fix(a11y): repair dark active-toolbar text contrast

[cursor]

Problem

Protected main@3b38ead2d00f44eb578d0689087b9293b3dabe1e still renders the dark active-toolbar 13px --cwl-accent text on --cwl-accent-soft at about 4.13:1, below the WCAG 2.2 4.5:1 normal-text threshold. This is an Inkspan-owned shipped default-presentation defect and #118 classifies it as a release blocker.

Root-cause repair

The active PR changes dark --cwl-accent to #58a6ff while --cwl-accent-soft remains #163356, producing about 5.06:1. Runtime CSS, the typed token catalog, deterministic contrast helpers, Storybook/operator surfaces, ADR 0031, doctoring and traceability keep protected-main shipped truth distinct from active-PR repaired truth.

The same canonical lane converges a standards contradiction: toDesignTokenFormatGroup() emits DTCG 2025.10-native sRGB color objects and dimension { value, unit } objects rather than legacy CSS-string $value fields. getEditorThemeTokenContrast() is catalog-only; actual host overrides are checked through contrastRatioFromHex(actualForegroundHex, actualBackgroundHex).

Test-first / truth-convergence lineage

• accessibility RED a831359d1509811ab8777e7356f6ebd5f251b5cf;
• documentation RED d22a8d508bcbf86546f522c817014d57d0cc48ac;
• DTCG value-shape RED e4a14d1b95359cc0dcab3b90c295a2c8b51a798f / CI 32140624357;
• active-PR/shipped-truth RED 0f7d3bdc7d69b278d11356fc571bee43ca54c2f0 / CI 32145768304;
• catalog-vs-resolved-override RED on predecessor ce078cf93ae45c09d44af872ac313d4a5d26d997 / CI 32151070615;
• source/test repair 92d8f5ac8176f20bb3a8fd0700c37b21f7e2a3b2 made successful and failing contrast actions explicitly identify WCAG 2.2 and bound host overrides to resolved hex values;
• documentation-contract RED on 92d8f5ac8176f20bb3a8fd0700c37b21f7e2a3b2 / CI 32152646994 proved doctoring still lacked one unambiguous nine-token authority statement;
• current exact head 93bb31cfd9721eb8987796c21b9b1825e2eff63c repairs that canonical wording without broadening product authority.

Fresh live base remains exact protected main@3b38ead2d00f44eb578d0689087b9293b3dabe1e. GitHub reports this Ready PR mergeable; mergeability is not authorization.

Exact-current-head evidence

For unchanged 93bb31cfd9721eb8987796c21b9b1825e2eff63c:

• CI 32153134329: completed / success;
• Security Scan 32153134260: completed / success;
• SAST Semgrep 32153134456: completed / success;
• qualifying approving reviews: 0;
• unresolved inline review threads: 0;
• the only formal review is predecessor OpenCode CHANGES_REQUESTED for 7ba47884393b14a4b3c92b82756ec052c3bfe9c2, caused by central coverage-evidence failure and containing no source-backed Inkspan finding. It is not current-head approval evidence.

Repository exact-head technical evidence is green, but absent current-head central review/coverage evidence and absent qualifying approval remain non-passing.

Central owner boundary

The historical OpenCode coverage failure is owned by central .github, not Inkspan source. Existing owner PR .github#1117 remains open at exact head 35c87751a986e2d84e349e04b39205e8f9e6ff07 against protected .github/main@85e18357c2be7cb8cb6eb55881677afb8f180e9a. It retains the exact trusted-uv target-triple version verification repair. Its exact-head Trusted uv Materializer Quality CI, Security Scan, SAST Semgrep, Strix Changed Path Quality CI, SBOM, OSV, Scorecard and Secret Scan are terminal-success; Python Security and CodeQL PR remain queued/non-passing at the latest refetch. Its formal OpenCode CHANGES_REQUESTED is predecessor-head evidence and cannot authorize the current owner head. The Inkspan lane requested a fresh CodeRabbit review through that existing owner path rather than creating another central writer.

The historical Inkspan OpenCode run is frozen to central workflow ref 092df969f71c7afc56dd9ab2662b016ad40696c8; rerunning that generation cannot inherit #1117. After the central repair is live on protected .github/main, a genuinely new exact-head OpenCode dispatch is required for the then-unchanged #362 head.

Release / governance boundary

Issue #118 accepts #362 as the sole canonical release-blocking accessibility lane and authorizes Ready status. v0.6.0 remains blocked until this repair integrates and a fresh protected-main generation proves all applicable accessibility, CI, security, package, SBOM/provenance, reproducibility, rollback and operational gates together.

Live organization governance requires a qualifying independent approval, stale-approval dismissal after pushes, latest-push approval by another actor, review-thread resolution and applicable central workflows. Do not merge while current-head central evidence is absent/non-passing, while the predecessor change request is not superseded by current-head review evidence, or while qualifying latest-push approval is absent. No self-approval, predecessor-evidence transfer, force push, destructive rebase, gate weakening or bypass.

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 7ba47884393b14a4b3c92b82756ec052c3bfe9c2.

• Head SHA: 7ba47884393b14a4b3c92b82756ec052c3bfe9c2

• Workflow run: 32107324836

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (15 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (15 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs (12 files)"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs (12 files)"]
  R2 --> V2["docs review"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 7ba47884393b14a4b3c92b82756ec052c3bfe9c2
• Workflow run: 32107324836
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 7ba47884393b14a4b3c92b82756ec052c3bfe9c2.

• Head SHA: 7ba47884393b14a4b3c92b82756ec052c3bfe9c2

• Workflow run: 32107324836

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (15 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (15 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs (12 files)"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs (12 files)"]
  R2 --> V2["docs review"]

Loading