fix(a11y): lock console busy/unavailable contract and Storybook inventory

[cursor]

Buyer-visible outcome

Operators can tell a scan-detail request is in flight without losing the close control, and they cannot re-activate the same row from pointer or keyboard until the request finishes. Later dashboard or Storybook work reuses --busy-opacity from the inventory instead of inventing a second busy style.

Exact scope

This branch extends #974 (57a281ab) with the residual contract pins from current-head review.

• Base: develop@a68b57d4ccad4f895d7a3d9f909fffbc4653b17e
• Head commits after fix(a11y): align console busy and unavailable states #974: aba5129 (tests) and 8759efb (docs)
• Files added or tightened: tests/test_console_detail_loading_contract.py, tests/test_console_dashboard_security.py, scanner/dashboard/console.html (newline), docs/adr/0007-console-busy-unavailable-tokens.md, docs/storybook-inventory.md, CHANGELOG.d/974-console-busy-unavailable.md, plus ADR/PRD/TRACEABILITY/ARCHITECTURE/TEST_STRATEGY and .jules/palette.md citations.

No scanner rule, detector, API, database, dependency, credential, model, workflow, or merge-policy authority changes.

Interaction contract locked by tests

• unavailable styling stays on button:disabled and tr.scan[aria-disabled="true"] and is the only rule allowed to set pointer-events: none;
• busy styling stays on #connect[aria-busy="true"] and tr.scan[aria-busy="true"] and must not set pointer-events;
• the global :disabled, [aria-busy="true"] selector must not return;
• closeDetail() clears aria-busy and aria-disabled on lastDetailFocus before deleting the request id;
• --busy-opacity remains the shared token.

Storybook and standards

The standalone console stays no-build. docs/storybook-inventory.md is the reusable object list for a later optional Storybook package. ADR-0007 records the WAI-ARIA 1.2 / WCAG 2.2 split in APA 7th.

Do this next

1. Prefer this successor over merging fix(a11y): align console busy and unavailable states #974 at 57a281ab so the close-path and busy-rule pins land together.
2. Wait for terminal required CI/security/coverage/review on this exact head. CodeRabbit rate-limit SUCCESS is not current-head robot evidence.
3. After merge, reuse --busy-opacity for the next dashboard or Storybook surface. Do not add a global [aria-busy="true"] rule.

Merge boundary

Do not integrate until this unchanged exact head has terminal required CI/security/coverage/review evidence and any qualifying independent non-author approval required by the live protected rules is present. Queued, skipped-required, stale, predecessor-head, author-only, model-only, or synthetic evidence is non-passing.

  

[seonghobae]

Current-owner reconciliation required before this successor can integrate. Exact head 8759efb721020c99dd171fe43ce3f6bb398df95e is based on protected develop, but its scanner/dashboard/console.html still carries several states already hardened on active #930: it reads/writes the org key through sessionStorage, accepts a general organization API key instead of enforcing the dedicated viewer role, interpolates data-id="${s.id}" without esc(...), and focuses #detail rather than the rendered close button. Those are not equivalent to #930's memory-only viewer-key contract, attribute escaping, and actionable close-control focus. The busy/unavailable token split and Storybook inventory here are useful and should be preserved, but this branch must be reconciled against the then-current #930/protected tree rather than merged later as a stale replacement. Please keep the --busy-opacity/aria-disabled work while retaining the stricter credential, escaping, stale-response, and focus contracts. Fresh exact-head tests should prove both sets together; predecessor checks do not transfer.

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 8759efb721020c99dd171fe43ce3f6bb398df95e.

• Head SHA: 8759efb721020c99dd171fe43ce3f6bb398df95e

• Workflow run: 32153713227

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (4 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (4 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs (6 files)"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs (6 files)"]
  R2 --> V2["docs review"]
  Evidence --> S3["Test (2 files)"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test (2 files)"]
  R3 --> V3["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 8759efb721020c99dd171fe43ce3f6bb398df95e
• Workflow run: 32162156537
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 8759efb721020c99dd171fe43ce3f6bb398df95e.

• Head SHA: 8759efb721020c99dd171fe43ce3f6bb398df95e

• Workflow run: 32162156537

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (4 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (4 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs (6 files)"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs (6 files)"]
  R2 --> V2["docs review"]
  Evidence --> S3["Test (2 files)"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test (2 files)"]
  R3 --> V3["targeted test run"]

Loading

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 8759efb721020c99dd171fe43ce3f6bb398df95e.

• Head SHA: 8759efb721020c99dd171fe43ce3f6bb398df95e

• Workflow run: 32162156537

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (4 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (4 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs (6 files)"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs (6 files)"]
  R2 --> V2["docs review"]
  Evidence --> S3["Test (2 files)"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test (2 files)"]
  R3 --> V3["targeted test run"]

Loading

[seonghobae]

@opencode-agent Re-review unchanged exact head 8759efb721020c99dd171fe43ce3f6bb398df95e. Repository-owned Tests, Security Process, Security Scan, SAST Semgrep, Scan path context, Pinned HTTPS, OpenSSF Evidence, and Retention Audit are all terminal-success. Both existing REQUEST_CHANGES submissions cite central coverage-infrastructure failure rather than a source finding; regenerate a formal exact-head review under the repaired coverage path.

[seonghobae]

Integrate the unique buyer behavior from overlapping dashboard PR #981 into this active design-system successor before final exact-head review: the deploy-blocking summary card may toggle the existing deploy-blocking filter only if the same source of truth also updates the filter control, aria-pressed, visible active state, result count, and keyboard Enter/Space behavior without inline event attributes. Preserve #930's viewer-only authorization, memory-only credential, escaped identifier, stale-detail, focus-restoration, reduced-motion, external-link, busy/unavailable token, and Storybook/ADR contracts. Add RED then GREEN regressions for pointer/keyboard toggle, second activation clearing the filter, control synchronization, and no duplicate activation. Do not copy #981's branch history or evidence; implement on this successor's current tree and reacquire all exact-head checks.

[seonghobae]

@opencode-agent @cwl-noema-review Please review exact current head 8759efb721020c99dd171fe43ce3f6bb398df95e. The current PR remains unchanged since the prior review and has no failed Checks; validate current coverage/accessibility evidence and report only current-head findings.