fix(ci): execute Server Tests on exact PR heads

[seonghobae]

Buyer/control outcome

Refs #522.

ScopeWeave's repository-owned CI evidence is being made defensible at the revision boundary: deterministic pull-request execution binds repository-owned Server Tests to the immutable contributor head, base-sensitive comparisons independently resolve the live protected base, owned browser/server coverage fails closed at exact 100%, and dependency/security controls are tightened against stale or incomplete evidence.

Exact current identity

• protected live base: develop@2c328875e00e86537df3e965170be80532571cad;
• exact contributor head: 135117e0594939240e787a161574b6fb4e10f155;
• exact head tree: 16f86b70539a410c20940a5e237af9b69c35479d;
• current GitHub synthetic merge commit: 7f133dc301c9a2f86bd3a0f0c273ef676bf18e6a;
• branch: fix/server-tests-exact-head-522;
• ready and mechanically mergeable at the latest fresh refetch; and
• no qualifying independent current-head approval exists.

Any contributor-head or protected-base movement invalidates head/base-sensitive evidence until exact revisions, actual checkout attestations, reviews, checks, and live-base identity are freshly revalidated. This body is traceability, not merge authority.

Current exact-head evidence

Fresh evidence on 135117e0594939240e787a161574b6fb4e10f155 includes repository-owned Server Tests, Fuzz, Dependency Review, CodeQL Required and OSV runs plus centrally owned security/review workflows. The current central SAST run 33148083441, job 98791495212, explicitly checked out the submitted contributor revision and passed a runtime exact-SHA verification before Semgrep; this is the working exact-head control pattern.

Two required central lanes remain non-authoritative/non-passing on this unchanged head:

• Required OpenCode Review run 33148082474, job 98775450437, failed closed because no current-head OpenCode verdict existed. A fresh @opencode-agent review request has been issued for this exact SHA; predecessor verdicts remain historical.
• Required Strix workflow run 33148082533 was cancelled before any job/report materialized. A cancelled zero-job run supplies no exact-head scan receipt.

The organization-owned Security Scan workflow still has head-oriented dependency-review/Trivy/Scorecard jobs whose central reusable workflow uses default checkout rather than explicit contributor-repository/ref checkout plus runtime SHA attestation. That owner defect is actively tracked in ContextualWisdomLab/.github#1222; the Strix no-report recovery/evidence defect is actively tracked in ContextualWisdomLab/.github#891. ScopeWeave does not create a competing writer in the central repository.

GitHub Advanced Security also emits a neutral osv-scanner comparison check because protected develop currently has the reusable-workflow configuration .github/workflows/osvscanner.yml:osv-scan, while this PR intentionally changes repository OSV to a read-only, artifact-preserving exact-head differential job named scan and keeps GitHub code-scanning publication CodeQL-only. The neutral comparison is not treated as passing evidence; repository OSV scan evidence is evaluated separately from the GHAS comparison surface.

Review-driven repairs

Earlier realistic RED findings on this PR have been repaired test-first, including false file-picker authority, OSV/CodeQL contract contradiction, live-base resolver singular-result validation, deterministic browser/API coverage cases, dependency/coverage workflow evidence gaps, and exact-head browser invariant coverage. The current review-thread sweep returns no unresolved threads. Historical OpenCode REQUEST_CHANGES evidence is anchored to predecessor head 3ce9a8bbc483036bddc2fa1681f84e25f8493772, is dismissed/stale, and is not converted into a current verdict or approval. Current CodeRabbit, Devin, GitHub code-quality, and other model/informational submissions do not constitute the required independent approval.

Merge boundary

Do not merge or enable auto-merge until the unchanged exact contributor head remains freshly reconciled to protected develop, central required-workflow evidence is regenerated under corrected exact-head/evidence contracts, every applicable repository and organization CI/browser/coverage/docstring/CodeQL/SAST/security/dependency/supply-chain/package/provenance/required-workflow gate is substantively terminal-passing, valid unresolved findings are zero, and live review rules are satisfied. Active repository ruleset 17214767 requires one approving review, dismisses stale reviews on push, requires resolved review threads, and requires approval from someone other than the latest pusher; organization ruleset 18156473 also requires one approval and resolved threads.

Pending, queued, skipped-required, cancelled, absent, neutral-required, failed, stale, predecessor, synthetic-only, status-only, author-only, model-only, rate-limited, or infrastructure-only evidence is non-passing. Do not self-approve, manufacture approval, dismiss a valid current review, weaken protection, or transfer predecessor evidence.

docs/doctoring/server-tests-exact-head.md remains the detailed evidence-integrity record; CHANGELOG.md records active Unreleased work rather than protected-shipped truth.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c5e7ee71-af15-4999-8845-b30ffe06056a

📥 Commits

Reviewing files that changed from the base of the PR and between 2842fde and 41643dc.

📒 Files selected for processing (7)

• .github/workflows/server-tests.yml
• package.json
• tests/api/attachment-metadata.test.mjs
• tests/e2e/browser-residual-behavior.spec.js
• tests/unit/playwright-install-timeout-contract.test.mjs
• tests/unit/static-stylesheet-serving.test.mjs
• tests/unit/workflow-exact-head-contract.test.mjs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Server Tests, CodeQL Required, OSV 스캔이 exact-head 검증을 사용합니다. 서버·브라우저 커버리지와 API 경계 테스트가 확장되었습니다. E2E 테스트와 모달·토스트 UI 검증도 추가되었습니다.

Changes

CI 무결성 및 커버리지

Layer / File(s)	Summary
커밋 식별자 검증과 차등 보안 스캔 .github/workflows/*, CHANGELOG.md, docs/doctoring/server-tests-exact-head.md	워크플로가 예상 SHA를 checkout하고 실제 HEAD를 검증합니다. OSV가 보호된 base와 contributor head를 별도 스캔하고 SARIF를 업로드합니다.
서버·브라우저 커버리지 수집 scripts/ci/*, tests/e2e/coverage-test.js, tests/unit/coverage-script-contract.test.mjs	서버와 브라우저 커버리지를 분리합니다. 소스 SHA와 raw evidence를 검증하고 100% 기준과 실패 진단을 적용합니다.

애플리케이션 계약

Layer / File(s)	Summary
API 경계와 저장 동작 검증 server/app.mjs, tests/api/*, tests/unit/auth-password.test.mjs, tests/unit/clearfolio-status-signal.test.mjs	인증, 권한, 테넌트 격리, provider 오류, webhook, 첨부파일, 감사 로그, rollback과 세션 폐기 경로를 검증합니다. 저장 입력의 fallback 동작도 변경합니다.

브라우저와 UI

Layer / File(s)	Summary
E2E 흐름과 UI 동작 tests/e2e/*, index.html, styles.css, toast-state.css, tests/unit/*stylesheet*	Cloud, 작업 이동, 모달 포커스, 저장 실패 토스트, CSS 자산 제공을 검증합니다. 불필요한 preload와 script 로드를 제거합니다.

Estimated code review effort: 4 (Complex) | ~60 minutes

Merge Risk: 🟡 Moderate · up to 41643

This PR improves exact-head CI execution and bounds browser-install time, but the supplied evidence still identifies unresolved validation risks, including a failing API timing test, potentially incomplete coverage enforcement, and flaky or overly permissive automated checks. Fix or explicitly accept these bounded risks before merging.

Sequence Diagram(s)

sequenceDiagram
  participant PullRequest
  participant ServerTests
  participant CodeQLRequired
  participant OSVScanner
  participant GitCheckout
  participant CoverageCollector

  PullRequest->>ServerTests: contributor head SHA 전달
  ServerTests->>GitCheckout: exact-head checkout
  GitCheckout-->>ServerTests: actual HEAD 반환
  ServerTests->>CoverageCollector: 서버·브라우저 테스트 실행
  CoverageCollector-->>ServerTests: Istanbul 보고서와 진단 결과 반환
  PullRequest->>CodeQLRequired: head SHA 전달
  CodeQLRequired->>GitCheckout: exact-head checkout 및 SHA 검증
  PullRequest->>OSVScanner: protected base와 contributor head 전달
  OSVScanner->>GitCheckout: base·head 순차 checkout
  OSVScanner-->>PullRequest: 비교 SARIF 업로드

Loading

Possibly related issues

• fix(ci): run exact-head gates on stacked pull requests inkspan#298 — CI exact-head 검증과 Playwright 설치 제한 시간을 함께 다룹니다.
• [CI Integrity] Run repository gates on exact PR contributor heads #522 — Server Tests의 exact contributor-head checkout과 SHA 검증을 다룹니다.

Possibly related PRs

• ContextualWisdomLab/scopeweave#497 — CI 무결성 제어와 계약 문서·테스트를 함께 변경합니다.

Suggested reviewers: opencode-agent

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	PR 제목은 Server Tests를 정확한 PR contributor head에서 실행하는 핵심 변경을 명확하고 간결하게 설명합니다.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/server-tests-exact-head-522

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@opencode-agent review

Please submit a review-only formal verdict for exact current head 58b542103a3c6009d693d32410340c1262ee87a3 against protected develop@44e7903cf8891c65410f7fc6ca5144de3fdb5185. Re-evaluate only the exact-head workflow-integrity slice for Server Tests, CodeQL Required, and OSV contributor/base evidence; do not transfer predecessor reviews, mutate the branch, update the base, merge, or infer approval from the opencode-review status check. Current Strix is being authoritatively re-run because its predecessor execution reported backend unavailability, so a formal source review is independent of that security-evidence retry.

[seonghobae]

@opencode-agent review

Review only the exact current contributor head 135117e0594939240e787a161574b6fb4e10f155 against protected develop@2c328875e00e86537df3e965170be80532571cad. Treat every predecessor verdict, status, check and review as historical. The current Required OpenCode Review run 33148082474 failed closed specifically because no current-head OpenCode verdict was available; bootstrap/coverage-source-tree/coverage-evidence completed, while opencode-review failed at Fail closed without a current-head OpenCode verdict. Re-evaluate current source and same-head evidence and submit a formal review-only verdict bound to this exact SHA. Do not mutate the branch, rebase, force-push, merge, weaken gates, or infer approval from status-only/model-only evidence.

[seonghobae]

@opencode-agent review

Please submit a review-only formal verdict for exact current contributor head 135117e0594939240e787a161574b6fb4e10f155 against current protected develop@2c328875e00e86537df3e965170be80532571cad. Re-evaluate current source and same-head evidence only; predecessor reviews, model/status-only evidence, synthetic-merge evidence, and cancelled/absent lanes are historical or non-passing. Focus on exact-head checkout/attestation, full server/browser coverage provenance, and unintended semantic regression. Do not mutate the branch, rebase, force-push, merge, or infer approval from status-only evidence.

[seonghobae]

@opencode-agent review

Current-head re-dispatch request for 135117e0594939240e787a161574b6fb4e10f155 only. Fresh required-workflow evidence shows coverage-evidence and coverage-source-tree succeeded on this exact head, while required opencode-review failed solely because no APPROVED or CHANGES_REQUESTED review from opencode-agent exists for this SHA. Please review the exact current contributor head; do not transfer predecessor-head verdicts. Repository-owned Server Tests, Fuzz, Dependency Review, CodeQL Required, OSV Scanner, Security Scan, and SAST Semgrep are terminal-success on this unchanged head. Treat any current finding as actionable and anchor the verdict to this exact SHA.

[seonghobae]

@opencode-agent review

Exact-head review-only request for ContextualWisdomLab/scopeweave#523 at 135117e0594939240e787a161574b6fb4e10f155 against protected develop@2c328875e00e86537df3e965170be80532571cad.

Please submit a formal current-head APPROVED or CHANGES_REQUESTED review through the existing review path. Do not reuse predecessor-head evidence or synthesize a status-only verdict. The required OpenCode workflow currently fails closed because no such exact-head review exists.

[seonghobae]

@opencode-agent review

Review only the exact current contributor head e28b5caba7a6f16071ead232b33d0c5d64d78b7a against protected develop@2c328875e00e86537df3e965170be80532571cad. Treat every predecessor verdict, status, check, review, and PR-body SHA as historical. The current required opencode-review job 99087424481 failed closed solely because no APPROVED or CHANGES_REQUESTED Reviews API verdict from opencode-agent exists for this exact head. The current-head OSV repair removes repository-local code-scanning publication and security-events: write, retains exact-head/base differential scanning and bounded SARIF artifact evidence, and restores the CodeQL-only ownership contract. Re-evaluate current source and same-head evidence and submit a formal review-only verdict anchored to this SHA. Do not mutate the branch, rebase, force-push, merge, weaken gates, or infer approval from status-only/model-only evidence.