pediatric-ai-scribe-v3/TODO.md

TODO

Live state as of 2026-09-11. Everything not listed under Open is deployed and green (674 tests, three consecutive clean runs).

Open

Needs your decision

• Replace Cloudflare Turnstile. Used on registration and password reset only (src/routes/auth.js); login is not gated, it relies on a 10-per-15-min limit and a constant-time credential check. Recommended replacement: ALTCHA — open source, self-hosted, proof-of-work, no third-party calls and no tracking, which also lets three CSP entries and frameSrc go away. Alternatives: mCaptcha (open source, self-hosted, heavier to run) and Cap (newer, smaller). hCaptcha is neither Google nor open source, so it trades one third party for another.
• Kubernetes / CI-CD hardening. Details under Deployment readiness.
• Finish pointing audio backups at MinIO — one blocked step. The audio-backups bucket now exists on the same MinIO the app already uses (assets:9000). The app's key is scoped by a MinIO user policy, so a bucket policy alone grants it nothing — verified, it returns AccessDenied. The remaining step attaches a second policy covering only that bucket, leaving the generated-images grant untouched. It needs the MinIO root credentials, and my permission layer blocked me from running it. Run: RU=$(cat ../ped-ai-storage/secrets/minio-root-user) RP=$(cat ../ped-ai-storage/secrets/minio-root-password) then docker compose exec -T -e MINIO_ROOT_USER="$RU" -e MINIO_ROOT_PASSWORD="$RP" pediatric-scribe node scripts/enable-audio-backup-bucket.js, set AUDIO_BACKUPS_S3_* (the script prints them), and restart. Until then recordings go to the encrypted Postgres column, which works; rows already there keep working afterwards.
• Basic index has no reader. MilvusVectorStore.search() exists, but no tool calls it. Decide where the query path lives: pymilvus inside the deliberately-lean nextcloud-basic-mcp image, or a query API from the indexer container. Nothing can read that index until this is settled. Source: /home/danvics/docker/nextcloud-basic-mcp
• Apply the restored clinical vector-store compose. Written, committed and validated at /home/danvics/docker/nextcloud-mcp-server, deliberately NOT applied — up -d recreates the live clinical Milvus.

Known gaps

• Multi-collection, ped-ai half. The MCP side is deployed (clinical_semantic_search(collection=…) + clinical_list_collections, allowlisted by MILVUS_COLLECTIONS). ped-ai still searches one collection per request. Needs an admin setting for which collections to search, then fan-out and merge — dedupeSources in src/utils/clinicalRetrieval.js already merges and renumbers. See clinical-assist/COLLECTIONS.md.
• Confirm mail indexing end to end. Six separate breaks are fixed, and mail is enabled (BASIC_INDEXING_MAIL_ENABLED=true), but no mail has been indexed yet: the file pass was still working through 472 large PDFs (68 done in six hours, some over 1,500 chunks each) and mail runs after it. On 2026-09-11 the indexed folder was changed from Documents to Personal assistant, which currently lists 0 files, so the file pass is now trivial and mail should be reached on a scan cycle (every 300s). Watch for [SCAN-*] Mail messages: N seen, M queued. Note: the 68 files already indexed from Documents are still in the collection. Say the word if they should be cleared.
• image-size DoS advisory (high), no upstream fix. Every published version up to 2.0.2 is affected; npm audit fix only offers a breaking downgrade of pptxgenjs. Not reachable here: the only addImage call (src/routes/learningAI.js) is fed PNGs the app generated itself and fetched with an ownership check, never an uploaded file. Uploads are allowlisted to jpeg/png/gif and checked against their magic bytes. Revisit when pptxgenjs ships a patched dependency.
• uuid advisory (moderate) via gaxios via Google auth. Not reachable: the flaw needs v3/v5/v6 with an explicit buffer, and gaxios calls only v4() for a multipart boundary. Forcing an override risks Vertex auth.

Deployment readiness (CI/CD and Kubernetes)

What already exists: ci.yml (tests on PR and main), security.yml (weekly audit), docker-publish.yml and Android/versioning workflows, a Dockerfile HEALTHCHECK, and /api/health.

Worth doing before Kubernetes, roughly in order:

• Fail CI on vulnerabilities. security.yml runs weekly and does not gate merges. npm audit --audit-level=high in ci.yml would have caught the nodemailer advisories at the PR.
• Build the image on PRs too. docker-publish.yml only runs on tags, so a Dockerfile break is found at release time.
• Run the e2e suite in CI. scripts/e2e.sh and docker-compose.e2e.yml exist but nothing calls them.
• Separate liveness from readiness. /api/health is one endpoint; Kubernetes wants liveness (process up) apart from readiness (database, gateway and MinIO reachable), or rollouts take traffic too early.
• Graceful shutdown. No SIGTERM handler, so a rolling update can cut off an in-flight transcription or image job.
• Externalise state. Uploads and audio backups assume local paths and a single instance; more than one replica needs them all in MinIO/Postgres.
• Config as secrets. Everything is env vars in compose today, which maps to ConfigMap/Secret cleanly, but JWT_SECRET, gateway keys and database credentials should be a Secret from the start.
• Pin the base image by digest and keep the SBOM the build already has.

Done since this file was written

2026-09-11

• Live transcription: proved working end to end against the live gateway — local-kokoro-tts produced 92KB of speech and mistral-voxtral-mini-transcribe returned the sentence back verbatim. The Settings picker offered six hardcoded ids that do not exist on this gateway (local-whisper-large-v3-turbo → 400 Invalid model name); it now lists the nine the gateway advertises, cached, with the admin default marked.

• Assistant voice mode is wired end to end: record → browser recognition, falling back to server transcription → send → spoken answer. All four helpers it needs exist.

• Recordings can be exported (server and local copies) and a recorder that dies — an error, or the microphone taken by another app, unplugged or revoked — now says so instead of appearing to record silence. No wake lock, deliberately: stopping on sleep or sign-out is the behaviour you want.

• nodemailer 9.0.1 → 9.1.1, clearing four high advisories, two of them delivery bugs that can route mail to an attacker-controlled domain.

• Admin routers state their own authentication. adminMilestones relied on adminConfig being mounted first on /api/admin; it failed closed, but on mount order rather than intent.

• Test suite made deterministic. A file failed about one run in four with "Unable to deserialize cloned data": node:test parses each child's stdout, and page/server logging was landing inside those frames. Every test child's stdout is now pure TAP.

• iOS: text fields are 16px on phones, so Safari no longer zooms the page on focus — which was also why fixed chrome (the menu button) scrolled away.

• Settings claim corrected: there is no "use my normal physical exam" trigger, and the prompt forbids copying template content.

• Storage stack is under version control (/home/danvics/docker/ped-ai-storage), secrets verified excluded, with a README recording the misleading project names and the MinIO/separate-etcd requirements.

• Both Milvus stores keep objects in MinIO; verified end to end on the basic side (16 objects in the bucket, rows queryable, collection Loaded).

• The operator image is built from source (Dockerfile.operator), so the drifted check.py that broke image generation can no longer be run by accident.

Worth knowing

• Four repos were rescued from container images today: nextcloud-basic-mcp, clinical-assist, the deleted nextcloud-mcp-server compose file, and the operator's check.py drift. Prefer building from a repo over a live container.
• Two Milvus instances, historically misleading names. Clinical index = nextcloud-mcp-server-milvus-1 (MinIO-backed, collection mcp_bge_m3_1024). Nextcloud basic index = ped-ai-storage-basic-milvus-1 (db basic, collection basic_bge_m3_1024_v2).
• Embedded etcd is unusable with authorization on. Every non-root Milvus user failed etcdserver: invalid auth token. Both stores now run a separate etcd container, matching the profile that always worked.
• Both Milvus stores now keep objects in MinIO, matching what clinical always did. COMMON_STORAGETYPE=local wrote segment files relative to the working directory, so a recreate destroyed them while etcd kept referencing them and the collection hung at Loading forever. S3 semantics also mean either store can be pointed at a managed bucket without touching Milvus — which is what makes a Terraform-managed deployment straightforward.
• Milvus object-store credentials live in milvus-user.yaml in the protected secrets dir, not in the compose, because Milvus has no file-based option for them and the compose should stay reviewable.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com