feat(workspace): name tonight's first riff plan on the map

[seonghobae]

Product outcome

The mounted rehearsal workspace names tonight's first riff so a part can lock the figure before the room starts. Open moves to the matching rendered map section.

Customer-facing next action: Open Bass Guitar riff at 0:10 (demo). If no corroborated riff exists, stay on tonight's map for the next rehearsal cue.

Exact current identity

• Protected base: develop@acdbea6344fe1231c39535b575f4de35e4c607c9.
• Exact head: 45176f181a2ca78161a9c00a85469b752bffd58e.
• Branch: feat/workspace-first-riff-plan.
• Open, non-Draft, mergeable, unmerged at the latest refetch.

Scope and trust boundary

• Owned riffPlan copy on an active, corroborated part plus labeled section and time.
• Do not invent riff copy from groove, cue, simplification, overlap, range, chord labels, function labels, setup notes, transposition plans, fill plans, tuning plans, dynamics plans, articulation plans, voicing plans, hook plans, capo plans, confirmed overrides, harmonic explanations, or confidence notes.
• Runtime riff-plan text authority is the snapshotted own data-property descriptor value. A Proxy get trap cannot substitute buyer-visible riff copy after the own-data check.
• Runtime section-time authority is also snapshotted from own data-property descriptors: the section's timeRange descriptor and its start/end descriptor values are read once, validated as bounded positive-duration integers, and the validated snapshot supplies atSeconds. A Proxy get trap cannot substitute a different displayed/navigation time after validation.
• Dense own arrays, canonical section labels, ranked rehearsal priority, unique role/graph ids, active graph corroboration, and single-line bounded copy (180 Unicode code points) remain fail-closed requirements.
• Distinct from first-hook-plan, first-fill-plan, first-setup-note, first-transposition-plan, first-tuning-plan, first-dynamics-plan, first-articulation-plan, first-voicing-plan, and first-capo-plan.
• Reduced-motion Open uses behavior: auto.
• Korean next-action copy stays particle-safe (리프).

Current review repair

Fresh current-head review found that predecessor code validated timeRange as an own data property but later read it through normal property access, so a Proxy could report a trusted descriptor while returning different start/end values through get traps.

• d912bceaafa632b2f1f0b48324e0f2f1ed6d6e3c adds a regression requiring a descriptor-backed start=10 to remain authoritative even when a Proxy get("start") returns 20. No hosted RED run completed before the successor push, so that commit is regression-first source evidence, not terminal hosted RED evidence.
• ac85cef05f6d6844caaba2a024ad08f396775a86 snapshots and validates the own descriptor values for timeRange, start, and end and uses the validated snapshot for atSeconds.
• Current head 45176f181a2ca78161a9c00a85469b752bffd58e tightens TypeScript narrowing without changing the runtime contract.
• Fresh review-thread inventory on the unchanged current head now has zero unresolved threads. The predecessor time-range finding is resolved/outdated; current remaining thread content is informational and resolved.

Exact-head verification state

Fresh repository workflow inventory for exact unchanged head 45176f181a2ca78161a9c00a85469b752bffd58e is terminal:

• success: ci, release, sbom, build-baseline, bandit, SAST Semgrep, secret-scan-gate;
• failure: security-audit, Security Scan.

The two failures are inherited protected-base dependency findings, not a leaf-specific runtime regression. security-audit reports the canonical npm HIGH set in nanoid <3.3.18, pdfjs-dist <6.2.108, and undici <7.29.0; Security Scan's failing Trivy filesystem job reports the corresponding protected-base pdfjs-dist vulnerability. Dependency Review, OSV, and Scorecard inside Security Scan succeed.

No predecessor-head success is transferred, and wrapper success does not replace a failed underlying security job.

Design authority boundary

The repository continues to name Figma file zthWmqfNKUgJBECvv002Qk as the BandScope design authority and Storybook remains the executable component-side authority. A fresh live Figma inventory currently exposes only 16:2 — 00 Cover; the repository-documented implementation-contract / component-catalog / screen-blueprint / workspace-state pages are not discoverable. Existing issue #959 owns that Figma↔repository handoff drift.

Therefore this PR's source/runtime behavior may be reviewed, but stale repository prose must not be promoted as current Figma evidence. Do not create a Figma-only duplicate of an existing runtime/Storybook component and do not mutate this product branch to work around #959.

Dependency / merge gate

• fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 remains the canonical protected JavaScript dependency-security owner for the inherited pdfjs-dist / nanoid / undici findings. Do not copy, suppress, or independently upgrade those dependencies here.
• Do not mix with 🔒 [보안] CLI 무제한 파일 읽기 취약점 수정 #811, Storybook-token work, or test(analysis): govern real YouTube known-stem benchmark #828.
• Keep unmerged until fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 has legitimately integrated and this unchanged-or-restacked leaf has every applicable repository/central CI, cross-platform build, exact owned statement+branch coverage, docstring, SAST/security/SBOM/supply-chain/package/release gate terminal-success; zero valid unresolved findings; a qualifying independent non-author last-push approval; and ordinary branch-protection acceptance.
• Queued, pending, skipped, cancelled, failed, predecessor-head, protected-base, model-only, self/author, or administrative-bypass evidence is not success.

Security Notes

• Untrusted inputs: runtime song/section/role metadata, including inherited objects, accessors, Proxy traps, sparse arrays, and hostile identity getters.
• Trust boundary: only owned snapshotted descriptor values of riff text and time metadata, corroborated active graph nodes, canonical section labels, and bounded integer time ranges may name the next action.
• Safe failure: malformed or hostile metadata keeps the callout guidance-only and does not navigate.
• Logging/privacy: no rejected path, payload, or rehearsal metadata is logged.
• Test points: riffPlan and timeRange own-data vs Proxy behavior, inherited metadata, Korean particle-safe copy, reduced-motion Open, workspace-scoped renderer, co-mounted callout identity, and coverage-gate membership.

---

[coderabbitai]

Warning

Review limit reached

Next included review available in 14 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b0d190fa-5a40-40e7-b075-7ba7b4cadff7

📥 Commits

Reviewing files that changed from the base of the PR and between 749511c and 96643cf.

📒 Files selected for processing (32)

• .Jules/palette.md
• .jules/palette.md
• AGENTS.md
• ARCHITECTURE.md
• CHANGELOG.md
• CLAUDE.md
• apps/desktop/src/features/workspace/FirstRiffPlanCallout.identity.test.tsx
• apps/desktop/src/features/workspace/FirstRiffPlanCallout.memoization.test.tsx
• apps/desktop/src/features/workspace/FirstRiffPlanCallout.particle.test.tsx
• apps/desktop/src/features/workspace/FirstRiffPlanCallout.proxy-root.test.tsx
• apps/desktop/src/features/workspace/FirstRiffPlanCallout.reduced-motion.test.tsx
• apps/desktop/src/features/workspace/FirstRiffPlanCallout.test.tsx
• apps/desktop/src/features/workspace/FirstRiffPlanCallout.tsx
• apps/desktop/src/features/workspace/FirstRiffPlanCallout.unavailable-copy.test.tsx
• apps/desktop/src/features/workspace/FirstRiffPlanCallout.workspace-scope.test.tsx
• apps/desktop/src/features/workspace/Workspace.test.tsx
• apps/desktop/src/features/workspace/Workspace.tsx
• apps/desktop/src/features/workspace/coverageContract.test.ts
• apps/desktop/src/features/workspace/firstRiffPlan.inherited-metadata.test.ts
• apps/desktop/src/features/workspace/firstRiffPlan.proxy-authority.test.ts
• apps/desktop/src/features/workspace/firstRiffPlan.section-label.test.ts
• apps/desktop/src/features/workspace/firstRiffPlan.test.ts
• apps/desktop/src/features/workspace/firstRiffPlan.ts
• apps/desktop/src/i18n/index.test.ts
• apps/desktop/src/i18n/index.ts
• apps/desktop/src/locales/en/common.json
• apps/desktop/src/locales/ko/common.json
• apps/desktop/vite.config.ts
• docs/design-system/component-contract.md
• docs/doctoring/reduced-motion-first-riff-plan-navigation.md
• packages/shared-types/src/index.ts
• packages/shared-types/test/index.test.ts

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/workspace-first-riff-plan

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Re-review request for exact head 549c668edfdd2410a8d95bba735ac65320aaa160: all required status contexts are green on this head (including coverage-evidence and security scans) and all review threads are resolved. @opencode-agent please review current head 549c668edfdd2410a8d95bba735ac65320aaa160 and update the review decision.

[seonghobae]

Resolved merge conflicts against origin/develop (749511c): union-merged AGENTS.md/CHANGELOG.md bullets, sentence-merged CLAUDE.md, kept both import sets in Workspace.tsx (FirstRiffPlanCallout + firstRangeSqueeze), unioned en/ko locale tails (JSON valid, en/ko symmetric). Merged legacy .Jules/palette.md into canonical .jules/palette.md, dropped alias. No conflict markers remain. Merge head: 96643cf.

[devin-ai-integration]

Devin Review found 2 new potential issues.