feat(workspace): name tonight's first dynamics plan on the map by seonghobae · Pull Request #1011 · ContextualWisdomLab/bandscope

seonghobae · 2026-08-23T21:17:04Z

Buyer next action

The mounted rehearsal workspace names tonight's first dynamics plan so a part can lock the owned dynamics before rehearsal starts.

Demo: Bass Guitar still has Keep the verse under the vocal so the chorus still has somewhere to lift. Open is the next action: it moves to the matching rendered song-structure section.

Protected base: develop@749511c3ad4000090048718f685c6bee6b3d2c25.
Exact current head: c7fa06aed32757aac5c94503582f39b07f9a36e5 on feat/workspace-first-dynamics-plan.

What the player sees

The callout names the owning part when an active graph node corroborates it, the owned dynamicsPlan copy, the labeled section, and the time.
Open scrolls the renderer-owned song-structure section and arms the next action: lock that dynamics before the room starts.
If no part owns rehearsal-facing dynamics copy, the card stays guidance-only. Stay on tonight's map.

Authority boundary and current-head repair

Do not invent copy from groove, cue, simplification, overlap, range, chord labels, function labels, setup notes, transposition plans, confirmed overrides, harmonicExplanation, or confidence notes.
Owned optional RehearsalRole.dynamicsPlan is distinct from setupNote, transpositionPlan, and tuningPlan.
Runtime dynamics-plan authority is the snapshotted own data-property descriptor value. A Proxy get trap cannot substitute a different buyer-visible dynamics plan after the own-data check.
Regression commit 07fa70fcdbe2df6aba9c8b198a099a7f1ecfe20f locks that Proxy get-trap case; production repair c7fa06aed32757aac5c94503582f39b07f9a36e5 consumes the descriptor value directly.
Inherited/accessor-backed runtime metadata remains guidance-only instead of becoming navigation authority.
Analysis section.id is never DOM-ID authority. Open uses renderer-owned data-section-index.
Distinct from first-entrance Tempo/Key/Transpose cockpit metrics (feat(workspace): name tonight's tempo, starting chord, and transpose setup #987), first-setup-note (feat(workspace): name tonight's first setup note on the map #1004), first-transposition-plan (feat(workspace): name tonight's first transposition plan on the map #1006), first-part-handoff (feat(workspace): name tonight's first part handoff on the map #1007), first-capo-plan (feat(workspace): name tonight's first capo plan on the map #1008), and first-tuning-plan (feat(workspace): name tonight's first tuning plan on the map #1010).
Do not mix with 🔒 [보안] CLI 무제한 파일 읽기 취약점 수정 #811, test(analysis): govern real YouTube known-stem benchmark #828, or feat(workspace): Storybook tokens for rehearsal components #897.

Security Notes

Project-file metadata is untrusted. The shared schema, buyer-visible resolver, and Rust loader now apply one explicit Unicode-safe blank and single-line dynamics-plan policy; malformed values fail closed without echoing rejected content. Tests cover TypeScript, UI, and Rust boundaries.

Exact-head verification state

Fresh repository workflows for c7fa06aed32757aac5c94503582f39b07f9a36e5 are queued/pending at the latest refetch. No non-terminal result and no predecessor-head evidence is counted as success.

Dependency / merge gate

fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 remains the canonical protected JavaScript dependency-security owner. Inherited pdfjs-dist / nanoid / undici HIGH findings are not copied or suppressed here. No lockfile change.
Keep unmerged until the unchanged current head has every applicable repository/central CI, cross-platform build, exact owned statement+branch coverage, docstring, SAST/security/SBOM/supply-chain/package/release gate terminal-success; zero valid unresolved findings; a qualifying independent non-author last-push approval; and ordinary branch-protection acceptance.
Queued, pending, skipped-required, cancelled, failed, predecessor-head, protected-base, model-only, self/author, or administrative-bypass evidence is not success.
Never bypass protection or transfer predecessor evidence. Do not self-approve.

The mounted rehearsal workspace names tonight's first dynamics plan so a part can lock the owned dynamics before rehearsal starts. Open moves to the matching rendered song-structure section. Do not invent that copy from groove, cue, simplification, overlap, range, chord labels, function labels, setup notes, transposition plans, confirmed overrides, harmonic explanations, or confidence notes. Distinct from first-setup-note, first-transposition-plan, and first-tuning-plan. Security Notes: - Attack surface: untrusted rehearsal-song runtime metadata (sections, roles, partGraph, identity accessors) plus DOM navigation against the mounted song-structure renderer. - Trust boundary: only own data properties on dense collections are read. Inherited/accessor/sparse/hostile getters fail closed to null and keep the callout guidance-only. - Navigation authority is the renderer-owned section index, not analysis ids. - Logging/privacy: no path, filename, or rejected-metadata echo. - Test points: inherited-metadata suite, particle-safe Korean copy, reduced-motion scroll, workspace-scope renderer selection, Workspace navigation. Shared-types 20/20 at 100%. Desktop targeted 68/68.

coderabbitai · 2026-08-23T21:17:15Z

Warning

Review limit reached

Next included review available in 33 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9c81c7af-c910-46a5-aff3-d8a735a190fb

📥 Commits

Reviewing files that changed from the base of the PR and between 749511c and c7fa06a.

📒 Files selected for processing (31)

.Jules/palette.md
.jules/palette.md
AGENTS.md
ARCHITECTURE.md
CHANGELOG.md
CLAUDE.md
apps/desktop/core/src/lib.rs
apps/desktop/src/features/workspace/FirstDynamicsPlanCallout.identity.test.tsx
apps/desktop/src/features/workspace/FirstDynamicsPlanCallout.memoization.test.tsx
apps/desktop/src/features/workspace/FirstDynamicsPlanCallout.particle.test.tsx
apps/desktop/src/features/workspace/FirstDynamicsPlanCallout.reduced-motion.test.tsx
apps/desktop/src/features/workspace/FirstDynamicsPlanCallout.test.tsx
apps/desktop/src/features/workspace/FirstDynamicsPlanCallout.tsx
apps/desktop/src/features/workspace/FirstDynamicsPlanCallout.workspace-scope.test.tsx
apps/desktop/src/features/workspace/Workspace.test.tsx
apps/desktop/src/features/workspace/Workspace.tsx
apps/desktop/src/features/workspace/dynamicsCoverageContract.test.ts
apps/desktop/src/features/workspace/firstDynamicsPlan.inherited-metadata.test.ts
apps/desktop/src/features/workspace/firstDynamicsPlan.proxy-authority.test.ts
apps/desktop/src/features/workspace/firstDynamicsPlan.section-label.test.ts
apps/desktop/src/features/workspace/firstDynamicsPlan.test.ts
apps/desktop/src/features/workspace/firstDynamicsPlan.ts
apps/desktop/src/i18n/index.test.ts
apps/desktop/src/i18n/index.ts
apps/desktop/src/locales/en/common.json
apps/desktop/src/locales/ko/common.json
apps/desktop/vite.config.ts
docs/design-system/component-contract.md
docs/doctoring/reduced-motion-first-dynamics-plan-navigation.md
packages/shared-types/src/index.ts
packages/shared-types/test/index.test.ts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

# Conflicts: # AGENTS.md # CHANGELOG.md # CLAUDE.md # apps/desktop/src/features/workspace/Workspace.tsx # apps/desktop/src/locales/en/common.json # apps/desktop/src/locales/ko/common.json

seonghobae · 2026-08-26T11:00:25Z

Resolved merge conflicts against origin/develop (749511c): union-merged AGENTS.md/CHANGELOG.md bullets, sentence-merged CLAUDE.md, kept both import sets in Workspace.tsx (FirstDynamicsPlanCallout + firstRangeSqueeze), unioned en/ko locale tails (JSON valid, en/ko symmetric). Merged legacy .Jules/palette.md into canonical .jules/palette.md, dropped alias. No conflict markers remain. Merge head: bb06076.

seonghobae · 2026-08-29T02:33:09Z

@devin-ai review this PR at current HEAD c7fa06a. Shared-types, the buyer-visible first-dynamics resolver, and Rust project loading now use the same explicit Unicode plan policy; tests cover NEL/LS/PS rejection and BOM-padded text.

devin-ai-integration

Devin Review found 1 new potential issue.

devin-ai-integration · 2026-08-29T02:33:50Z

+/** Return whether a code point is in the cross-language plan whitespace set. */
+function isPlanWhitespaceCodePoint(codePoint: number): boolean {
+  return (
+    (codePoint >= 0x0009 && codePoint <= 0x000d) ||
+    codePoint === 0x0020 ||
+    codePoint === 0x0085 ||
+    codePoint === 0x00a0 ||
+    codePoint === 0x1680 ||
+    (codePoint >= 0x2000 && codePoint <= 0x200a) ||
+    codePoint === 0x2028 ||
+    codePoint === 0x2029 ||
+    codePoint === 0x202f ||
+    codePoint === 0x205f ||
+    codePoint === 0x3000 ||
+    codePoint === 0xfeff
+  );
+}
+
+/** Apply one explicit cross-language Unicode whitespace policy to plan text. */
+export function isNonEmptySingleLineText(value: unknown): value is string {
+  if (typeof value !== "string") {
+    return false;
+  }
+  let hasNonWhitespace = false;
+  for (const character of value) {
+    const codePoint = character.codePointAt(0)!;
+    if (
+      codePoint === 0x000a ||
+      codePoint === 0x000d ||
+      codePoint === 0x0085 ||
+      codePoint === 0x2028 ||
+      codePoint === 0x2029
+    ) {
+      return false;
+    }
+    if (!isPlanWhitespaceCodePoint(codePoint)) {
+      hasNonWhitespace = true;
+    }
+  }
+  return hasNonWhitespace;


📝 Info: Cross-language validation stays aligned

Rust and TypeScript use identical whitespace and line-separator sets. BOM-padded text remains valid, while blank or line-separated plans fail at both boundaries.

Was this helpful? React with 👍 or 👎 to provide feedback.

This comment was marked as resolved.

Sign in to view

seonghobae added 4 commits August 23, 2026 14:25

test(workspace): require unique dynamics-plan callout ids

5dbaf8f

fix(workspace): give dynamics callouts unique DOM ids

389d929

test(workspace): require dynamics-plan resolver memoization

b1b17ee

perf(workspace): memoize first dynamics-plan resolution

eb419f7

This comment was marked as resolved.

Sign in to view

seonghobae added 10 commits August 23, 2026 14:38

test(workspace): reject non-contract dynamics labels

0c17ce8

fix(workspace): reject non-contract dynamics labels

1d077d0

test(workspace): lock dynamics-plan own-data authority

07fa70f

fix(workspace): snapshot owned dynamics-plan data

10a651c

test(workspace): require dynamics plan coverage ownership

4118da7

fix(coverage): include dynamics production paths

a1dfef9

test(workspace): pin dynamics-plan runtime authority

5702d2c

fix(workspace): snapshot dynamics-plan runtime authority

0289471

fix(workspace): consume dynamics-plan authority snapshots

44a47f5

docs(changelog): record dynamics-plan authority snapshots

2df325e

This comment was marked as resolved.

Sign in to view

seonghobae added 3 commits August 24, 2026 16:01

fix(changelog): restore 0.1.0 issue history

f295265

Merge branch 'develop' into feat/workspace-first-dynamics-plan

6b78ac8

Merge remote-tracking branch 'origin/develop' into HEAD

bb06076

# Conflicts: # AGENTS.md # CHANGELOG.md # CLAUDE.md # apps/desktop/src/features/workspace/Workspace.tsx # apps/desktop/src/locales/en/common.json # apps/desktop/src/locales/ko/common.json

This comment was marked as resolved.

Sign in to view

fix(workspace): keep dynamics plan contract and navigation stable

ecfed4f

This comment was marked as resolved.

Sign in to view

fix(contract): align Unicode dynamics validation

c7fa06a

devin-ai-integration Bot reviewed Aug 29, 2026

View reviewed changes

Navigation Menu

Uh oh!

feat(workspace): name tonight's first dynamics plan on the map - #1011

feat(workspace): name tonight's first dynamics plan on the map#1011
seonghobae wants to merge 20 commits into
developfrom
feat/workspace-first-dynamics-plan

seonghobae commented Aug 23, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 23, 2026 •

edited

Loading

Review limit reached

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

seonghobae commented Aug 26, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

seonghobae commented Aug 29, 2026

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

devin-ai-integration Bot Aug 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

seonghobae commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Buyer next action

What the player sees

Authority boundary and current-head repair

Security Notes

Exact-head verification state

Dependency / merge gate

Uh oh!

coderabbitai Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

seonghobae commented Aug 26, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

seonghobae commented Aug 29, 2026

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Aug 29, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

seonghobae commented Aug 23, 2026 •

edited

Loading

coderabbitai Bot commented Aug 23, 2026 •

edited

Loading