fix(desktop): remove synthetic browser analysis success by seonghobae · Pull Request #827 · ContextualWisdomLab/bandscope

seonghobae · 2026-08-09T12:05:58Z

Canonical production gap

BandScope must not manufacture successful rehearsal state when the native runtime or licensed audio authority is absent. This lane owns the desktop bridge/browser-fallback boundary only: browser-only analysis cannot fabricate jobs/results or successful saves; buyer-visible/import and routine console errors are redacted; and native demo requests fail closed before bridge invocation until a licensed demo recording is installed.

Exact current identity

Protected target: develop@314ddeae7b775a4957594b599358c8255617eb2e.
Exact head: 94612e38994bc2fe442edcbf4bbf2e458540ec51.
Open, Draft, mergeable.
Fresh protected-base compare is ahead 28 / behind 0, merge base exactly current protected develop.
Exact diff is ten bounded desktop-owner files: CHANGELOG.md, CLAUDE.md, apps/desktop/src/App.test.tsx, the analysis* implementation/regression surfaces, and the job_runner* implementation/regression surfaces. No workflow, dependency, lockfile, supply-chain policy, model, database, widened filesystem/network authority, or vulnerability suppression is a live delta.

Protected-base adoption

The prior live head a2e5d260e68a0fe36a4d0551af202b73f257dd70 still forked from historical develop@acdbea6344fe1231c39535b575f4de35e4c607c9. Ordinary two-parent non-force descendant 94612e38994bc2fe442edcbf4bbf2e458540ec51 adopts current protected develop while preserving only this lane's validated desktop bridge/privacy/demo contracts. The already-merged #783 dependency baseline and #1165 workflow consolidation remain protected ancestry; their deltas are not copied or reverted here.

Test-first product contracts retained

Browser runner RED/GREEN removes fake workspace/jobs/timers/demo-song success and makes enqueue/retry/cancel fail closed outside Tauri.
Active analysis.ts removes staged browser success and retained fake job state.
Browser save_project rejects instead of claiming persistence that never happened.
YouTube dependency/native failures map to one stable next-action message rather than exposing URLs, local paths, tokens, cookies, or tool diagnostics.
Workspace fetch failure keeps the existing null recovery result but logs only stable operation-level text.
RED e42049ae861f9f995e000f490605e47404eba1e7 proves a native demo request must not reach the invocation bridge even if a synthetic downstream success could be returned.
GREEN b0971e4daf8f0f4ad377b4b67ba96de6a0de285d returns engine_unavailable with Demo analysis is unavailable until a licensed demo track is installed. Choose a local audio file. and no result; a2e5d260... records that boundary in the changelog.

The demo restriction is buyer/scientific truth: the arrangement-only fixture is test data, not rights-cleared decoded production audio. A future licensed demo source must enter through Audio Ingestion/Resource Admission rather than re-enabling a synthetic success shortcut.

Security Notes

Attack surface is URL/source selection, Tauri invocation errors, workspace diagnostics, and the browser/native execution boundary. Dependency/native exception strings are untrusted diagnostic input and may contain full URLs, local usernames/paths, cookies/tokens, stderr, or tool details. This lane keeps schema/allowlist validation, replaces post-invocation payloads with BandScope-owned messages, and adds no telemetry/storage/network authority.

Exact-head hosted evidence

Fresh ci run 34083740826 on exact 94612e38994bc2fe442edcbf4bbf2e458540ec51 proves npm-lock validation and Rust/Tauri check success. ci / build-and-test reaches quickcheck and fails only at ruff format --check because protected-base services/analysis-engine/tests/test_supply_chain_policy.py would be reformatted. This PR does not change that file. The failure is the canonical #1176 protected-base formatter prerequisite, not a desktop/browser-fallback regression; #827 must not duplicate its one-file repair.

Exact-head build-baseline run 34083740833 and sbom run 34083740846 are now terminal success. Security Scan, SAST Semgrep, and central CodeQL remain queued/non-terminal at the latest fresh sweep. Repository GREEN is not claimed. After #1176 becomes protected ancestry by normal merge, #827 must ordinarily reconcile onto the new protected develop and reacquire all evidence; do not stack the mutable Draft prerequisite merely to make quickcheck green.

Merge gate

All predecessor workflow/review evidence is historical after protected-base adoption. Central CodeQL verdict recovery remains separately owned by ContextualWisdomLab/.github#1902; BandScope #1172/#1183 own stale protected required-context-name migration. This lane must not recreate removed repository scanners or synthesize compatibility statuses.

Keep Draft and unmerged until #1176 is protected ancestry and one unchanged exact head has desktop lint/typecheck/tests/coverage/build, repository and central security/SAST/SBOM/supply-chain/package evidence terminal-success, zero valid unresolved findings, a qualifying independent non-author last-push approval, and ordinary branch-protection acceptance. No force-push, destructive rebase, self-approval, bypass, gate weakening, or predecessor-evidence transfer.

coderabbitai · 2026-08-09T12:06:07Z

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

seonghobae · 2026-08-14T11:35:45Z

@coderabbitai review

coderabbitai · 2026-08-14T11:35:52Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

seonghobae · 2026-08-14T11:35:52Z

@opencode-agent Please run a fresh review and coverage pass on exact current head a9063cb1eca490010e0f6905380304afb908db40. Ignore predecessor-head evidence. Verify the fail-closed browser-runtime boundary: non-Tauri analysis mutations reject, workspace reads return null, passive subscriptions emit no fabricated success, native Tauri behavior remains unchanged, and the CLAUDE guidance matches production behavior. Repository CI/release/SBOM/build-baseline/Bandit/Semgrep/secret-scan are successful on this exact head; Security Scan and security-audit are blocked by the protected-base dependency findings being remediated in #783 and must remain blockers until the base is updated. Do not copy dependency changes into this product PR. Publish only exact-head evidence and approve only if your coverage/review contract is satisfied.

seonghobae · 2026-08-14T18:35:59Z

Current-head gate evidence on a9063cb1eca490010e0f6905380304afb908db40 confirms the two red security workflows are inherited from protected develop, not introduced by this four-file product slice: security-audit fails on existing nanoid <3.3.18, pdfjs-dist <6.2.108, and undici <=7.28.0; Security Scan / trivy-fs fails on existing pdfjs-dist CVE-2026-16633. Keep this PR Draft and do not duplicate dependency remediation here. PR #783 is the atomic shared-base remediation; after it lands, update this branch from the new protected develop and require fresh exact-head security/audit/CI/review evidence.

opencode-agent · 2026-08-19T05:00:26Z

Queued @opencode-agent for PR #827 at head e169e6b89ea913d5e9ab723695ae7b6f39810876. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

opencode-agent · 2026-08-20T03:29:42Z