fix(reliability): reject non-string theme contrast colors before coercion

[seonghobae]

Current authoritative state

Protected shipped truth remains exact main@3b38ead2d00f44eb578d0689087b9293b3dabe1e. The hostile runtime contrast-input defect is repaired on the existing canonical single-writer Ready PR #362; current exact head is 11d5cfecdcc0949ec98e6ca110d482124bff00c4. The repair is active-PR truth only until #362 integrates.

Current src/designTokens.ts rejects every runtime non-string color in relativeLuminance() with the stable module-owned EditorThemeTokenContrastError before RegExp.prototype.exec() or any caller-controlled coercion/string conversion can run. A malformed object-cast host value therefore cannot invoke a hostile toString()/primitive-conversion hook or leak its private thrown value through contrastRatioFromHex().

This remains an Inkspan-owned deterministic local validation/error-containment boundary. Hosts still own CSS/theme selection and resolved host overrides; no transport, persistence, auth, tenancy, credential, network, model/provider, deployment, retention, migration, or durable-audit authority moves into Inkspan.

TDD / repair lineage

• predecessor ac23bc280a77f60c57874f4a8dacc3695b113c49 still allowed RegExp.prototype.exec() to coerce a hostile runtime value;
• d56be5a6c9fae490ef26030c917ebef2c6e66088 added the public hostile-value regression and the narrow typeof hex !== 'string' fail-closed repair;
• 0dbb7f4c5864c39ea2ea49e3aba82037977caa87 preserved that containment while freezing nested DTCG font-family output;
• later fix(a11y): repair editor contrast and keyboard focus #362 accessibility/fidelity work retained that containment through the focus and print contracts;
• e56301cc2e338df1ba6156c3b5fed910d5e536c2 was the last fully verified source generation before later branch movement; and
• current exact head 11d5cfecdcc0949ec98e6ca110d482124bff00c4 is net tree-identical to e56301c... after forward-removing an intervening competing architecture-maturity change whose source ownership already belongs to Draft docs: reconcile protected capability maturity #156. compare_commits(e56301c..., 11d5cfe...) has an empty file list.

Valid six-digit #rrggbb behavior, case-insensitive hex acceptance, catalog contrast values, DTCG output, the dark active-toolbar contrast repair, and standalone no-network/no-service operation remain preserved.

Exact-current-head evidence

All workflow/review evidence attached to e56301cc2e338df1ba6156c3b5fed910d5e536c2 became predecessor evidence when the branch head moved, even though the current tree is identical. For exact #362 head 11d5cfecdcc0949ec98e6ca110d482124bff00c4 against protected main@3b38ead2d00f44eb578d0689087b9293b3dabe1e at the latest fresh refetch:

• CI 32344528267: completed / success. Build-and-test job 96350377576 explicitly checked out exact head and passed 151 test files / 845 tests with 100% aggregate statement/branch/function/line coverage, packed-package consumer verification and demo build; Office Python 3.11–3.14 and dependency-locked Chromium/Firefox/WebKit are terminal success.
• Security Scan 32344528097: completed / success.
• SAST Semgrep 32344528210: completed / success.
• formal same-head OpenCode verdict: absent / non-passing; existing OpenCode reviews are dismissed predecessor-head verdicts only.
• qualifying approving reviews: 0;
• unresolved inline review threads: 0; both CodeRabbit threads are resolved.

The earlier scanner-queue snapshot and .github#712 escalation are historical incident evidence only; the sole exact-current-head scanner generations have since completed successfully and supersede that state. Pending, queued, skipped, cancelled, absent, neutral, failed, stale, predecessor, status-only, or model-only evidence remains non-passing.

Current review-control-plane generation

Protected central review/control-plane truth is the merged .github repair #1216 at protected central main@e4a853b3f32f263050aee5f29885dfad532578ed. It corrected the trusted mention wrapper so the second-hop repository dispatch forwards trigger_reviews=true; its activation contract requires a fresh trusted post-integration request before a resulting review can count.

Inkspan request comments 5352555668, 5353399090, and 5374020803 are therefore predecessor control-plane generations. In particular, 5353399090 is bound to this same Inkspan source head but predates protected #1216, so it cannot establish post-repair dispatch or review acceptance.

Exactly one post-#1216 superseding canary is live as PR #362 issue-comment 5378092156, bound to repository ContextualWisdomLab/inkspan, PR #362, exact head 11d5cfecdcc0949ec98e6ca110d482124bff00c4, and protected base 3b38ead2d00f44eb578d0689087b9293b3dabe1e. Fresh refetch still shows no durable acknowledgement/reaction on that comment and no formal same-head OpenCode review. Do not duplicate this request while the generation remains live.

The first failing post-repair selection/claim/receipt/acknowledgement/dispatch/downstream-review boundary remains foreign-owned by existing ContextualWisdomLab/.github#814; the current owner-path handoff there is comment 5378106210. Acceptance requires a durable receipt bound to the exact request/repository/PR/head/base, a fresh central generation proving TRIGGER_REVIEWS=true, observed downstream checkout SHA 11d5cfecdcc0949ec98e6ca110d482124bff00c4, passing same-head coverage/docstring evidence, and one formal same-head Reviews API verdict. Do not synthesize an Inkspan source defect around that control plane or weaken review/coverage gates.

Integration boundary

PR #362 remains the sole canonical release-blocking source writer and #118 owns v0.6.0 integration/publication authority. Keep this issue open until #362 integrates under then-live governance so the repair becomes protected-main shipped truth. Repository-owned exact-current-head gates are terminal-success; the remaining current blockers are the post-#1216 same-head OpenCode/independent-review path and every then-live governance requirement.

Do not self-approve, weaken gates, transfer predecessor evidence, create a competing design-token writer, duplicate the live same-head OpenCode request, merge around live review/control-plane requirements, or fabricate release identity.