feat(workspace): guide tonight's first bridge on map and player

[seonghobae]

Product outcome

Name tonight's first labeled bridge so the room can catch the turn. The workspace action opens the matching map section. The player exposes Hear only when its owning playback surface supplies a seek callback.

Design authority: workspace next-action pattern in docs/design-system/component-contract.md. Distinct from intro #943, chorus #939, pickup #916, stop #934, and labeled handoff #937.

Exact current identity

• Protected target: develop@acdbea6344fe1231c39535b575f4de35e4c607c9.
• Exact current head: 4d13986d.
• Branch: feat/workspace-first-bridge-turn.
• Do not mix with 🔒 [보안] CLI 무제한 파일 읽기 취약점 수정 #811, test(analysis): govern real YouTube known-stem benchmark #828, or fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783.

Delivered contract

• resolveFirstBridge selects the earliest labeled bridge with a bounded positive-length rehearsal window.
• Fail closed on intro, verse, pre-chorus, chorus, outro, tag, pickup, stop, and handoff.
• Prefer a unique active ranked holding part; otherwise keep a band-wide turn.
• Workspace Open scrolls the renderer-owned song-structure cell. Reduced motion uses behavior: "auto".
• Player Hear runs only when onPlayFromSeconds exists and receives the exact bridge second.
• Copy names the holding part when corroborated, the localized form label, and the time so the next action is obvious (en/ko).
• Unavailable state stays guidance-only.

Security Notes

• Untrusted input: analysis section identities, labels, times, role graph, and song title.
• Trust boundary: React workspace/player click handlers → renderer-owned section index / optional owning-player seek callback. No filesystem, URL, or IPC authority is added.
• Safe failure: sparse or malformed collections, duplicate role identities, unbounded windows, missing map cells, and missing seek callbacks fail closed without inventing a destination.
• Privacy: no path, payload, or network access is introduced.
• Test points: resolver fail-closed labels, map scroll vs missing target, reduced-motion auto scroll, callback-only Hear gating, player sparse/malformed section summaries, and Korean form-label localization.

Dependency ownership

Canonical JavaScript dependency-security owner remains #783. This branch has no lockfile, PDF.js, Nanoid, Undici, or vulnerability-suppression delta. Inherited npm HIGH findings must not be suppressed here.

Merge gate

Keep Draft until one unchanged resulting exact head has repository CI/build/release/security/SAST/SBOM/supply-chain gates terminal-success, exact required owned coverage, fresh central coverage/OpenCode/Noema/Strix evidence, zero valid unresolved findings, a qualifying independent non-author last-push approval, and ordinary protected-branch acceptance without bypass.

Queued, pending, skipped-required, cancelled, failed, predecessor-head, protected-base, self/author, model-only, or administrative-bypass evidence is non-passing. Do not self-approve.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fef8967e-e173-4d17-872d-9fc76bef6ee3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}