feat(official): CMS138 onboarded — 0/47 → 47/47, and the gate learned a new kind of claim

[Taleef7]

Result

CMS138: 0/47 with 47 errors → 47/47, 0 unexpected mismatches, 0 errors. The MADiE gate is now 278/278 across six measures.

Three things had to be true and only the first was: the value set had to be sourced, the artifact had to be complete, and the deck had to be able to see it.

1. Sourced

The credentialed workflow from #365 pulled …3.526.3.1278 ("Tobacco Use Screening") from VSAC at the pinned release — 4 codes, where upstream ships none. Its verification step confirmed truncated [] / absent [] before uploading, and refuses to upload anything less.

2. The deck still said 0/47 — which falsified ADR-053

Every case errored with Missing the following valuesets. ADR-053 had claimed "the real check on a sourced value set is the MADiE gate." The report explains why that's wrong in its own words:

"ValueSets are consumed directly from each official measure Bundle."

The gate runs on upstream's terminology. That is exactly what makes it a genuine external check for the other five — and exactly what makes it blind here, since the bundle is the thing lacking the set. A complete sidecar sat beside it the whole time, unread.

3. So the gate supplements — but only what upstream omits

runOfficialMeasureCases takes the artifact's runtime terminology and narrows it to the OIDs the bundle does not ship.

The narrowing lives next to the calculate call, not at the call site. The natural thing for a caller to do is pass the whole cache — which would quietly convert this gate from "upstream's terminology" into "ours" for every measure, deck still green, nothing to notice. With nothing missing, calculate takes three arguments exactly as before; the pre-existing assertion pinning that still passes, which is what makes the five complete measures provably unaffected.

What 47/47 licenses — and what it does not

For that one value set the codes are ours. What stays upstream's is the answer key — the expected population vectors. So agreement is real evidence the four sourced codes are right, and no evidence about upstream's terminology.

Everything here exists to stop that being rounded off to "47/47 like the others":

mechanism	where
supplementedOids on the run	in the data, so nothing downstream can drop it
mode measure-bundle+sourced-supplement	distinguishes it from measure-bundle
stderr warning naming the OIDs	a weaker claim shouldn't need a markdown diff to notice
a paragraph on the measure's own line in the report	not a footnote

The report's controls paragraph no longer claims terminology comes only from the bundle — a supplemented run would have contradicted it two lines later.

Guards, mutation-checked

mutation	result
supplementFor passes everything through unfiltered	5 tests fail
drop the |version OID normalization	fails exactly the test written for it

Smaller things caught

• A test comment still asserted cms138 "scores 0/47 because one value set will not expand" — the misdiagnosis ADR-053 corrected, living on where nobody looks.
• Two CLI test doubles predated supplementedOids and threw on it, surfacing as the CLI returning exit 2 — reading as "the configuration was refused" rather than "the fixture is incomplete".
• I re-ran the ADR-writing script by accident and duplicated ADR-053. Caught by grepping the heading count rather than by reading, which is the only reason it didn't ship.
• official-artifacts.test.ts's vendored list is hardcoded on purpose ("a new artifact appearing unannounced is a review event"), so cms138 is a deliberate edit.

Still open

CMS130 and CMS165 are not vendored. Their blockers are capped expansions, which the gate handles today — no supplement needed. One workflow dispatch each.

---

Suite 1764 pass / 0 fail / 15 skipped; typecheck clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Q3BNWAJwJJ5QjP1X6JpHUo

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bffec21738

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep uncredentialed fork CI from running CMS138 incomplete

When this job runs for a fork or Dependabot PR, GitHub withholds WORKWELL_VSAC_API_KEY_VENDOR, so lines 170–176 leave $COMPLETE empty. This new invocation then regenerates CMS138 with only the 31 upstream value sets; backend-ts/scripts/vendor-official-measure.mjs:507-515 explicitly says that the resulting artifact cannot run because the missing set requires --complete-terminology. The bundle-only reproducibility check still passes, but the workflow subsequently runs the default pnpm test:official-cases gate at lines 232–234, which now includes CMS138 and therefore reports all 47 cases as errors and exits nonzero. Condition the CMS138 invocation/gate for the uncredentialed path or otherwise provide a credentialless way to retain its validated supplement, so every external PR is not unconditionally red.

Useful? React with 👍 / 👎.

[Taleef7]

Correct and fixed in 895027d — thank you, this would have turned every external contributor's PR red on merge.

Your trace is exactly right: uncredentialed → $COMPLETE empty → cms138 re-vendored with only upstream's 31 value sets → the supplement has nothing to draw on → 47 errors → nonzero exit. And the bundle-only reproducibility check passes, so nothing upstream of the gate would have caught it.

--allow-missing-terminology skips a measure the CONTEXT cannot resolve, passed by CI only where steps.vendor.outputs.credentialed != 'true' — the same conditional the reproducibility check already splits on, and the same shape official-flip-config.test.ts uses to excuse the capped class.

The opt-OUT is the load-bearing half, so it is the one I pinned hardest: a credentialed run passes nothing and therefore skips nothing, because there an unresolvable value set means a broken artifact — which is the whole point of the gate. There is a test that supplies the SAME unresolvable OID without the flag and asserts the measure still runs, so the accommodation cannot quietly become the default.

Two consequences your comment did not have to reach, both handled:

1. A skipped run is PARTIAL even though it asked for the full list, so it must not rewrite the committed report — otherwise CI's staleness check would read "current" on the very run that could not produce it. Extended the existing --measure guard rather than adding a second one.
2. That staleness step is now credentialed-only, since an uncredentialed run deliberately leaves the report alone and the comparison would always differ.

The skip predicate is absentValueSets(artifact, requiredOids(artifact)) — the same one officialRoutingProblems refuses on — so "the gate skipped it" and "routing would refuse it" are one decision, not two that can drift.

Mutation-checked both ways: skipping regardless of the flag, and letting a partial run overwrite the report, each fail exactly one test.