⚡ Bolt: O(1) 메모리로 순차적 코드 변경 횟수 계산 최적화

[seonghobae]

Performance and numerical-correctness scope

_summarize_one_section counts adjacent chord changes with O(1) auxiliary memory by retaining only previous_chord while preserving overlap-weighted duration aggregation. The canonical branch also fail-isolates malformed chord/timing evidence so one bad record or section window cannot erase valid neighboring harmony evidence or become a false buyer-visible section range.

Protected base: develop@acdbea6344fe1231c39535b575f4de35e4c607c9.
Exact current head: c686ae450677303d2622abec1869aef6cef98155.

The exact current diff contains eight files: CHANGELOG.md, services/analysis-engine/src/bandscope_analysis/chords/section_harmony.py, and six focused section-harmony regression files. There is no dependency, lockfile, workflow, database, public schema, network/filesystem authority, IPC surface, model/provider configuration, review credential, .trivyignore, or vulnerability-suppression delta.

Regression-first correctness work

The canonical regression set covers non-finite and non-positive timing, malformed non-mapping entries, blank labels, Boolean timing, numeric values that cannot be represented as finite Python floats, one-shot iterators, and malformed section-window shapes.

Validated predecessor be0fed7cb254e3eb0514cb6f0ac627c603754eb4 established the intended product/test tree. Later branch movement through f02738b4a9d54e3360f35eb50dfa07e4aa662407 regressed that tree by deleting malformed-label/numeric-overflow regressions, removing corresponding production guards, and adding an unconditional CVE-2026-16633 Trivy suppression even though that protected-base dependency finding is owned by #783. A later restoration removed that unrelated suppression and restored the validated fail-isolated implementation/tests/CHANGELOG.

Fresh exact-head CI on predecessor 9ed375b975135dfae55b6da811c3adf66a2adbb8 then exposed one BandScope-owned coverage defect in the restored implementation: section_harmony.py lines 170-171, the except (IndexError, TypeError): continue malformed-window isolation path, remained uncovered. The exact failing job otherwise reported the full frontend/shared-types/Python suite green and failed only the required Python 100% statement threshold at 99.93%.

Current head c686ae450677303d2622abec1869aef6cef98155 adds the smallest focused regression for that owning boundary. test_section_harmony_boundary_shape.py supplies both a short tuple (IndexError) and a non-subscriptable None window (TypeError) next to one valid section and requires the malformed window to be skipped without erasing valid neighboring output. No production behavior changed for this coverage repair.

Key preserved boundaries:

• non-mapping chord entries are skipped independently rather than collapsing the entire section result;
• blank/whitespace-only chord labels do not become buyer-visible harmony evidence;
• Boolean timing is rejected instead of being coerced through Python float() to 0/1 seconds;
• overflow/unrepresentable numeric timing is fail-isolated at the owning segment/window boundary;
• malformed/short/non-subscriptable section windows are isolated from valid neighbors;
• one-shot iterable chord inputs remain supported; and
• inherited dependency CVEs are not hidden from Trivy in this unrelated numerical branch.

Exact-current-head verification

Fresh repository workflows bind to c686ae450677303d2622abec1869aef6cef98155 against protected merge tree b499f33d74260f601319c358838592040370d4b4.

Terminal-success on this unchanged head: ci, release, build-baseline, bandit, secret-scan-gate, SAST Semgrep, and sbom. Exact ci / build-and-test proves desktop 194/194 with 100% statements/branches/functions/lines, shared-types 20/20 with all four coverage dimensions at 100%, and Python 701 passed / 1 skipped, 3038/3038 statements at 100%, including section_harmony.py 76/76 statements. The new malformed-boundary regression contributes two passing cases. Current protected Python coverage tooling is statement-only; #861 remains the canonical branch-measurement owner, so Python branch coverage is not inferred from this result.

Exact-head build-baseline run 32095925592 is now terminal-success on the unchanged head. Its earlier in-progress state was non-passing and is superseded by this terminal result.

The two terminal security failures were inspected at exact current-head job/log level before classification:

• security-audit run 32095925741, job 95587144694, checks out merge tree b499f33... and fails first at npm audit --workspaces --audit-level=high on the protected-base nanoid <3.3.18, pdfjs-dist >=5.6.83 <6.2.108, and undici 7.0.0-7.28.0 HIGH set. Python/Rust audit stages are skipped because npm exits first; skipped evidence is not success.
• aggregate Security Scan run 32095925973 has successful Dependency Review, OSV base-vs-head comparison, and Scorecard. Its only failed job is trivy-fs job 95587145741, which scans successfully, uploads SARIF, then reports exactly one HIGH finding: CVE-2026-16633 for protected-base pdfjs-dist at package-lock.json:6370, with the workflow directing remediation to the shared base.

Because this branch has no JavaScript dependency/root-lock or suppression delta, those failures remain canonical #783 dependency-security evidence and are neither copied nor suppressed here.

Review / dependency state

Fresh inline review inspection has zero unresolved threads. Existing OpenCode CHANGES_REQUESTED submissions bind only to predecessor heads and the central coverage prerequisite; they do not approve or condemn the current head. There is no qualifying independent non-author exact-current-head approval.

Canonical #783 remains the protected JavaScript dependency-security owner; #894 owns the separate checkout-credential lifecycle repair observed in inherited workflows; #861 owns Python branch-measurement baseline integration; current central coverage-materialization owner is read-only ContextualWisdomLab/.github#1020. This branch does not duplicate or suppress those authorities.

Merge gate

Keep Draft and unmerged until the unchanged then-current head has all applicable repository CI/release/cross-platform build/SAST/security/SBOM/supply-chain gates terminal-success, canonical dependencies integrated and regenerated where applicable, exact owned production statement and branch coverage at 100% plus required public docstrings, zero valid unresolved current-head findings, a qualifying independent non-author last-push approval, and ordinary branch-protection acceptance without bypass.

Queued, in-progress, skipped-required, failed inherited-base, predecessor-head, protected-base, status-only/model-only, author/self, suppressed-finding, or administrative-bypass evidence is not success.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5a454d23-405c-4e9a-be4e-fff484cf0b1e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 42555f0ba2651ff0406ae1284d7cb7db2ea81154.

• Head SHA: 42555f0ba2651ff0406ae1284d7cb7db2ea81154

• Workflow run: 31513552063

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 8a5db607cb0fad82c422ab90f1a382d09f34183d
• Workflow run: 31677107418
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 8a5db607cb0fad82c422ab90f1a382d09f34183d.

• Head SHA: 8a5db607cb0fad82c422ab90f1a382d09f34183d

• Workflow run: 31677107418

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (4 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (4 files)"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 8a5db607cb0fad82c422ab90f1a382d09f34183d.

• Head SHA: 8a5db607cb0fad82c422ab90f1a382d09f34183d

• Workflow run: 31671788876

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (4 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (4 files)"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 8a5db607cb0fad82c422ab90f1a382d09f34183d.

• Head SHA: 8a5db607cb0fad82c422ab90f1a382d09f34183d

• Workflow run: 31677107418

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (4 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (4 files)"]
  R1 --> V1["required checks"]

Loading

[seonghobae]

@opencode-agent address

Operate only if the live head is exactly 8a5db607cb0fad82c422ab90f1a382d09f34183d; otherwise stop without writing and report the new head. Reconstruct a bounded numerical-performance PR from the current polluted diff.

Restore .jules/bolt.md, apps/desktop/package.json, and package-lock.json exactly from protected develop; PR #783 owns the JavaScript dependency/security baseline and no dependency changes belong in this chord-summary optimization. Preserve only the streaming previous_chord implementation in services/analysis-engine/src/bandscope_analysis/chords/section_harmony.py.

Add a focused regression in services/analysis-engine/tests/test_section_harmony.py that proves the streaming state is updated only by segments that actually overlap the section: include an overlapping chord, a non-overlapping different chord, then another overlapping chord, and assert the computed chord_changes matches the prior filtered-list semantics. Also retain existing consecutive-identical, empty, boundary-straddling, malformed-segment, deterministic tie, and main-chord tests. Do not use wall-clock timing as a CI gate; the bounded claim is removal of the O(N) temporary overlapping_chords list/slice while preserving O(N) traversal and O(1) extra state for change counting.

Final base-to-head scope should be services/analysis-engine/src/bandscope_analysis/chords/section_harmony.py, services/analysis-engine/tests/test_section_harmony.py, and a concise CHANGELOG.md Unreleased performance entry only. Run focused/full analysis-engine tests with 100% owned production statement/branch coverage and public API docstrings, Ruff check/format, mypy, compileall, native Rust/parity gates where applicable, and repository quickcheck. Then request fresh exact-current-head CI/security/SAST/SBOM and central review. No polluted-head or predecessor evidence transfers; after #783 lands, update onto the current protected base and revalidate.