename-logo-5cq3nw at starting commit b4e1a67; never publish fixes to a detached or synthetic work branch and never create a stacked pull request. Use the authenticated GitHub connector to commit each approved fix to BigSimmo/Database:claude/psychsift-rename-logo-5cq3nw, then verify that the pull request head contains the published commit before reporting success. Always fix P0 and P1 findings. For P2 and lower findings, fix only clear, scoped, low-risk issues; otherwise disposition them with a concise reason. For a fixed thread, reply with as the first line and as the second line. For a no-code disposition, use followed by . These result markers authorize the workflow to close that exact thread only after it verifies a fixed commit is the pull request head; a local-only commit is not a fix. If publication or verification fails, do not use either result marker, do not claim success, and leave the thread open with the blocker. If human input or new authorization is required, do the same. Finish only after every actionable thread is fixed or dispositioned and closed, or explicitly left open for a human decision. Do not update the branch from main, address unrelated reviews, broaden scope, or create more than one scoped fix commit. Do not use external APIs, paid services, credentials, dependency changes, or broad refactors unless explicitly authorized. Add targeted tests where behavior changes and run the narrowest relevant validation.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: b4e1a67db9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BigSimmo]

Unit coverage is red, and it is not this PR's failure

Failing check: Unit coverage (and the PR required aggregate downstream of it), on b4e1a67 and expected again on 0ac2621.

Failing test:

FAIL |jsdom| tests/caring-contacts-contact-time-adjustment.dom.test.tsx
  > a time this service may not send at
  > raises the warning from the domain's own window rule, on the exact hour it excludes
AssertionError: expected 'adjust-date-time' to be 'outside-window-warning'

Why it is not this PR's

• This PR touches no Caring Contacts code. Its diff is documentation, two container-image label sets, one repository-hygiene script and its test.

• The test file is byte-identical to main: git diff origin/main...HEAD -- tests/caring-contacts-contact-time-adjustment.dom.test.tsx returns nothing.

• It reproduces on unmodified origin/main (95b5c1b) in a clean worktree — the base branch is red on this test independently of this PR:

  FAIL |jsdom| tests/caring-contacts-contact-time-adjustment.dom.test.tsx > … on the exact hour it excludes
   Test Files  1 failed (1)
   Tests  1 failed | 16 passed (17)
  

I have not re-run the job. A re-run is for confirming a suspected flake; reproducing the failure directly on the base branch is stronger evidence than a second CI roll, and this failure is deterministic (3/3 local reproductions). Spending the re-run would not add information.

Root cause, verified rather than guessed

The test pins a clock for the repository but not for the component:

const NOW = "2026-08-30T03:00:00.000Z";
return createInMemoryRepository(fixedClock(NOW));   // data clock: pinned

There is no vi.useFakeTimers() / vi.setSystemTime() anywhere in the file, so the React component under test reads the real system clock while its fixtures sit at a pinned instant. The two agreed closely enough to pass until the real-world date reached the pinned date; they no longer do.

Confirmed empirically. Adding a system-clock pin alongside the existing repository clock, changing nothing else:

beforeAll(() => {
  vi.useFakeTimers({ shouldAdvanceTime: true });
  vi.setSystemTime(new Date(NOW));
});
afterAll(() => vi.useRealTimers());

	run 1	run 2
pinned system clock	Tests 17 passed (17)	Tests 17 passed (17)
unpinned (current main)	Tests 2 failed | 15 passed	Tests 1 failed | 16 passed

This also explains a second, intermittent failure in the same file — "refuses the next move rather than guessing a version the service did not confirm" — which appears in some unpinned runs and never in pinned ones. One root cause, two symptoms. Worth noting because that one would otherwise get filed as an unrelated flake and re-run until green.

Not a flake, and not fixable by waiting. It is a fixed-date fixture that the calendar has caught up with, so it will keep failing and will worsen: the file also carries CONTACT_DAY = "2026-08-31", which rolls into September tomorrow.

Why the fix is not in this PR

Per AGENTS.md, a failure in code unrelated to the change gets a proposed patch rather than a widened PR — this is a product-rename PR, and Caring Contacts scheduling is a clinical-adjacent surface that deserves its own review rather than riding along in a docs change. No fix PR for it exists yet (the only other open PRs are #2296 and #2297, both Dependabot), so there is nothing to port.

The patch above is two lines plus imports, test-only, and verified. I can raise it as its own PR on request; once it lands, this branch goes green with no change of its own.

Everything else on this PR is green

Build, PR policy, PR mergeability, Change scope, Semgrep, Gitleaks, GitGuardian all pass on 0ac2621, and the one Codex review finding is fixed and resolved. Unit coverage is the only thing standing between this PR and the auto-merge that is already armed.

---

Generated by Claude Code

[github-actions]

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

• Unit coverage — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.
• PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #14502 (failure).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_1e7feec4-5e24-4fca-afce-ac842fde9a37)

[BigSimmo]

Unit coverage baseline fix published

Current head 489fd8648bf01daa6bc40bea8f28b08578561175 now contains the smallest test-only fix for the Caring Contacts clock mismatch.

• tests/caring-contacts-contact-time-adjustment.dom.test.tsx now pins the suite's system clock to its existing NOW fixture with vi.useFakeTimers({ shouldAdvanceTime: true }) / vi.setSystemTime(...), and restores real timers in afterAll.
• No production code changed.
• Focused proof on the PR branch, twice: Test Files 1 passed (1); Tests 17 passed (17).
• Independent proof after applying the same patch to current main at b0af4dab13ad25365c2888611a7b15571feeba58, twice: Test Files 1 passed (1); Tests 17 passed (17).
• npm run format completed with the changed test unchanged by Prettier.
• Remote verification confirms PR Finish the PsychSift rename across the repository's living surfaces #2461 points at the published commit and the file blob is b0a399021c59813430e14e203a8bb08c31e1b85b.

A full local npm run test:coverage was attempted because that is the required hosted blocker, but it was not a valid local verdict: unrelated environment-sensitive suites failed and the run was stopped when a later test attempted a Supabase connection. No provider-backed workaround was used. Fresh GitHub Unit coverage on this exact head is the authoritative broad gate.