feat(workspace): open Stem Lab as honest isolation lanes

[cursor]

Buyer-visible Stem Lab slice

Stem Lab was a coming soon dead end even after analysis had named roles, ranges, and clashes. This Draft opens it as a display-only isolation board: sidebar/compact-nav access before and after analysis, an honest pre-analysis next action, and one role lane showing validated range evidence, sections to lock first, clashes, and rehearsal priority without pretending a playable stem file exists.

Exact current head: e33ca56a3922b78b5569e32e1a949f5a488c7e01.
Protected base: develop@acdbea6344fe1231c39535b575f4de35e4c607c9.
Draft retained.

No Play/Loop/Solo control, generic file API, playback IPC, dependency/root-lock, database, model, or new filesystem/network authority is added. Korean/English copy, Storybook Workspace/Stem Lab, repeatable lane design tokens, doctoring, and CHANGELOG remain part of the bounded UI slice.

Current-head convergence and test-first repairs

The former documented head 30f69b370c2c6669e96a30a283187679bd9b963e is historical. Current head is a direct 10-commit descendant and changes only Stem Lab range/lane behavior, focused tests, locale copy, doctoring, and CHANGELOG.

Earlier review findings on cross-section range widening and first-section-label trimming were fixed and their current inline threads are resolved. Subsequent work tightened the range evidence boundary further:

• scientific-pitch syntax gates both initial and later range evidence;
• cross-section widening compares pitch rather than label strings;
• a contradictory complete range from one section is discarded as a unit instead of widening a trustworthy lane;
• partial valid range evidence may remain available for a later section to complete;
• a complete aggregate range whose validated lower boundary is above its validated upper boundary fails closed to unknown range evidence;
• malformed/incomplete ranges do not render a buyer-facing Playable range claim and instead trigger the explicit ear-check action;
• valid section labels remain normalized and first-seen ordered; and
• overlap warnings remain unique/non-blank without inventing playable stem availability.

Current stemLanes.range-integrity.test.ts explicitly proves that a contradictory section range (A0–C-1) cannot widen a previously valid A2–C4 role range. Current production source documents the same fail-closed contract. No dependency, lockfile, model, network, filesystem, database, IPC, or reviewer-credential authority changed in these follow-ups.

Exact-current-head repository evidence

All evidence below binds only to e33ca56a3922b78b5569e32e1a949f5a488c7e01.

Terminal-success BandScope repository workflows:

• ci run 31989049887;
• release run 31989049835;
• build-baseline run 31989049893;
• sbom run 31989049890;
• secret-scan-gate run 31989049795;
• SAST Semgrep run 31989049875; and
• bandit run 31989049874.

Two exact-head repository security workflows are non-passing and were inspected at job/log level before classification.

security-audit — inherited protected-base dependency baseline

Run 31989050024, job 95269091918, completes checkout/tool setup and npm ci, then fails only at npm audit --workspaces --audit-level=high on the protected-base JavaScript set:

• nanoid <3.3.18 (GHSA-2v37-7h3g-55p8);
• pdfjs-dist >=5.6.83 <6.2.108 (GHSA-hq66-cqwq-w95j); and
• undici 7.0.0–7.28.0 advisories.

Python/Rust audit stages are skipped because npm exits first and are not counted as success. This branch has no JavaScript dependency/root-lock delta, so the failure remains canonical #783-owned protected-base evidence and is neither suppressed nor copied here.

aggregate Security Scan — inherited Trivy finding

Run 31989049974 has successful OSV base-vs-head comparison, Dependency Review, and Scorecard. Its only failed substantive job is trivy-fs 95269092881, which reports exactly one HIGH whole-tree finding:

CVE-2026-16633 for pdfjs-dist at package-lock.json:6370.

The scan itself directs remediation to the shared base so open PRs inherit the fix. This remains #783-owned and is not a Stem Lab source defect.

Current inline review-thread inspection shows all visible threads resolved. Historical automated review/check evidence is not qualifying independent approval.

Security Notes

Attack surface and trust boundary

The WebView renders analysis-derived RehearsalSong role names, range labels, section labels, and overlap warnings. Those values are untrusted presentation data and are rendered through React text. Stem Lab does not acquire storage, process, network, filesystem, model, or IPC authority.

Mitigations and test points

No generic file/playback API is introduced; copy says isolation targets, not available audio stems. Scientific-pitch syntax and cross-section range-integrity checks gate display evidence; a missing/invalid/contradictory trustworthy range fails closed to an explicit ear-check action. Tests cover empty-state next action, role/range display, pitch-aware cross-section widening, recovery from partial evidence, contradictory-section isolation, malformed evidence, UI fallback, section-label normalization, overlap-warning normalization, fallback role naming, locale pairing, and accessible lane structure.

Dependency / merge boundary

#783 owns the protected JavaScript dependency-security baseline. #861 owns Python statement/branch baseline integration where applicable. The current read-only central required-workflow repair is ContextualWisdomLab/.github#1020; historical .github#939 / closed predecessors do not transfer evidence. Do not redispatch unchanged central reviewer/coverage paths merely to reproduce a known unintegrated prerequisite.

Keep Draft and unmerged until the unchanged then-current head has terminal-success repository and central CI, desktop statement/branch/function/line coverage, required owned statement/branch coverage, type/lint/build/Storybook evidence where applicable, SAST/security/SBOM/supply-chain/package/release evidence, zero valid unresolved findings, #783/#861/current central prerequisites integrated and regenerated, a qualifying independent non-author last-push approval, and ordinary branch-protection acceptance without bypass.

Queued, skipped-required, failed, predecessor-head, protected-base, model-only, self/author, or bypass evidence is not success.

[cursor]

Review (head 2f31406a)

Stem Lab is the right buyer-facing fix for the coming-soon dead end. This head opens a display-only isolation board, keeps playback out, pairs Korean/English copy, adds Storybook Workspace/Stem Lab, and records design tokens plus doctoring.

No Critical findings. Do not self-approve or merge. Keep this draft until the range-merge residual is fixed and exact-head CI is green. Do not open a second Stem Lab PR.

Held

• Sidebar stems view is navigable before analysis and shows a next action, not Coming soon.
• After analysis, one lane per role id lists range, sections, and clash warnings.
• No Play / Loop / Solo control and no new file or playback API.
• Distinct from NIM landing #885, lock-in residual #880, and CLI authority #811.

Residual

collectStemLanes does not widen range when the same role appears in a later section. The merge test already uses A1–A2 then A1–C3 and never asserts the chorus ceiling. Fix that on this branch.

Also trim the first-seen section label the same way pushUniqueLabel does, so a padded label cannot duplicate after merge.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Stem Lab lanes are the right slice; range merge is still first-seen only

Display-only isolation lanes, honest empty-state copy, paired ko/en strings, Storybook Workspace/Stem Lab, and no playback API are the correct buyer cut. Do not add Play / Loop / Solo here.

Residual on exact head 2f31406a:

• collectStemLanes writes range only on first insert. A later section with a wider ceiling is dropped.
• The merge fixture uses verse A1–A2 then chorus A1–C3 and never asserts highestNote === "C3".

Next action: widen lowest/highest across sections on this branch and lock that in stemLanes.test.ts. Do not open a second Stem Lab PR. Distinct from #811, #880, and #885.

  

_{Sent by Cursor Automation: Fix Issues}

[seonghobae]

Exact-head maintenance update for db3df9f6c503c9f41045cc6bc5ba4b12839d814e:

• Fresh exact-code review found a separate buyer-truth gap after the existing scientific-pitch syntax repair: two individually valid pitch labels could still form a contradictory complete range such as G5–C4, and Stem Lab would present it under Playable range.
• RED regression 538aa3cccef02fe76db2c576d7fb1d8ffca71ce6 adds stemLanes.range-order.test.ts and requires an inverted complete range to fail closed to blank range evidence before the UI labels it playable.
• GREEN production repair 6908bf46effae295878949ede8c184581b0a0a7e compares the parsed low/high pitch values after cross-section aggregation. Partial ranges remain recoverable by later sections, but a complete low > high pair is cleared so the existing explicit ear-check UI is used.
• 123355b9ff18b5f80fbc23786263d2863cad0e66 / exact head db3df9f6c503c9f41045cc6bc5ba4b12839d814e align CHANGELOG and doctoring with the ordered-range evidence boundary.

Fresh exact-head repository runs were emitted. Several runnerless jobs were cancelled with the GitHub annotation The run was canceled by @seonghobae; those exact cancellations were inspected before rerunning failed jobs. Current reruns/pending jobs remain non-passing until terminal. No dependency, lockfile, filesystem/network/IPC/model authority, or reviewer credential changed. Keep Draft; no predecessor-head evidence transfers.