Skip to content

feat: add proof-bound WCAG 2.2 sRGB8 evaluator - #313

Merged
lemone112 merged 11 commits into
mainfrom
agent/wcag22-srgb8-evaluator-284
Jul 13, 2026
Merged

feat: add proof-bound WCAG 2.2 sRGB8 evaluator#313
lemone112 merged 11 commits into
mainfrom
agent/wcag22-srgb8-evaluator-284

Conversation

@lemone112

@lemone112 lemone112 commented Jul 13, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • add an exact, versioned WCAG 2.2 evaluator for one final foreground/background sRGB8 occurrence with an explicit caller-declared criterion
  • bind every terminal Pass/Fail to a canonical profile, Q55 outward table, full finite-domain proof, production kernel, strict parser, typed registry admission row, and sealed evidence path
  • expose the same decision through Rust, WASM/npm, UniFFI/Swift, and conformance pack 4
  • collapse the temporary capability split to one public numericalCapabilityManifest() V2
  • prevent downstream safe Rust from relabelling genuine evidence as another site/result
  • keep raw proof/profile documents in shipped evidence/ while allowing the linker to remove them from runtime WASM

Contract boundary

This is a terminal standards certificate for a final sRGB8 pair, not a replacement for the LPC/APCA-shaped perceptual target used upstream by selection. Core never infers typography, token semantics, component state, or applicability from opaque client IDs. The caller declares one of the supported occurrence criteria; malformed input fails closed without fallback or panic.

The existing adaptive runtime and legacy wcagRatio diagnostic are unchanged. Neither can manufacture this evaluator's typed WCAG 2.2 result.

Evidence

  • exhaustive verifier covers all 16,777,216 sRGB8 colours, both foreground/background orientations, and the exact 3.0/4.5 integer laws with zero unresolved outcomes
  • 768 channel/code contributions are independently bounded with directed Decimal rounding and exact-integer tightness checks
  • Q55 is derived, not guessed: the conservative maximum cleared term is 6,737,385,042,546,262,556, leaving 2,485,986,994,308,513,251 below signed i64::MAX; Q56 exceeds it; the production kernel promotes arithmetic to u128
  • a compiled Rust probe binds the live typed WCAG registry row across exactly 10 mint-relevant fields; canonical row SHA-256: c91c5e185c432ae4a9fb9ea03e9838bf2565f2aabff56019e190aae97bfaa0f1
  • 15 negative controls: 3 numerical, 10 registry-field, and 2 injective transport mutations
  • variant-level #[non_exhaustive] seals generic terminal decisions and Glow outcomes; boundary tests obtain outcomes only through the real Core resolver
  • proof SHA-256: c4a35a902ea49729704d05c2a9a07530a1731ebd4ff7325b5e5baf261fbe7b9e
  • canonical proof payload SHA-256: fa10908a1960e51b122a11ca0413083ab67749c79161c8b5d22a6c0c69ce71fb
  • verifier SHA-256: 8757b348b99926700c6d9854ed4ae515d4c676b31c7924b0812a3745f2181221

Gates run locally

  • full workspace tests and doctest/compile-fail seals
  • full finite-domain verifier
  • fmt + clippy -D warnings
  • docs drift 23/23
  • npm runtime tests 113/113 and TypeScript typecheck
  • clean-tree release verification with Node 24.14.0 / npm 11.9.0, including reproducible packing and a clean-consumer runtime/type smoke
  • independent architecture/API, numerical/scientific, and docs/performance reviews: CLEAN

Canonical WASM

Pinned Linux x64 release build (rustc 1.96.0, wasm-pack 0.13.1, wasm-bindgen 0.2.126, wasm-opt 117 -Oz):

  • raw: 454,385 bytes, exact no-headroom ceiling
  • gzip: 197,230 bytes, diagnostic only
  • SHA-256: 94c61c1689fa2e1c10d79817864471f41c623463bd9b5b4e0dac2a850a58f09f

This is 3,430 raw bytes below the previous canonical artifact. An anti-vacuum gate proves neither separately shipped WCAG document is duplicated in runtime WASM.

Compatibility

No existing adaptive colour emission changes. The public capability/conformance surface is a deliberate pre-client correction; the next release must receive the documented coordinated 0.x version bump rather than preserving a temporary V1 alias.

Closes #284

Summary by CodeRabbit

  • Новые возможности

    • Добавлена точная оценка контраста WCAG 2.2 для пар цветов sRGB8 с результатом Pass/Fail.
    • Результаты включают границы luminance Q55 и проверяемые доказательства.
    • Манифест численных возможностей обновлён до версии 2 с поддержкой идентификаторов доказательств.
    • Пакет цветов теперь содержит WCAG 2.2 API и связанные контрактные артефакты.
  • Улучшения

    • Обновлён conformance-пакет до версии 4.0.
    • Добавлены независимые проверки WCAG-артефактов и жёсткий контроль размера WASM-сборки.
    • Документация обновлена для новых API и гарантий доступности.

@coderabbitai

coderabbitai Bot commented Jul 13, 2026

Copy link
Copy Markdown

Review Change Stack

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 34 seconds

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d0d0f74f-3245-4112-84b9-16e57446c87c

📥 Commits

Reviewing files that changed from the base of the PR and between 1599ae1 and 5814811.

📒 Files selected for processing (27)
  • .github/workflows/ci.yml
  • CHANGELOG.md
  • conformance/README.md
  • conformance/vectors/manifest.json
  • conformance/vectors/wcag22.json
  • crates/labcolors-conformance/src/lib.rs
  • crates/labcolors-core/contracts/wcag22-srgb8-q55-proof-v1.json
  • crates/labcolors-core/src/glow.rs
  • crates/labcolors-core/src/numerics.rs
  • crates/labcolors-core/src/srgb8.rs
  • crates/labcolors-core/src/wcag22.rs
  • crates/labcolors-core/src/wcag22/kernel.rs
  • crates/labcolors-core/src/wcag22_tests.rs
  • crates/labcolors-ffi/src/lib.rs
  • crates/labcolors-wasm/src/error.rs
  • crates/labcolors-wasm/src/lib.rs
  • crates/labcolors-wasm/src/projection.rs
  • crates/labcolors-wasm/tests/wasm_parity.rs
  • docs/decisions/0004-finite-alpha-glow-reference.md
  • docs/migrations/exact-alpha-glow.md
  • docs/verification-map.md
  • packages/colors/README.md
  • packages/colors/bench/wasm-size-budget-v1.json
  • packages/colors/test/release-contract.test.mjs
  • scripts/check-wasm-size-budget.mjs
  • scripts/verify-package-release.mjs
  • scripts/verify_wcag22_q55.py

Walkthrough

Добавлен доказуемый WCAG 2.2 sRGB8 evaluator с Q55-границами, proof-bound evidence и capability manifest V2. Результаты экспортируются через Rust, FFI, WASM и npm, включаются в conformance pack v4, а независимые скрипты проверяют артефакты, полный конечный домен и release-бюджеты.

Changes

WCAG 2.2 evaluator

Layer / File(s) Summary
Профиль, Q55-ядро и evidence
crates/labcolors-core/..., scripts/generate_wcag22_q55.py
Добавлены строгий sRGB8 parser, канонический профиль, Q55-границы, целочисленный Pass/Fail evaluator и запечатанное evidence.
Capability manifest V2
crates/labcolors-core/src/numerics.rs, crates/labcolors-conformance/src/lib.rs
Capability registry переведён на proof-capable V2 с proofIds, новым checksum preimage и WCAG22 site.
Conformance pack v4
conformance/vectors/*, crates/labcolors-conformance/*
Добавлены шесть WCAG22-векторов, обновлены pack metadata, counts и проверки точного воспроизведения.
FFI, WASM и npm API
crates/labcolors-ffi/*, crates/labcolors-wasm/*, packages/colors/*
Добавлена evaluateWcag22, типы оценки, V2 capability manifest и проверки JSON/TypeScript/ошибок.
Независимая проверка и CI
scripts/verify_wcag22_q55.py, scripts/verify-package-release.mjs, .github/workflows/ci.yml
Добавлены full-domain proof, release-проверки evidence и жёсткий raw-byte WASM budget gate.

Estimated code review effort: 5 (Critical) | ~120 minutes

Possibly related issues

Possibly related PRs

  • Labpics-Team/lab-colors#311 — предыдущая переработка numerics и capability manifest, расширенная здесь до proof-capable V2.
  • Labpics-Team/lab-colors#62 — WASM boundary и error/type surface, расширенные WCAG22 API.
  • Labpics-Team/lab-colors#102 — связанная CI-конфигурация headless Chrome, шаг которой теперь удалён из WASM job.

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant ColorsPackage
  participant WasmBinding
  participant CoreEvaluator
  participant EvidenceRegistry
  Client->>ColorsPackage: вызывает evaluateWcag22
  ColorsPackage->>WasmBinding: передаёт hex-пары и criterion
  WasmBinding->>CoreEvaluator: вызывает evaluate_wcag22_hex
  CoreEvaluator->>EvidenceRegistry: запрашивает canonical proof-bound evidence
  EvidenceRegistry-->>CoreEvaluator: возвращает зарегистрированные IDs
  CoreEvaluator-->>WasmBinding: возвращает Pass/Fail и Q55 assessment
  WasmBinding-->>ColorsPackage: сериализует JsWcag22Assessment
  ColorsPackage-->>Client: возвращает оценку и evidence
Loading
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name Status Explanation Resolution
Linked Issues check ❓ Inconclusive Большинство требований реализовано, но содержимое crates/labcolors-core/contracts/wcag22-srgb8-q55-v1.bin скрыто фильтром !**/*.bin, поэтому proof-артефакт нельзя полностью проверить. Снимите фильтр или приложите crates/labcolors-core/contracts/wcag22-srgb8-q55-v1.bin, чтобы подтвердить целостность Q55 proof-артефакта.
✅ Passed checks (4 passed)
Check name Status Explanation
Out of Scope Changes check ✅ Passed Изменения выглядят согласованными с целями PR: evaluator, evidence, CI, манифесты, тесты и документация поддерживают одну тему без явных посторонних правок.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed Заголовок точно отражает основное изменение: добавлен proof-bound evaluator для WCAG 2.2 sRGB8.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch agent/wcag22-srgb8-evaluator-284

Comment @coderabbitai help to get the list of available commands.

@lemone112

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 13, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@lemone112
lemone112 marked this pull request as ready for review July 13, 2026 02:25
@lemone112

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 13, 2026

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 13

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@conformance/README.md`:
- Around line 58-76: Обновите раздел «Версионирование» в conformance/README.md:
укажите текущий manifest.packVersion как 4.0.0 вместо 3.0.0 и опишите переход
3.0.0 → 4.0.0 с изменениями capability V2 и добавлением семейства wcag22. В
таблицу «Семейства векторов» добавьте строку для wcag22.json, согласовав её с
источником истины из docs/NAMING.md и общим количеством семейств.

In `@crates/labcolors-core/src/numerics.rs`:
- Around line 233-366: Зафиксируйте уникальность wire-ключей в
NUMERICAL_REGISTRY_V2: добавьте проверку, которая обнаруживает повторяющиеся
значения, возвращаемые NumericalSiteIdV2::key(), и закрепите её тестом для
полного V2-реестра. Не ограничивайте проверку только NumericalSiteIdV1 и
используйте единый источник данных NUMERICAL_REGISTRY_V2.
- Around line 725-728: Добавьте независимый mutation guard непосредственно в
ветви кодирования proof_ids, проверяя ожидаемый результат сериализации, а не
пересчитывая checksum той же реализацией. Покройте все соответствующие пути
вокруг push_sorted_key_list и явно зафиксируйте, что legacy Glow не содержит
proof ID; guard должен обнаруживать удаление или перестановку этого кодирования.
- Around line 569-578: Mark the public enum NumericalRuntimeAttestationIdV2 with
#[non_exhaustive] so downstream code cannot exhaustively match its currently
empty variants. Leave its key method and other attributes unchanged.

In `@crates/labcolors-core/src/srgb8.rs`:
- Around line 3-14: Update hex_bytes to remove at most one leading '#' and
reject inputs with a repeated prefix such as ##1A2B3C, while preserving valid
optional-prefix parsing. Add a regression test that exercises the public parsing
path and fails before the fix for the repeated-prefix input.

In `@crates/labcolors-core/src/wcag22_tests.rs`:
- Around line 148-159: В тесте с детерминированной выборкой вынесите seed,
размер выборки и параметры LCG из тела цикла в именованные константы, используя
их в генерации состояния и диапазоне итераций. Добавьте комментарий,
объясняющий, что генератор обеспечивает воспроизводимую PR-time выборку, но не
заменяет доказательство по всему домену.

In `@crates/labcolors-core/src/wcag22.rs`:
- Around line 29-34: Уточните документацию варианта Wcag22Srgb8ContrastV1 в
перечислении Wcag22ProfileIdV1: отделите ссылку на рекомендацию WCAG 2.2 от
выбора конечного домена профиля, не приписывая стандарту ограничение «final
encoded sRGB8 bytes». Сохраните указание на Recommendation как нормативный
источник, а описание sRGB8 представьте как design-choice профиля.

In `@crates/labcolors-core/src/wcag22/kernel.rs`:
- Around line 56-64: Добавьте рядом с вычислением passes/fails в match threshold
поясняющий комментарий с выводом целочисленных коэффициентов из `(L + 0.05) / (D
+ 0.05)`: для порогов 3:1 и 4.5:1 укажите соответствующие неравенства, включая
обратное строгое условие для Fail. Не изменяйте логику вычислений.

In `@crates/labcolors-ffi/src/lib.rs`:
- Around line 851-884: Добавьте в тестовый модуль отдельный тест для успешного
результата `evaluate_wcag22`, используя валидные цвета и критерий
`Wcag22Criterion`; проверьте, что `assessment.decision` равен
`Wcag22Decision::Pass`. Разместите тест рядом с
`wcag22_transport_preserves_core_decision_and_evidence`, сохранив существующие
проверки без изменений.
- Around line 439-544: Update evaluate_wcag22 to verify that the core-returned
assessed_criterion matches the original criterion before constructing
Wcag22Assessment. Perform the comparison through the existing Wcag22Criterion
conversion or equivalent variant matching without requiring PartialEq on the
core type, and return IncompatibleCoreContract on mismatch; preserve the
existing criterion mapping for matching values.

In `@crates/labcolors-wasm/src/projection.rs`:
- Around line 71-96: Вынесите каноническое преобразование и разбор ключей WCAG22
в методы `Wcag22CriterionV1` на стороне core, например `key()` и `parse()`.
Замените повторяющиеся литералы в сериализации этого участка, сообщениях
`error.rs` и парсинге внутри `evaluate_wcag22` в `lib.rs` вызовами этих методов,
сохранив текущую обработку неизвестных вариантов.

In `@scripts/verify_wcag22_q55.py`:
- Around line 743-747: Remove the unnecessary f-string prefix from the
replacement string passed to re.subn in the normalization logic, while
preserving the existing \1 and <self-digest> replacement content.

In `@scripts/verify-package-release.mjs`:
- Around line 114-123: Update validateWcag22Evidence and verifyCleanConsumer so
WCAG22 evidence artifacts are validated from the packed tarball and installed
clean-consumer files, not only staging paths. Pass the expected evidence
artifacts into verifyCleanConsumer, then compare each installed evidence/*
file’s bytes and SHA-256 against the expected artifact before accepting the
release manifest.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 370e8cba-b1be-4ca1-9fba-3592e6bb506b

📥 Commits

Reviewing files that changed from the base of the PR and between b364adc and 1599ae1.

⛔ Files ignored due to path filters (1)
  • crates/labcolors-core/contracts/wcag22-srgb8-q55-v1.bin is excluded by !**/*.bin
📒 Files selected for processing (42)
  • .cargo/mutants.toml
  • .github/workflows/ci.yml
  • .gitignore
  • README.md
  • bindings/swift/Tests/LabColorsConformanceTests/ConformanceTests.swift
  • conformance/README.md
  • conformance/vectors/manifest.json
  • conformance/vectors/wcag22.json
  • crates/labcolors-conformance/src/bin/gen.rs
  • crates/labcolors-conformance/src/lib.rs
  • crates/labcolors-conformance/tests/reference_runner.rs
  • crates/labcolors-core/contracts/wcag22-srgb8-q55-proof-v1.json
  • crates/labcolors-core/contracts/wcag22-srgb8-v1.json
  • crates/labcolors-core/src/lib.rs
  • crates/labcolors-core/src/numerics.rs
  • crates/labcolors-core/src/semantic.rs
  • crates/labcolors-core/src/spaces/srgb.rs
  • crates/labcolors-core/src/srgb8.rs
  • crates/labcolors-core/src/wcag22.rs
  • crates/labcolors-core/src/wcag22/kernel.rs
  • crates/labcolors-core/src/wcag22/q55_data.rs
  • crates/labcolors-core/src/wcag22_evidence.rs
  • crates/labcolors-core/src/wcag22_tests.rs
  • crates/labcolors-ffi/src/lib.rs
  • crates/labcolors-wasm/src/error.rs
  • crates/labcolors-wasm/src/lib.rs
  • crates/labcolors-wasm/src/projection.rs
  • docs/NAMING.md
  • docs/verification-map.md
  • packages/colors/README.md
  • packages/colors/bench/wasm-size-budget-v1.json
  • packages/colors/index.d.ts
  • packages/colors/index.js
  • packages/colors/package.json
  • packages/colors/test/capability-manifest.test.mjs
  • packages/colors/test/release-contract.test.mjs
  • packages/colors/test/wcag22.test.mjs
  • scripts/check-wasm-size-budget.mjs
  • scripts/generate_wcag22_q55.py
  • scripts/prepare-npm-package.mjs
  • scripts/verify-package-release.mjs
  • scripts/verify_wcag22_q55.py

Comment thread conformance/README.md
Comment thread crates/labcolors-core/src/numerics.rs
Comment thread crates/labcolors-core/src/numerics.rs
Comment thread crates/labcolors-core/src/numerics.rs
Comment thread crates/labcolors-core/src/srgb8.rs
Comment thread crates/labcolors-ffi/src/lib.rs
Comment thread crates/labcolors-ffi/src/lib.rs
Comment thread crates/labcolors-wasm/src/projection.rs Outdated
Comment thread scripts/verify_wcag22_q55.py
Comment thread scripts/verify-package-release.mjs Outdated

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

Final exact head: 42ee2b2122a167d392d41fb9f280d3bc8fdae412. Please re-review the sealed terminal evidence, live typed registry proof binding, Q55 signed-64 derivation, raw-evidence WASM stripping, and exact canonical Linux size lock.

@coderabbitai

coderabbitai Bot commented Jul 13, 2026

Copy link
Copy Markdown

@lemone112 Understood — I'll re-review at head 42ee2b2122a167d392d41fb9f280d3bc8fdae412, paying particular attention to:

  • Sealed terminal evidence (CanonicalFiniteBoundedEvidenceV1 in crates/labcolors-core/src/wcag22_evidence.rs)
  • Live typed registry proof binding (numerical_registry_v2() / mint_wcag22_evidence validation path)
  • Q55 signed-64 derivation and bounds (crates/labcolors-core/src/wcag22/q55_data.rs, scripts/generate_wcag22_q55.py, scripts/verify_wcag22_q55.py)
  • Raw-evidence WASM stripping/size behavior (scripts/check-wasm-size-budget.mjs, packages/colors/bench/wasm-size-budget-v1.json)
  • Exact canonical Linux size lock in CI (.github/workflows/ci.yml)
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

Final infrastructure-only head: 58148111eb67040cc8d5f99e830ad8f95a60ab75. The previous exact-head product gates, canonical WASM identity, and release verification passed; this commit fixes the observed Debian mirror 404 by refreshing signed APT metadata into job-local lists/cache before the fixed dependency download. The anti-vacuum test requires both commands, exact ordering, and all isolated paths.

@coderabbitai

coderabbitai Bot commented Jul 13, 2026

Copy link
Copy Markdown
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
sed -n '1,200p' .github/workflows/ci.yml

Length of output: 10182


🏁 Script executed:

#!/bin/bash
set -euo pipefail
rg -n 'apt-get|apt ' .github/workflows/ci.yml -C3

Length of output: 1806


🏁 Script executed:

#!/bin/bash
set -euo pipefail
sed -n '360,430p' .github/workflows/ci.yml

Length of output: 4539


🏁 Script executed:

#!/bin/bash
set -euo pipefail
awk 'NR<=365 && /^  [a-zA-Z_-]+:$/ {print NR": "$0}' .github/workflows/ci.yml | tail -5
grep -n "name: " .github/workflows/ci.yml | sed -n '1,60p'

Length of output: 2200


🏁 Script executed:

#!/bin/bash
set -euo pipefail
git log --oneline -5
git show --stat 58148111eb67040cc8d5f99e830ad8f95a60ab75 2>&1 | head -50

Length of output: 955


🏁 Script executed:

#!/bin/bash
set -euo pipefail
git show 58148111eb67040cc8d5f99e830ad8f95a60ab75 -- .github/workflows/ci.yml packages/colors/test/release-contract.test.mjs

Length of output: 5086


@lemone112 Reviewed at head 58148111eb67040cc8d5f99e830ad8f95a60ab75. This commit is indeed infrastructure-only and looks correct:

  • The install Chrome + dependencies step in the wasm job now builds an APT_OPTIONS array that redirects Dir::State::lists, Dir::Cache, and Dir::Cache::archives into job-local, $RUNNER_TEMP-scoped paths ($DEPS_DIR/apt-lists, $DEPS_DIR/apt-cache), while leaving Dir::State::status pointed at the real /var/lib/dpkg/status (correct, since update/download don't mutate dpkg status).
  • apt-get "${APT_OPTIONS[@]}" update now runs before apt-get "${APT_OPTIONS[@]}" download ..., so package metadata is refreshed into the isolated lists dir first — this directly fixes the stale-metadata/404 root cause you described.
  • Debug::NoLocking=1 and Acquire::Retries=3 avoid lock contention and add resilience without sudo.
  • mkdir -p correctly pre-creates the partial subdirectories apt requires for both update and download.
  • The added assertions in packages/colors/test/release-contract.test.mjs check for every new option string and explicitly assert aptUpdate < aptDownload, which enforces the exact ordering you called out — good anti-regression coverage.
  • All new paths derive from $RUNNER_TEMP/$DEPS_DIR, so the existing doesNotMatch(/\$HOME|~\//) guard still holds — no leakage into shared HOME.
  • No other files were touched, so the previously-verified product gates, canonical WASM identity, and release verification are unaffected by this commit.

No issues found — this is a clean, narrowly-scoped fix with matching test coverage for the exact-ordering and isolation invariants.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Collaborator Author

Final gate packet for 58148111eb67040cc8d5f99e830ad8f95a60ab75:

  • CI run 620: SUCCESS (full finite-domain proof, Rust, docs, audit, MSRV, exact canonical WASM, npm release, headless Chrome, Node 22 consumer)
  • Native conformance run 142: SUCCESS
  • local clean-tree release verification with Node 24.14.0 / npm 11.9.0: SUCCESS
  • architecture/API, numerical/scientific, docs/performance: CLEAN
  • CodeRabbit: APPROVED; final infrastructure re-review found no issues
  • unresolved review threads: 0
  • canonical WASM: 454,385 B, SHA-256 94c61c1689fa2e1c10d79817864471f41c623463bd9b5b4e0dac2a850a58f09f

Proceeding with squash merge under exact-head guard.

@lemone112
lemone112 merged commit 7e0fb03 into main Jul 13, 2026
11 checks passed
@lemone112
lemone112 deleted the agent/wcag22-srgb8-evaluator-284 branch July 13, 2026 10:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

BUG/A11Y: ввести доказуемый versioned WCAG 2.2 sRGB8 evaluator

1 participant