Add Pandora Shadow Context Pack Lab v1 (shadow-only staging, operator review)

[besfeng23]

Motivation

• Provide a safe, reviewable way to prepare deterministic context-pack candidates without mutating production memory tables.
• Keep all identity server-derived and namespace-scoped to avoid cross-user or cross-namespace contamination.
• Ensure operator workflow integration so candidates can be dry-run, approved, created in staging, and reviewed without promotion to live memory_context_packs.

Description

• Schema: add additive Supabase migration supabase/migrations/20260703020000_pandora_shadow_context_pack_lab.sql that introduces pandora_shadow_context_packs and pandora_shadow_context_pack_events, indexes, RLS policies, and an updated_at trigger, and extend the pandora_operator_actions action_type check with prepare_shadow_context_pack.
• Service: add lib/services/pandora-shadow-context-pack-service.ts exposing listShadowContextPacks, getShadowContextPack, dryRunShadowContextPackCandidate, createShadowContextPackCandidate, updateShadowContextPackStatus, and createShadowContextPackEvent, with deterministic, evidence-based candidate generation and strict namespace/user filtering.
• Operator actions: integrate prepare_shadow_context_pack into lib/services/pandora-operator-action-service.ts so dryRunOperatorAction computes a candidate without inserting, and executeApprovedOperatorAction inserts exactly one shadow row and a matching event while recording shadow_write_performed, no_core_memory_mutation_performed, and no_promotion_performed metadata.
• API routes: add authenticated server routes under app/api/pandora/shadow-context-packs for list/detail and POST review/reject/archive that only change shadow rows and create shadow events, rejecting any client-supplied user_id.
• UI: add components/pandora/ShadowContextPackLabCard.tsx, ShadowContextPackList.tsx, ShadowContextPackDetail.tsx, ShadowContextPackEvidence.tsx, and ShadowContextPackControls.tsx, wire them into the /pandora dashboard, and add the prepare_shadow_context_pack option to the Operator Action Composer; UI shows a clear banner: “Shadow only — no production memory mutation.”
• Dashboard loader: extend loadPandoraDashboardData to include shadow lab data safely and surface warnings if shadow tables are unreadable.
• Docs and guards: add docs/pandora-shadow-context-pack-lab.md and update operator-runner docs to explain the shadow-only boundary and keep promotion gated.
• Tests: add unit tests for the shadow service (tests/unit/pandora-shadow-context-pack-service.test.ts) and extend operator action tests and guards to validate dry-run vs approved execution behavior and safety boundaries.

Testing

• Ran type checks with npm run typecheck and it passed.
• Ran lint with npm run lint which passed (reported existing warnings in lib/db/core-repositories.ts and vitest.config.ts).
• Ran unit tests with npm run test and all tests passed (total: 623 tests, 623 passed, including new tests: tests/unit/pandora-shadow-context-pack-service.test.ts, updated operator action tests and guards).
• Built the app with npm run build, which completed successfully (Next.js emitted non-blocking runtime/build warnings about edge runtime imports).
• Environment policy checks passed with npm run env:policy.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
memory	Ready	Preview, Comment	Jul 3, 2026 9:50pm

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

@besfeng23, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 14 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 3a8c68cb-7394-4e70-af17-039cf9cc45d1

📥 Commits

Reviewing files that changed from the base of the PR and between 87857c9 and 4124288.

📒 Files selected for processing (24)

• app/api/pandora/shadow-context-packs/[id]/archive/route.ts
• app/api/pandora/shadow-context-packs/[id]/reject/route.ts
• app/api/pandora/shadow-context-packs/[id]/review/route.ts
• app/api/pandora/shadow-context-packs/[id]/route.ts
• app/api/pandora/shadow-context-packs/route.ts
• components/pandora/OperatorActionComposer.tsx
• components/pandora/PandoraDashboard.tsx
• components/pandora/ShadowContextPackControls.tsx
• components/pandora/ShadowContextPackDetail.tsx
• components/pandora/ShadowContextPackEvidence.tsx
• components/pandora/ShadowContextPackLabCard.tsx
• components/pandora/ShadowContextPackList.tsx
• components/pandora/mock-data.ts
• components/pandora/types.ts
• docs/pandora-operator-action-center.md
• docs/pandora-readonly-action-runner.md
• docs/pandora-shadow-context-pack-lab.md
• lib/services/pandora-dashboard-service.ts
• lib/services/pandora-operator-action-service.ts
• lib/services/pandora-shadow-context-pack-service.ts
• supabase/migrations/20260703020000_pandora_shadow_context_pack_lab.sql
• tests/unit/pandora-operator-action-guards.test.ts
• tests/unit/pandora-operator-action-service.test.ts
• tests/unit/pandora-shadow-context-pack-service.test.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/implement-pandora-shadow-context-pack-lab

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}