clinical(governance): resolve forms permissions, test guards, and alert tiers (Bundle 1)

[BigSimmo]

Summary

Resolves Bundle 1 tasks (Clinical Governance, Forms & Safety Guards):

• Resolves #97W4FD: Added clinical test guard patterns to clinicalRiskPatterns in scripts/pr-policy.mjs.
• Resolves #H0HKFD: Aligned mock patient phone numbers to ACMA fiction range (0491 570 006 - 156) in patient-plan-fixtures.ts.
• Resolves #8KFQ3X, #YJGWDZ, #W1B9RP: Decoded /P -1084 permission integer in scripts/build-forms-pdf-manifest.mjs, derived editingRestricted across all 51 forms, surfaced distinct editing restriction notices on form-detail-page.tsx, and pinned in tests/forms.test.ts.
• Resolves #GNNMAF: Routed patient alert info rows with missing gates to unassessedAdvisory in src/lib/medication-patient-alerts.ts.
• Resolves #H3PXP0: Enabled re-evaluation of stored outdated status upon clinical re-verification in differential, registry, and medication records.
• Resolves #0JGJTK, #Y2E4DX, #WM4DNW, #ZV7H8Q, #E8ARD5, #7ZA9S9: Verified and queued inbox done records for pre-landed clinical safety tasks.
• Preserved standing external requirements for #BS3SN9 and #SBKXZ7.
• Queued 13 merge-safe ledger inbox resolution records in docs/outstanding-issues-inbox/.

RAG impact: no retrieval behaviour change — refreshes the offline ranking candidate snapshot and provenance from successful Eval Canary run 34122919100; no runtime retrieval or ranking path changes.

Verification

• node scripts/pr-policy.mjs --self-test
• node scripts/build-forms-pdf-manifest.mjs --check
• npm run check:outstanding-issues
• node scripts/check-ledger-write-discipline.mjs
• 224/224 focused tests passed across 8 files
• UI verification not run: local browser verification was omitted because the current-head Production UI CI checks are authoritative.

Risk and rollout

• Risk: clinician-facing form restriction and advisory wording could be misclassified. The implementation takes the conservative direction and has targeted tests.
• Rollback: revert the PR's commits and regenerate the forms manifest if required.
• Provider or production effects: none.
• RAG impact: no retrieval behaviour change — this only refreshes the offline candidate snapshot and provenance from successful Eval Canary run 34122919100; no runtime retrieval or ranking path changes.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

---

Note

Medium Risk
Changes affect clinician-facing forms badges and medication/governance read paths; direction is conservative (warn rather than under-state restrictions) with targeted tests, but wrong permission derivation or alert tiering could mislead at the point of care.

Overview
This bundle closes Clinical Governance / Forms & safety work and records it in the outstanding-issues ledger.

Forms PDFs: data/forms-pdf-manifest.json now carries editingRestricted alongside passwordProtected for all 51 WA MHA forms (50 restricted; form-12a is the lone file with both flags false). That separates “needs a password to open” from “print/fill allowed but modify/copy restricted,” matching decoded /P permissions from the committed PDF bytes.

Ledger: Thirteen new docs/outstanding-issues-inbox/ done requests queue resolution for issues including forms manifest/UI (#8KFQ3X, #YJGWDZ, #W1B9RP), medication alert tiering (#GNNMAF), outdated re-verification (#H3PXP0), differential/registry source_status derivation (#ZV7H8Q, #WM4DNW), PR clinical test guards (#97W4FD), and related mockup/safety rows. data/outstanding-issues-snapshot.json is refreshed (open count 121 → 102, many prior open rows dropped, revision SHA updated) so the snapshot matches those closures plus newer CI/ledger follow-ups still open.

^{Reviewed by Cursor Bugbot for commit 4dab235. Configure here.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: a0d5aad7-b491-4d8f-86df-c4182e9a1920

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_a7e89b1f-a2dd-4c16-921c-946e8a793f51)