Current authoritative state
Protected shipped truth is exact main@a40b9489665bed7d95af619a6079b9c51cab299a; it still accepts malformed runtime values in the public contrast helper. Closed Draft #167 is historical evidence only and is no longer a writer.
Issue-specific Draft PR #404 / codex/contrast-color-validation-305 now owns this repair from current protected main. Its exact head is 1ad7c417d01cb8f8c68c8094fb1962fc4352ceec. This is active-PR behavior, not protected-main shipped truth.
Required behavior
contrastingTextColor() must accept only exact #[0-9a-fA-F]{6} strings before channel parsing. Non-string, shorthand, non-hex, alpha, named, blank, and other malformed values fail closed with stable payload-redacted RangeError('collaboration contrast color must be a six-digit hexadecimal color'). Valid uppercase and lowercase six-digit inputs preserve the existing WCAG relative-luminance calculation and black/white result.
Remote cursor rendering remains separate: untrusted awareness colors use the existing strict grammar and safe fallback. Remote awareness remains untrusted presentation data; no transport, authorization, tenancy, persistence, credentials, deployment, retention, migration, model, or durable-audit authority moves into Inkspan.
Exact-head evidence
Test-only 28b18ede6008da34a6c671f3b740407b3bdfce31 reproduces the protected-main defect with 5 failures / 1 passing valid-input check. Current GREEN head passes:
- focused contract: 6 / 6 tests;
- full TypeScript suite: 157 files / 887 tests;
- statement, branch, function, and line coverage: 100%;
- typecheck, build, and packed-package consumers.
Repository-local success is not protected integration, independent approval, or release proof. Keep #404 Draft while #118 owns the protected release boundary. Before any lifecycle action, refetch exact head/base, reviews, threads, live rules, and every applicable workflow; do not transfer #167 evidence, self-approve, weaken gates, or fabricate release identity.
Current authoritative state
Protected shipped truth is exact
main@a40b9489665bed7d95af619a6079b9c51cab299a; it still accepts malformed runtime values in the public contrast helper. Closed Draft #167 is historical evidence only and is no longer a writer.Issue-specific Draft PR #404 /
codex/contrast-color-validation-305now owns this repair from current protectedmain. Its exact head is1ad7c417d01cb8f8c68c8094fb1962fc4352ceec. This is active-PR behavior, not protected-main shipped truth.Required behavior
contrastingTextColor()must accept only exact#[0-9a-fA-F]{6}strings before channel parsing. Non-string, shorthand, non-hex, alpha, named, blank, and other malformed values fail closed with stable payload-redactedRangeError('collaboration contrast color must be a six-digit hexadecimal color'). Valid uppercase and lowercase six-digit inputs preserve the existing WCAG relative-luminance calculation and black/white result.Remote cursor rendering remains separate: untrusted awareness colors use the existing strict grammar and safe fallback. Remote awareness remains untrusted presentation data; no transport, authorization, tenancy, persistence, credentials, deployment, retention, migration, model, or durable-audit authority moves into Inkspan.
Exact-head evidence
Test-only
28b18ede6008da34a6c671f3b740407b3bdfce31reproduces the protected-main defect with 5 failures / 1 passing valid-input check. Current GREEN head passes:Repository-local success is not protected integration, independent approval, or release proof. Keep #404 Draft while #118 owns the protected release boundary. Before any lifecycle action, refetch exact head/base, reviews, threads, live rules, and every applicable workflow; do not transfer #167 evidence, self-approve, weaken gates, or fabricate release identity.