Phase 17 Goes Green: Cohort PRS Read API, Drawer Wiring, and Installer Bootstrapper Progress

A dense Saturday on the Parthenon platform — Phase 17 crossed the finish line with a full green test sweep, the cohort Polygenic Risk Score read API landed end-to-end, drawer navigation got properly wired to Phase 15 sections, and the Rust/Tauri installer bootstrapper TODO got a significant planning pass as we map out the path to a true self-contained Community edition.

Phase 17 Closes Out Clean

The headline today is test(17-06): the full Phase 17 test sweep is GREEN. That means 10 Wave-0 files passing, Vitest clean, and lint clean — all in one sweep. Getting a multi-wave phase to this state requires discipline across the entire stack, and it's satisfying to see it land without stragglers. Phase 17 has been an intensive push on the PRS (Polygenic Risk Score) subsystem, and closing it out cleanly positions us well to turn attention to Phase 18 planning.

Cohort PRS Read API — End-to-End

The centerpiece of Phase 17's final push was the cohort PRS read API (feat(17-04)), which delivers two core capabilities:

1. Aggregated histogram endpoint — Given a cohort ID, the API aggregates PRS scores across cohort members and returns a binned histogram payload ready for visualization. This is the backbone of the score distribution view.
2. Picker integration — The histogram feeds directly into a cohort-level PRS picker component, letting analysts select and compare score distributions without leaving the cohort context.

Alongside the feature work, we added five Pest tests (test(17-04)) covering the full surface area of the download path:

• Streaming CSV download (happy path)
• 404 behavior on missing cohort or missing PRS data
• Auth guard enforcement

CSV streaming tests are always a little fiddly to write correctly in Pest because you're asserting against chunked response behavior — glad to have those locked in before merge.

The plan summary (docs(17-04)) is also committed, which documents the cohort PRS read API end-to-end design for future reference. We've been consistent about closing plans with summaries and it pays off every time someone needs to revisit the rationale.

Phase 15 Drawer Wiring

On the UI side, feat(15-07) wired the drawer body to the Phase 15 section structure on the page edit view. This is the kind of glue work that looks small in the commit log but matters enormously for usability — a drawer that opens to a blank body is worse than no drawer at all. The companion commit also reserves the Phase 16 GWAS results route with a stub page, keeping the routing layer ahead of the feature work so navigation doesn't break as we build out.

The drawer wiring plan summary (docs(15-07)) is committed alongside, consistent with our pattern of closing each plan with documentation.

CI Fixes: Keeping the Pipeline Honest

Three CI fixes landed today, each patching a subtle but real issue:

• fix(ci) — vocab-grant migration guard: Migration 000050 was failing in environments where the parthenon_migrator role doesn't exist yet (common in fresh CI runners). The fix adds a conditional guard so the grant is skipped safely rather than erroring out. This is the kind of thing that bites you in staging but not local dev, so worth the explicit protection.

• fix(ci) — banned connection alias in PgsScoreIngester: A stray DB::connection('omop') call was caught by our connection-alias lint rules. Replaced with 'vocab' — the correct alias for vocabulary-layer queries. This matters for multi-tenancy correctness; routing a vocab query through the wrong connection can produce silent wrong-database reads in environments with multiple schemas.

• fix(ci) — FinnGen test suite: The FinnGen ingestion test suite had accumulated three separate issues: a shared PDO instance causing cross-test state bleed, missing guards on optional fields, and a set of stale assertions that were passing for the wrong reasons. All three are resolved.

Rust Installer Bootstrapper: Planning Pass

Outside of the main commit stream, today included a significant planning pass on the Rust/Tauri installer v2 bootstrapper. The core product shift here is treating the installer as a true self-contained bootstrapper for Parthenon Community — meaning a user should be able to go from zero to a running OMOP environment without cloning the repository first.

Several items crossed off today on the planning checklist:

• The versioned installer bundle manifest (with checksums, phases, and DBMS support tiers) is defined
• The bundle build is validated in CI from that manifest
• Checksum verification happens before any phase executes — no running unverified payloads

The remaining open items are the meaty ones: connecting to existing database servers via a HADES/DatabaseConnector helper container, validating existing OMOP CDM schemas, creating missing DDL, loading Athena vocabulary ZIPs, and provisioning a full local PostgreSQL stack for users who don't have a target database server at all. The vocabulary acquisition flow deserves particular care — we want to guide users through restricted vocabulary acquisition honestly rather than pretending protected content can be silently downloaded.

What's Next

• Phase 18 kickoff — with Phase 17 green and documented, sprint planning for the next phase begins Monday
• Installer bootstrapper implementation — the planning checklist is clear; next step is the HADES/DatabaseConnector integration for the existing-database-server path
• GWAS results page — the stub route is reserved; feature work for Phase 16 GWAS results can begin filling it in
• FinnGen ingestion hardening — the test fixes exposed some fragility in the PDO sharing pattern; worth a broader audit of the ingestion test suite for similar issues

Good velocity today across a mix of feature, test, and infrastructure work. The green sweep on Phase 17 is the right note to end the week on.