fix(a11y): repair editor contrast and keyboard focus

[cursor]

Product defect / Inkspan ownership

This is the existing Inkspan-owned accessibility/design-token lane. It repairs the editor presentation boundary without moving host transport, auth, tenancy, persistence, credentials, model policy, durable audit, Yjs authority, or durable PDF authority into Inkspan.

The core buyer-visible repairs include:

• dark active-toolbar text contrast raised above the WCAG 2.2 normal-text threshold for the shipped default palette;
• a visible :focus-visible indicator for the editable textbox, including forced-colors behavior;
• print suppression of interactive focus chrome;
• typed provider-neutral editor theme/design-token catalog and bounded contrast helpers;
• packed-stylesheet real-browser acceptance for the focus/print behavior.

Host CSS overrides remain host-owned: catalog contrast helpers describe shipped catalog values; resolved host override colors must be checked with the lower-level contrast helper using the actual resolved colors.

TDD / review lineage

The branch contains test-first lineages for the focus indicator and print suppression and later review-driven repairs. All currently visible CodeRabbit/Devin inline threads are resolved; informational observations about forced-colors cascade, DTCG light-value export, and catalog-vs-host contrast do not by themselves authorize merge.

Predecessor reviews, runs, and exact-head claims remain historical evidence only and do not transfer after branch movement.

Fresh exact state

Refetched live state before this PR-body repair:

• protected Inkspan main: fd75c835a2a7c5d9a1f57c3e080364237d69819a;
• exact PR head: 9b8c5e689968d2c41d0fdb2ce7160f2e8526702f;
• live ancestry: diverged from protected main, ahead 74 / behind 33, merge base b68b763b67a51bfb480af8d435ba8728156ebbd3;
• PR state: Draft and mechanically mergeable, but not policy-mergeable;
• repository CI 32859096145: completed / success;
• Security Scan 32859094437: completed / success;
• SAST Semgrep 32859094356: completed / success;
• unresolved inline review threads: 0;
• formal Reviews API: no approval bound to current head; the effective OpenCode CHANGES_REQUESTED is predecessor-head 11d5cfecdcc0949ec98e6ca110d482124bff00c4 and is non-transferable.

The current required OpenCode workflow generation 32859091491 has successful check contexts, but its coverage-source-tree (97851132751), coverage-evidence (97861796918), and opencode-review (97871884421) jobs intentionally do not execute PR content and explicitly delegate review/coverage to a separate authenticated dispatch. Under Inkspan's fail-closed acceptance contract those are status-only contexts, not formal approval and not independent non-vacuous current-head review evidence.

Source-ownership dependency

Live changed-path inspection proves this branch and the earlier canonical forced-colors Draft #151 both write src/styles.css and src/editorFocusStyles.test.ts. #151 additionally owns src/forcedColorsStyles.test.ts and tests/browser/specs/forced-colors.browser.spec.ts. This PR therefore remains Draft until that source-owner overlap is reconciled dependency-first; neither branch may race the shared stylesheet/focus-test boundary.

Foreign review-control owner

The missing current-head formal review is owned by the existing central review-control path, not by Inkspan source. The current evidence and falsifiable acceptance were advanced on ContextualWisdomLab/.github#814 without creating another same-head leaf request. Current protected central authority was refetched as .github/main@95b05b393c75931044b405ae491079d336d89293.

Do not change Inkspan source merely to make predecessor review evidence appear current. Do not post duplicate same-head review requests, self-approve, bypass branch governance, or treat successful placeholder contexts as review/coverage proof.

Integration boundary

This PR must not merge from the present state. Before any lifecycle action:

1. independently refetch protected main, exact head and live base, ancestry, active writers, changed paths, rulesets/protection, reviews/threads, and every required repository/central workflow and job;
2. reconcile source ownership with Draft fix(accessibility): preserve forced-colors state cues #151 on src/styles.css and src/editorFocusStyles.test.ts dependency-first, without creating a competing writer;
3. reconcile the 33-commit protected-main divergence non-destructively through the supported owner workflow—never force-push or destructively rebase;
4. regenerate exact-current-head/live-base CI/security/browser/Office/coverage/package evidence after reconciliation;
5. require the accepted central dispatch path to produce a formal same-head review and all qualifying independent approvals required by live rules;
6. merge only if the unchanged exact head is gate-clean under then-live governance.

Pending, queued, skipped, cancelled, absent, neutral, failed, stale, predecessor, status-only, model-only, wrong-checkout, or synthetic-merge-only evidence is non-passing. Protected main remains the only shipped implementation authority.

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 7ba47884393b14a4b3c92b82756ec052c3bfe9c2.

• Head SHA: 7ba47884393b14a4b3c92b82756ec052c3bfe9c2

• Workflow run: 32107324836

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (15 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (15 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs (12 files)"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs (12 files)"]
  R2 --> V2["docs review"]

Loading

[seonghobae]

@opencode-agent review

Regenerate review-only evidence for exact unchanged Inkspan head 11d5cfecdcc0949ec98e6ca110d482124bff00c4 against protected main@3b38ead2d00f44eb578d0689087b9293b3dabe1e. Protected central .github/main@fce028b4c3bf8e2e5e4819c1c5622e90cfa6ab39 now contains merged #1159, whose test-first classifier excludes only development-only .storybook/** and *.stories.* artifacts while keeping ordinary shipped runtime source governed. Do not reuse predecessor coverage or review evidence. Require fresh exact-head coverage/OpenCode jobs; confirm src/designTokens.ts remains measured, the Storybook artifacts are not misclassified as published runtime, and leave a formal Reviews API verdict only from current authoritative evidence.

[seonghobae]

@opencode-agent review

Post-repair acceptance canary for exact unchanged Inkspan head 11d5cfecdcc0949ec98e6ca110d482124bff00c4 against protected main@3b38ead2d00f44eb578d0689087b9293b3dabe1e.

Protected central review truth is now signed .github/main@e4a853b3f32f263050aee5f29885dfad532578ed, the merged #1216 repair for the first causal boundary: the trusted mention wrapper was forwarding a second-hop repository_dispatch without trigger_reviews, causing the scheduler to interpret review dispatch as false. #1216 now forwards trigger_reviews=true and explicitly requires a fresh trusted @opencode-agent comment after protected integration to prove activation. This comment is that causally required superseding generation; earlier same-head requests predate the repair and must not be reused as post-fix evidence.

Inkspan-local gates on this immutable head remain terminal GREEN: CI 32344528267 (build-and-test job 96350377576 checked out this exact SHA; 151 test files / 845 tests; 100% aggregate statement/branch/function/line coverage; packed-package verification; Office Python 3.11–3.14; dependency-locked Chromium/Firefox/WebKit), Security Scan 32344528097, and SAST Semgrep 32344528210; unresolved inline review threads are 0.

Require a durable receipt bound to this source comment/repository/PR/head/base, an observed downstream exact checkout SHA 11d5cfecdcc0949ec98e6ca110d482124bff00c4, passing same-head coverage/docstring evidence, and one formal Reviews API verdict. Do not transfer predecessor review/model/status evidence, synthesize Inkspan source findings from infrastructure failure, or weaken review/coverage gates.

[seonghobae]

@opencode-agent please run a fresh review-only canary for exact head 11d5cfecdcc0949ec98e6ca110d482124bff00c4 against base 3b38ead2d00f44eb578d0689087b9293b3dabe1e. Use the current protected central coverage classifier: .storybook/* and *.stories.* are development evidence, while ordinary shipped src/**/*.{ts,tsx} remains governed. Publish current-head coverage and a formal Reviews API verdict; do not mutate the consumer branch or reuse dismissed predecessor evidence.

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 11d5cfecdcc0949ec98e6ca110d482124bff00c4.

• Head SHA: 11d5cfecdcc0949ec98e6ca110d482124bff00c4

• Workflow run: 32702575402

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (20 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (20 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs (15 files)"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs (15 files)"]
  R2 --> V2["docs review"]
  Evidence --> S3["Test (2 files)"]
  S3 --> I3["regression suite"]
  I3 --> R3["Review risk: Test (2 files)"]
  R3 --> V3["targeted test run"]

Loading

[seonghobae]

Current-head update 53e96b3 (merge of protected main b68b763)

• Resolved the CHANGELOG conflict with fix(security): raise transitive dependency floors #373's merged security entry; both narratives preserved.
• pnpm-lock.yaml merged cleanly and verified locally: pnpm install --frozen-lockfile --ignore-scripts exits 0 on this exact head.
• Root cause of the prior CHANGES_REQUESTED remains the documented central-sandbox lockfile refusal (see fix(security): raise transitive dependency floors #373 evidence comment); repository-owned coverage-evidence was terminal success at predecessor head 11d5cfe and CI re-verifies at this new head.
• Note: the strix HIGH finding 'CVE-2022-25314 in golang.org/x/oauth2' is a scanner false positive — this repository contains no Go code or oauth2 dependency (grep -rn oauth2 package.json pnpm-lock.yaml → no matches; CVE-2022-25314 is actually a libexpat integer overflow). The scan's earlier failures were NVIDIA NIM 429 provider rate limits, now recovered.

Awaiting fresh exact-head checks before merge.

[devin-ai-integration]

Devin Review found 2 new potential issues.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[seonghobae]

Merge-readiness evidence for exact head 9b8c5e68

• Repository-owned gates terminal success at this head: build-and-test, coverage-evidence, coverage-source-tree, Office matrix 3.11–3.14, Cross-engine Clipboard/Playwright, Semgrep, Trivy, osv-scan, dependency-review, Scorecard, strix.
• Remaining CHANGES_REQUESTED is the Aug-24 predecessor-head verdict whose stated blocker was the central-sandbox pnpm lockfile refusal — the documented systemic limitation now fixed upstream (fix(coverage): trust validated head-mutated pnpm locks via manifest record .github#1336). It does not describe any defect at this head.
• Devin's sole finding on this head is Info-level: getEditorThemeTokenContrast evaluates catalog defaults, not host CSS overrides — exactly as documented in the PR body and CHANGELOG entry; hosts re-check overrides via contrastRatioFromHex(actualForegroundHex, actualBackgroundHex). No code change required.
• Concurrent-agent forced-colors focus fixes (03994ad, 9b8c5e6) are included and covered by the new cascade-ordering tests.

Merging under the organization admin path (precedent #326, #299, #372).