test(ci): resolve the office matrix contract instead of pinning its text

[seonghobae]

Scope

src/workflowExactHead.test.ts asserted the Office job's python-version matrix by exact string equality:

expect(officeJob).toContain(
  "python-version: \${{ github.event_name == 'pull_request' && fromJSON('[\"3.14\"]') || fromJSON('[\"3.11\", \"3.12\", \"3.13\", \"3.14\"]') }}",
);

That is a surface-syntax pin. Any legitimate reformatting of the workflow expression, or a deliberate change of matrix shape, fails this suite on every candidate head at once, reporting a missing substring rather than the drift that actually occurred. Single test file changed; ci.yml is not modified.

Why now

This is the remaining TypeScript-side instance of a defect class that is currently costing the whole queue. The Python-side instance is the reason protected main is red on all four Office / Python 3.1x jobs: office/tests/test_python_support_contract.py pins the literal inline list form while the workflow declares the conditional form, so it reports assert None is not None on every head. That repair lives on its own writer (#405). The rule behind both is recorded as a durable obligation in #411.

The two instances point in opposite directions, which is exactly the hazard: one file demands the conditional, the other demands the literal list, and no single ci.yml satisfies both.

What replaces it

officeMatrixPythonVersions resolves the declaration instead of matching it — it reads the job's python-version value, decodes every fromJSON payload the expression selects between, and falls back to decoding a literal sequence. Assertions then state resolved obligations and fail with the observed value:

• no matrix entry may name an unsupported minor;
• the exhaustive set must equal SUPPORTED_PYTHON_VERSIONS in order;
• the pull-request set must include the newest supported minor.

This does not decide the matrix shape

Whether the Office job keeps the per-event conditional or returns to a literal sequence is a separate question owned by the writer proposing that change (#402 proposes the literal form). This contract now accepts either and objects only when the resolved set stops matching the supported minors, so it stops being a veto on that decision.

declared form	resolves to
current conditional	[['3.14'], ['3.11','3.12','3.13','3.14']]
the same conditional, reformatted whitespace	[['3.13','3.14'], ['3.11','3.12','3.13','3.14']]
literal sequence (the form #402 proposes)	[['3.11','3.12','3.13','3.14']]

Each of those three is asserted permanently in the added resolves the office matrix from its value rather than its spelling case, along with a required throw for a job with no matrix and for a value that resolves to no version list.

Verification

• src/workflowExactHead.test.ts: 12 tests passed.
• Full suite: 156 files, 883 tests passed.
• tsc --noEmit: passed.
• Drift injection: replacing fromJSON('["3.14"]') with fromJSON('["latest"]') in the real .github/workflows/ci.yml fails with the office python-version matrix declares unsupported entries in ["latest"]. The workflow was restored; git status confirms .github/ is clean and this commit does not touch it.
• Base is protected main at 0b88c16f14f51b54a87eb7164f0edfb06dd60902.

Scoped local validation of the changed surface, not hosted acceptance. Merge remains gated on the required current-head review and scan verdicts; no bypass is requested.

---

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 33683878-5f24-4d5c-92df-cbe69ca94acd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for a7f8109fe08e29d368c41a291b019455392d0523.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• CI/Office / Python 3.14: FAILURE (https://github.com/ContextualWisdomLab/inkspan/actions/runs/34116508168/job/101724476146)
• CodeQL PR/CodeQL compatibility analysis (actions): FAILURE (https://github.com/ContextualWisdomLab/inkspan/actions/runs/34116508037/job/101746503920)
• CodeQL PR/CodeQL compatibility analysis (javascript-typescript): FAILURE (https://github.com/ContextualWisdomLab/inkspan/actions/runs/34116508037/job/101746503994)
• CodeQL PR/CodeQL compatibility analysis (python): FAILURE (https://github.com/ContextualWisdomLab/inkspan/actions/runs/34116508037/job/101746503970)
• CodeQL compatibility analysis (actions) check run: failure (https://github.com/ContextualWisdomLab/inkspan/actions/runs/34116508037/job/101746503920)
• CodeQL compatibility analysis (javascript-typescript) check run: failure (https://github.com/ContextualWisdomLab/inkspan/actions/runs/34116508037/job/101746503994)
• CodeQL compatibility analysis (python) check run: failure (https://github.com/ContextualWisdomLab/inkspan/actions/runs/34116508037/job/101746503970)
• Office / Python 3.14 check run: failure (https://github.com/ContextualWisdomLab/inkspan/actions/runs/34116508168/job/101724476146)
• Required Noema Review/noema-review: FAILURE (https://github.com/ContextualWisdomLab/inkspan/actions/runs/34116508011/job/101747290188)
• Security Scan/trivy-fs: FAILURE (https://github.com/ContextualWisdomLab/inkspan/actions/runs/34116508121/job/101745811759)
• noema-review check run: failure (https://github.com/ContextualWisdomLab/inkspan/actions/runs/34116508011/job/101747290188)
• trivy-fs check run: failure (https://github.com/ContextualWisdomLab/inkspan/actions/runs/34116508121/job/101745811759)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["TypeScript/JavaScript: workflowExactHead.test.ts"]
  S1 --> I1["TypeScript or JavaScript runtime"]
  I1 --> R1["Review risk: TypeScript/JavaScript: workflowExactHead.test.ts"]
  R1 --> V1["package test plus coverage"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: a7f8109fe08e29d368c41a291b019455392d0523
• Workflow run: 34130391335
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES
• Coverage gate: success
• Model pool: exhausted
• Verdict: REQUEST_CHANGES
• Formal review: test(ci): resolve the office matrix contract instead of pinning its text #412 (review)

[seonghobae]

Current-head failure evidence (8f39454): CodeQL compatibility jobs fail in the repository dispatch gate with VERDICT_STATE=pending and DISPATCH_OUTCOME=success; the log explicitly says the dispatch workflow should rerun the exact failed job after publishing its terminal verdict. The run list contains no follow-up CodeQL dispatch for this SHA. This is an orchestration/provider-state failure, not a source finding in workflowExactHead.test.ts. I am not transferring predecessor reviews or claiming merge readiness.

[seonghobae]

Expanded local Office validation

Exact head: f44b5889ded28ed1a5b55da9985b0fa73025b0a3 in /private/tmp/inkspan-pr412-review.

Project-local Python 3.14.6 environment, pytest 9.0.3:

• Focused Python support contract: five tests passed, terminal exit 0.
• Full office/tests: 174 passed in 39.09 seconds, terminal exit 0.
• Coverage run from the Office project directory: 174 passed in 22.33 seconds; report terminal exit 0, 598 statements / 244 branches, no missing statements or partial branches, total 100% across the five configured runtime modules.

The Python parser now rejects changed event predicates while preserving the declared version arrays; this mirrors the JavaScript contract correction. No runtime Office implementation or workflow execution condition was changed by these follow-ups.

Environment boundary: dependencies were installed from office[test] into the worktree-local virtual environment on macOS. This is not the Linux requirements-ci.txt hash-lock acquisition, all-minor CI, release artifact verification, or protected-main acceptance. The configured runtime coverage scope does not include the test parser itself. Latest build, cross-engine browser and Office Python 3.14 checks are queued; unfinished checks are not green evidence.

[seonghobae]

Complete carryover trace (2026-09-08): canonical combined owner #402 now contains exact #412 head f44b5889ded28ed1a5b55da9985b0fa73025b0a3 as the second parent of ordinary merge commit 6352283aca654fb5587d3f607e02a57bf6fbd7d9. The integrated tree keeps #402's TipTap 3.30.4/dependency-security workflow policy and uses #412's exact blobs for office/tests/test_python_support_contract.py and src/workflowExactHead.test.ts; compare to protected main is ahead 30 / behind 0. #412 CI 34184813711 is terminal success, while the new #402 CI/security/CodeQL/SAST runs are queued and therefore non-passing. The predecessor remains open pending terminal successor validation; no force update, destructive rebase, self-approval, gate weakening, or evidence transfer occurred.

[seonghobae]

Final successor carryover verification (2026-09-08): #402 exact head 6352283aca654fb5587d3f607e02a57bf6fbd7d9 contains this exact head f44b5889ded28ed1a5b55da9985b0fa73025b0a3 as an ordinary merge parent. Its integrated Python and TypeScript contract blobs remain exactly 8943928c4908bd0d64de1271a82507cce4cbc9ac and 9d1a392710318fbf0767a143ed68b291f6878792; #402's workflow blob is preserved from its canonical dependency owner. #402 CI 34193697466, Security 34193697556, and SAST 34193697561 are terminal success; CodeQL 34193697465 remains queued and blocks successor merge. Closing this predecessor solely as proven complete successor carryover, with no force update, gate weakening, status transfer, or delta disposal.