fix(clinical): the prescribing panel calls itself decision support; close four holes in the new token-divergence gate - #2499
Conversation
… pin design-system figures and token drift The app told users four times that it was clinical decision support while its own privacy page says the opposite. Two design-system documents had also drifted far enough from the code to mislead, and one silent trap had no gate at all. Clinical copy (the reason this change exists) - Differentials (3 sites) and Specifiers (1) said "Clinical decision support only" / "Use this as structured decision support". The privacy page and CLAUDE.md both scope this product as "a clinical reference prototype, not validated clinical decision support", and the PR preflight carries a device-classification item, so the clinical surfaces were the ones out of step. - All four now read "Clinical reference - not validated decision support", the wording already recorded as the clinical-owner copy decision on #PM9SP1. - The fifth site was the copied/exported differential text in src/lib/differential-detail.ts, which carried the same claim into anything a clinician pastes elsewhere. Its pinned assertion moved with it. - Therapy Compass was already correct and is untouched. New gate: token-layer divergence (scripts/token-layer-divergences.mjs) layout.tsx mounts .ckb-v2 on <html>, so .ckb-v2.ckb-v2 (0,2,0) beats :root (0,1,0) and for any role both stylesheets declare the v2 value paints while the globals.css one is dead - editing it changes nothing, with no lint, type or screenshot signal. 53 roles are in that state today (29 light, 24 dark). The v2 migration is deliberate and unfinished, so divergence is pinned rather than banned: docs/design-system/token-layer-divergences.json is the reviewed set, and a role that starts diverging OR stops diverging fails. The comparison covers globals' @theme block as well as :root, which is where the structural roles live. Wired into the existing check:design-system-contract, so no gate-manifest change was needed. Mutation-verified both directions. New gate: GATES.md figures are generated (scripts/generate-gates-figures.mjs) GATES.md carried the same metric as three different hand-typed values in three sections. Measured against the baseline: interactiveTapFloorDeclarations appeared as 9, 32 and 2 (true value 2); rawMarginLiterals as 74 and 53 (34); legacyShadowAliases as 231, 224 and 87 (34). Nearly every figure overstated remaining debt, which costs a session in exactly the way the document's own section 5 warns about. A generated section 0 is now the single current count, with the prose figures in sections 2, 4 and 5 explicitly marked as the historical record. Comparison is normalised cell-wise so Prettier's table padding cannot report false drift. Mutation-verified both directions. Breakpoint tokens: reconciled toward the code, not away from it GATES.md 3b banned --breakpoint-* tokens; globals.css has five, added four days after that decision. The obvious fix - delete the three device-band names, which have zero product call sites - was attempted and reverted in the same session: MIN_WIDTH_BREAKPOINT_BANDS in design-system-contract-utils.mjs hard-codes them as same-threshold aliases of sm/md/lg, and they are the only fixtures exercising the tap-floor gate's alias-collision path. "Nothing imports it" was necessary and nowhere near sufficient, exactly as AGENTS.md warns. All five stay, with the real reason recorded in both the stylesheet and 3b, and the wrong "(Task #336)" attribution removed. AGENTS.md bundle-budget route list Documented five budgeted routes; the config has two. The config is right: /therapy-compass, /dsm and /forms became redirect stubs rendering the same shared home as /, so budgeting them measured / three more times (see tests/check-lighthouse-budget.test.ts, COMMITTED_ROUTES). Corrected the document and recorded why, so the next reader does not "fix" the config back. Also: indexed the one mockup route missing from mockups/README.md (answer-loading-redesign), taking that index to 79 of 79. Verification npm run verify:cheap exit 0. Full unit suite 934 files / 11,771 tests passed, 1 skipped, 0 failures. lint and typecheck clean. Clean-build bundle check passed (production 1742.1 KiB gzip, / at 240.0 KiB); it reports a +5.2% drift warning against a baseline commit that no longer resolves, which is pre-existing and tracked as #QSHHGK, not caused here. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015uQ7pGjA4hBxi9TRNsfjAL
…app-review-sxd0mm # Conflicts: # data/outstanding-issues-snapshot.json # data/repo-awareness-snapshot.json
Resolve conflicts: - data/outstanding-issues-snapshot.json: keep main (superset pending incl. privacy inbox items) - data/repo-awareness-snapshot.json: keep main (includes docs landed on main) - package.json: keep main deps/engines; take PR design-system gate scripts
Codex P2: reject hand-edited/merge-skewed counts when divergences are unchanged.
…les in the new token-divergence gate Two independent audits ran against the previous commit. Both found real defects, and both are fixed here. Clinical over-claim sweep — two more surfaces The earlier fix found its sites by grepping one phrase. A sweep for the whole class found two it missed, both on the medication/prescribing surface, which is the highest-consequence screen in the app: - `patient-profile-panel.tsx` (rendered by the prescribing workspace, the medication record page, and the patient-details dock) said "Decision support, not medical advice" under the panel where a clinician enters renal/hepatic function, allergies and a current medication list to get a per-patient interaction verdict. This asserted the feature IS decision support — worse than the five sites already corrected, which merely said "not ... decision support". - `medication-record-page.tsx`'s standing footer claimed PsychSift "provides evidence summaries", an authority claim the product does not make anywhere else, and disclaimed with a generic "not medical advice" rather than the house governance phrasing every comparable mode uses. Both now match the wording used on the other surfaces. Production is clean: the only remaining "decision support" strings in src are the document-intent taxonomy (classifying UPLOADED guideline documents, not the app's own voice) and the privacy page's own boundary statement. Token-divergence gate — four holes, three of them live An adversarial review of the gate added in the previous commit demonstrated four false passes. The parser has been rewritten: 1. **Forced colours was unmonitored.** Both stylesheets declare a third theme in `@media (forced-colors: active)`, and the same specificity trap applies there. Editing a real Windows High Contrast value produced no complaint. Three roles are genuinely diverging in it today and are now pinned: `--clinical-accent-border`, `--overlay-backdrop`, `--text-soft`. 2. **Indentation-sensitive parsing.** The old regex required exactly two leading spaces, so re-indenting a declaration — no rendered effect — dropped it from the comparison, and the tool then reported the divergence as RESOLVED. Acting on that advice removed a still-dead token from tracking and left the gate green. Parsing is now indentation-insensitive. 3. **`var()` aliases were never resolved.** Two layers can declare identical alias text and still paint different colours when the alias itself diverges: dark `--clinical-chat-document` is `var(--surface-inset)` on both sides while `--surface-inset` differs. Values are now resolved within their own layer before comparison, which also removes three false FAILS where different text resolved to the same value (dark `--text`, `--text-heading`, `--clinical-accent-soft`). 4. **Ambiguous markers in GATES.md** silently retargeted both the comparison and the `--write` overwrite at the wrong slice. Now a hard error. Block extraction uses real brace matching instead of slicing to the next line-initial `}`, so an `@media` wrapper is context rather than a terminator, and comments are stripped before selectors are read. An empty result for any theme is a hard error, never a quiet pass. Counts move from light 29 / dark 24 to light 29 / dark 22 / forcedColors 3 — the dark drop is the three false fails above, the forced-colours three are newly visible real divergences. One review claim was checked and NOT adopted: the review reported forced-colours `--border`/`--border-strong`/`--border-lux` as diverging. globals.css declares them twice in that media context and the later value already matches v2, so they are not divergent; the manual diff had only read the first block. Verification Full unit suite 937 files / 11,796 tests passed, 1 skipped, 0 failures. lint, typecheck and the design-system contract chain all clean. Each of the four holes was re-attacked against the hardened code: the forced-colours edit and the duplicated marker now fail as they should, and the re-indented declaration is proven still tracked rather than silently dropped. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015uQ7pGjA4hBxi9TRNsfjAL
…sxd0mm' into claude/design-system-app-review-sxd0mm # Conflicts: # data/outstanding-issues-snapshot.json # data/repo-awareness-snapshot.json
…app-review-sxd0mm # Conflicts: # docs/design-system/token-layer-divergences.json # scripts/generate-gates-figures.mjs # scripts/token-layer-divergences.mjs
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Team Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_f9dab00b-f6c2-41c3-96d6-5f770d4d956c) |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2123acfcc8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Resolve dirty/behind after #2498: keep main regenerated snapshots and deps; overlay PR intentional clinical copy + token-divergence gate hardening.
…base theme comparison Codex P2 on #2499, verified and confirmed. `collect()` filtered only on `forced-colors`, so every OTHER `@media` block was admitted into the unconditional theme map and its override replaced the base declaration. Comparing a narrow-viewport override against an unconditional v2 declaration compares two different contexts, and it reports "identical" for a pair that diverges everywhere the condition does not apply. Proven on real data, not argued: before this change the light compat map held `--mode-home-copy-reserve` as the `(min-width: 412px)` override (`calc(var(--text-hero) * …)`) rather than its unconditional declaration at globals.css:1240 (`calc(2 * var(--text-hero) * …)`). globals.css has three such `:root` blocks today — `--mode-home-copy-reserve` twice and `--spacing-mode-home-composer-wide` once. Reproduced as a false pass with the synthetic wide-viewport case the review asked for: base compat `--radius-md: 0.7rem`, an override at `(min-width: 9999px)` matching v2's `0.625rem`, v2 unconditionally `0.625rem`. The old predicate reported no divergence; the new one flags it. Latent rather than live today only because the v2 layer declares none of the three affected names. Base themes now take unconditional blocks only. Conditional non-forced-colors blocks are excluded rather than merged, which is the conservative direction: a token declared only under such a condition goes uncompared instead of being compared wrongly. Forced colours remains its own theme — it is a condition, and it is modelled as one rather than treated as base. Also fixes the return typing of `readLayers`, which inferred `{}` and broke `npm run typecheck` for the new test's consumers. Verification Full unit suite 937 files / 11,798 tests passed, 1 skipped, 0 failures. lint, typecheck and the design-system contract chain clean; pin unchanged at light 29 / dark 22 / forcedColors 3, confirming this was latent. The new regression test is mutation-verified: restoring the old predicate fails it, and it asserts against the real stylesheet rather than a fixture, so it tracks the file as it changes. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015uQ7pGjA4hBxi9TRNsfjAL
…sxd0mm' into claude/design-system-app-review-sxd0mm
|
Codex P2 (Separate conditional overrides from the base theme) — verified and fixed in The finding is correct. Confirmed on real data before changing anything: the light compat map held Reproduced as an actual false pass using the synthetic wide-viewport case the comment suggested: base compat Fix: base themes take unconditional blocks only. Conditional non-forced-colors blocks are excluded rather than merged — the conservative direction, so a token declared only under such a condition goes uncompared instead of compared wrongly. Forced colours stays its own theme, since it is a condition and is modelled as one. Guard: Also fixed Full suite 939 files / 11,816 tests passed, 1 skipped, 0 failures; lint, typecheck and the design-system contract chain clean. Generated by Claude Code |
|
Owner decision: keep the fix. This supersedes the earlier "deferring for this PR" reply on the Codex thread — that comment and the fix commit landed within seconds of each other, so the branch already contained One correction to that reply for the record: the finding was not speculative. It was reproduced against the real stylesheet before any change — the light compat map was reading No further action; the branch is unchanged from the state described in the comment above. Generated by Claude Code |
… measured bundle drift on #QSHHGK - done #PM9SP1: the decision-support over-claim is fixed at seven sites across PRs #2497 and #2499, two of them (the prescribing patient-profile panel and the medication record footer) not named in the original row and worse than those that were. Production verified clean. - add: the row's second clause, 'mount the footer on the other mode homes', contradicts a recorded decision at mode-home-template.tsx:216-219. Filed for an owner ruling rather than carried silently into the close. - update #QSHHGK: clean-build measurement puts production at +5.2% (drift warning, over half way to the 10% ceiling), and the recorded baselineSource is unreachable even on a full 5415-commit clone, so the distance cannot be attributed to any reviewed change set. Requests only; docs/outstanding-issues.md is untouched and reconciliation runs on its own fresh-base branch. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015uQ7pGjA4hBxi9TRNsfjAL
Follow-up to #2497, which merged while two independent audits were running against it. Both audits found real defects in what that PR shipped. This is the fix.
Summary
patient-profile-panel.tsx— rendered by the prescribing workspace, the medication record page and the patient-details dock — carried "Decision support, not medical advice" under the form where a clinician enters renal/hepatic function, allergies and a current medication list to get a per-patient interaction verdict. fix(clinical): stop four surfaces calling themselves decision support, and pin two drifting design-system documents #2497 corrected five sites that said "not … decision support"; this one asserts the opposite, on the highest-consequence screen in the app. It now reads "Clinical reference — not validated decision support".Production is now clean for this defect class: the only remaining "decision support" strings under
src/are the document-intent taxonomy (which classifies uploaded guideline documents, not the app's own voice) and the privacy page's own boundary statement.The gate holes, and how each was proven
The gate was reviewed adversarially, with every finding required to be executed rather than argued. Each fix was then re-attacked to confirm it fails as it should.
@media (forced-colors: active), and.ckb-v2.ckb-v2beats:rootthere for exactly the reason the gate exists. Editing a real Windows High Contrast value produced no complaint at all. Three roles diverge in it today and are now pinned:--clinical-accent-border,--overlay-backdrop,--text-soft.var()aliases were never resolved. Two layers can declare identical alias text and paint different colours when the alias itself diverges — dark--clinical-chat-documentisvar(--surface-inset)on both sides while--surface-insetdiffers. Values now resolve within their own layer before comparison. This also removed three false failures where different text resolved to the same value (dark--text,--text-heading,--clinical-accent-soft).GATES.mdsilently retargeted both the staleness comparison and the--writeoverwrite at the wrong slice, reporting success while §0 stayed stale. Now a hard error naming the count found.Block extraction now uses real brace matching rather than slicing to the next line-initial
}, so an@mediawrapper is context instead of a terminator, and comments are stripped before selectors are read. An empty result for any theme is a hard error, never a quiet pass.Counts move from light 29 / dark 24 to light 29 / dark 22 / forcedColors 3: the dark drop is the three false failures, the forced-colours three are newly visible real divergences.
One review claim was checked and not adopted. The review reported forced-colours
--border,--border-strongand--border-luxas diverging.globals.cssdeclares them twice in that media context and the later value already matches the v2 layer, so they are not divergent — the manual diff had only read the first block. Verified by reading both declarations.Verification
npm run lint— fresh run, clean.npm run typecheck— reused gate receipt (identical content hash, recorded 13 minutes earlier in the same session), not a fresh run.npm run check:design-system-contract— passed:Token-layer divergence pin matches (light 29; dark 22; forcedColors 3),GATES.md figures block is current.check:outstanding-issuesandcheck:repo-awareness-snapshot— both in step after the generated files were regenerated with repo tooling, never hand-edited.UI verification not run: the two changed strings are static copy in existing paragraph elements, with no layout, routing, state or styling change. The DOM assertions covering both files pass in the suite above.
Risk and rollout
classifyPullRequestFilesreportsragRanking: false, and nothing undersrc/lib/rag/**, the retrieval RPCs, the eval harness or the golden fixtures is touched.Clinical Governance Preflight
Clinical KB Database(sjrfecxgysukkwxsowpy)Each item is addressed in Governance detail below; the boxes above keep the exact template text because
scripts/pr-policy.mjsmatches them literally.Governance detail
Notes
Why this is a separate PR. #2497 squash-merged while these audits were running, so its commits are not ancestors of
main. Rather than force-push over a merged branch,origin/mainwas merged into the branch somainis an ancestor and this diff shows only the follow-up. A concurrent session had also added a genuine improvement to the same gate on that branch (validating the pin'scountsmetadata against its own contents); that change was merged in and kept, not overwritten, and both hardenings are present and tested together.One audit finding deliberately left alone. The clinical sweep found that Calculators is the only clinical mode with no standing scope statement anywhere on the page, while its heading asserts "Validated psychiatry scores…". That is a real gap, and it is not fixed here:
mainreceived calculator safety and evidence-governance work earlier the same day (#2491), so widening into that surface now risks colliding with in-flight work, and the wording is a clinical-owner copy decision rather than a mechanical fix. Raised for the owner instead.Generated by Claude Code
Note
Low Risk
Copy weakens product authority claims; gate changes only tighten an existing offline check and refresh pins—no RAG, auth, or database behavior changes.
Overview
This PR tightens clinical governance copy on high-consequence prescribing surfaces and closes four false-pass holes in the design-system token-divergence check introduced in #2497.
Clinical disclaimers — The patient profile panel under the prescribing workspace no longer says “Decision support, not medical advice”; it now reads “Clinical reference — not validated decision support.” The medication record footer drops the generic “evidence summaries” framing and instead states the product is a clinical reference prototype and tells clinicians to verify every dose and interaction against the linked source.
Token-divergence gate —
scripts/token-layer-divergences.mjsnow parses CSS with brace-aware rule blocks (so@media (forced-colors: active)is a theme, not a truncated block), compares declarations without indentation sensitivity, and compares resolvedvar(--*)values so alias-only matches don’t hide real paint differences. A third pinned themeforcedColors(3 roles) is added; dark drops from 24 to 22 after removing false positives.generate-gates-figures.mjserrors ifGATES.mdhas duplicate figure markers instead of silently updating the wrong slice.Repo hygiene — Regenerated
token-layer-divergences.json,outstanding-issues-snapshot.json(pending +1, inbox update for #ZBAC9D), andrepo-awareness-snapshot.json.Reviewed by Cursor Bugbot for commit 2123acf. Configure here.