docs: gate consolidation audit — evidence-based proposal for the 78-gate maze

[BigSimmo]

Summary

• Adds docs/audit/gate-consolidation-audit-2026-09-02.md — a proposal-only audit of this
  repo's 78 check:* npm scripts, 284 npm scripts total, and 23 GitHub Actions workflows,
  investigating gate-by-gate whether each is load-bearing or routine, and where consolidation
  is plausible.
• Method: gate-arbiter/gate-receipts evidence check (both empty in this fresh container — noted
  explicitly as a limitation), a full CI routing map, eight parallel family investigations
  (static/consistency, lint/type, unit/coverage, browser/Playwright, database/migration,
  RAG/clinical, docs/workflow, security/secrets), a synthesis ranking findings by confidence,
  and a Stage 4 adversarial pass (red team, blue team, and verification-router, each seeing
  only the synthesis, not the underlying reasoning) whose full verbatim responses are appended —
  including two real corrections to the synthesis's own claims (one Tier 2 proposal was
  factually wrong and is withdrawn/reclassified load-bearing; one "gap" finding turned out to
  already be covered via an indirect script chain).
• Regenerates data/repo-awareness-snapshot.json to reflect the new document, per
  check:repo-awareness-snapshot's own fix instruction.
• Merged origin/main in to pick up PR Correct the Ward Flow pinned-clock record and defend the fix at screen level #2522, which touched the same generated snapshot file;
  resolved by regenerating with npm run snapshot:repo-awareness against the merged tree
  rather than hand-resolving the conflict.
• Nothing else changes. No package.json script, no GitHub Actions workflow, and no check
  script is touched — every recommendation in the document is for a human to read and decide on.

Verification

• npm run verify:pr-local — full green before the merge (19/19 gates completed, 0 failed);
  re-run after merging origin/main to confirm the merged tree is still clean.
• npm run verify:ui — not applicable, no UI/routing/styling changed.
• npm run verify:release — not applicable, no release/handoff claim.
• eval:retrieval:quality / eval:rag / eval:quality — not applicable, no retrieval,
  ranking, or answer-generation code changed (this PR is a Markdown document only).
• check:production-readiness / check:deployment-readiness — not applicable, no clinical
  workflow, privacy, environment, Supabase, source-governance, or deployment behavior changed.

Risk and rollout

• Risk: none — documentation only, no executable code, gate, or workflow changed. The PR policy
  bot classifies this as clinical-risk purely because it touches a path under data/ (the
  regenerated data/repo-awareness-snapshot.json, a route/doc-count inventory with no clinical
  content) — the classifier is deliberately broad on that path since PR perf: reduce Therapy startup and sidebar layout work #1489 once shipped a
  mislabeled therapy record without tripping it; this PR carries no clinical dataset content.
• Rollback: revert the commit; nothing downstream depends on this document.
• Provider or production effects: None.
• RAG impact: none (no RAG ranking surface touched; the document discusses RAG gates but
  changes none of them).

Clinical Governance Preflight

Triggered only by the data/ path match on the regenerated snapshot file described above
(a route/doc-count inventory, not clinical content). None of these items are substantively
affected — checked as true for this PR:

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Notes

• This is explicitly a proposal, not a decision. The document's own Tier 1–4 findings, the
  "never touch" list, and the Stage 4 adversarial responses are meant to be read together —
  several findings were contested or corrected between stages, and that disagreement is
  preserved rather than resolved in the document's favor.
• No follow-up implementation work is included in or implied by this PR. Any action on the
  document's recommendations (script merges, CI routing changes, doc updates) would be separate,
  reviewed work.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01FDiC2BK8XcPbstaJf7So2x

---

Note

Low Risk
Documentation and generated snapshot only; no runtime, CI, or gate behavior changes. Snapshot under data/ may trigger policy checks but carries no clinical data.

Overview
Adds docs/audit/gate-consolidation-audit-2026-09-02.md, a proposal-only audit of the repo’s ~78 check:* scripts, npm/CI routing, and where consolidation might be safe. It ranks gaps and overlaps (e.g. verify:pr-local vs verify:cheap), names a never-touch set (RAG, drift, tenancy), and appends Stage 4 red/blue/verification-router reviews with inline corrections (e.g. client-bundle-secrets already runs via build:internal; C3 withdrawn).

No gates, workflows, or package.json scripts change — recommendations are for humans only.

Regenerates data/repo-awareness-snapshot.json so it lists the new audit doc, updates doc counts, refreshes captured_revision, and picks up merged ledger entries (including caring-contacts review rows). That path can trip broad clinical-risk PR policy despite non-clinical inventory content.

^{Reviewed by Cursor Bugbot for commit cdfb3fd. Configure here.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 4d4143b6-319b-48eb-aae2-aa3b62e3b8bc

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_9d815e50-37d8-4340-b82a-edb1033d182d)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T06:01:48.680414Z	9a48024	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_95eba532-f76b-41bf-926d-ac8226a543b5)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_bd016fc1-f1be-48a8-a5f2-7290d3a19b89)

[BigSimmo]

CI: Production UI (3) failed, not this PR's.

tests/ui-tools.spec.ts:2818 — "differentials compare queue launches presentation comparison" — timed out (30s) waiting for navigation to /differentials/presentations/acute-confusion-encephalopathy after clicking differential-compare-open; it stayed on /differentials/compare?ids=wernicke-encephalopathy. Full log: https://github.com/BigSimmo/Database/actions/runs/33609338581/job/100180777655

This PR's diff is docs/audit/gate-consolidation-audit-2026-09-02.md and data/repo-awareness-snapshot.json only — no application code, and nothing touching the differentials/presentations comparison flow. I checked tests/flake-ledger.json and docs/outstanding-issues.md for an existing record of this failure and found none, so there's no fix to port yet. Re-running the job once to confirm this is a base-branch/flake issue rather than something this PR introduced.

---

Generated by Claude Code

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_240ec3f0-a58f-44fd-a0e5-02b81c5739ed)

[BigSimmo]

"Production UI (1)" failed on cdfb3fdda5 — not this PR's diff.

Failing test: tests/ui-smoke.spec.ts:2481 — "privacy sticky chrome is an opaque bar on phones and glass from sm". Job log.

Error: locator.evaluate: Error: strict mode violation: getByTestId('privacy-sticky-chrome') resolved to 2 elements

src/components/privacy-quiet-signal-page.tsx renders exactly one element with that test id, and both matches in the error report show identical outerHTML — this reads as a transient double-render caught mid page.goto("/privacy") navigation (a hydration/transition race), not a real duplicate-chrome bug. This PR's own diff is two files (docs/audit/gate-consolidation-audit-2026-09-02.md, data/repo-awareness-snapshot.json) — it cannot touch /privacy page chrome. The only reason this test ran against this code at all is the routine merge of origin/main needed to keep this branch's generated snapshot in sync with the fast-moving main branch (this is the 7th such merge on this PR).

No existing record of this failure in tests/flake-ledger.json or docs/outstanding-issues.md, so there's no fix to port. Production UI (2) is still finishing on this same run — re-running the failed shard once it completes, to confirm this is a flake rather than something newly broken.

---

Generated by Claude Code