feat(editor): insert XLS/XLSX worksheets into document body

[seonghobae]

Problem

Inkspan needs a bounded, local-only path for inserting visible XLS/XLSX worksheet contents into the current document without granting workbook bytes network, credential, persistence, model, transport, macro, link, or formula-execution authority.

Current exact boundary

• Protected shipped source: main@3b38ead2d00f44eb578d0689087b9293b3dabe1e.
• Canonical Draft branch: agent/318-spreadsheet-body-import@fce8fe72ebf4d438c17a7c889dd37c92118c6204.
• The branch remains Draft and mechanically mergeable; mergeability is not authorization.
• release: reconcile Office and npm versions before next stable registry publication #118 freezes protected v0.6.0; this feature lane must not create or imply release identity.

Implemented active-PR boundary

This branch contains the bounded spreadsheet product slice only: exact official SheetJS CE 0.20.3 provenance and frozen lock integrity; source-envelope and byte ceilings before parser materialization; framework-neutral XLS/XLSX parsing; descriptor-safe workbook/sheet/range/row inspection; worksheet/name/row/column/cell/text ceilings; inert displayed/cached cell-value projection; real XLSX and BIFF8 fixtures; bounded BIFF8 visibility metadata preflight; editor toolbar insertion; spreadsheet package/export verification; and active-PR product documentation.

Macros, formulas, hyperlinks and hidden sheets receive no executable/editor authority. The adapter adds no network, credentials, persistence, tenant, transport, durable-audit or model authority.

Source-ownership convergence

Two older PR-body claims are superseded by the live diff:

1. PR docs: reconcile protected capability maturity #156 remains the earlier canonical owner of the already-shipped Markdown package-maturity documentation contradiction. This spreadsheet lane does not own that correction; after docs: reconcile protected capability maturity #156 integrates, this branch must inherit the protected-main result rather than reintroducing its own competing contract.
2. PR fix(a11y): repair editor contrast and keyboard focus #362 / release issue release: reconcile Office and npm versions before next stable registry publication #118 now own the release-blocking canonical correction from stale three-file draft-release prose to the protected release workflow's four-file inventory (npm tarball, Office wheel, inkspan.spdx.json, SHA256SUMS). Current feat(editor): insert XLS/XLSX worksheets into document body #318 no longer carries src/releaseContractCanonicalConsistency.test.ts or docs/OPERABILITY.md as PR-owned files. Any still-inherited protected-main three-file wording in feat(editor): insert XLS/XLSX worksheets into document body #318's overlapping documentation must be inherited from the eventual protected-main fix(a11y): repair editor contrast and keyboard focus #362 result after that release blocker integrates, not repaired independently here.

The current changed-file inventory is therefore interpreted by product responsibility, not by the stale former body: overlapping canonical docs such as docs/CONTRACTS.md, docs/TEST_STRATEGY.md, docs/PRD.md, docs/TRD.md, docs/TRACEABILITY.md, README/CHANGELOG and package metadata are changed here only where required to describe or package the spreadsheet active-PR slice. Do not use this branch to re-own #362's release correction or #156's maturity correction.

Exact-current-head evidence

For unchanged fce8fe72ebf4d438c17a7c889dd37c92118c6204:

• CI 32144783586: completed / success;
• SAST Semgrep 32144783644: completed / success;
• Security Scan 32144783558: completed / failure;
• exact failing job: OSV 95735816267; base/head scans completed successfully and failure occurs at Report PR-introduced OSV findings;
• same run: Trivy 95735816261 success, Scorecard 95735816309 success, dependency-review 95735816431 success with unsupported action step skipped;
• exact osv-scan-debug artifact: 9328396543, digest sha256:594d8a8551017a78c98a33b6574bfbb9ce945f8b202988788ab96b224c3cfd3d, bound to this exact head/run;
• formal submitted review: one GitHub Advanced Security COMMENTED review, non-approving;
• the sole inline thread is resolved/outdated;
• qualifying approving reviews: 0.

Security failure is non-passing. Repository CI/SAST do not override it.

Foreign central OSV owner boundary

The current OSV failure remains owned by existing central .github#1158, not by an Inkspan-local dependency suppression. The existing owner path must preserve genuine affected-version fail-closed behavior while distinguishing official SheetJS CE 0.20.3 provenance from incorrect npm-registry advisory attribution. Do not rename the dependency, suppress advisories, weaken Security Scan, or create a competing central writer.

Inkspan-side GREEN after the central owner repair is a fresh Security Scan on the then-unchanged #318 head whose OSV comparison no longer reports fixed official xlsx@0.20.3 as a PR-introduced vulnerable npm package; any genuine applicable advisory must still fail closed.

Remaining acceptance

1. Keep docs: reconcile protected capability maturity #156 as sole owner of the Markdown protected-main maturity correction and fix(a11y): repair editor contrast and keyboard focus #362/release: reconcile Office and npm versions before next stable registry publication #118 as sole owner of the release-inventory correction.
2. Require a fresh passing Security Scan after the .github#1158 owner repair; predecessor results do not transfer.
3. Revalidate exact head/live base, ancestry, formal reviews/threads, required central workflows and live governance after any movement.
4. Obtain the qualifying independent latest-push approval required by live governance before any future lifecycle transition.
5. Keep this PR Draft/unmerged while release: reconcile Office and npm versions before next stable registry publication #118 owns the release freeze.

No force push, destructive rebase, self-approval, gate weakening, predecessor-evidence transfer or fabricated release authority is permitted.

[seonghobae]

Implementation lane: agent/318-spreadsheet-body-import, exact protected base main@e8109ec2a17de8bd6594487aa12c8c8a93cb2c03. The first test-only/product-placeholder commit is faf7c2fd4bb2ce021a22506838ad44786115fefb; it adds only the executable RED contract, repository plan, and a temporary read-only workspace snapshot workflow. No protected-main, release, registry, credential, persistence, or deployment mutation is intended.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/318-spreadsheet-body-import

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Exact-head OSV triage — fce8fe7

The exact current head fce8fe72ebf4d438c17a7c889dd37c92118c6204 is blocked by the osv-scan job in run 32144783558 / job 95735816267. Build, dependency-review, Trivy, Scorecard, Semgrep, and the separate osv-scanner check passed, but the canonical PR-introduced comparison reported two High findings for the direct xlsx@0.20.3 CDN tarball in pnpm-lock.yaml:

• GHSA-4r6h-8v6p-xvw6 / CVE-2023-30533
• GHSA-5pgg-2g8v-p4x9 / CVE-2024-22363

The OSV records document CDN releases in their affected-range notes, but this exact workflow still reports the exotic tarball as affected with no fixed version. Because this PR parses user-selected spreadsheet files, I am not waiving or bypassing the failing security gate; the dependency provenance/fix must be resolved and re-run at the same head before readiness can be claimed.

Evidence: https://github.com/ContextualWisdomLab/inkspan/actions/runs/32144783558/job/95735816267
OSV records: https://osv.dev/vulnerability/GHSA-4r6h-8v6p-xvw6 and https://osv.dev/vulnerability/GHSA-5pgg-2g8v-p4x9

[seonghobae]

Fresh downstream revalidation (2026-08-28): no local dependency mutation is authorized for this finding.

• Inkspan feat(editor): insert XLS/XLSX worksheets into document body #318 remains unchanged at exact head fce8fe72ebf4d438c17a7c889dd37c92118c6204, with canonical osv-scan still failing at job 95735816267 in run 32144783558.
• The existing owner boundary is live: .github#1158 is now head 54f5bbe73a292aa11d920efc263f88870acde4b9, based on central main@f6c2a2702b7b7578b2d1fc5f2f9a5125a0390d33, but its materialized checks are all cancelled. Its cancelled owner evidence cannot authorize a consumer rerun or be transferred as green proof.
• The committed official SheetJS CDN URL, version, and integrity remain the active branch contract. Renaming to a mirror, suppressing the two advisories, or weakening the scanner would bypass the central provenance owner and is intentionally not done.

Consumer acceptance remains: central #1158 must reach protected-main under its own exact-head governance, then #318 needs a fresh Security Scan on this unchanged/descendant head showing the official immutable xlsx@0.20.3 exception while affected and unknown/conflicting provenance stays fail-closed. No waiver, ready, or merge action was taken.

[seonghobae]

Conflict integration and current evidence

I brought the existing PR head fce8fe72ebf4d438c17a7c889dd37c92118c6204 up to protected main@0b88c16f14f51b54a87eb7164f0edfb06dd60902 with one ordinary, non-force merge commit:

a6d9bb2101c8b4779d2a0940a4ff1fd65f3f06f6

The resolution retains the spreadsheet source and package changes, the Proposed ADR 0032 status, protected-main's design-token documentation, and the current four-file release inventory. pnpm 11.5.3 regenerated the lockfile; frozen installation passed. A runnable merge check proves the protected lock content is unchanged except for the exact pinned SheetJS CE 0.20.3 importer/package/snapshot blocks and that the spreadsheet runtime files are byte-identical to the pre-merge head.

Current local evidence:

• pnpm build passed, including vite.spreadsheet.config.ts and generated cwl-spreadsheet ESM/CJS outputs.
• pnpm typecheck passed.
• Focused acquisition: 197 passed / 2 failed / 199 tests. The two failures are retained: the existing real-XLSX body-import wait remained at Importing spreadsheet…, and the toolbar picker-contract test exceeded the unchanged 5,000 ms timeout. No fixture, deadline, or threshold was changed.
• Native spreadsheet/parser, real XLSX/BIFF8, hidden-sheet, formula/link inertness, source-boundary, and package-contract tests passed within the same acquisition.
• CodeGraph initialized and synced on the integrated tree.

Visual inspection attempt is retained at /private/tmp/inkspan-pr318-proof.PhluJ9/visual.log and screenshots. The generic clipboard harness page does not mount the editor UI, so the probes correctly found no toolbar/textbox; this is not claimed as UI acceptance. Existing direct three-engine visual evidence remains the applicable UI baseline. A mounted spreadsheet-specific browser visual needs a dedicated harness entry before it can be used as acceptance.

Security remains open: central .github PR #1158 is still OPEN and owns the OSV provenance repair. Its predecessor security result is not transferred, and this PR remains Draft/blocked until a fresh exact-head Security Scan and qualifying independent latest-push approval exist. No merge bypass, self-approval, publication, or deployment was performed.

Evidence protocol and failed output: /private/tmp/inkspan-pr318-proof.PhluJ9/protocol.md.