Stop the privacy readiness register failing on a shallow clone

[BigSimmo]

Summary

• The shallow-clone guard that closed #1M0J6D covers tests/clinical-hazard-controls.test.ts and tests/rag-plan-package-parity.test.ts, but a third check with the identical defect was missed: tests/privacy-readiness-contract.test.ts and the check:privacy-readiness CLI gate behind it.
• On a web-container clone (depth ~102) reviewedCommit is simply absent from a truncated history, and both report reviewedCommit does not exist: d3074946a917cac378de64284c67cbc1d4dc58fa. That reads as a corrupt privacy register rather than a truncated checkout, which is exactly the wrong conclusion to invite about a governance manifest.
• tests/privacy-readiness-contract.test.ts now uses the same guard as its two sibling specs: deepen the history first, and skip the commit checks only when the commit is still unreachable and the clone is still shallow.
• scripts/check-privacy-readiness.mjs had the same defect, so check:production-readiness carried it too. It now warns with PRIVACY_READINESS_SHALLOW_CLONE naming exactly what was skipped, mirroring check-clinical-hazard-controls.mjs.

This does not weaken the check. The skip requires both a shallow clone and an unreachable commit, so on a full-history checkout a genuinely missing reviewedCommit still fails. CI checks out at fetch-depth: 0, where the commit and evidence-at-commit checks run in full.

The helper trio is duplicated from the two sibling specs rather than extracted. Extracting it would mean editing two currently-passing governance specs, which is wider than this fix needs; noting it here as a deliberate choice rather than an oversight.

Verification

• npm run lint — clean, [gate-receipts] recorded a pass for "lint:internal" (7425 input files)
• npm run typecheck — clean, [gate-receipts] recorded a pass for "typecheck:internal" (7425 input files)
• npm run test (full offline unit suite) — Test Files 1268 passed | 1 skipped (1269) / Tests 18035 passed | 2 expected fail | 3 skipped, zero failures. Before this change the same container failed privacy-readiness-contract.
• node scripts/check-privacy-readiness.mjs — PRIVACY_READINESS_PASS mode=structural requirements=11
• Fail-closed proof, run directly against a manifest carrying a bogus reviewedCommit on this now-full-history clone:
  • with git checks on: still reports reviewedCommit does not exist → true
  • only the explicit checkGit: false path suppresses it → true
• Honest caveat: this container's clone stopped being shallow during the session (git rev-parse --is-shallow-repository → false, 5898 commits), so the suite passed with the commit checks running, not skipped. The skip branch was proven by the direct fail-closed check above rather than by a shallow-clone reproduction.

Verification not run: npm run verify:pr-local and browser gates. No UI, routing, styling or browser surface is touched — the diff is one test file and one Node check script.

Risk and rollout

• Risk: Low. The change only adds a skip that requires two independent conditions to both hold, and adds a warning line. No production code path is involved.
• Rollback: Revert the single commit.
• Provider or production effects: None.
• RAG impact: none

Clinical Governance Preflight

• The privacy register's contents are unchanged; only the checkout-dependent commit checks gain a documented skip.
• No patient-identifiable workflow is introduced or expanded.
• Supabase target is untouched and remains Clinical KB Database (sjrfecxgysukkwxsowpy).
• Failure behaviour stays conservative: the skip cannot trigger on a full-history checkout, which is what CI and any release gate use.

Notes

• Related to #1M0J6D, closed 2026-09-06 as "Added auto-shallow clone detection to governance test suites". This completes that work for the third affected check.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RkMv1BzScPTvrzJ8F7DtzY

---

Generated by Claude Code

---

Note

Low Risk
Governance CLI and test-only behavior; skip is gated on shallow clone plus unreachable commit, so release/CI full-history gates are unchanged.

Overview
Privacy readiness no longer fails in truncated checkouts when reviewedCommit is missing from shallow history, aligning with the existing guards on clinical hazard controls and RAG plan parity.

scripts/check-privacy-readiness.mjs adds shallow-repo detection and, when the clone is shallow and reviewedCommit is absent, emits PRIVACY_READINESS_SHALLOW_CLONE and runs validation with checkGit: false so existence, ancestry, and evidence-at-commit checks are skipped while structural checks still run.

tests/privacy-readiness-contract.test.ts mirrors the sibling contract tests: try git fetch --deepen, then set checkGit: false only if the commit is still missing and the repo remains shallow.

On full-history checkouts (including CI with fetch-depth: 0), a bogus or missing reviewedCommit still fails as before—the skip needs both conditions.

^{Reviewed by Cursor Bugbot for commit a21aa05. Configure here.}

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 45a5cafa-76fb-443c-b5b5-1026231328fb

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T10:07:27.834753Z	a21aa05	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_ae5cd679-60d9-4df3-a993-8810975ba6fe)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a21aa05a84

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

• Unit coverage — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.
• PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #16294 (cancelled).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.

[BigSimmo]

Consolidated into #2733 at 7822e61. The complete original head 42fcbf9 is retained as an ancestor. Combined focused checks passed (27 tests); required hosted checks still govern merge. Closing this duplicate review and CI stream; source branch retained.