fix(analysis): score C major acceptance from decoded WAV bytes

[cursor]

Summary

Tier 1 real-audio acceptance writes license-clean C-major and 120 BPM click WAVs, verifies and decodes the on-disk bytes, then scores the production ChordRecognizer and TemporalAnalyzer. The branch fails closed on malformed metric, timing, fixture-generation, decoded-PCM, digest, and report-provenance evidence.

Compatibility repair

The locked numba 0.62.1 plus llvmlite 0.45.1 runtime reproducibly crashed inside librosa's Numba beat-tracking gufunc on macOS arm64 / Python 3.12 during the decoded 120 BPM acceptance case. numba 0.63.1 reproduced the same crash in the full and single-case regressions, while numba 0.66.0 plus llvmlite 0.48.0 completed the production path and full engine suite.

The dependency is target-specific: ARM64 selects numba==0.66.0; non-ARM targets retain numba==0.62.1 plus llvmlite==0.45.1 because 0.66.0 has no macOS Intel wheel. The complete lock was regenerated by uv. This is a compatibility repair for an existing dependency, not a new dependency or a security exception.

Current exact-head evidence

• Current HEAD: e11a0e3738e864372abe30a87b94e29c33a41895
• Protected base: develop@749511c3ad4000090048718f685c6bee6b3d2c25
• PR fix(accuracy): bound fixture decode resources #1064 was normally merged into this branch at e11a0e3738e864372abe30a87b94e29c33a41895; no protected develop merge is claimed.
• Local ARM64 locked verification before the child merge: numba 0.66.0, llvmlite 0.48.0; 83 real-audio accuracy tests passed; 21 temporal/pipeline tests passed; full engine suite 762 passed, 24 skipped with 100% statement and branch coverage.
• The child resource-boundary merge was verified at the resulting branch with full engine suite 768 passed, 24 skipped, 100% production statements/branches/functions/lines, plus 43 targeted accuracy tests.
• Local quality verification: mypy, Ruff, uv lock --check, documentation, security-note, supply-chain, and git diff --check passed. The x86_64 macOS dry-run selects numba 0.62.1 plus llvmlite 0.45.1. The aarch64 macOS 13 dry-run remains blocked by the pre-existing torch==2.12.1 macOS 14-only wheel constraint, unrelated to this Numba change.
• Hosted deterministic repository lanes for the predecessor dependency head were terminal-success; the current merge head must have its own checks and no predecessor result is transferred.
• The PR remains Draft on protected develop; current-head Noema/Strix/OpenCode and independent approval evidence must be re-queried after this merge.

Security Notes

The acceptance path remains local-only: generated WAV bytes, decoded PCM, fixture inputs, report provenance, and production analyzer outputs are untrusted evidence. Checksum-before-score, finite/non-Boolean numeric admission, bounded fixtures, exact lockfile consumption, and fail-closed report validation remain in force. No network, shell, IPC, model, export, or credential boundary was added.

Merge gate

Keep Draft and unmerged until this exact HEAD has terminal-success repository and central security/SBOM/supply-chain/package/release/platform gates, realistic audio acceptance, zero valid unresolved findings, and a qualifying independent non-author approval. Do not count queued, pending, skipped-required, cancelled, failed, predecessor-head, protected-base, model-only, self/author, or bypass evidence as success. Normal branch protection remains required.

[seonghobae]

Exact-head maintenance update for fa2abea:

• Reproduced the non-numeric input boundary defect: string sample-rate/timing/tempo values leaked NumPy or math TypeError instead of the documented ValueError contract.
• Added one shared finite-real guard and focused regressions across fixture generation, PCM evaluation, chord recall, and tempo Acc1.
• Local verification: 762 Python tests passed, 24 numeric-parity tests skipped by platform policy, 100% statements/branches/functions/lines; Ruff and mypy passed.

No dependency, workflow, model, network, filesystem, IPC, or reviewer-credential authority changed. Keep Draft; predecessor evidence does not transfer.

[seonghobae]

Current-head review note for fa2abea:\n\nThe acceptance code writes/decodes WAV bytes, but the fixture itself is generated in-process (C-major sines and a click track), so this proves PCM round-trip and metric wiring—not a real musical recording's production accuracy. I ran the current engine against a licensed public-domain piano recording separately: TemporalAnalyzer returned 147.7 BPM over 176.59 seconds, but chord output was 261 low-confidence time segments and the production API returned no tempo. Please keep the claim boundary explicit or add a licensed, annotated recording fixture before calling this a real-audio accuracy gate.

[seonghobae]

@opencode-agent review\n\nReview only current PR head fa2abea against protected develop base 749511c. Validate the decoded-WAV accuracy framework, exact-version/provenance and finite-real input contracts, metric behavior, and documentation claim boundary. Treat the generated in-process C-major fixture as PCM/metric wiring evidence, not real-recording production accuracy; do not reuse predecessor-head or provider-failure evidence.

[seonghobae]

Queued @opencode-agent for PR #892 at head fa2abea4f0063db55490b6f392d28315a975cf59. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

[seonghobae]

Real-file connectivity evidence for exact head fa2abea: a locally materialized, uncommitted M4A was decoded to a temporary mono 22050 Hz WAV and passed through the production TemporalAnalyzer and ChordRecognizer. Output was duration 253.5467 s, 78.3026 BPM, 313 beats, 79 downbeats, tempo stability loose with no detected tempo changes, and 125 chord segments; the first segments were N, D, A, D, Bm, E, A, D, G, D, A, Em. The temporary source path and waveform bytes were not committed or logged. This is real-audio runtime evidence only: the recording has no registered chord ground truth, so it does not satisfy the Tier-1/P0 accuracy acceptance gate.

[seonghobae]

@opencode-agent review

Review only exact current head e11a0e3738e864372abe30a87b94e29c33a41895 against protected develop@749511c3ad4000090048718f685c6bee6b3d2c25; predecessor verdicts do not transfer. Validate the decoded-WAV Tier 1 accuracy boundary and its claim limits, target-specific Numba/llvmlite resolution (ARM64 numba==0.66.0/llvmlite==0.48.0, non-ARM numba==0.62.1/llvmlite==0.45.1), exact-version/provenance and finite-real input contracts, bounded resource admission from merged #1064, metric interval/union behavior, and current docs/CHANGELOG consistency. Hosted repository CI/build/coverage/security/SBOM lanes on this SHA are evidence inputs only; submit an authenticated formal APPROVED or CHANGES_REQUESTED review anchored to this unchanged head, and do not mutate the branch or reuse provider/predecessor evidence.