Skip to content

fix(sources): register publishers with RAG policy protection - #2711

Open
claude[bot] wants to merge 5 commits into
mainfrom
claude/register-australian-publishers
Open

fix(sources): register publishers with RAG policy protection#2711
claude[bot] wants to merge 5 commits into
mainfrom
claude/register-australian-publishers

Conversation

@claude

@claude claude Bot commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

Summary

Registers the nine proposed Australian/international clinical publishers and protects the source-authority registry and Australian priority gate with the RAG impact policy. Unknown verification status still keeps sources in the lowest evidence band.

Consolidates #2711 (87e43c3), #2732 (ac21a2f). Original heads are retained as ancestors; absorbed PRs are closed only after publication is verified.

Verification

  • npm run test -- tests/source-acquisition-ledger.test.ts tests/source-catalogue-providers.test.ts tests/source-authority-tooling.test.ts — 56 passed in 3 files. npm run check:pr-policy — self-test and workflow guard passed.
  • npm run format — passed; formatting committed.
  • git diff --check — passed.
  • Verification not run: full local PR/release suites; focused integration checks above were selected, and GitHub remains the merge gate. No live provider evaluation, deployment, migration or production data access was performed.
  • UI verification not run: local browser matrix; applicable hosted UI checks must pass before merge.
  • Current-base CI limitation: Make the outstanding-issues snapshot merge-safe (v2), and record the measured assessment of two other rows #2735 run 34495136858 failed only the aged ranking fixture provenance test (32 days old). clinical(governance): resolve forms permissions, test guards, and alert tiers (Bundle 1) #2763 carries the existing refresh; these bundles must not be merged past failed required checks.

Risk and rollout

  • Risk: Publisher classification can change the clinical context selected within relevance bands. Live retrieval comparison remains a merge/release prerequisite.
  • Rollback: revert the consolidated merge commit as one unit; original source branches and heads remain available.
  • Provider or production effects: GitHub branch/PR updates only during consolidation. No deployment or provider write was performed.
  • RAG impact: behaviour change — canary pair https://github.com/BigSimmo/Database/actions/runs/34099357211 (historical baseline) -> pending separately authorised post-change canary. This pair is incomplete; the historical baseline is not current-head proof.
  • Production-readiness evidence: npm run check:production-readiness on the shared current-base governance integration stopped at six existing privacy release blockers (five pending and one partial). The production-readiness stage did not execute. These approvals remain outstanding.

Clinical Governance Preflight

  • Source-backed claims still require linked source verification before clinical use
  • No patient-identifiable document workflow was introduced or expanded without explicit governance approval
  • Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
  • Service-role keys and private document access remain server-only
  • Demo/synthetic content remains clearly separated from real clinical sources
  • Source metadata, review status, and outdated/unknown-source behavior remain conservative
  • Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Against those last two: registration adds no ranking penalty or boost anywhere, and both WA entries are trusted, not official. Clinical decision-support behaviour and its classification are unchanged.

…register

Adds Therapeutic Guidelines, the Australian Medicines Handbook, Australian
Prescriber, RACP, AIHW and Healthdirect Australia as australian_national/trusted;
the Mental Health Commission WA and HealthyWA as wa/wa_validated/trusted
(deliberately not official, since neither is a WA hospital or health service
network); and Cochrane as international/supplementary. Until now none of them
could be placed in a jurisdiction, so every source they publish was pinned at
D band.

Publisher aliases cover the spellings the corpus actually records, including the
lower-case "healthdirect Australia" and the spaced "Healthy WA".

tests/source-acquisition-ledger.test.ts used "Therapeutic Guidelines Limited" as
its example of an unregistered publisher, which stops being true with this
change. It now uses Beyond Blue and asserts against the register that the example
really is absent, so the premise cannot silently rot again.

docs/source-acquisition-protocol.md carried the same stale list.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DXnbx8Pa4VMp2dzBrYFH4J
@claude
claude Bot requested a review from BigSimmo as a code owner September 7, 2026 08:48
@supabase

supabase Bot commented Sep 7, 2026

Copy link
Copy Markdown

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.


Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

… log the red canary

Two pieces of RAG-safeguard hygiene found while preparing PR #2711.

pr-policy classified `src/lib/source-authority-registry.ts` as an ordinary
file, so PR #2711 declared its RAG impact voluntarily rather than because the
gate asked. That file and `src/lib/australian-source-priority.ts` do sit on the
ordering path: classifySourceAuthority assigns a result's tier,
australianSourceTier reads it, and selectAustralianClinicalContext orders and
trims the model's context by it. Registering or re-scoping a publisher moves
that ordering without touching a score, which is exactly the shape the gate
exists to catch. Both are now in ragRankingPatterns, asserted in the self-test,
and listed in the protected-surface table.

This is authority classification, not a governance ranking penalty or boost.
That shape stays refuted and the safeguards note says so, so a later reader
cannot mistake this entry for permission to revisit Refutation 3.

The second piece is an outstanding-issues inbox request. The eval canary has
been red on the same three answer-quality cases since at least 2026-08-23, over
five consecutive runs, while golden retrieval passed 36/36 in every one. Nothing
in the ledger tracked it. A permanently red canary is a poor instrument to
validate the next protected change against.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DXnbx8Pa4VMp2dzBrYFH4J
@coderabbitai

coderabbitai Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 93c75f2c-051b-4f09-b400-2087e0db237b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@BigSimmo BigSimmo changed the title Register nine Australian clinical publishers in the source authority register fix(sources): register publishers with RAG policy protection Sep 10, 2026
@github-actions

Copy link
Copy Markdown
Contributor

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

  • Unit coverageneeds investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.
  • PR requiredneeds investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #16436 (failure).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants