Daily devotional quality gate: verse pre-filter + AI judge with regenerate

.github/workflows/ci.yml

@@ -38,6 +38,9 @@ jobs:
       - name: Run edge function tests
         run: deno test --allow-all supabase/functions/
 
+      - name: Check devotional request handler
+        run: deno check supabase/functions/daily-devotional/index.ts
+
   parser-tests:
     name: Parser unit tests (Python)
     runs-on: ubuntu-latest

.github/workflows/deploy-supabase-functions.yml

@@ -5,52 +5,65 @@
     branches: [master]
     paths:
       - "supabase/functions/**"
+      - "supabase/migrations/**"
       - ".github/workflows/deploy-supabase-functions.yml"
+      - ".github/workflows/deploy-supabase-migrations.yml"
   workflow_dispatch:
 
+concurrency:
+  group: supabase-production
+  cancel-in-progress: false
+
 jobs:
+  migrations:
+    uses: ./.github/workflows/deploy-supabase-migrations.yml
+    with:
+      serialized_by_caller: true
+    secrets: inherit
+
   deploy:
+    needs: migrations
     runs-on: ubuntu-latest
 
     env:
       SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
       PROJECT_ID: ${{ secrets.SUPABASE_PROJECT_ID }}
 
     steps:
       - uses: actions/checkout@v5
 
       - uses: supabase/setup-cli@v2
         with:
           version: latest
 
       # Deploy create-donation-session WITHOUT JWT verification (anonymous donations only)
       - name: Deploy create-donation-session function
         run: supabase functions deploy create-donation-session --project-ref "$PROJECT_ID" --no-verify-jwt
 
       # Deploy donation-status WITHOUT JWT verification (anonymous donations only)
       - name: Deploy donation-status function
         run: supabase functions deploy donation-status --project-ref "$PROJECT_ID" --no-verify-jwt
 
       # Deploy donation-history WITHOUT JWT verification (anonymous donations only)
       - name: Deploy donation-history function
         run: supabase functions deploy donation-history --project-ref "$PROJECT_ID" --no-verify-jwt
 
       # Deploy stripe-donation-webhook WITHOUT JWT verification (called by Stripe webhooks)
       - name: Deploy stripe-donation-webhook function
         run: supabase functions deploy stripe-donation-webhook --project-ref "$PROJECT_ID" --no-verify-jwt
 
       # Deploy record-storekit-donation WITH JWT verification (called from authenticated app)
       - name: Deploy record-storekit-donation function
         run: supabase functions deploy record-storekit-donation --project-ref "$PROJECT_ID"
 
       # Deploy user-self-deletion WITH JWT verification (called from authenticated frontend)
       - name: Deploy user-self-deletion function
         run: supabase functions deploy user-self-deletion --project-ref "$PROJECT_ID"
 
       # Deploy daily-devotional WITH JWT verification (called by cron job with service role)
       - name: Deploy daily-devotional function
         run: supabase functions deploy daily-devotional --project-ref "$PROJECT_ID"
 
       # Deploy get-daily-devotional WITHOUT JWT verification (called by mobile clients)
       - name: Deploy get-daily-devotional function
         run: supabase functions deploy get-daily-devotional --project-ref "$PROJECT_ID" --no-verify-jwt

.github/workflows/deploy-supabase-migrations.yml

@@ -1,13 +1,19 @@
 name: Deploy Supabase Database Migrations
 
 on:
-  push:
-    branches: [master]
-    paths:
-      - "supabase/migrations/**"
-      - ".github/workflows/deploy-supabase-migrations.yml"
+  workflow_call:
+    inputs:
+      serialized_by_caller:
+        type: boolean
+        default: false
   workflow_dispatch:
 
+# Reusable calls already run inside the parent's production lock. Manual
+# migration runs acquire that same lock; re-acquiring it in a child deadlocks.
+concurrency:
+  group: ${{ inputs.serialized_by_caller && format('supabase-migrations-{0}', github.run_id) || 'supabase-production' }}
+  cancel-in-progress: false
+
 jobs:
   deploy-migrations:
     runs-on: ubuntu-latest

Makefile

@@ -3,7 +3,7 @@
 	functions functions-background \
 	ngrok-up ngrok-down ngrok-background \
 	functions-deploy test_daily_devotional test_slowness fresh \
-	test test-ios test-android test-parsers \
+	test test-ios test-android test-parsers test-edge eval-devotional-judge \
 	archive upload release \
 	pull-listings dry-listings push-listings push-listing create-version \
 	pull-screenshots dry-screenshots push-screenshots \
@@ -31,6 +31,8 @@ help:
 	@echo "  make test-ios       – iOS unit tests (swiftbibleTests, simulator)"
 	@echo "  make test-android   – Android unit tests (gradle)"
 	@echo "  make test-parsers   – Python parser unit tests (stdlib unittest)"
+	@echo "  make test-edge      – Edge function tests (Deno)"
+	@echo "  make eval-devotional-judge – Live devotional-judge evals (needs OPENAI_API_KEY)"
 	@echo ""
 	@echo "Deploy:"
 	@echo "  make functions-deploy – Deploy all functions to remote project"
@@ -154,6 +156,15 @@ test-android:
 test-parsers:
 	python3 -m unittest discover -s python_parser
 
+test-edge:
+	deno test --allow-all supabase/functions/
+
+# Live evals for the daily-devotional quality judge. Calls OpenAI (costs a few
+# cents); needs OPENAI_API_KEY. TRIALS=3 runs each labelled case 3 times.
+eval-devotional-judge:
+	RUN_JUDGE_EVALS=1 JUDGE_EVAL_TRIALS=$${TRIALS:-1} \
+	deno test --allow-all supabase/functions/daily-devotional/judge_eval_test.ts
+
 test: test-ios test-android test-parsers
 	@echo "✅ All unit tests passed"
 

supabase/functions/_shared/devotional-examples.ts

@@ -0,0 +1,66 @@
+// The writer and live evaluation use the exact same worked example.
+// Keep imagined details out of biblical scenes; put the observable opening
+// in the reader's world, then distinguish the verse from its context.
+export const EMPATHY_EXAMPLE = `# May 15 — Mark 1:35: Before the next request
+
+**Where does prayer fit when the work is still waiting?**
+
+> *"And in the morning, rising up a great while before day, he went out, and departed into a solitary place, and there prayed."*
+> **Mark 1:35**
+
+## Before opening the messages
+
+A phone lies beside a half-filled mug. Even with the screen dark, it can hold your attention. If you have ever reached for it before you knew what you wanted to read, you know how quickly a morning can fill with other people's requests.
+
+Leaving it there for a few minutes may feel surprisingly difficult. Someone could need you.
+
+## The work was real
+
+Mark places this prayer after an evening of healing. The previous verses describe people bringing the sick to Jesus and the city gathered at the door. Then, a great while before day, Jesus goes out to a solitary place and prays.
+
+The passage gives us his action without reporting his prayer's words or his private reasons for choosing that hour. The Greek word translated "solitary" is also used for wilderness or an uninhabited place. Here, Mark names somewhere away from the gathering crowd.
+
+The requests have not ended. In the following verses, Simon and the others find Jesus and tell him that everyone is looking for him. Prayer takes place within a ministry full of actual needs. Mark does not describe a quiet season with nothing pressing to do.
+
+## While things remain unfinished
+
+If you are waiting for every obligation to be settled before you pray, this scene gives you something to reconsider. Jesus has people seeking him, and he prays. We need not know everything about his morning to notice that.
+
+You may have a few minutes before opening your messages, or a pause later in the day. Bring the unfinished work to the Father in that time. It may still be waiting when you finish praying, and someone may still be asking for you.
+
+## A prayer
+
+*Father, help me bring You the work I have not finished and the people whose needs I cannot settle. Give me the willingness to pray while things remain unresolved, and the patience to return to those people with care. Amen.*`;
+
+export const NARRATIVE_EXAMPLE = `# October 12 — Luke 19:5: A name above the crowd
+
+**The crowd calls him a sinner; Jesus calls him Zacchaeus.**
+
+> *"And when Jesus came to the place, he looked up, and saw him, and said unto him, Zacchaeus, make haste, and come down; for to day I must abide at thy house."*
+> **Luke 19:5**
+
+## Up in the sycamore
+
+Zacchaeus is up in a tree. The preceding verses tell us how he got there: a short man, unable to see Jesus through the crowd, runs ahead and climbs a sycamore along the route. He wants to see who Jesus is.
+
+Below him, Jesus comes to the place and looks up. He sees the man in the branches and speaks his name. Then comes the command to hurry down, with a reason attached: today Jesus must stay at his house.
+
+The man who ran ahead to get a look has been asked to receive a guest.
+
+## The name and the complaint
+
+In the next verse, Zacchaeus makes haste, comes down and receives him joyfully. His movement answers the words Jesus spoke from below. The tree has served its purpose; the visit is now the concern.
+
+Around that welcome, another response takes shape. Luke records the onlookers murmuring that Jesus has gone to be the guest of a sinner. Jesus has addressed Zacchaeus by name. The complaint identifies him by the category that makes the visit objectionable.
+
+The account does not deny that sin matters. A little later, Zacchaeus speaks about giving to the poor and repaying anyone he has defrauded. But the crowd's objection is to Jesus going into his house at all. Luke lets us hear that objection beside the welcome.
+
+## Whose response resembles yours?
+
+If there is someone you find easy to dismiss, that contrast deserves time. Knowing something true about a person's conduct can become a reason to resent anyone showing them kindness. In this scene, Jesus goes to the house the crowd thinks he should avoid.
+
+Consider one ordinary act of welcome you have been withholding. Offering it will not settle every question about the person. The murmuring Luke records reminds us how readily a welcome can draw objections, including our own.
+
+## A prayer
+
+*Father, keep us from resenting the mercy Your Son shows. Help us see the people we have reduced to a reputation, and teach us to offer welcome without pretending that sin is harmless. Give us patience for the questions we cannot settle at the door. Amen.*`;