[PetrefiedThunder]

STACKED. Based on claude/supplier-data-quality (#3574), which is stacked on #3572. Retarget this PR to main after #3572 and #3574 merge.

Do not merge until C.Lee approves the production migration.

What changed

The late CTE measure on the supplier data quality view now works. Each supplier facility can store an agreed sending time in hours. A CTE record counts as late when it is received (created_at) more than agreed_sending_hours after its event_time. The label is unchanged (LATE_CTE_LABEL): this is our measure against the agreed sending time, not an FDA rule.

• Schema: public.supplier_facilities.agreed_sending_hours integer NULL CHECK (agreed_sending_hours > 0). No backfill. Alembic b005ddbf1dba (v136, down revision 41f96588d87c, the single head before this PR) and supabase/migrations/20261024070000_supplier_agreed_sending_hours.sql, both with a downgrade. SupplierFacilityModel gains the column and the named CHECK.
• Metric (services/shared/supplier_data_quality.py):
  • fetch_sending_hours is a SELECT filtered on tenant, supplier user and facility ids.
  • timed_records gives the denominator: records received in the window that have both event_time and created_at.
  • late_records gives the numerator: created_at - event_time > agreed_sending_hours. A record received exactly at the agreed hours is on time.
  • late_metric: with no hours set, the status is not_enough_data, the counts are null and the reason is LATE_CTE_NO_HOURS_REASON. With hours set, it uses the same share_metric rule as the other measures, so the status stays not_enough_data below MIN_RECORDS timed records.
  • late_cte is added to DRILLDOWN_METRICS.
• API (services/admin/app/supplier_compliance_routes.py):
  • New PUT /v1/supplier/facilities/{facility_id}/agreed-sending-hours with body {"agreed_sending_hours": int | null}. It has the same guards as the other facility routes: tenant context is required, the facility id must parse, and _get_supplier_facility_or_404 checks tenant and owning supplier user. Validation is strict: a positive integer up to the Postgres integer maximum, or null to clear. Strings, floats, booleans, zero, negatives and a missing key all return 422.
  • GET /v1/supplier/data-quality returns agreed_sending_hours for each facility.
  • GET /v1/supplier/data-quality/{facility_id}/records?metric=late_cte lists the late records. It returns 409 when the facility has no agreed hours.
• Route security manifest: I added the new tenant scoped PUT to docs/security/route-security-manifest.json by hand, with the same classification, permissions and adapter as the sibling PUT .../ftl-categories. Counts are now 258 enabled and 205 tenant scoped, updated in tests/security/test_route_security_manifest.py. The generator could not run locally because the local venv has no opentelemetry.instrumentation. CI should confirm the file with scripts/generate_route_security_manifest.py --check.
• UI (frontend/src/app/dashboard/suppliers/data-quality.tsx):
  • The late CTE row shows "Agreed sending time: N hours after the event" or "Not set", with Set or Edit.
  • The edit form accepts whole hours above zero, with Save, Clear (sends null) and Cancel. After a save the page reloads the data quality summary.
  • With no hours set, the row shows "Not enough data." followed by the reason.
  • Late records can be drilled into (event and received times) once at least one is late.
  • Added apiClient.setFacilityAgreedSendingHours and AgreedSendingHoursResponse. SupplierDataQuality.agreed_sending_hours and 'late_cte' are added to SupplierQualityDrilldownMetric.

Migration SQL (up)

alter table public.supplier_facilities
    add column if not exists agreed_sending_hours integer null
        constraint supplier_facilities_agreed_sending_hours_check
            check (agreed_sending_hours > 0);

Idempotent: the inline CHECK is only created together with the column, so a second run does nothing. Existing rows get NULL. Nothing is backfilled and no row is rewritten.

Downgrade SQL

alter table public.supplier_facilities
    drop constraint if exists supplier_facilities_agreed_sending_hours_check;
alter table public.supplier_facilities
    drop column if exists agreed_sending_hours;

The downgrade drops only what this revision added. It deletes any agreed sending hours entered after the upgrade.

Read only verification SQL (for C.Lee, after applying)

-- 1. Column exists, integer, nullable.
select column_name, data_type, is_nullable
  from information_schema.columns
 where table_schema = 'public'
   and table_name = 'supplier_facilities'
   and column_name = 'agreed_sending_hours';

-- 2. CHECK constraint present with the expected definition.
select conname, pg_get_constraintdef(oid)
  from pg_constraint
 where conrelid = 'public.supplier_facilities'::regclass
   and conname = 'supplier_facilities_agreed_sending_hours_check';

-- 3. No backfill: every existing row is NULL right after applying.
select count(*) as total_rows,
       count(agreed_sending_hours) as rows_with_hours
  from public.supplier_facilities;

-- 4. Alembic is at the new head (if applied through alembic).
select version_num from alembic_version;

Expected results:

1. One row: integer, YES.
2. One row: CHECK ((agreed_sending_hours > 0)).
3. rows_with_hours = 0.
4. b005ddbf1dba.

Test results

All tests are data free. Ids come from uuid4 / crypto.randomUUID, and counts are derived from generated input lengths or MIN_RECORDS.

Check	Result
pytest services/shared/tests/test_supplier_data_quality.py	41 passed
services/admin/tests/test_supplier_data_quality_routes.py (stub runner)	30 passed
tests/migrations/test_destructive_downgrade_documented_2827.py	3 passed
Single Alembic head (parsed from alembic/versions)	b005ddbf1dba only
vitest supplier-data-quality, suppliers-metrics, suppliers-removal	3 files, 25 passed (19 in supplier-data-quality)
tsc --noEmit -p .	Only the existing src/instrumentation.ts(26,5) error
eslint on touched files	0 errors (1 existing warning in page.tsx, line 532)
design-lint	Clean (656 files)
ruff check + ruff format on touched Python files	Clean

These could not run locally because the venv is missing packages; CI needs to run them:

• tests/security/test_route_security_manifest.py: needs opentelemetry.instrumentation.
• tests/migrations/test_alembic_chain_health.py: the repo alembic/ folder shadows the alembic package in this venv.
• test_supplier_onboarding_routes.py, test_supplier_facilities_routes_1342.py, test_qa5_supplier_integrity.py: need PyJWT.

No database was contacted.

Remaining risk

• Any authenticated supplier user can set hours on their own facilities. No tenant owner role is required, which matches the other facility settings such as FTL categories. Cross tenant and cross user writes return 404 and are covered by tests.
• The late measure trusts created_at as the received time. A record sent through a bulk upload long after the event counts as late, which is the intended behavior.

---

Note

Medium Risk
Adds tenant-scoped facility settings and late-CTE logic tied to timestamps, plus broad UX/copy and navigation changes that affect onboarding paths and CI gates.

Overview
Adds per-facility agreed sending hours so the supplier data quality late CTE metric can be computed and edited in the dashboard (set/clear hours, drill into late records), with schema (supplier_facilities.agreed_sending_hours), Alembic v136, documented PUT /v1/supplier/facilities/{facility_id}/agreed-sending-hours, and data_gap_events / facility column updates in expected_schema.json.

In parallel, the PR tightens product copy and removes demo fabrications: a new Copy gate CI workflow runs scripts/copy-lint against a baseline; developer docs and ingest samples use <field> placeholders instead of TEST- lots; recall report, demo banner, pricing, and import flows drop sample/simulation UI; EPCIS is labeled (Preview) across marketing and dashboard copy.

Inflow Lab is retired from the product surface: dashboard nav and integrations links are removed, /dashboard/inflow-lab returns 404, connector docs/OG assets and large test suites are deleted, and dashboard CTAs point at Import (/ingest) instead of the workbench.

Engine Review Pass now reacts to issue comments, accepts more engine names, and requires a full 40-character commit SHA in REVIEW: markers (exact match, not prefix).

^{Reviewed by Cursor Bugbot for commit c77c400. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
regengine	Ready	Preview	Oct 25, 2026 3:39am UTC

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review: 1

• main

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: regengine/RegEngine
• Branch: claude/supplier-agreed-sending-hours
• File: .coderabbit.yaml
• Commit: c77c400
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 26214c66-f766-4d7c-8cba-7c62ba951899

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-24T08:05:24.843469Z	11eb280	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[vercel]

Changing or clearing the agreed sending hours while late records are expanded leaves the old records visible, even when the refreshed metric has no late records and no Hide records button.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 11eb280. Configure here.}

[cursor]

Stale late records after hours change

Medium Severity

Saving a new agreed sending time reloads the summary counts but leaves MetricRow drilldown state in place. The expanded late list still shows records from the previous threshold, and hide/show does not refetch while items remain. If the new late count is zero, canDrill hides the toggle so that stale list cannot be dismissed.

Additional Locations (1)

• frontend/src/app/dashboard/suppliers/data-quality.tsx#L237-L257

 

^{Reviewed by Cursor Bugbot for commit 11eb280. Configure here.}

[PetrefiedThunder]

Delta review of #3575 against claude/supplier-data-quality (4332a82) at 11eb280.

Code: sound.

• PUT isolation: _get_supplier_facility_or_404 (tenant + supplier_user) runs before any write. Foreign and other-tenant facilities return 404 with no commit. The body is strict int, > 0 and <= int4 max, and null clears the value.
• Migration: nullable int with CHECK > 0, idempotent, and the Alembic and Supabase versions match. The downgrade drops the constraint, then the column.
• Late metric: the numerator counts records with created_at - event_time > agreed hours. The denominator is records that have both times. With no hours set, the status is not_enough_data with a reason. The drill-down uses the same late_records and returns 409 when no hours are set.
• Tests: no invented literals. AGREED_HOURS = MIN_RECORDS, times come from datetime.now, ids are uuid4/randomUUID, and the invalid inputs are deliberate.

FAIL: the manifest test is stale.

• tests/security/test_route_security_manifest.py:195-196 still asserts len(dual) == 54 and len(mutations) == 23. The checked-in manifest marks the new PUT as tenant_dual_session_csrf (docs/security/route-security-manifest.json:2970), so the real counts are 55 and 24, and this test will fail. Bump both and add a comment.

CI: Vercel and CodeRabbit pass. Most required checks are pending, and no backend suite has run on this stacked base. No migration was applied.

REVIEW: FAIL codex 11eb280

[PetrefiedThunder]

Delta review of #3575: 11eb280 -> 8cc9a3b. Only tests/security/test_route_security_manifest.py changed.

The test now asserts len(dual) == 55 and len(mutations) == 24. Counting the checked-in manifest JSON gives 258 enabled operations, 55 tenant_dual_session_csrf and 24 mutations, so they match. My earlier finding is fixed, and everything else is as in my last review.

CI: Vercel, Vercel Preview Comments and CodeRabbit pass; Bugbot, Non-main PR Secret Scan and report are pending. No backend suite has run on this stacked base, so merging needs green backend CI after it is retargeted to main. No migration was applied.

REVIEW: PASS codex 8cc9a3b

[github-actions]

PR Blocker Checklist

Head SHA: c77c4005c573bacfe0e88ac1123c78966926bd54

Status: Blocked (3 open blockers)

Review Threads (2 unresolved)

• frontend/src/app/dashboard/suppliers/data-quality.tsx by @vercel: "Changing or clearing the agreed sending hours while late records are expanded le..."
• frontend/src/app/dashboard/suppliers/data-quality.tsx by @cursor: "### Stale late records after hours change Medium Severity <!-- DESCRIPTION S..."

Changes Requested (0)

• No reviews requesting changes

Blocked Engines (1)

• Engine codex blocked at 11eb280 (current head: c77c400): View verdict: REVIEW: FAIL codex 11eb28005771d0977e1be3c05b68f416e2064822

[PetrefiedThunder]

REVIEW: FAIL deepseek 8eaf374

Reviewed by hand: Mac load was 34–46, over the 28 limit, so no DeepSeek pass.
Blocking:

• alembic/versions/20261024_b005ddbf1dba_v136_supplier_agreed_sending_hours.py:9 adds public.supplier_facilities.agreed_sending_hours, but docs/schema/expected_schema.json at this head doesn't include it (0 matches). The repo-root schema parity audit (scripts/schema_parity_audit.py check) already fails on main's data_gap_events and will flag this column too. Regenerate the snapshot from a freshly migrated DB in this PR (python scripts/schema_parity_audit.py snapshot).
  Verified OK:
• Chain: main has 103 revisions with head 41f96588d87c. b005ddbf1dba (down_revision 41f96588d87c, line 23), then feat(epcis): document receipts and live EPCIS failure metric #3576's a3f7ce361b0e, gives a single head a3f7ce361b0e with no missing parents. No revision or Supabase timestamp collisions with main (main's last Supabase migration is 20261024060000; 080000 is unused).
• Merge delta: the only change is the documented Supabase rename 070000 -> 20261024080000. No stale 070000 references.
• Schema-only migration (column plus CHECK > 0), no seed or synthetic data. Non-test code is clean.

[PetrefiedThunder]

REVIEW: PASS deepseek c77c400

Delta review from 16f29dc (main merge) to c77c400, covering 0aafb55 and c77c400. Reviewed by hand (load was 23.9, under the limit, but a manual pass was enough for a 6-file delta).

• docs/schema/expected_schema.json:6810 adds public.supplier_facilities.agreed_sending_hours as {nullable: true, type: integer}. That matches alembic/versions/20261024_b005ddbf1dba_v136_supplier_agreed_sending_hours.py:32 (integer null, CHECK > 0) and supabase/migrations/20261024080000. The snapshot diff is just these 4 added lines, so it's a clean regeneration. This fixes the earlier FAIL at 8eaf374.
• scripts/copy-lint/baseline.json: no file/rule count went up. The total went from 288 to 136.
• frontend/src/app/dashboard/suppliers/data-quality.tsx:20 now reads "EPCIS (Preview) files failing validation", and frontend/src/app/ingest/page.tsx:695 reads "EPCIS (Preview) files are all or nothing". Both follow the Preview label convention, and the test at frontend/src/tests/pages/ingest-epcis.test.tsx:139 was updated to match.
• frontend/src/app/docs/walkthrough/page.tsx:66-67: the em dash is gone. None of the 3 touched pages has an em dash left.
• Real data: no test facilities or synthetic values were added to prod code, copy or migrations.
• CI: Copy gate passed, and so did the security and tenant-isolation checks. The only failures are Engine Review Pass, PR Blocker Checklist and Head SHA Check Guard, which are review gates. Note that no backend or schema-parity job ran for this PR (base is claude/supplier-data-quality). Parity was checked by hand above, and it must still go green on the PR to main.