🎨 Palette: 입력 폼의 필수 항목에 명시적인 (required) 텍스트 추가

[seonghobae]

Current authority — Draft predecessor preserved by successor #662

• Current predecessor head: 586bfc9a4a3436653e0488cae55fa4b34b22e525.
• This fifth repeated writer commit again restored Jackson 2.22.1 and the expired OSV exception while deleting the canonical owner evidence. Exact-head Security 36830817393 is FAILURE. CI 36830817378, SAST 36830817306, and fuzz 36830817438 are GREEN; CodeQL 36830817375 is skipped. This head is not mergeable authority.
• Direct repairs were preserved in ordinary history but were repeatedly overwritten by the same eight-path rollback. No force, destructive rebase, or close was used.
• Draft successor fix(security): preserve #661 accessibility and Jackson owner delta #662 carries every valid accessibility and canonical-owner delta at exact head 802b309d21bc26714d22283c9a2ffe596156e6db.
• Completeness proof: successor versus the first validated integration 7d0e62bac287e590df8451950a0c90952ed76b36 differs only in docs/product-technical-gap-baseline.md; successor versus the original UI head 600995328dc03d53a63e7b67d3b8c9501f3baa17 differs by exactly the eight canonical owner paths.
• This predecessor remains open Draft as evidence. Merge is HOLD.

---

Superseded predecessor context

🎨 Palette: 입력 폼의 필수 항목에 명시적인 (required) 텍스트 추가

💡 변경 내용: "Document" 라벨을 "Document (required)"로 변경하고 span 태그로 감쌈
🎯 이유: 웹 접근성 향상을 위해 시각적 표시(*) 대신 스크린 리더가 읽을 수 있는 텍스트가 필요함.
📸 전후: [해당사항 없음]
♿ 접근성: 필수 항목임을 스크린 리더가 명확하게 인지할 수 있도록 개선됨

---

PR created automatically by Jules for task 1952575059373729323 started by @seonghobae

Summary by CodeRabbit

• 접근성 개선
  • 필수 문서 업로드 항목에 별표 대신 “(required)” 문구를 표시합니다. 파일 입력의 필수 설정은 유지됩니다.
• 보안
  • Jackson 구성 요소를 최신 버전으로 업데이트하고, 관련 보안 예외와 소프트웨어 구성요소 정보를 갱신했습니다.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: deeb637f-a1af-4c08-978f-0db822ca5634

📥 Commits

Reviewing files that changed from the base of the PR and between 06633a2 and 4b5537f.

📒 Files selected for processing (3)

• .jules/palette.md
• src/main/java/com/clearfolio/viewer/controller/ViewerUiController.java
• src/test/java/com/clearfolio/viewer/controller/ViewerUiRequiredFieldAccessibilityTest.java

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

업로드 레이블을 Document (required)로 변경하고 문구를 <span>으로 감쌌습니다. 필수 입력 속성은 유지했습니다. 지침과 페이지 응답을 확인하는 테스트도 추가했습니다.

Changes

필수 입력 레이블 표시와 검증

Layer / File(s)	Summary
레이블 표시와 검증 .jules/palette.md, src/main/java/com/clearfolio/viewer/controller/ViewerUiController.java, src/test/java/com/clearfolio/viewer/controller/ViewerUiRequiredFieldAccessibilityTest.java	필수 입력 레이블에 (required) 문구를 <span>으로 감싸 표시하도록 지침을 추가했습니다. 업로드 레이블을 Document (required)로 변경했으며, 파일 입력의 required 속성은 유지했습니다. 테스트는 / 응답 상태, 콘텐츠 타입, 레이블 텍스트를 확인합니다.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Possibly related PRs

• ContextualWisdomLab/clearfolio#576: 같은 업로드 레이블에 별표를 표시하는 변경입니다.
• ContextualWisdomLab/clearfolio#634: 같은 업로드 레이블의 필수 입력 표시와 <span> 사용을 다룹니다.

Merge Risk: ⚪ Minimal · up to 60099

The upload label now explicitly states that a document is required without changing upload enforcement. No merge-blocking risk is identified in the supplied changes.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	PR 제목은 입력 레이블을 “Document (required)”로 변경하는 주요 내용을 정확하게 설명합니다. 제목의 “Palette:” 접두사와 이모지는 의미를 방해하지 않으며, 변경 범위도 명확합니다.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Preserved predecessor and verified successor

The original branch advanced five times with the same eight-path Jackson rollback. Its current head 586bfc9a4a3436653e0488cae55fa4b34b22e525 fails Security 36830817393. It remains open Draft; no valid delta was discarded and no force/rebase/close was used.

Draft successor #662 now carries the complete valid lineage at 802b309d21bc26714d22283c9a2ffe596156e6db:

• accessibility controller and regression test preserved;
• complete fix(security): bump Jackson from 2.22.1 to 2.22.3 #503 Jackson 2.22.3, SBOM, attribution, downgrade contracts, expired-exception removal, CHANGELOG, and product-gap RCA preserved;
• all five concurrent commits retained in ordinary history;
• versus validated integration 7d0e62bac287e590df8451950a0c90952ed76b36, only the expanded product-gap baseline differs;
• versus original UI head 600995328dc03d53a63e7b67d3b8c9501f3baa17, exactly the eight owner paths differ.

Successor exact-head Checks and independent approval remain mandatory. Merge is HOLD.

[google-labs-jules]

Exact-head Security RCA and canonical-owner integration

Predecessor 600995328dc03d53a63e7b67d3b8c9501f3baa17 failed Security Scan 36798597036, Trivy job 110167652487, on five jackson-databind findings: CVE-2026-68497, CVE-2026-91776, CVE-2026-91777, CVE-2026-19032, and CVE-2026-83557. The accessibility delta does not own Maven dependency policy.

Current exact head 7d0e62bac287e590df8451950a0c90952ed76b36 ordinarily integrates canonical dependency owner #503 at bf121dffff24e771739f50b9e2cc7961459670a2 through a two-parent commit. The complete owner delta is present: Jackson 2.22.3, generated SBOM hashes/edges, regenerated attribution, POM/SBOM/attribution regression contracts, expired OSV-exception removal, CHANGELOG, and product-gap evidence. The required-field controller and its accessibility test remain the predecessor blobs.

Fresh exact-head runs: Security 36829111902, CI 36829111991, SAST 36829111823, fuzz 36829111945, and CodeQL 36829111968 are non-terminal and are not counted as passing. No manual rerun, gate weakening, or merge was performed.

Acknowledged.