feat(diagnostics): add strict writing diagnostic contract

[seonghobae]

Scope

Stacked Task 1 implementation lane for PR #248's writing-diagnostics plan. The PR remains Draft and targets design/llm-writing-diagnostics; #248 is the governing dependency-root authority.

Current exact stack authority

• parent: design/llm-writing-diagnostics@f97d9d6787fd0d6c01bd245506e8a220af8a8a5a;
• exact head: b878721bf1c085612f8aea889081f0322e62a2ae;
• parent-to-child comparison: merge base exactly f97d9d6787fd0d6c01bd245506e8a220af8a8a5a, ahead_by=26, behind_by=0;
• protected shipped truth is independently resolved as main@128a239f8b71ca16add4b9e15e21752d1ad63ff0;
• ADR authority inherited from docs(adr): define revision-bound host-owned writing diagnostics #248: ADR 0028 host-owned revision-bound diagnostics and ADR 0029 strict invalidation / semantic-neutral accessibility; ADR 0027 remains owned by earlier PR feat(office): add bounded DOCX page layout contract #141.

Mutable head/base/check values above are decision-time evidence only and must be refetched before any later lifecycle action.

Test-first behavior

The contract was developed RED→GREEN before production implementation and provides provider-neutral diagnostics/provenance types, bounded priorities/resources/strings/selectors, exact own-data-property validation, hostile-reflection rejection, duplicate-ID rejection, exact revision/projection binding, deeply detached/frozen accepted values, stable redacted failures, and root plus React-free exports.

It performs no semantic language judgment, keyword/regex/phrase fallback, model/provider/network/database/credential access, stale-text repair, decoration, document mutation or send gate.

Exact-current-head evidence

For exact head b878721bf1c085612f8aea889081f0322e62a2ae, the live workflow query returns exactly one generation:

• Writing Diagnostics Contract TDD run 32862313851: push, completed / success, exact head b878721bf1c085612f8aea889081f0322e62a2ae.

Canonical repository PR CI/Security/SAST/browser/Office/coverage evidence is absent/non-passing for this exact head. The branch's inherited canonical ci.yml still uses the historical main-only PR trigger and lacks the exact-head checkout contract already integrated by #299 on protected main. Therefore #299 is no longer an open CI repair dependency, but this long-lived stack has not inherited its protected-main control-plane fix. Do not duplicate that canonical CI repair on this child branch.

The correct next source action is a non-destructive parent/root reconciliation with current protected main through a supported merge/update operation, then stack propagation and fresh exact-head PR evidence. The presently exposed safe GitHub mutation surface does not provide a high-level current-base merge/update operation; do not emulate it with ref movement, force push, destructive rebase, or guessed merge trees.

Formal approval and thread state must be refetched independently before lifecycle action; workflow/status/model output is never formal approval.

Remaining gates

• docs(adr): define revision-bound host-owned writing diagnostics #248 remains the dependency-root and must converge first;
• inherit protected-main fix(ci): run exact-head gates on stacked pull requests #299 CI behavior through source-owner-aware non-destructive reconciliation rather than a competing local CI patch;
• temporary branch-specific TDD workflow material must not survive final protected integration;
• exact-current-head canonical CI/security/SAST/package/browser/Office/coverage and applicable central review evidence are required before any lifecycle transition;
• qualifying independent non-author approval and zero valid unresolved findings remain mandatory under live governance;
• issue release: reconcile Office and npm versions before next stable registry publication #118 remains the canonical protected release/publication boundary.

Do not self-approve, transfer predecessor evidence, weaken gates, bypass dependency order, force-push/destructively rebase, or synthesize release identity.

---

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Marking ready for review: this is the base of the writing-diagnostics stack (#249 → #254 → #256 → #257 → #266 → #280 → #281 → #282 → #285). Exact-head checks are green at this head; requesting central review evidence so the stack can integrate bottom-up.

[devin-ai-integration]

Devin Review found 2 potential issues.

[seonghobae]

Fresh exact-head coverage verification for 23223569910dbee36fb6e285b9a6e8b4c2da88ac: pnpm coverage completed with 160 test files / 913 tests and 100% statements, branches, functions, and lines, including src/writingDiagnostics.ts and src/writing-diagnostics/index.ts. The coverage observation thread is resolved from current executable evidence; no source mutation was needed.

[seonghobae]

The downstream package-publication requirement is now verified on #282 exact head 643baed. Current #249 head 2322356 is an ancestor of that tree.

The verified packed artifact exposes @contextualwisdomlab/cwl-editor/writing-diagnostics through ESM, CommonJS, SSR-safe import, and strict TypeScript declarations. The full package verifier and build passed. The package concern remains correctly owned by #282 and is now executable in the restored stack, so this #249 thread is resolved.