ℹ️ About Codex in GitHub

\n
\n\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\n- Open a pull request for review\n- Mark a draft as ready\n- Comment \"@codex review\".\n\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\n\n\n\n\nCodex can also answer questions or update the PR. Try commenting \"@codex address that feedback\".\n \n

","side","line","**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Validate every requested desktop report**\n\nWhen a desktop Lighthouse invocation in the workflow fails while all mobile runs succeed, it leaves no JSON, but this final check asks `mobileBreaches` only about missing mobile reports. I reproduced this with the five default mobile reports and zero desktop reports: the script printed the metrics-acceptable verdict and exited 0. The new expected-mobile fix therefore still allows #017—which explicitly requires reproducible mobile/desktop evidence in `docs/outstanding-issues.md:114`—to be closed with no desktop baseline; validate the expected route-by-strategy matrix and fail when any requested report is absent.\n\nAGENTS.md reference: [AGENTS.md:L254-L259](https://github.com/BigSimmo/Database/blob/a626ef08012bd43cbf76c3c96c29f46291a353c6/AGENTS.md#L254-L259)\n\nUseful? React with 👍 / 👎.","RIGHT",140,"Confirmed and fixed in `e2e05ea8`. Verified against the tree rather than taking it on trust:\n\n```\nsrc/app/(search-app)/documents/ -> [id] error.tsx layout.tsx search source\n```\n\nNo `page.tsx`, and `next.config` has no rewrite or redirect for the bare path, so `/documents` is a 404. The generated `docs/site-map.md` agrees — it lists `/documents/search` (\"Documents search command centre\") and no bare `/documents`. The default input is now `/,/therapy-compass,/documents/search,/dsm,/forms`; I checked the other four each resolve to a real `page.tsx`.\n\nThis is worth more than a spurious data point now that the sibling P1 is fixed: with a missing mobile report counted as a hard breach, a route that cannot produce a usable report would *block* the `#017` verdict rather than quietly skew it — so the two findings compound.\n\nThe slug rule handles the nested path: `/documents/search` → `documents-search`, matching the workflow's `sed 's|^/||; s|/|-|g'`. `tests/summarise-web-vitals.test.ts` tracks the same default and already pins `/a/b` → `a-b`. 8 tests pass; `check:github-actions` — `GitHub Actions pin check passed.`; Prettier clean.\n\n---\n_Generated by [Claude Code](https://claude.ai/code)_","**Actionable comments posted: 2**\n\n

🧹 Nitpick comments (2)

\n\n
\n
tests/summarise-web-vitals.test.ts (1)
\n\n`47-53`: _🎯 Functional Correctness_ | _🔵 Trivial_ | _⚡ Quick win_\n\n**Add a `missingReport`/`missingMetric` assertion here.**\n\nThis test confirms `mobile-dsm` is flagged as a breach when its LCP is `null`, but doesn't assert what `missingReport` is set to. Given the gap flagged in `scripts/summarise-web-vitals.mjs` (Line 137-141) where only `missingReport` gates the process exit, a test asserting the flag value here would have caught that the fail-closed exit doesn't currently cover this case.\n\n```diff\n const breaches = mobileBreaches(rows, DEFAULT_ROUTES);\n expect(breaches.map((breach) => breach.run)).toEqual([\"mobile-dsm\"]);\n+ expect(breaches[0].missingReport).toBe(false);\n```\n\n
\n
🤖 Prompt for AI Agents
\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@tests/summarise-web-vitals.test.ts` around lines 47 - 53, Extend the test for\nthe null LCP case in mobileBreaches to assert the resulting breach’s\nmissingMetric or missingReport flag, using the expected fail-closed value. Keep\nthe existing run-name assertion and ensure the new assertion verifies the flag\nneeded by the process-exit logic.\n```\n\n
\n\n\n\n
\n
\n
.github/workflows/live-web-vitals.yml (1)
\n\n`88-94`: _🗄️ Data Integrity & Integration_ | _🔵 Trivial_ | _⚡ Quick win_\n\n**Pin Lighthouse to an exact patch version**\n\n`npx --yes lighthouse@12` can drift across v12 patch/minor releases, which makes these decision-gate measurements less reproducible; pin an exact version such as `12.8.2` instead.\n\n
\n
🤖 Prompt for AI Agents
\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn @.github/workflows/live-web-vitals.yml around lines 88 - 94, Update the\nLighthouse invocation in the workflow to use an exact v12 patch version, such as\nlighthouse@12.8.2, instead of the floating lighthouse@12 reference; preserve all\nexisting options and failure handling.\n```\n\n
\n\n\n\n
\n\n

\n\n

🤖 Prompt for all review comments with AI agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nInline comments:\nIn @.github/workflows/live-web-vitals.yml:\n- Around line 54-55: Update the checkout step using actions/checkout in the live\nweb vitals workflow to set persist-credentials to false, while preserving the\nexisting pinned action reference and read-only permissions.\n\nIn `@scripts/summarise-web-vitals.mjs`:\n- Around line 66-88: Update mobileBreaches so rows with null lcpMs or cls are\nmarked as fail-closed missing-metric breaches, distinct from ordinary threshold\nfailures, and update main()’s exit gate to treat both missingReport and\nmissing-metric breaches as fatal. Preserve the existing handling for genuinely\nover-threshold metrics and completely missing mobile reports.\n\n---\n\nNitpick comments:\nIn @.github/workflows/live-web-vitals.yml:\n- Around line 88-94: Update the Lighthouse invocation in the workflow to use an\nexact v12 patch version, such as lighthouse@12.8.2, instead of the floating\nlighthouse@12 reference; preserve all existing options and failure handling.\n\nIn `@tests/summarise-web-vitals.test.ts`:\n- Around line 47-53: Extend the test for the null LCP case in mobileBreaches to\nassert the resulting breach’s missingMetric or missingReport flag, using the\nexpected fail-closed value. Keep the existing run-name assertion and ensure the\nnew assertion verifies the flag needed by the process-exit logic.\n```\n\n

\n\n

🪄 Autofix (Beta)

\n\nFix all unresolved CodeRabbit comments on this PR:\n\n- [ ] Push a commit to this branch (recommended)\n- [ ] Create a new PR with the fixes\n\n

\n\n---\n\n

ℹ️ Review info

\n\n

⚙️ Run configuration

\n\n**Configuration used**: Path: .coderabbit.yaml\n\n**Review profile**: CHILL\n\n**Plan**: Pro\n\n**Run ID**: `01611a64-5733-483b-aa05-ff909d283cac`\n\n

\n\n

📥 Commits

\n\nReviewing files that changed from the base of the PR and between 8605cf72f63a0344b7f314cfb961126ea5fb3d30 and 0d880753d77dce47e4b89e705b890f4aaa0f04ba.\n\n

\n\n

📒 Files selected for processing (4)

\n\n* `.github/workflows/live-web-vitals.yml`\n* `docs/branch-review-ledger.md`\n* `scripts/summarise-web-vitals.mjs`\n* `tests/summarise-web-vitals.test.ts`\n\n

\n\n

\n\n","_🎯 Functional Correctness_ | _🟠 Major_ | _⚡ Quick win_\n\n**`main()` only fails closed for missing reports, not for missing metrics in an existing report.**\n\n`mobileBreaches` classifies a present report with `lcpMs === null || cls === null` under `failed` with `missingReport: false` (Line 81), lumped in with genuine over-threshold breaches. But `main()`'s fail-closed gate (Line 137) filters strictly on `breach.missingReport`, so a mobile report that exists but has a null LCP/CLS (e.g. an errored audit) is surfaced only in the table/summary — it does not make the step exit non-zero.\n\nThis contradicts the PR's own stated guarantee that the summarizer \"fails closed for missing metrics or missing mobile reports,\" and the JSDoc above `mobileBreaches` (\"a metric is missing... run produced no report at all\" — described together as fail-closed cases). Right now only the \"no report at all\" case actually fails the step.\n\n

🐛 Proposed fix — distinguish missing-metric breaches and fail closed on them too

\n\n```diff\n const failed = present\n .filter(\n (row) =>\n row.lcpMs === null ||\n row.cls === null ||\n row.lcpMs >= WEB_VITALS_THRESHOLDS.lcpMs ||\n row.cls >= WEB_VITALS_THRESHOLDS.cls,\n )\n- .map((row) => ({ ...row, reason: \"outside the threshold\", missingReport: false }));\n+ .map((row) => ({\n+ ...row,\n+ reason: row.lcpMs === null || row.cls === null ? \"missing LCP or CLS metric\" : \"outside the threshold\",\n+ missingReport: false,\n+ missingMetric: row.lcpMs === null || row.cls === null,\n+ }));\n```\n\n```diff\n- const missing = mobileBreaches(rows, routes).filter((breach) => breach.missingReport);\n- if (missing.length > 0) {\n- console.log(`::error::${missing.length} requested mobile route(s) produced no report — evidence is incomplete`);\n+ const incomplete = mobileBreaches(rows, routes).filter((breach) => breach.missingReport || breach.missingMetric);\n+ if (incomplete.length > 0) {\n+ console.log(`::error::${incomplete.length} requested mobile route(s) have incomplete evidence — missing report or metric`);\n process.exit(1);\n }\n```\n

\n\n\n\n\n\n\nAlso applies to: 137-141\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@scripts/summarise-web-vitals.mjs` around lines 66 - 88, Update mobileBreaches\nso rows with null lcpMs or cls are marked as fail-closed missing-metric\nbreaches, distinct from ordinary threshold failures, and update main()’s exit\ngate to treat both missingReport and missing-metric breaches as fatal. Preserve\nthe existing handling for genuinely over-threshold metrics and completely\nmissing mobile reports.\n```\n\n

\n\n\n\n\n\n\n\n",88,"_🔒 Security & Privacy_ | _🟡 Minor_ | _⚡ Quick win_\n\n**Set `persist-credentials: false` on checkout.**\n\nzizmor flags this checkout step for credential persistence (artipacked). The job only reads files here (no push/PR needed) and `permissions: contents: read` is already minimal, so there's no reason to keep the token in the local git config for the rest of the job.\n\n

🔒 Proposed fix

\n\n```diff\n - name: Check out the repository\n uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n+ with:\n+ persist-credentials: false\n```\n

\n\n\n\n

📝 Committable suggestion

\n\n> ‼️ **IMPORTANT**\n> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.\n\n```suggestion\n - name: Check out the repository\n uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1\n with:\n persist-credentials: false\n```\n\n

\n\n\n\n

🧰 Tools

\n\n

🪛 zizmor (1.28.0)

\n\n[warning] 54-55: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false\n\n(artipacked)\n\n

\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn @.github/workflows/live-web-vitals.yml around lines 54 - 55, Update the\ncheckout step using actions/checkout in the live web vitals workflow to set\npersist-credentials to false, while preserving the existing pinned action\nreference and read-only permissions.\n```\n\n

\n\n\n\n\n\n\n\n_Source: Linters/SAST tools_\n\n",59,"**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Point the baseline at the document search route**\n\nWith the default dispatch input, `/documents` is not a page route: a repo-wide route search at this commit finds `/documents/search`, `/documents/[id]`, and `/documents/source`, but no `documents/page.tsx` or rewrite for the bare path. That run therefore measures the Next.js 404/error document or produces no usable report, creating a spurious breach and preventing the default workflow from discharging #017; use the canonical `/documents/search` route (or the root documents-mode URL) instead.\n\nUseful? React with 👍 / 👎.","\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `6972f3679f`\n \n\n

ℹ️ About Codex in GitHub

","Confirmed and fixed in `6972f367`. I reproduced the false pass before changing anything, running the original `mobileBreaches` against a directory holding only `desktop-root.json`:\n\n```\nOLD breaches: 0 -> verdict: PASS (close #017, 7 findings WONTFIX)\n```\n\nSo the finding is exactly right: because the workflow downgrades a per-route Lighthouse failure to a warning, and the summariser enumerated only the reports that existed while rejecting only an entirely empty directory, a run where every mobile route failed rendered \"Every mobile route is within…\" and recommended closing `#017` on evidence that was never collected.\n\nThe fix tracks the requested route matrix rather than the surviving files. The workflow now passes `ROUTES` into the summariser; `expectedMobileRuns()` derives the `mobile-` names using the same slug rule as the workflow's `sed`, and any expected run with no report is a breach carrying `missingReport: true`. The summarise step also exits non-zero when reports are missing, so an incomplete run cannot be read as a pass at the job level either. Zero mobile reports with no route list given is still a breach, so the guard cannot be bypassed by omitting the argument. An absent number was already a breach; an absent run is one now too.\n\nSame input against the new logic:\n\n```\nNEW breaches: 5 -> mobile-root (no Lighthouse report produced), mobile-therapy-compass (…), mobile-documents (…), mobile-dsm (…), mobile-forms (…)\n```\n\n`tests/summarise-web-vitals.test.ts` is new and pins this: the `desktop-root.json`-only directory you named as the reproducer is a test case, and it asserts the rendered table does **not** contain the pass sentence. 8 tests pass. `check:github-actions` (pin check), ESLint and Prettier are clean on the changed files.\n\n---\n_Generated by [Claude Code](https://claude.ai/code)_",98,"\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `eab2183503`\n \n\n

ℹ️ About Codex in GitHub

","**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Require evidence from every requested mobile run**\n\nWhen Lighthouse fails for one route or strategy while any other report succeeds, this `||` converts the failure into a warning without creating a placeholder report. The summarizer enumerates only existing JSON files and rejects only an entirely empty directory, so the missing mobile route is absent from `mobileBreaches()` and the workflow can report “Every mobile route” passed, recommending that #017 be closed and its gated findings marked WONTFIX despite incomplete evidence. Track the expected route-by-strategy matrix and treat every missing mobile report as a breach; a directory containing only `desktop-root.json` reproduces the current false pass.\n\nAGENTS.md reference: [AGENTS.md:L258-L259](https://github.com/BigSimmo/Database/blob/eab21835030d2d2814aea942c0258a80917157c5/AGENTS.md#L258-L259)\n\nUseful? React with 👍 / 👎.","[supa]:sjrfecxgysukkwxsowpy\nThis pull request has been ignored for the connected project `sjrfecxgysukkwxsowpy` because there are no changes detected in `supabase` directory. You can change this behaviour in [Project Integrations Settings ↗︎](https://supabase.com/dashboard/project/sjrfecxgysukkwxsowpy/settings/integrations).\n\n

\n\nPreview Branches by Supabase.\nLearn more about [Supabase Branching ↗︎](https://supabase.com/docs/guides/platform/branching).","\n\n\n[![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/BigSimmo/Database/pull/1385?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)\n\n\n\n\n> [!WARNING]\n> ## Review limit reached\n> \n> You’ve reached a temporary PR review limit under our [Fair Usage Limits Policy](https://docs.coderabbit.ai/management/plans#fair-usage-limits-policy).
\n> Your recent review volume is higher than typical usage, so adaptive limits are currently applied.\n> \n> **Next review available in:** **51 minutes**\n> \n> Your organization has reached its usage spending cap. Adjust your spending cap in the [billing tab](https://app.coderabbit.ai/settings/billing?tab=usage&orgId=420f13a9-28c9-4ad8-9f2e-1fd2cf273b7c).\n> \n>

\n>

How can I continue?

\n> \n> After more reviews become available, a review can be triggered using the `@coderabbitai review` command as a PR comment. Alternatively, push new commits to this PR.\n> \n> To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.\n> \n>

\n> \n> \n>

\n>

How do review limits work?

\n> \n> CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.\n> \n> For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.\n> \n> Please refer [docs](https://docs.coderabbit.ai/management/plans#rate-limits) for additional details.\n> \n>

\n> \n>

\n>

Review details

\n> \n>

\n>

⚙️ Run configuration

\n> \n> **Configuration used**: Path: .coderabbit.yaml\n> \n> **Review profile**: CHILL\n> \n> **Plan**: Pro\n> \n> **Run ID**: `49fe664a-19e7-4e36-9d26-42ac9abd37eb`\n> \n>

\n> \n>

\n>

📥 Commits

\n> \n> Reviewing files that changed from the base of the PR and between 0d880753d77dce47e4b89e705b890f4aaa0f04ba and a626ef08012bd43cbf76c3c96c29f46291a353c6.\n> \n>

\n> \n>

\n>

📒 Files selected for processing (3)

\n> \n> * `.github/workflows/live-web-vitals.yml`\n> * `docs/branch-review-ledger.md`\n> * `tests/summarise-web-vitals.test.ts`\n> \n>

\n> \n>

\n\n\n\n\n\n

📝 Walkthrough

\n\n## Walkthrough\n\nAdds a manually triggered Lighthouse workflow for configured live routes, a Node CLI that summarizes reports using fail-closed Web Vitals thresholds, tests for the evaluation helpers, and a branch review ledger entry.\n\n### Changes\n\n**Live Web Vitals Baseline**\n\n|Layer / File(s)|Summary|\n|---|---|\n|**Report normalization and breach evaluation**
`scripts/summarise-web-vitals.mjs`, `tests/summarise-web-vitals.test.ts`|Normalizes Lighthouse reports, renders markdown summaries, applies LCP/CLS thresholds, detects missing data, and tests these behaviors.|\n|**Dispatch configuration and live-site preflight**
`.github/workflows/live-web-vitals.yml`|Adds manual route inputs, execution settings, live-domain configuration, and an HTTP 200 preflight check.|\n|**Route measurement and artifact publication**
`.github/workflows/live-web-vitals.yml`|Runs mobile and desktop Lighthouse checks for each route, invokes the summarizer, and uploads reports regardless of earlier step outcomes.|\n\n**Branch Review Ledger**\n\n|Layer / File(s)|Summary|\n|---|---|\n|**Review record**
`docs/branch-review-ledger.md`|Records the squash result and verification details for the referenced prior pull request.|\n\n**Estimated code review effort:** 3 (Moderate) | ~20 minutes\n\n### Sequence Diagram(s)\n\n```mermaid\nsequenceDiagram\n participant Workflow\n participant Lighthouse\n participant Summarizer\n participant ArtifactStore\n Workflow->>Lighthouse: Measure configured routes with mobile and desktop strategies\n Lighthouse-->>Workflow: Write route JSON reports\n Workflow->>Summarizer: Evaluate reports against Web Vitals thresholds\n Workflow->>ArtifactStore: Upload web-vitals reports\n```\n\n**Possibly related PRs**\n\n- [BigSimmo/Database#870](https://github.com/BigSimmo/Database/pull/870): Both changes append a review record to `docs/branch-review-ledger.md`.\n\n

\n\n\n\n\n

🚥 Pre-merge checks | ✅ 3 | ❌ 2

\n\n### ❌ Failed checks (2 warnings)\n\n| Check name | Status | Explanation | Resolution |\n| :------------------------: | :--------- | :---------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------- |\n| Linked Issues check | ⚠️ Warning | The PR does not bump `@types/node` to 25.9.2; it adds a Web Vitals workflow, script, and tests instead. | Change the PR to update `@types/node` from 25.9.1 to 25.9.2, or retarget/remove the linked issue if that bump is not intended. |\n| Out of Scope Changes check | ⚠️ Warning | The workflow, script, docs, and tests are unrelated to the linked dependency bump request. | Remove the unrelated Web Vitals and ledger changes, or update the linked issue scope if this PR is meant to deliver that workflow. |\n\n

✅ Passed checks (3 passed)

\n\n| Check name | Status | Explanation |\n| :----------------: | :------- | :--------------------------------------------------------------------------------------------------------------------------------- |\n| Title check | ✅ Passed | The title accurately describes the main change: a dispatch-only live Web Vitals workflow. |\n| Description check | ✅ Passed | The description covers summary, verification, risk/rollback, and notes, though it omits the Clinical Governance Preflight section. |\n| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. |\n\n

\n\n

\n\n\n\n\n

✨ Finishing Touches

\n\n

📝 Generate docstrings

\n\n- [ ] Create stacked PR\n- [ ] Commit on current branch\n\n

\n\n

\n\n\n\n\n---\n\n\n\n\n_{Comment `@coderabbitai help` to get the list of available commands.}\n\n","## Summary\n\nLedger `#017` gates **seven** client findings from the 2026-07-28 latency audit, plus `#012`/`#013`/`#016`. Nothing in the repo could produce the evidence it asks for — in-sandbox vitals are blocked because the production server hard-requires Supabase secrets, and local Playwright timings rank routes against each other without measuring the real origin. This adds the missing instrument.\n\nModelled on `live-domain-monitor.yml`: no secrets, no third-party actions, no providers beyond what an anonymous visitor triggers, `LIVE_DOMAIN_URL` repo-variable override, pinned action SHAs. **Dispatch-only rather than scheduled** — it is heavier than that monitor's plain GETs, and the decision it feeds is made a few times a year.\n\n**The decision rule is committed before any numbers are read**, so the gate cannot be rationalised afterwards:\n\n- mobile LCP < 2500 ms **and** CLS < 0.1 on every route → close `#017` as metrics-acceptable; the gated payload findings become WONTFIX\n- any breach → only that route's findings become actionable, ranked by measured contribution\n\nBased on prior evidence I expect the first branch: `#069` closed with hosted p90 175–243 ms and \"plans are not the multi-second tail\", and `#017`'s own row records dev-mode CLS 0.00–0.04. This repo has a track record of inferred perf claims that measurement refuted — which is the point of measuring before optimising.\n\n### Why the summariser is a script, not inline YAML\n\n`scripts/summarise-web-vitals.mjs` keeps the escaping out of YAML-inside-shell-inside-node quoting and makes the thresholds testable. **It fails closed**: a missing LCP or CLS counts as a *breach*, because an absent number is not evidence of passing — exactly the mistake `#017` exists to prevent.\n\nLab metrics only. Lighthouse cannot measure INP in lab conditions (it is an interaction metric; TBT is the lab proxy), so the rule's INP clause is confirmed from CrUX field data and the pass verdict is stated as provisional on that.\n\nAlso records the PR #1376 `prlanded` verification in the branch review ledger.\n\n## Correction — a missing mobile run read as a pass (`6972f367`)\n\nReview raised at P1, and it was correct. The workflow deliberately downgrades a per-route Lighthouse failure to a warning so one flaky route cannot discard the whole run. But the summariser enumerated only the reports that existed and rejected only an *entirely* empty directory. A directory holding just `desktop-root.json` therefore produced zero mobile breaches and rendered \"Every mobile route is within…\" — recommending `#017` be closed and its seven gated findings marked WONTFIX on evidence that was never collected.\n\nI reproduced it against the original function before changing anything:\n\n```\nOLD breaches: 0 -> verdict: PASS (close #017, 7 findings WONTFIX)\n```\n\nThat is the exact failure mode `#017` exists to prevent, in the script whose stated purpose is to fail closed — \"an absent number is not evidence of passing\" was implemented, but an absent *run* was not.\n\nThe fix tracks the requested route matrix rather than the surviving files. The workflow passes `ROUTES` into the summariser; `expectedMobileRuns()` derives the `mobile-` names using the same slug rule as the workflow's `sed`, and any expected run with no report is a breach. The summarise step also exits non-zero when reports are missing, so an incomplete run cannot read as a pass at the job level either. Zero mobile reports with no route list supplied is still a breach, so the guard cannot be bypassed by omitting the argument.\n\n```\nNEW breaches: 5 -> mobile-root (no Lighthouse report produced), mobile-therapy-compass (…), …\n```\n\n## Verification\n\n- [x] `check:github-actions` (pin check) — `GitHub Actions pin check passed.`\n- [x] `tests/summarise-web-vitals.test.ts` — new. `Test Files 1 passed (1)` / `Tests 8 passed (8)`. Covers the pass case, missing-metric, over-threshold, the `desktop-root.json`-only reproducer, and the no-route-list case. Each was checked to fail against the pre-fix shape rather than pass vacuously.\n- [x] ESLint and Prettier clean on the changed files\n- No provider-backed gates run. **Running the workflow itself is a live production action and needs explicit approval at dispatch time** — this PR only adds the capability.\n\n## Risk and rollout\n\n- **Risk:** None to the product. Adds a workflow that only runs on manual dispatch and a script nothing else imports.\n- **Rollback:** Delete the files.\n- **Provider or production effects:** None until someone dispatches it. When dispatched it issues anonymous page loads against the public domain, the same class as the existing `live-domain-monitor.yml`.\n\n## Notes\n\nRead the summary table in the run's step summary; full Lighthouse JSON is uploaded as a 30-day artifact. Record the `#017` verdict in `docs/outstanding-issues.md` either way — a pass is as valuable as a breach here, because it closes seven findings. A run with any missing mobile report is not a verdict at all; rerun it first.\n\nRAG impact: no retrieval behaviour change — adds a dispatch-only CI workflow, a standalone summariser script, and its unit test; no retrieval, ranking, selection, or answer-generation code is touched.\n\n\n\n## Summary by CodeRabbit\n\n* **Monitoring**\n * Added an on-demand workflow to measure live-site Web Vitals across configurable routes and mobile/desktop Lighthouse runs.\n * Reports are summarized against performance thresholds and saved as downloadable artifacts.\n\n* **Bug Fixes**\n * Missing reports, metrics, or threshold violations now fail validation instead of being incorrectly marked as passing.\n\n* **Documentation**\n * Recorded verification details for a recent branch review.\n\n* **Tests**\n * Added coverage for route handling, metric parsing, missing reports, and breach detection.\n\n","base_ref","f505ab4987bcdbb1420e97e707b10f2c0f4453bc","head_ref","pull_request_info",[795],{"_709":49,"_49":796},"\n\n\n\n\n\n\n\n@codex resolve actionable Codex review findings for this pull request and current head using the repository instructions. This is the pull request's single automatic repair pass: do not perform a fresh review, create new standalone findings, or request another review. Work only the existing unresolved Codex threads on the current head. Always fix P0 and P1 findings. For P2 and lower findings, fix only clear, scoped, low-risk issues; otherwise disposition them with a concise reason. After fixing or dispositioning a thread, reply in that thread with as the first line, followed by a concise summary; that marker authorizes the workflow to close that exact thread. If human input or new authorization is required, do not use the marker and leave the thread open with the blocker. Finish only after every actionable thread is fixed or dispositioned and closed, or explicitly left open for a human decision. Do not update the branch from main, address unrelated reviews, broaden scope, or create more than one scoped fix commit. Do not use external APIs, paid services, credentials, dependency changes, or broad refactors unless explicitly authorized. Add targeted tests where behavior changes and run the narrowest relevant validation.",[827,828,829],[],{"_312":826},{"_309":825},{"_309":824},{"_276":277,"_267":278,"_279":280,"_281":62,"_282":18,"_283":18,"_284":285,"_286":287,"_288":238,"_289":130,"_290":291,"_292":293,"_294":295,"_296":-5,"_297":-5,"_298":823,"_300":301,"_302":303,"_304":305,"_306":307},{"_45":126,"_164":165,"_166":167,"_168":18,"_169":170,"_171":172,"_173":812,"_175":-5,"_176":-5,"_177":18,"_178":813,"_180":181,"_182":181,"_183":814,"_185":815,"_187":816,"_189":-5,"_190":191,"_192":193,"_194":195,"_196":817,"_58":-5,"_122":198,"_199":818,"_201":819,"_203":204,"_205":18,"_206":18},{"_136":805},[806,807,808],{"_148":811,"_150":161},{"_148":810,"_150":157},{"_148":809,"_150":151},{"_152":153,"_96":154,"_122":155},{"_152":158,"_96":154,"_122":159},{"_152":162,"_96":154,"_122":163},{"_269":270,"_271":72,"_272":-5,"_273":-5,"_274":-5,"_275":-5},[228],{"_228":820},{"_210":211,"_212":213,"_214":215,"_216":217,"_218":219,"_220":221,"_222":223,"_224":225,"_226":227},{},[],{"_209":62},{"_207":62,"_208":181},{"_45":230,"_152":231,"_232":821,"_234":167,"_235":236,"_237":238,"_239":240,"_241":242,"_243":244,"_245":67,"_246":18,"_247":-5,"_248":-5,"_249":-5,"_250":-5,"_251":-5,"_252":-5,"_253":254,"_255":-5,"_58":822},{"_261":262,"_45":263,"_96":264,"_265":266,"_267":268},{"_257":18,"_258":18,"_259":18,"_260":18},{"_261":262,"_152":262,"_308":-5,"_265":266,"_45":263},[],[],[],{"_96":697,"_100":97,"_361":846},{"_96":344,"_345":833},{"_96":317,"_318":319,"_320":321,"_322":830,"_324":-5},{"_96":322,"_325":326,"_131":132,"_327":-5,"_297":328,"_329":831,"_331":332,"_333":334,"_335":336,"_337":338,"_339":832},{"_341":342,"_343":-5},[],[834,835,836],{"_350":560,"_352":-5,"_353":843,"_355":-5},{"_350":455,"_352":-5,"_353":840,"_355":-5},{"_350":351,"_352":-5,"_353":837,"_355":-5},[838],{"_357":358,"_359":360,"_361":839,"_363":62},[364,181,365,366,367,368,369,370,371,372,373,181,374,375,376,377,181,378,379,380,181,381,382,383,384,385,386,387,388,389,390,181,391,392,393,394,395,396,397,398,399,389,390,181,400,401,402,403,404,405,406,407,408,399,409,410,389,181,411,412,413,414,415,389,390,181,416,417,418,419,389,181,420,421,422,414,423,424,389,181,425,421,426,414,427,389,181,428,429,430,431,432,433,423,434,435,436,389,181,437,438,439,440,441,389,390,181,442,443,444,445,446,447,448,449,450,451,452,453,454,389,390],[841],{"_357":358,"_359":458,"_361":842,"_363":62},[460,181,461,462,463,464,465,466,467,468,469,470,468,471,472,473,474,468,475,476,477,478,479,480,481,482,181,483,484,485,486,487,488,489,490,491,492,493,181,494,495,181,496,497,498,181,499,500,501,502,503,504,505,506,507,508,509,510,511,181,512,513,514,515,181,516,517,518,519,520,521,522,523,524,181,525,517,518,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,181,549,550,551,552,553,181,554,555,556,514,557,558,559],[844],{"_357":358,"_359":563,"_361":845,"_363":62},[565,566,567,568,569,570,571,572,569,573,574,575,576,181,577,578,181,579,580,181,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,587,380,181,596,597,598,599,600,601,602,603,380,181,604,605,606,607,608,609,380,181,610,611,612,380,181,613,614,615,616,380,181,596,617,618,619,620,621,622,623,599,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,380,181,646,647,648,649,650,651,633,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,380,181,673,674,675,676,677,678,679,680,681,682,683,644,684,685,671,686,687,688,689,690,644,691,692,693,694,414,683,644,380,181,695,696,380],[847,848,849,850,851,852,853,854,855,856],{"_709":49,"_49":724},{"_709":711,"_350":560,"_357":723,"_359":713},{"_709":49,"_49":722},{"_709":711,"_350":560,"_357":720,"_359":721},{"_709":711,"_350":560,"_357":718,"_359":719},{"_709":49,"_49":717},{"_709":711,"_350":455,"_357":715,"_359":716},{"_709":49,"_49":714},{"_709":711,"_350":351,"_357":712,"_359":713},{"_709":49,"_49":710},[887,888,889],[],{"_312":886},{"_309":885},{"_309":884},{"_276":277,"_267":278,"_279":280,"_281":62,"_282":18,"_283":18,"_284":285,"_286":287,"_288":238,"_289":130,"_290":291,"_292":293,"_294":295,"_296":-5,"_297":-5,"_298":883,"_300":301,"_302":303,"_304":305,"_306":307},{"_45":126,"_164":165,"_166":167,"_168":18,"_169":170,"_171":172,"_173":872,"_175":-5,"_176":-5,"_177":18,"_178":873,"_180":181,"_182":181,"_183":874,"_185":875,"_187":876,"_189":-5,"_190":191,"_192":193,"_194":195,"_196":877,"_58":-5,"_122":198,"_199":878,"_201":879,"_203":204,"_205":18,"_206":18},{"_136":865},[866,867,868],{"_148":871,"_150":161},{"_148":870,"_150":157},{"_148":869,"_150":151},{"_152":153,"_96":154,"_122":155},{"_152":158,"_96":154,"_122":159},{"_152":162,"_96":154,"_122":163},{"_269":270,"_271":72,"_272":-5,"_273":-5,"_274":-5,"_275":-5},[228],{"_228":880},{"_210":211,"_212":213,"_214":215,"_216":217,"_218":219,"_220":221,"_222":223,"_224":225,"_226":227},{},[],{"_209":62},{"_207":62,"_208":181},{"_45":230,"_152":231,"_232":881,"_234":167,"_235":236,"_237":238,"_239":240,"_241":242,"_243":244,"_245":67,"_246":18,"_247":-5,"_248":-5,"_249":-5,"_250":-5,"_251":-5,"_252":-5,"_253":254,"_255":-5,"_58":882},{"_261":262,"_45":263,"_96":264,"_265":266,"_267":268},{"_257":18,"_258":18,"_259":18,"_260":18},{"_261":262,"_152":262,"_308":-5,"_265":266,"_45":263},[],[],[],{"_96":697,"_100":97,"_361":906},{"_96":344,"_345":893},{"_96":317,"_318":319,"_320":321,"_322":890,"_324":-5},{"_96":322,"_325":326,"_131":132,"_327":-5,"_297":328,"_329":891,"_331":332,"_333":334,"_335":336,"_337":338,"_339":892},{"_341":342,"_343":-5},[],[894,895,896],{"_350":560,"_352":-5,"_353":903,"_355":-5},{"_350":455,"_352":-5,"_353":900,"_355":-5},{"_350":351,"_352":-5,"_353":897,"_355":-5},[898],{"_357":358,"_359":360,"_361":899,"_363":62},[364,181,365,366,367,368,369,370,371,372,373,181,374,375,376,377,181,378,379,380,181,381,382,383,384,385,386,387,388,389,390,181,391,392,393,394,395,396,397,398,399,389,390,181,400,401,402,403,404,405,406,407,408,399,409,410,389,181,411,412,413,414,415,389,390,181,416,417,418,419,389,181,420,421,422,414,423,424,389,181,425,421,426,414,427,389,181,428,429,430,431,432,433,423,434,435,436,389,181,437,438,439,440,441,389,390,181,442,443,444,445,446,447,448,449,450,451,452,453,454,389,390],[901],{"_357":358,"_359":458,"_361":902,"_363":62},[460,181,461,462,463,464,465,466,467,468,469,470,468,471,472,473,474,468,475,476,477,478,479,480,481,482,181,483,484,485,486,487,488,489,490,491,492,493,181,494,495,181,496,497,498,181,499,500,501,502,503,504,505,506,507,508,509,510,511,181,512,513,514,515,181,516,517,518,519,520,521,522,523,524,181,525,517,518,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,181,549,550,551,552,553,181,554,555,556,514,557,558,559],[904],{"_357":358,"_359":563,"_361":905,"_363":62},[565,566,567,568,569,570,571,572,569,573,574,575,576,181,577,578,181,579,580,181,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,587,380,181,596,597,598,599,600,601,602,603,380,181,604,605,606,607,608,609,380,181,610,611,612,380,181,613,614,615,616,380,181,596,617,618,619,620,621,622,623,599,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,380,181,646,647,648,649,650,651,633,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,380,181,673,674,675,676,677,678,679,680,681,682,683,644,684,685,671,686,687,688,689,690,644,691,692,693,694,414,683,644,380,181,695,696,380],[907,908,909,910,911,912,913,914,915,916],{"_709":49,"_49":724},{"_709":711,"_350":560,"_357":723,"_359":713},{"_709":49,"_49":722},{"_709":711,"_350":560,"_357":720,"_359":721},{"_709":711,"_350":560,"_357":718,"_359":719},{"_709":49,"_49":717},{"_709":711,"_350":455,"_357":715,"_359":716},{"_709":49,"_49":714},{"_709":711,"_350":351,"_357":712,"_359":713},{"_709":49,"_49":710},[919,920,921,922,923,924,925,926,927,928,929,930,931,932,933],{"_734":735,"_234":167,"_736":277,"_245":-5,"_325":228,"_737":18,"_738":-5,"_739":-5,"_740":741,"_742":743,"_744":-5,"_745":-5,"_746":747,"_748":18,"_749":62,"_750":57,"_751":18,"_752":-5},{"_96":697,"_100":298,"_361":934},{"_284":285,"_286":789,"_790":791,"_792":132,"_294":-5,"_96":793},{"_96":768,"_286":788,"_350":-5,"_770":-5,"_771":-5},{"_96":768,"_286":787,"_350":-5,"_770":-5,"_771":-5},{"_96":768,"_286":786,"_350":455,"_770":773,"_771":784},{"_96":768,"_286":785,"_350":-5,"_770":-5,"_771":-5},{"_96":768,"_286":783,"_350":455,"_770":773,"_771":784},{"_96":768,"_286":782,"_350":-5,"_770":-5,"_771":-5},{"_96":768,"_286":781,"_350":455,"_770":773,"_771":-5},{"_96":768,"_286":779,"_350":455,"_770":773,"_771":780},{"_96":768,"_286":777,"_350":560,"_770":773,"_771":778},{"_96":768,"_286":776,"_350":-5,"_770":-5,"_771":-5},{"_96":768,"_286":775,"_350":455,"_770":773,"_771":-5},{"_96":768,"_286":772,"_350":560,"_770":773,"_771":774},{"_96":768,"_286":769,"_350":-5,"_770":-5,"_771":-5},[935],{"_709":49,"_49":796},"task_e_6a6a07ae3d98832296c676e3110d7ccf",1785333678.240932,"GitHub Mention: ci: add dispatch-only live Web-Vitals workflow to discharge #017","has_generated_title","has_unread_turn","denormalized_metadata",{"_967":35,"_968":969,"_970":-5,"_971":-5,"_961":972,"_973":-5,"_974":-5,"_975":-5,"_976":-5},"task_status_display",{"_955":956,"_957":167,"_133":130,"_958":-5,"_959":317},"creator_workspace","external_pull_requests",[948],{"_45":949,"_950":87,"_951":952,"_953":132},"github-1243497866-1385","assistant_turn_id","pull_request",{"_276":277,"_267":278,"_279":280,"_281":62,"_282":18,"_283":18,"_284":285,"_286":287,"_288":238,"_289":130,"_290":291,"_292":293,"_294":295,"_296":-5,"_297":-5,"_298":954,"_300":301,"_302":303,"_304":305,"_306":307},"codex_updated_sha",{"_261":262,"_152":262,"_308":-5,"_265":266,"_45":263},"latest_turn_status_display",{"_960":87,"_115":116,"_961":962,"_98":963,"_964":-5,"_965":-5,"_966":317,"_117":-5},"environment_label","fix_task_id","initial_intent","turn_id","diff_stats",{"_331":332,"_333":334,"_335":336},[],"image_asset_pointer_citations","issue_counts","intent","num_follow_ups","repo_name_map",{},"last_user_turn_created_at","last_turn_status",{"_331":-5,"_333":-5,"_335":-5},"last_pushed_turn_id","start_branch_name","pushed_branch_name","cached_pull_request_data","dd",{"_991":992,"_993":994},"disablePrefetch","shouldPrefetchAccount","shouldPrefetchUser","shouldPrefetchSystemHints","manageRootRouteStylesheet","mobileWebHandoffEnabled","promoteCss","disableSSR","stripModulepreloadImports","paidCampaignAppRedirect","statsigGateEvaluationsPromise",["P",990],"traceId","7455445920688187018","traceTime",1787827805125]