Adds the Startup Ritual to signal/CLAUDE.md and records today's key
rotation + Clerk-in-flux note in context/current-state.md, so Pi and
Claude Code both read and write the same shared state file.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The backend master SIGNAL_API_KEY had leaked via two paths:
- baked into the public Vite bundle via VITE_SIGNAL_API_KEY (Vercel)
- hardcoded as a fallback in scripts/signal_e2e_test.py
The key has been rotated on Railway (old value now returns 401) and the
VITE_SIGNAL_API_KEY var removed from Vercel. This commit removes the two
code paths so the master key can never be re-baked or re-committed:
- signal-ui/src/lib/api.js: drop the X-API-Key fallback entirely; the
frontend now authenticates only with the signed-in user's Clerk token
- scripts/signal_e2e_test.py: read SIGNAL_API_KEY from env only; exit if unset
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Live validation of the deployed Signal stack: engine verified (5k-patient
upload, PHI-clean, export, confirm-visit), live app outage diagnosed and
restored (Clerk dev-instance revert), 3 product blockers + master-key
exposure + compliance gaps documented for Pi to design remediation.
Includes Pi's current-state.md design updates.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Moves llms.txt, robots.txt, auth.md, .well-known/api-catalog, agent-skills,
webmcp.js from VPS /var/www/signal-demo to signal-ui/public/ so they are
served from the Vercel deployment at signal.sttilsolutions.com.
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
- ClerkProvider now sets signInUrl/afterSignInUrl to signal-ui-xi.vercel.app so
invitation emails and sign-in links land on the webapp not Clerk's hosted page
- Stoplight colors on status badges (red/amber/teal/green)
- Clear to Ship shows checkmark instead of dot
- Filter tabs include count + percentage
- EmptyState V2: "Drop your file here" heading
- Legend bar removed from worklist header (redundant with tabs)
- Pilot readiness at 13/13 (100%) as of 2026-06-16
- Signal Intelligence spec added to docs
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
- Doc status click-to-update: SWO and PA cycle through states and persist to Supabase
- Status legend added to worklist header
- Empty state with file-open prompt for first-time users
- Device normalizer expanded for broader CGM variant coverage
- Warm cream text applied globally for secondary/muted UI elements
- Drag-drop CSV import support
- CORS root cause fixed via Railway ALLOWED_ORIGINS env var
- DOCS_REQUIRED badge: RESUPPLY_READY patients with open cascade items now show
amber Docs Required instead of green Clear to Ship, preventing premature shipment
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
- doc_state_machine: remove early returns from _build_cascade, surface all 5 doc checks, pecos gated to medicare/MA, pa denied routes to appeal alert
- main.py: add _recommended_next_step_code(), extend RecordOut and export CSV with new columns
- normalizer: accept order_number and hcpcs as pass-through fields
- coverage_calculator: add order_number/hcpcs to ShipmentRecord
- CLAUDE.md: supabase pro plan confirmed 2026-06-10
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Empty state UI: first-time prompt with file selector
- Mapping review step in CSVImport with confidence scores and override dropdowns
- Confirmation step in ConfirmVisitModal (one last look before save)
- Next-priority toast after visit confirmation
- Active patient banner with autosave and one-click return for interruptions
- Simplified cascade to 2-step (what is missing, device shipment at risk)
- Copy rewrites: status labels, doc checklist text, action messages, cascade language
- Pilot readiness updated to 85% (11/13)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
DME wins on patient outcomes despite heavier Part B documentation burden vs pharmacy Part D.
Signal removes the handicap — the pitch framing belongs in the Brand Vault.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Generates 25 PA (Gaboro DME, high challenge) and 25 NJ (Gaboro DME, high
challenge) synthetic CSV files. All 50 files pass normalizer ingestion
(50/50). Adds test-data/.gitignore override so CSV test sets are tracked
despite root-level *.csv exclusion.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add supabase/ to .gitignore (local CLI config should not be committed)
- Create and apply migration 20260607000001_audit_log_worm.sql via CLI:
creates audit_log table with RLS enabled + INSERT/SELECT policies +
WORM policies that block UPDATE and DELETE on all rows
- Update CLAUDE.md compliance checklist: audit_log WORM marked PASS
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
RED At Risk: SUPPLY_LAPSED, VISIT_REQUIRED, RENEWAL_CRITICAL
AMBER Action Needed: RENEWAL_ELEVATED, RENEWAL_SOON, TRANSFER_PENDING
GREEN: Clear to Ship (RESUPPLY_READY), On Track (ACTIVE)
Filter tabs updated to match 3-tier model.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- WorklistTable: consolidate 9 filter tabs to 8 matching 7-state labels
(Docs Required, Escalate, Confirm Appt., Begin Outreach, Clear to Ship,
New Patient, On Track) + add combined "escalate" filter key for
RENEWAL_CRITICAL + VISIT_REQUIRED
- Sidebar: fix broken filter keys (REFILL_WINDOW/VISIT_DUE/OUT_OF_COVERAGE
never matched any r.flag value) - replace with SUPPLY_LAPSED, escalate,
RESUPPLY_READY; update labels to 7-state names
- App: rename Sidebar props to match new framework; update stat cards to
Needs Attention / Outreach in Progress / Clear to Ship
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Lets users switch between orgs (e.g. STTIL Solutions, Gaboro DME)
directly from the top bar without going into account settings.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Backend: JWT middleware validates Clerk tokens on every request,
extracts org ID from claims, enforces org-scoped queries via
Supabase RLS. Frontend: ClerkProvider wraps the app, auth gate
blocks unauthenticated access, UserButton in header, token
injected into every API call. Supabase production wired to trust
Clerk JWTs via Third-Party Auth integration.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- supabase_client.py: lazy singleton client (no-ops when env vars absent)
- persistence.py: persist_upload writes batch, source_files, normalized_records,
mapping_decisions, report_runs; persist_export records export_files
- schema.sql: 11-table schema with RLS + WORM rules for audit/raw tables
- main.py: wire persist_upload/persist_export; add ExportRequest body model
so export accepts {records, batch_id}; batch_id returned on upload response
- api.js: add exportFromBackend helper passing batch_id through
- requirements.txt: add supabase>=2.0.0
- smoke_test.py: update export call to new body format
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- lock CORS to Vercel domain via ALLOWED_ORIGINS env var (removes allow_origins=*)
- add X-API-Key header auth on /api/upload and /api/export
- normalizer: add mapping confidence (high/inferred), new aliases for Acct #,
Member ID, External Patient Ref, DME Description, dispensedate; 63/63 CSV files pass
- coverage_calculator: add RULE_VERSION = "v0.1", rule_version on every CoverageResult
- main.py: audit logging wired on upload + export, rule_version + mapping_summary in response
- generate_samples.py: 25 CSV files now use 25 different real-world header formats
- add generate_10k.py for 10,000-patient synthetic dataset
- add tests/smoke_test.py (passes against local backend)
- add docs/pilot-guide-v1.md for Robert Robinson pilot onboarding
- add docs/daniel-pilot-readiness-whitepaper.md and .pdf
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
