Review 5632

Review-5632

PR

#5632 — fix(ci): trace affected PR check dependencies by @cixzhang (bucket: the maintainer)

HEAD REVIEWED

a0c034b7c6fccdf6ff5adea3dd7ed949bd6ac7d0 — direct child of approved #5630 head d7681c97aa7c1c2567c7f36ac91860a9bb7a18dc, stacked on approved #5608 head 37d70566fd5203763877d8f93f8e8469255f9005.

VERSIONS

LOOP VERSION: 1.9.1 AUDIT RUBRIC: 1.14.3 (the official page's Current line at gate 1; its history already contains a 1.14.4 row)

LANE

LANE: full WHY: this changes cross-cutting CI scope and trust boundaries, adds a shared classifier, changes workflow gates, and can silently suppress browser/a11y evidence.

PRIOR REVIEW AND CURRENT MAIN

There was no prior Review-5632 record and no human GitHub feedback at this head. The only PR comments were generated Vercel and PR Analysis reports.

The approved parent records establish that #5608 keeps one baseline-owned membership source and current deletion/failure verdicts, while #5630 keeps PR acceptance/promotion non-pruning, Probe current-only, and removal-bearing plans inside the 25/41 review budget. This top commit changes none of those approved evidence, acceptance, comparison, or promotion files.

Current main is 936256386b74d67f88a41adee235b91699977b2f, the stack base. No current-main commit touches the twelve top-commit files.

PROBLEM

WHY 1: component-only pull requests need bounded visual, RTL, and accessibility checks, while shared rendering inputs cannot be reduced to one trustworthy component list. WHY 2: broad PR sweeps can produce hundreds of shots a reviewer cannot judge, but silently skipping a real dependency leaves a green-looking PR with no evidence. WHY 3: a maintainer needs every rendering/audit input to reach exactly one of two outcomes: a bounded exact PR check or an explicit protected-main deferral. USER-FACING PROBLEM: a maintainer reviewing a component or rendering-infrastructure change needs a truthful scope decision; otherwise the check can either overwhelm review or report no work for a change that affects output. PROBLEM SEVERITY: broken task — an unclassified input can make all three PR browser/a11y jobs skip with no deferral. NEW FEATURE CASE: not a product feature — this repairs existing CI coverage routing. EARLY STOP: clear — the PR body, approved parent contracts, exact-head workflow log, and production classifier probes establish the intended two-outcome model.

VERDICT: clear

SOLUTION

A shared classifier reads changed paths and assigns component source to an exact component set. Shared or uncertain rendering inputs instead mark the visual and accessibility lanes for protected-main coverage. The workflow gates use that result, the report explains it, and lab readiness accepts both the old pathspec syntax and the new affected-root marker.

SOLUTION (3 decisions · 6 runtime/workflow files, +420/−146)

1. Add one changed-path classifier for exact components and global/uncertain dependencies.
2. Route CI and report generation through exact scope versus explicit protected-main deferral.
3. Preserve lab-readiness compatibility by parsing both the legacy pathspec and a new root marker.

BURDEN: medium — one new module, three consumers, one workflow gate, one parser marker, two new output booleans, and 145 focused tests across nine files. BURDEN MATCH: proportionate in shape, but incomplete in coverage — the central classifier is the right-sized owner, yet known inputs still fall through to “no scope.”

VERDICT: BLOCKS — the new two-outcome model has a third silent outcome for real component, theme, browser, and dependency inputs

ARCHITECTURE

OWNER: .github/scripts/lib/affected-scope.js owns changed-path dependency classification. TIER 1: git changed-file list, component package roots, Storybook config, theme/build infrastructure, setup/browser inputs, package manifests, and the lockfile. TIER 2: none. SEAMS: component root versus nested runtime files, shared infrastructure, stable theme packages, Storybook preview/config/static assets, browser setup/version, dependency resolution, mixed component+global changes, missing merge base, analysis/comment output, and legacy/current lab-readiness syntax. BEHAVIOR UNIT: pure utility — the classifier is deterministic and directly probeable from a path list. COMPLEXITY BUDGET: one classifier, one authoritative component-root source, every known input classified exact-or-deferred, one bounded O(changed paths) pass, and zero independent hand-maintained copies. ACTUAL BURDEN: 12 files, +709/−173 total; 6 runtime/workflow files +420/−146; 6 test files +289/−27; one new classifier module; one new comment marker that independently repeats the component roots; no dependency or lockfile change. BURDEN TREND: first reviewed head; relative to approved #5630, the top commit adds one classifier/consumer layer without changing the parent evidence or mutation authorities. RESET TRIGGER: not triggered — this is the first model-level finding, and the contraction is local: complete the classifier and make readiness consume the same root source.

domain fact	one authoritative writable source	generated / immutable projections	other writable copies
affected dependency class	affected-scope.js	analysis JSON and workflow outputs	none, but the source list is incomplete
component package roots	COMPONENT_PACKAGES in affected-scope.js	exact component records	ci.yml affected-root comment, parsed independently by lab readiness — can drift
stable theme eligibility	package manifests	trusted snapshots and stableThemes	none
protected-main coverage	scheduled/manual Release Gate	visual/a11y verdict and report	none

seam	driven result
packages/core/src/Button/Button.tsx	exact Core/Button scope; no deferral
packages/core/src/Calendar/hooks/index.ts	no component and no deferral, although Calendar, DateInput, and DateTimeInput import this runtime barrel
packages/core/src/theme/tokens.ts	shared-theme deferral
packages/core/src/utils/parseStyleKey.ts	no component and no deferral, although theme rule generation imports it and its own contract says it is shared by CSS generation and component class rendering
apps/storybook/.storybook/preview.tsx	Storybook-config deferral
apps/storybook/public/demo.woff2	Storybook-static-asset deferral; the current rendering roots contain no checked-in static/font asset, so this path class is synthetic/future-facing
.github/actions/setup/action.yml	browser-version deferral
.nvmrc	no component and no deferral, although the setup action names it as the single Node-version source
pnpm-lock.yaml / root or package manifest	uncertain dependency deferral
pnpm-workspace.yaml	no component and no deferral, although it owns the Vite catalog, overrides, linker, and allowed install scripts
component + lockfile	component is discovered internally, but workflow outputs suppress the exact component jobs and defer the whole bundle
no merge base	explicit visual/a11y deferral; no broad PR run
legacy pathspec / current marker	both parse to Core + Lab; the marker is not behaviorally tied to COMPONENT_PACKAGES and can false-pass after classifier drift

The catch-all metadata exclusion at affected-scope.js lines 17–36 drops nested runtime barrels as well as component-root metadata. The global/uncertain list at lines 39–87 omits actual setup and theme inputs. The workflow then turns any fallthrough into false/no-defer outputs at visual-scope.mjs lines 154–173.

VERDICT: BLOCKS — known inputs can bypass both exact PR scope and explicit deferral, and component roots have two writable representations

IMPACT

A pull request changing a nested component barrel, the Node source of truth, the workspace dependency catalog, or the shared theme selector parser receives has_components=false, has_stable_visual=false, a11y_deferred=false, and stable_visual_deferred=false. Its visual, RTL, and a11y jobs therefore skip as if nothing relevant changed. A mixed component+global change also loses its exact component run instead of preserving the bounded part. NEW FEATURE IMPACT: not a product feature.

VERDICT: BLOCKS — maintainers can receive a clean-looking no-scope result for a real rendering or audit dependency

API

No published package API changes. Internal CI surfaces add analysis.affectedScope, stable_visual_deferred, a11y_deferred, and the affected-root marker.

	change	public?	class	doc'd?	verdict
+	affectedScope analysis object	internal artifact	existing PR analysis	source/tests	finding — incomplete input coverage
+	deferred scope outputs/reasons	internal workflow contract	existing component/visual outputs	source/tests	finding — false/no-defer outcome remains
+	affected-component-roots marker	internal parser contract	legacy pathspec fallback	source/tests	finding — independent writable root copy

OSSIFICATION: no consumer package surface. The internal contract is repairable before landing; its exact-or-deferred invariant should be pinned now rather than learned from a skipped future PR.

VERDICT: BLOCKS — the new internal scope contract does not represent every dependency it claims to own

THEMING

No token, target, selector, CSS, or rendered theme changes. The review did trace theme dependencies: core theme files, reset/tailwind CSS, themeProps, theming-target discovery, build files, and stable theme packages defer correctly; parseStyleKey.ts, which feeds generateThemeRules, currently falls through.

VERDICT: BLOCKS — one real shared theme-generation input is outside the new dependency model

BREAKING

BEHAVIOR: yes inside CI — exact component jobs now skip on broad/uncertain input and broad work defers to the protected scheduled lane. API: no public package API change. VISUAL: no product pixels change in this top commit. THEME: no theme contract changes; only scope classification changes.

VERDICT: BLOCKS — intended routing works for listed paths, but omitted paths silently retain the old false-negative behavior

PERFORMANCE & RESOURCES

EFFECTS: zero.

Effect + deps	external system	why render/handler cannot do it	measured render cost	lifetime + cleanup	focused test
none	none	n/a	n/a	n/a	n/a

RENDER: no product render path. LISTENERS/OBSERVERS: none. LAYOUT: none. BUNDLE: no dependency or lockfile delta. Classification is one bounded pass over changed paths plus set deduplication/sort; no recursion, browser, network request, or unbounded capture is added.

VERDICT: clear

VISUAL EVIDENCE

VISUAL CHECK: not applicable WHY: the twelve top-commit files are CI scripts/tests, one workflow, and lab-readiness tooling. No component implementation, story, style, theme, asset, or rendered app file changes. Storybook was not started.

VERDICT: clear

REMEDY SEARCH

REMEDY SEARCH: not triggered — no proven visual defect

A11Y & I18N

No product role, accessible state, focus path, string, locale, or direction behavior changes. The finding is about whether a11y/RTL checks run: exact component source is scoped correctly in the positive case, but the omitted component/global inputs above can skip both PR coverage and explicit deferral.

VERDICT: BLOCKS — the changed gate can silently omit required a11y/RTL evidence

JUDGEMENT

slot	verdict
PROBLEM	clear
SOLUTION	BLOCKS — silent third outcome remains
ARCHITECTURE	BLOCKS — incomplete dependency model and duplicated roots
IMPACT	BLOCKS — real inputs can look irrelevant
API	BLOCKS — internal scope contract is incomplete
THEMING	BLOCKS — shared parser omitted
BREAKING	BLOCKS — false-negative routing remains
PERFORMANCE	clear
VISUAL	clear
A11Y & I18N	BLOCKS — required evidence can skip

GOAL: partly met — six requested positive classes route as designed, but four actual repository inputs and nested runtime barrels produce neither exact scope nor deferral; mixed changes suppress the exact component lane. DISPOSITION: incomplete dependency classification and duplicated root ownership block now. Acceptance criteria: (1) every input in the declared component/theme/Storybook/asset/browser/dependency classes resolves to exact scope or explicit deferral; (2) nested runtime barrels, .nvmrc, pnpm-workspace.yaml, and parseStyleKey.ts are pinned; (3) mixed component+global behavior preserves the exact bounded component lane or explicitly proves why whole-PR deferral is required; (4) current lab readiness derives roots from the executable classifier while legacy pathspec parsing remains covered; (5) a non-exempt path inside the declared dependency roots cannot silently mean “no scope.” ADVICE: bounded outcome criteria — keep the new classifier as the owner; do not add another independent path registry. AUTHOR CAN PROCEED: yes — the defect and acceptance criteria are concrete; implementation choice remains with the author. WORST OUTCOME: “maintainers can receive a clean-looking no-scope result for a real rendering or audit dependency” → request changes.

JUDGEMENT NEEDED: none — correctness defect in the existing CI contract.

request changes

1. Known rendering/audit inputs fall through the classifier, and the readiness root marker can drift from executable scope. → a maintainer can merge a change after visual, RTL, and a11y jobs all skip without an explicit protected-main deferral · .github/scripts/lib/affected-scope.js:17-87

REVIEW

Semantic verdict: request changes

Thanks — centralizing scope is the right shape, but this head can still return “no scope” for real inputs. ROOT_METADATA drops every nested index.ts, including the Calendar hook barrel used by Calendar and both date inputs. The dependency list also misses .nvmrc, pnpm-workspace.yaml, and the shared theme parseStyleKey.ts; each produces no component and no deferral. Mixed component+global changes suppress the exact component lane too. Lab readiness then trusts a comment marker that can drift from the executable map.

Please keep the executable classifier as the one root source, and ensure every input in these declared dependency classes resolves to exact scope or explicit protected-main deferral, with the negative and mixed cases pinned.

[Reviewed by Robohands]

INLINE (0–3, only when genuinely line-anchored)

None.

EVIDENCE I DID NOT SPEND

• Exact-head focused Vitest passed 9 files / 145 tests; changed-script syntax, actionlint for the three interacting workflows, and check:repo passed.
• Exact-head CI run 33164175791 passed every executed code job. Its scope log correctly classified the parent-stack workflow/script paths as browser-version-input; pr-a11y, pr-rtl, and Stable visual regression skipped by design.
• Security review found a fork head with changed workflows/scripts, but no package, lockfile, workspace, Node-version, lifecycle-script, permission, env/credential read, or network-call delta in the top commit; parent execution surfaces were already approved at their exact heads.

TIME

TIME total 10m setup 3m exact heads, fresh code/wiki checkouts, current authorities, trust screening, dependency seed reading 3m parent records, semantic delta, dependency consumers, workflow logs measuring 2m 145 focused tests, syntax, actionlint, repository checks, classifier/parser probes writing 2m presentation, two critic passes, exact-head GitHub/wiki delivery waste 1m first broad patch render was truncated and replaced with semantic-diff and direct-file reads

WHAT I COULD NOT VERIFY

• The changed trusted workflow_run comment path cannot execute from PR-head code; the current generated comment therefore does not exercise this head's deferral wording.
• The protected scheduled Release Gate was not dispatched. No Storybook/browser run was required for this non-rendering CI change.

What changed before posting

Posted as drafted in the exact-head GitHub COMMENT review; GitHub recorded COMMENTED at a0c034b7c6fccdf6ff5adea3dd7ed949bd6ac7d0.

---

Round 2 — exact-head delta re-review

PR

#5632 — fix(ci): trace affected PR check dependencies by @cixzhang (bucket: the maintainer)

HEAD REVIEWED

d8d553774f79b80672035c0fbd8c2cf8a082d732 — direct child of approved #5630 head d7681c97aa7c1c2567c7f36ac91860a9bb7a18dc, stacked on approved #5608.

VERSIONS

LOOP VERSION: 1.9.1 AUDIT RUBRIC: 1.14.4

LANE

LANE: full WHY: this re-review changes cross-cutting visual/a11y scope, trusted workflow routing, and the source of lab-readiness evidence after a prior architecture request-changes round.

PRIOR REVIEW AND CURRENT MAIN

Our Round 1 review at a0c034b7c6fccdf6ff5adea3dd7ed949bd6ac7d0 asked for nested runtime barrels, .nvmrc, pnpm-workspace.yaml, and parseStyleKey.ts to resolve exact-or-deferred; mixed exact+broad input to retain both lanes; unknown/non-exempt inputs not to become no-scope; one executable component-root source; and legacy/current readiness syntax coverage. The replacement head shares parent d7681c97 with the reviewed head; the semantic delta is 10 files, +169/−43.

The exact PR head remained d8d553774f79b80672035c0fbd8c2cf8a082d732, clean and mergeable, throughout the run. The approved parent contracts from #5608 and #5630 were re-read; this delta does not change their baseline ownership, removal authority, Probe policy, or promotion mutation paths.

PROBLEM

WHY 1: component-only pull requests need bounded visual, RTL, and accessibility checks, while shared or unknown rendering inputs need explicit protected-main deferral. WHY 2: a third outcome — neither exact work nor deferral — makes a green-looking skip indistinguishable from irrelevant files; a split exact+broad result can also route into a workflow path that refuses its own scope. WHY 3: the maintainer needs one truthful, executable routing decision for every non-exempt changed path before trusting the review evidence. USER-FACING PROBLEM: a maintainer changing a nested barrel, shared parser/hook, or the shared RTL audit harness can still receive missing evidence or a trusted-plan failure even though the classifier reports a relevant change. PROBLEM SEVERITY: broken task — the named parseStyleKey.ts case deterministically enters exact capture and is then refused as broad-only, while other non-exempt paths still emit no visual or a11y scope. NEW FEATURE CASE: not a product feature — this repairs existing CI coverage routing. EARLY STOP: clear — the prior acceptance criteria, current source, GitHub-output probes, workflow predicates, and production CLI failure establish the intended and actual behavior.

VERDICT: BLOCKS — the exact-or-deferred contract still has rejecting and silent third outcomes

SOLUTION

The delta correctly adds the four named inputs to classification, keeps exact component data when a known global input also defers, and exports a component-root command for readiness. It then introduces a second exact-visual predicate over Core files, while the helper retains its own component/root predicates and readiness detects an invocation string before loading the helper through a fallback. These independent interpretations disagree on the named parser, nested barrels, unknown shared inputs, and malformed current syntax.

SOLUTION (3 decisions · 4 runtime/workflow files, +68/−24; 10 files, +169/−43 including tests)

1. Expand known global/uncertain inputs and nested-barrel component discovery — fixes the named positive cases in the helper.
2. Separate exact visual presence from broad deferral so mixed inputs can set both — fixes the output booleans but not every downstream route.
3. Replace the readiness comment marker with a helper command — points at the right owner, but the command is unused by CI classification and the parser fallback can accept a missing/mistyped helper.

BURDEN: medium — one classifier, a second visual runtime predicate, two routing booleans, workflow predicates, a root CLI, a readiness loader/fallback, and six focused test surfaces. BURDEN MATCH: disproportionate at the contract boundary — the repair adds another representation of exact scope and roots instead of making one classifier result authoritative.

VERDICT: BLOCKS — multiple predicates still own the same scope facts

ARCHITECTURE

OWNER: .github/scripts/lib/affected-scope.js should own component identity, component roots, global/uncertain classification, and exact-or-deferred outcomes; workflows and readiness should consume that result. TIER 1: changed-file list, Core/Lab component roots, Storybook inputs, theme/build infrastructure, browser/setup inputs, package/dependency inputs, and protected-main coverage. TIER 2: none. SEAMS: nested barrels, component metadata exemptions, shared Core hooks/utilities, known/unknown audit inputs, named global inputs, exact+broad mixtures, trusted-plan routing, current helper syntax, malformed helper syntax, and legacy pathspec syntax. BEHAVIOR UNIT: one pure classifier plus one executable serialization of its result; callers should not re-derive component/root/scope semantics. COMPLEXITY BUDGET: one classifier, one component-root source, one exact-or-deferred result per non-exempt path, one mixed union, zero shadow predicates or fallback data sources. ACTUAL BURDEN: COMPONENT_ROOTS, componentSource()'s separate core|lab regex, visual-scope.mjs's separate isRuntimeCoreFile() and component extraction, an unused workflow COMPONENT_ROOTS variable, and a readiness parser that recognizes the command text then can load another checkout through a catch-all fallback; 10-file delta, +169/−43. BURDEN TREND: first reviewed head had one incomplete classifier plus a copied marker; current head adds the missing named entries but also adds another root representation and exact-visual routing predicate. The number of owners for component/root/scope facts grew rather than contracted. RESET TRIGGER: triggered — the prior one-source finding was repaired by adding another representation/guard for the same facts, and the named parseStyleKey.ts path now fails between those representations. Redraw around one classifier result before adding cases.

domain fact	one authoritative writable source	generated / immutable projections	other writable copies
component roots	intended COMPONENT_ROOTS	helper CLI output	componentSource() regex; isRuntimeCoreFile() root regex; readiness legacy parser
exact component identity	componentSource()	affected.components	visual-scope.mjs independently derives stableComponents from stableCoreFiles
global/uncertain deferral	inputKind()	reason lists and workflow outputs	visual-scope.mjs independently broadens all Core runtime files
mixed exact+broad routing	classifier result	CI outputs / trusted scope	workflow chooses exact capture or broad defer as mutually exclusive paths
readiness roots	helper should be sole current source	current CLI output; legacy pathspec parse	catch-all fallback can source roots outside the inspected fixture/repoRoot

seam	driven result
.nvmrc	fixed: visual+a11y explicit browser-version-input deferral
pnpm-workspace.yaml	fixed: visual+a11y explicit lockfile-ambiguity deferral
nested Calendar/hooks/index.ts	a11y exact Calendar; visual outputs has_stable_visual=false and stable_visual_deferred=false
parseStyleKey.ts	reports exact=true + broad=true, no exact component/story; exact workflow calls trusted-plan, which exits 1: broad stable scope must be deferred instead of captured
component + .nvmrc	exact and broad booleans both true; exact a11y components retained, but visual broad-defer step is suppressed when exact is true and report generation does not carry its deferred reasons
unknown apps/storybook/rtl-audit/rtl-audit.mjs	all exact/deferred visual+a11y outputs false — the real RTL harness is silent no-scope
shared packages/core/src/hooks/useLayer.tsx	exact visual=true + broad visual=true with no component; no a11y component or deferral; trusted-plan rejection shape
helper-root mutation	advertising Core only still classifies Lab/Drawer exact — the list does not own classification
valid current helper CLI	prints Core + Lab roots
malformed component-roots-broken CLI	exits 0 with no output; readiness parser still returns Core + Lab when the fixture helper is absent because the regex/fallback false-passes
legacy pathspec	still parses Core + Lab in the focused regression test
exempt test/doc files	remain intentionally no-scope

The representative split is visual-scope.mjs lines 154–171: exact visual scope is re-derived independently from affected components/deferral, then trusted workflow routing treats exact and broad as exclusive actions. The rejecting guard is visual-acceptance.mjs lines 767–775, and the root split begins at affected-scope.js lines 12–38.

VERDICT: BLOCKS — component identity, roots, and routing still have multiple owners and disagree on real inputs

IMPACT

A maintainer changing parseStyleKey.ts reaches a trusted publisher failure rather than protected-main deferral. A nested barrel still receives no visual scope, the real RTL audit harness can receive no scope anywhere, and a shared hook can lack a11y/RTL deferral. Mixed known input retains its exact checks, but the visual evidence path does not publish the broad half of the routing decision. NEW FEATURE IMPACT: not a product feature.

VERDICT: BLOCKS — required review evidence can still be absent, incomplete, or deterministically red

API

No published package API change. Internal CI surfaces add exactStableVisual, componentRoots(), the component-roots CLI mode, new scope booleans, and parser syntax.

	change	public?	class	doc'd?	verdict
+	componentRoots(): string[] + CLI output	internal CI/parser contract	existing component package map	tests/source	BLOCKS — does not own classifier roots
+	exactStableVisual: boolean	internal trusted workflow contract	existing stable component/story scope	tests/source	BLOCKS — separate predicate conflicts with deferral
~	mixed exact+broad booleans	internal workflow output	existing exact/deferred lanes	tests/source	note — flags are preserved, but visual downstream union is incomplete
~	readiness current syntax + legacy fallback	internal audit parser	existing legacy pathspec	test/source	BLOCKS — malformed/missing helper can false-pass

OSSIFICATION: no consumer package surface. These internal fields gate required evidence, so locking in mutually inconsistent meanings creates silent skips and trusted-job failures.

VERDICT: BLOCKS — the internal scope contract is not single-source or total

THEMING

No CSS, theme target, token, variable, or rendered theme output changes. parseStyleKey.ts is correctly identified as shared theme infrastructure by the helper, but the visual caller also marks it exact and sends it to a trusted-plan path that rejects it.

VERDICT: BLOCKS — the specifically requested shared theme parser still cannot complete its routing path

BREAKING

BEHAVIOR: yes inside CI — the four named classifications and mixed flags change, but some now route to failure or remain silent. API: no published package API. VISUAL: no product pixels change in this delta. THEME: no theme contract change; only theme-change evidence routing changes.

VERDICT: BLOCKS — intended scope correction remains incomplete end to end

PERFORMANCE & RESOURCES

EFFECTS: zero.

Effect + deps	external system	why render/handler cannot do it	measured render cost	lifetime + cleanup	focused test
none	none	n/a	n/a	n/a	n/a

RENDER: no product render path. LISTENERS/OBSERVERS: none. LAYOUT: none. BUNDLE: no dependency or lockfile delta. Classification remains O(changed paths) plus set/sort work; the defect is ownership/routing rather than cost.

VERDICT: clear

VISUAL EVIDENCE

VISUAL CHECK: not applicable WHY: the delta changes CI scripts/tests, workflows, and lab-readiness parsing only. No component implementation, story, style, asset, theme package, or rendered app path changes. No Storybook server or browser was started.

VERDICT: clear

REMEDY SEARCH

REMEDY SEARCH: not triggered — no proven visual defect

A11Y & I18N

No product role, accessible state, focus path, string, locale, or direction behavior changes. The affected gate is itself an a11y/RTL evidence boundary: nested barrels now reach exact a11y, but unknown shared inputs can still produce neither component scope nor protected-main a11y deferral.

VERDICT: BLOCKS — required a11y/RTL evidence can still silently disappear

JUDGEMENT

slot	verdict
PROBLEM	BLOCKS — exact/deferred routing still has silent and rejecting outcomes
SOLUTION	BLOCKS — added predicates do not share one owner
ARCHITECTURE	BLOCKS — root/component/scope facts have multiple writable representations
IMPACT	BLOCKS — required evidence can be absent or red
API	BLOCKS — internal contract meanings disagree
THEMING	BLOCKS — named parser path still fails
BREAKING	BLOCKS — CI behavior remains incomplete
PERFORMANCE	clear
VISUAL	clear
A11Y & I18N	BLOCKS — unknown shared inputs still skip deferral

GOAL: partly met — .nvmrc, pnpm-workspace.yaml, helper-level nested barrels, parseStyleKey.ts classification, and mixed booleans move as requested; the production parseStyleKey.ts route still fails, nested visual scope and unknown/global totality remain incomplete, and roots still have shadow parsers. DISPOSITION: the prior one-source/exact-or-deferred finding still blocks now. Acceptance criteria: one executable classifier/root source drives exact components and broad deferral; every non-exempt path gets at least one truthful outcome; mixed input preserves and publishes both outcomes; parseStyleKey.ts completes by deferral rather than exact-plan refusal; valid current and legacy syntax pass while missing/malformed current syntax fails closed. ADVICE: bounded contraction criteria — remove shadow derivation and consume one classifier result; no implementation is prescribed. AUTHOR CAN PROCEED: yes — the failing paths, invariants, and positive/negative/mixed regression matrix are deterministic. WORST OUTCOME: “A maintainer can receive no required evidence or a trusted-plan failure for a real rendering/audit dependency.” → request changes.

JUDGEMENT NEEDED: none — correctness defect in an existing CI contract.

request changes

1. Scope and root facts still have multiple owners, producing silent or rejecting third outcomes. → a maintainer changing a nested barrel, shared parser/hook, or the real RTL audit harness can lose visual/a11y evidence or receive a deterministic trusted-plan failure · visual-scope.mjs:154 → confirmed independently by production CLI output/failure plus root/parser mutations that leave the test suite green while breaking the claimed contract.

REVIEW

Semantic verdict: request changes

Thanks — the four named inputs now classify, and mixed changes preserve the exact booleans, but the exact/deferred contract is still split.

At this head, parseStyleKey.ts becomes both exact and broad while yielding no exact component/story; the exact workflow path then calls trusted-plan, which refuses it as broad-only. A nested barrel still has no visual outcome, and the real RTL audit harness has no outcome anywhere. The root command is also not the owner: changing its roots leaves component classification unchanged, while readiness accepts a missing or mistyped helper through its fallback.

Please contract this to one executable classifier consumed by workflow and readiness, with every non-exempt path producing exact scope or explicit deferral. Pin the positive, negative, ambiguous, mixed, and legacy/current syntax cases.

[Reviewed by Robohands]

INLINE (0–3, only when genuinely line-anchored)

None — the defect is one cross-file ownership/routing model.

EVIDENCE I DID NOT SPEND

• .nvmrc and pnpm-workspace.yaml now produce broad visual+a11y deferral with the intended reasons; component + .nvmrc retains exact component and broad flags.
• Exact-head GitHub reports 17 successful and 5 path-skipped checks, 0 pending/failed; the check-components log classifies this stack’s known workflow/scripts as browser-version-input and defers them.
• Security screening found no top-delta dependency, lockfile, lifecycle-script, permission, credential, or network-call addition; parent execution surfaces were already approved at exact heads.

TIME

TIME total 12m setup 4m exact heads, trust screening, fresh isolated code/wiki worktrees, dependency clone reading 3m current kit/rubric, all Review-5608/5630/5632 rounds, source and workflow consumers measuring 3m focused tests/checks, old/new matrix, production CLI failure, root/parser mutations, exact CI writing 2m presentation, template gate, two critic passes, GitHub/wiki delivery waste 1m first verification command inherited the parent directory and was rerun from the exact-head worktree

WHAT I COULD NOT VERIFY

• The changed trusted workflow_run publisher cannot execute PR-head workflow code; exact-head Actions therefore prove repository code checks, not this modified default-branch publisher path.
• The protected scheduled Release Gate was not dispatched, as requested. No Storybook/browser run was needed for this non-rendering CI change.

What changed before posting

Posted as drafted in the exact-head GitHub COMMENT review; GitHub recorded COMMENTED at d8d553774f79b80672035c0fbd8c2cf8a082d732.

---

Round 3 — exact-head delta re-review

PR

#5632 — fix(ci): trace affected PR check dependencies by @cixzhang (bucket: the maintainer)

HEAD REVIEWED

fbf0e9b1dddfee059fca6a3d5e305901cf0b74f9 — direct child of approved #5630 head d7681c97aa7c1c2567c7f36ac91860a9bb7a18dc, stacked on approved #5608.

VERSIONS

LOOP VERSION: 1.9.1 AUDIT RUBRIC: 1.14.4

LANE

LANE: full WHY: this re-review must settle a standing architecture block across changed-path classification, trusted visual routing, exact a11y/RTL filters, and lab-readiness contract parsing.

PRIOR REVIEW AND CURRENT MAIN

Our Round 2 review at d8d553774f79b80672035c0fbd8c2cf8a082d732 asked for one executable classifier/root source consumed by workflows and readiness, every non-exempt path to produce exact scope or explicit deferral, mixed scope to preserve both outcomes, parseStyleKey.ts to defer rather than enter rejected planning, and current syntax to fail closed while legacy syntax remains compatible.

This replacement commit has the same approved parent. Ignoring formatting-only rewrites, the prior-head delta changes three files by +38/−8: the helper becomes directly executable, visual scope consumes its component parser, and CI invokes the helper before the visual wrapper. Current main remains 936256386b74d67f88a41adee235b91699977b2f, the stack base; no current-main commit invalidates these paths.

PROBLEM

WHY 1: one component path must produce the same exact a11y and RTL filter everywhere it is used. WHY 2: if a workflow rebuilds that filter independently, changing the shared classifier can leave the gate green while the browser job receives no component. WHY 3: the maintainer then cannot trust a green routing contract to mean the named component was actually audited. USER-FACING PROBLEM: a maintainer extending or correcting component scope can update the advertised owner while a11y/RTL keep using a shadow parser; the tests still report green and the required exact check can silently disappear or broaden. PROBLEM SEVERITY: broken task — the PR exists to eliminate scope drift, but an executable mutation proves that drift remains undetected at the workflow boundary. NEW FEATURE CASE: not a product feature — this repairs existing CI evidence routing. EARLY STOP: clear — prior acceptance criteria, exact-head source, workflow output tracing, direct syntax probes, and a mutation run establish both the intended and actual contracts.

VERDICT: BLOCKS — exact component identity still has multiple executable owners

SOLUTION

The changed-path helper now correctly owns the named path classifications and the stable visual wrapper consumes its component parser. It also emits exact component names as workflow outputs. The a11y and RTL steps do not consume those outputs: they rebuild their filters from the older analysis component lists, while readiness recognizes command text and can load a helper outside the inspected repository after failure.

SOLUTION (3 decisions · one new module plus four runtime/workflow consumers)

1. Make the shared helper executable and serialize exact/deferred scope — correct and useful.
2. Route stable visual component identity through the helper — fixes the prior rejected exact-plan path.
3. Keep a11y/RTL selection on the older analysis parser and readiness on a catch-all loader fallback — leaves the one-source contract incomplete.

BURDEN: medium — 14 top-commit files, +916/−195 against the approved parent; one classifier module, two workflow classifier invocations, two component-list representations, one readiness command marker/fallback, and 158 focused tests. BURDEN MATCH: disproportionate at the remaining seam — the new executable output is written but discarded before the two browser jobs that need it.

VERDICT: BLOCKS — the repair adds an output without removing the consumers’ shadow parser

ARCHITECTURE

OWNER: .github/scripts/lib/affected-scope.js should own component identity, component roots, and exact/deferred changed-path scope; visual, a11y, RTL, reporting, and readiness should consume source-identified projections. TIER 1: git changed paths, Core/Lab roots, Storybook/theme/browser/dependency inputs, trusted visual publisher, a11y/RTL browser jobs, and lab-readiness derivation. TIER 2: none. SEAMS: nested barrels, shared theme parsers, Node/workspace globals, mixed exact+broad unions, exact a11y/RTL filters, current helper syntax, malformed/missing helper syntax, and legacy pathspec compatibility. BEHAVIOR UNIT: one pure classifier plus one executable serialization; workflows should pass its component list rather than reconstruct it. COMPLEXITY BUDGET: one classifier/root source, one exact component set, one exact-or-deferred decision per path, one mixed union, and zero shadow parsers or fallback sources. ACTUAL BURDEN: one helper module; visual scope consumes it; analysis both imports it and separately rebuilds component identity; CI writes affected_components/affected_core_components but exports neither and both browser jobs read newComponents + modifiedComponents; readiness conditionally requires the helper but catches failure by loading from the process working directory. BURDEN TREND: Round 1 had one incomplete classifier plus a copied root marker; Round 2 added the named cases but also shadow visual/root predicates; Round 3 contracts visual component identity into the helper, but exact a11y/RTL identity and readiness failure behavior remain independently writable. Owner count shrinks by one and remains above the stated budget. RESET TRIGGER: remains triggered — the prior architecture reset required one executable owner, while this round leaves the same disputed component fact in the helper and the analysis parser and adds an unused workflow serialization.

domain fact	one authoritative writable source	generated / immutable projections	other writable copies
changed-path dependency class	affected-scope.js	visual scope and analysis metadata	none for the named inputs
exact component identity	intended helper components	affected_components / affected_core_components	analyze-pr.js independently derives newComponents / modifiedComponents, and a11y/RTL consume those instead
current component roots	helper COMPONENT_ROOTS	component-roots CLI output	readiness first parses CI command text, then can load a helper from another working directory
exact/broad visual routing	helper plus stable story/theme metadata	trusted scope JSON	no rejected exact plan for the named broad-only cases

seam	driven result
nested Calendar/hooks/index.ts	fixed: exact Core/Calendar component and exact visual scope
parseStyleKey.ts	fixed: exact visual false, broad visual/a11y true; protected-main deferral precedes exact planning
.nvmrc / pnpm-workspace.yaml	fixed: explicit broad visual/a11y deferral
Core/Button + .nvmrc	exact Button plus broad visual/a11y flags are both retained
Lab/Drawer	helper reports exact @astryxdesign/lab:Drawer
workflow use of exact components	helper writes the names, but the check-components job does not expose them; a11y and RTL read the independent analysis arrays
shadow-parser mutation	changing only analysis’s Lab directory makes its exact list empty while the helper still reports Lab/Drawer; all 80 focused contract tests pass
current helper syntax	real repository returns Core + Lab roots
legacy pathspec syntax	explicit compatibility parser returns Core + Lab roots
missing current helper	readiness still returns Core + Lab by loading the process-working-directory helper
mistyped component-roots-broken syntax	readiness still returns Core + Lab for the same reason
exact-head Actions	parent-stack workflow/script paths defer broadly; a11y, RTL, and visual are skipped, so the run does not exercise an exact component filter

The representative workflow boundary is ci.yml lines 478–484: a11y builds its component filter from analysis.json; the RTL step repeats the same expression at lines 722–740. The helper’s emitted component outputs are only defined and tested, not consumed. Readiness’s cross-checkout fallback is at automated.mjs lines 100–112.

VERDICT: BLOCKS — component identity and current-syntax failure still have multiple executable sources

IMPACT

A maintainer changing the shared classifier’s roots or component policy can get a green helper contract while the exact a11y and RTL jobs receive a different filter. The executable Lab mutation demonstrates the full failure: the advertised owner still reports Drawer, the browser-job source becomes empty, and every focused contract test remains green. A missing or mistyped current helper can also be certified by unrelated local code rather than failing the inspected repository. NEW FEATURE IMPACT: not a product feature.

VERDICT: BLOCKS — required evidence can silently use a different component set from the advertised scope owner

API

No published package API changes. Internal workflow surface adds executable JSON/GitHub outputs for affected components and deferred reasons.

	change	public?	class	doc'd?	verdict
+	affected_components / affected_core_components	internal workflow output	existing component filter	source/tests	BLOCKS — written but not consumed by a11y/RTL
~	stable visual exact scope from helper component identity	internal trusted scope	existing visual scope	source/tests	clear
~	readiness current helper syntax + legacy pathspec	internal audit parser	existing compatibility contract	source/tests	BLOCKS — missing/malformed current syntax false-passes

OSSIFICATION: no consumer package surface. These internal values gate whether required evidence runs, so independent parsers create the exact silent-drift class the PR is intended to remove.

VERDICT: BLOCKS — the internal exact-component contract is serialized but not authoritative

THEMING

No CSS, token, target, variable, selector, or rendered theme output changes. The named shared parser now correctly broad-defers before exact planning.

VERDICT: clear

BREAKING

BEHAVIOR: yes inside CI — nested barrels and named global inputs now route correctly, but the exact a11y/RTL component filter still comes from the prior parser. API: no published package API. VISUAL: no product pixel change. THEME: no theme contract change; only evidence routing changes.

VERDICT: BLOCKS — the intended one-source routing behavior is incomplete at two browser-job consumers

PERFORMANCE & RESOURCES

EFFECTS: zero.

Effect + deps	external system	why render/handler cannot do it	measured render cost	lifetime + cleanup	focused test
none	none	n/a	n/a	n/a	n/a

RENDER: no product render path. LISTENERS/OBSERVERS: none. LAYOUT: none. BUNDLE: no dependency or lockfile delta. Classification remains one bounded pass over changed paths; the defect is ownership and workflow consumption, not cost.

VERDICT: clear

VISUAL EVIDENCE

VISUAL CHECK: not applicable WHY: the top commit changes CI scripts/tests, workflows, and lab-readiness tooling only. No component implementation, story, style, asset, theme package, or rendered app path changes. No Storybook server or browser was started.

VERDICT: clear

REMEDY SEARCH

REMEDY SEARCH: not triggered — no proven visual defect

A11Y & I18N

No product role, accessible state, focus path, string, locale, or direction behavior changes. The affected boundary decides whether exact a11y/RTL evidence runs: both jobs still derive their component list from analysis.json rather than the helper output, and the mutation test proves the two can diverge without a failing contract test.

VERDICT: BLOCKS — exact a11y/RTL selection does not consume the shared component source

JUDGEMENT

slot	verdict
PROBLEM	BLOCKS — one-source evidence routing remains unproved
SOLUTION	BLOCKS — executable output is discarded before a11y/RTL
ARCHITECTURE	BLOCKS — exact component identity still has shadow parsers
IMPACT	BLOCKS — browser jobs can receive a different component set
API	BLOCKS — internal output is not authoritative
THEMING	clear
BREAKING	BLOCKS — intended routing is incomplete
PERFORMANCE	clear
VISUAL	clear
A11Y & I18N	BLOCKS — exact filters remain independently derived

GOAL: partly met — nested barrels, parseStyleKey.ts, .nvmrc, pnpm-workspace.yaml, and mixed exact+broad classification now produce the required values; the exact component outputs are not consumed by a11y/RTL, and missing/malformed current readiness syntax still false-passes. DISPOSITION: the prior one-source architecture finding still blocks now. Acceptance criteria: (1) the executable classifier’s exact component set is the filter input for a11y and RTL, not merely another artifact field; (2) a drift mutation in any former parser fails a contract test; (3) current helper syntax loads only the inspected repository and missing/malformed current syntax fails closed; (4) legacy pathspec compatibility remains explicit; (5) the passing named path and mixed-union cases remain. ADVICE: bounded contraction criteria — consume the existing executable output and remove or demote shadow derivation; no new owner is needed. AUTHOR CAN PROCEED: yes — the ownership defect, failed mutation guard, and exact acceptance criteria are deterministic. WORST OUTCOME: “the shared classifier says a component is in scope while both browser-job filters receive no component and every contract test stays green” → request changes.

JUDGEMENT NEEDED: none — correctness and architecture defect inside an existing CI contract.

request changes

1. Exact component identity is emitted by one module but consumed from another parser. → a maintainer changing scope can silently lose the exact a11y/RTL component filter while the advertised classifier and all contract tests stay green · ci.yml:478 → confirmed independently by source/output tracing and a Lab-parser mutation that produced divergent filters while 80 focused tests passed.

REVIEW

Semantic verdict: request changes

We asked for one executable scope owner; the named path cases now route correctly, but the contract still stops at classification.

At the browser-job filter boundary, a11y—and the matching RTL step—rebuild their component filter from analysis.json’s independent newComponents + modifiedComponents parser instead of consuming the component list emitted by affected-scope.js. Mutating only that shadow parser to drop Lab leaves the shared classifier reporting Lab/Drawer while both jobs receive no component; all 80 focused contract tests still pass. Lab readiness likewise accepts missing or mistyped current helper syntax by loading another checkout through its fallback.

Please make the executable classifier’s component set the a11y/RTL workflow input and make current-syntax readiness fail closed, while keeping legacy syntax as an explicit compatibility branch.

[Reviewed by Robohands]

INLINE (0–3, only when genuinely line-anchored)

None — one cross-file ownership defect carries the verdict.

EVIDENCE I DID NOT SPEND

• Exact-head focused Vitest passed 9 files / 158 tests; the drift mutation passed 5 files / 80 tests while producing the helper-versus-analysis mismatch.
• Actionlint passed the four interacting workflows; six changed runtime files passed node --check; git diff --check and check:repo passed.
• Exact-head CI run 33171909063 is green for every executed job; exact a11y, RTL, and visual jobs are path-skipped because this stack’s workflow/script files broad-defer.

TIME

TIME total 12m setup 3m exact heads, fresh code/wiki checkouts, live rules/rubric, trust screening, dependency seed reading 3m every parent/current round, prior-head semantic delta, workflow and readiness consumers measuring 4m 158 tests, path/syntax matrix, shadow-parser mutation, actionlint, syntax, repository and CI checks writing 2m presentation, two critic passes, exact-head GitHub/wiki delivery waste 1m one broad source search produced irrelevant component-path references and was replaced with targeted consumer reads

WHAT I COULD NOT VERIFY

• The changed trusted workflow_run publisher cannot execute PR-head workflow code; current Actions prove repository checks and broad deferral, not an exact component consumer path.
• The protected scheduled Release Gate was not dispatched. No Storybook/browser run was needed for this non-rendering CI change.

What changed before posting

Posted as drafted in the exact-head GitHub COMMENT review; GitHub recorded COMMENTED at fbf0e9b1dddfee059fca6a3d5e305901cf0b74f9.

---

Round 4 — one-time manual final delta re-review

PR

#5632 — fix(ci): trace affected PR check dependencies by @cixzhang (bucket: the maintainer)

HEAD REVIEWED

a5676f81cab6fe9ecaa1352ff0b73aa2e8338e82 — direct child of approved #5630 head d7681c97aa7c1c2567c7f36ac91860a9bb7a18dc, stacked on approved #5608.

VERSIONS

LOOP VERSION: 1.9.1 AUDIT RUBRIC: 1.14.4

LANE

LANE: full WHY: this fourth exact-head round must settle a standing one-source architecture block across every PR visual/a11y/RTL consumer and fail-closed lab-readiness parsing.

PRIOR REVIEW AND CURRENT MAIN

Our Round 3 review at fbf0e9b1dddfee059fca6a3d5e305901cf0b74f9 asked for the executable classifier’s exact component set to feed a11y/RTL, every former parser’s drift mutation to fail, and current helper syntax to fail closed while legacy syntax stays explicit. The current five-file delta fixes the a11y/RTL filters and rejects missing, malformed-export, throwing, and cross-checkout fallback helpers, but it leaves another PR visual parser and accepts malformed invocation syntax.

The exact head remained a5676f81cab6fe9ecaa1352ff0b73aa2e8338e82, clean and mergeable, throughout the review. Its parent is the approved #5630 head; current main remains base 936256386b74d67f88a41adee235b91699977b2f, so no later-main change invalidates this delta.

PROBLEM

WHY 1: every PR browser/audit consumer must receive the same exact component and global-deferral decision. WHY 2: a handwritten inventory can omit a real workflow while all listed-consumer tests stay green, and a prefix parser can certify a command CI would not execute. WHY 3: maintainers need scope/readiness evidence to fail on drift rather than silently widen, skip, or certify a broken gate. USER-FACING PROBLEM: a maintainer changing component or story scope can still receive visual evidence derived from the legacy component parser, while a malformed current readiness command is reported as covering Core and Lab. PROBLEM SEVERITY: broken task — one executable drift mutation survives the complete consumer-contract test and two malformed current commands false-pass. NEW FEATURE CASE: not a new feature — this repairs existing CI evidence routing. EARLY STOP: clear — the prior acceptance criteria, exact-head source, consumer inventory, direct path probes, and executable mutations establish the remaining failures.

VERDICT: BLOCKS — the one-source/fail-closed goal remains incomplete

SOLUTION

The delta adds versioned scope metadata and a declared consumer list, routes the exact a11y and RTL filters through the shared analysis projection, and makes readiness import and execute the inspected helper. Those changes fix the Round 3 Lab drift and cross-checkout fallback. The consumer list and its readiness copy are still handwritten and omit the in-workflow Stable visual job, while readiness recognizes a command prefix and then executes a different canonical command.

SOLUTION (3 decisions · 3 runtime/workflow files, +63/−13; 5 files, +174/−13 including tests)

1. Publish schema, roots, and a declared consumer inventory from the classifier.
2. Read a11y/RTL component filters from analysis.affectedScope.components.
3. Validate, import, and execute the inspected scope helper for readiness.

BURDEN: medium — one classifier, three serialized projections, three handwritten consumer inventories/checks, two workflow component-filter paths, and one readiness syntax/loader boundary. BURDEN MATCH: disproportionate at the remaining boundary — metadata names five consumers without enforcing the actual set, so the same one-source defect survives behind another list.

VERDICT: BLOCKS — the repair does not cover every consumer or the actual current command syntax

ARCHITECTURE

OWNER: .github/scripts/lib/affected-scope.js should own component identity, roots, and exact/deferred scope; every visual/a11y/RTL/readiness consumer should execute it or consume a source-identified projection. TIER 1: changed paths, Core/Lab roots, exact component filters, stable-story scope, broad deferral, PR visual jobs, and lab-readiness derivation. TIER 2: none. SEAMS: nested barrels, shared theme parser, Node/workspace inputs, exact+broad mixtures, Lab a11y/RTL filters, stable-story-only visual scope, malformed current helper invocations, explicit legacy pathspec syntax, and the real RTL harness input. BEHAVIOR UNIT: one pure classifier plus one executable serialization; consumer membership and invocation syntax need executable validation rather than parallel lists/prefixes. COMPLEXITY BUDGET: one classifier/root source, one complete consumer inventory derived from actual workflow use, one exact-or-deferred result per non-exempt path, and zero shadow parsers or fallback commands. ACTUAL BURDEN: 14 top-commit files, +1080/−198 against approved #5630; the final delta is 5 files, +174/−13. The helper CONSUMERS, readiness EXPECTED_SCOPE_CONSUMERS, and workflow test’s hand-selected jobs are three inventories; ci.pr-visual is in none. Readiness matches a command prefix but always executes canonical component-roots itself. BURDEN TREND: Round 3 was 14 files, +916/−195; current grows by +174/−13. A11y/RTL and cross-checkout loading contract correctly, but consumer/invocation representations grow while the same one-source finding remains. RESET TRIGGER: triggered — this is the fourth round of the same model-level finding, and the repair adds another consumer representation without covering the actual consumer set.

domain fact	one authoritative writable source	generated / immutable projections	other writable copies
exact component identity	affected-scope.js	analysis.affectedScope, visual-scope result	ci.pr-visual still reads newComponents + modifiedComponents
scope-consumer membership	none	none	helper CONSUMERS, readiness expected list, workflow-test slices; all omit ci.pr-visual
current readiness invocation	ci.yml command	helper module/CLI result	prefix regex accepts malformed command then runs a different canonical command
broad/global deferral	affected-scope.js	visual/a11y reasons	the RTL harness path still has no exact or deferred outcome

seam	driven result
nested Calendar/hooks/index.ts	exact Core/Calendar; no deferral
parseStyleKey.ts	no exact component; visual+a11y defer with shared-theme-token-infrastructure
.nvmrc	visual+a11y defer with browser-version-input
pnpm-workspace.yaml	visual+a11y defer with lockfile-ambiguity
Core/Button + .nvmrc	exact Button plus both broad-defer flags
Lab/Drawer	exact Lab component; a11y/RTL consume affectedScope; Lab-root mutation is rejected by 2 failing tests
a11y+RTL old-parser mutation	rejected by the workflow contract test
cross-checkout readiness fallback mutation	rejected by the missing/malformed/throwing helper test
missing / malformed exports / throwing helper	all return no roots at exact head
Stable visual legacy-parser mutation	all 13 workflow consumer-contract tests still pass
stable-story-only change	visual-scope.mjs reports exact story scope, while ci.pr-visual sees no legacy component and enters the broad full-surface arm
component-roots-broken / component-roots --unexpected	both return Core + Lab instead of failing closed
apps/storybook/rtl-audit/rtl-audit.mjs	no exact component and no protected-main deferral

VERDICT: BLOCKS — actual consumers and current-syntax validity are not represented by one executable contract

IMPACT

The a11y and RTL component filters now follow the shared source and reject a Lab-parser drift. The remaining Stable visual job can still widen or diverge under a legacy parser while its inventory test stays green, and lab readiness can certify Core/Lab coverage for a command CI would not execute as intended. NEW FEATURE IMPACT: not a new feature.

VERDICT: BLOCKS — maintainers can receive green contract tests for a drifted visual consumer or malformed readiness wiring

API

No published package API change. Internal CI surfaces add schema/version metadata, a consumer list, component roots, and changed workflow/readiness parsing.

	change	public?	class	doc'd?	verdict
+	scope schema/version, roots, consumer inventory	internal CI metadata	existing affected-scope contract	source/tests	BLOCKS — inventory is incomplete and duplicated
~	a11y/RTL filters from affectedScope.components	internal workflow contract	existing exact component filter	source/tests	clear
~	readiness helper validation/execution	internal audit contract	existing current + legacy syntax	source/tests	BLOCKS — malformed current invocation false-passes

OSSIFICATION: no consumer package surface. These internal fields gate review evidence, so a partial inventory or permissive parser directly recreates the drift this PR is meant to remove.

VERDICT: BLOCKS — the internal contract is not complete or fail-closed

THEMING

No CSS, token, target, variable, selector, or rendered theme output changes. parseStyleKey.ts still broad-defers correctly.

VERDICT: clear

BREAKING

BEHAVIOR: yes inside CI — a11y/RTL now use the canonical component projection and readiness removes the cross-checkout fallback; another visual parser and malformed syntax remain. API: no published package API. VISUAL: no product pixel change. THEME: no theme contract change; only evidence routing changes.

VERDICT: BLOCKS — intended one-source routing remains incomplete at a visual consumer and readiness parser

PERFORMANCE & RESOURCES

EFFECTS: zero.

Effect + deps	external system	why render/handler cannot do it	measured render cost	lifetime + cleanup	focused test
none	none	n/a	n/a	n/a	n/a

RENDER: no product render path. LISTENERS/OBSERVERS: none. LAYOUT: none. BUNDLE: no dependency or lockfile delta; classification remains bounded by changed paths.

VERDICT: clear

VISUAL EVIDENCE

VISUAL CHECK: not applicable WHY: the final delta changes CI scripts/tests, one workflow, and lab-readiness tooling only. No component implementation, story, style, asset, theme package, or rendered app path changes. Exact-head Stable visual regression, pr-a11y, and pr-rtl are path-skipped and are not claimed as evidence.

VERDICT: clear

REMEDY SEARCH

REMEDY SEARCH: not triggered — no proven visual defect

A11Y & I18N

No product role, accessible state, focus path, string, locale, or direction behavior changes. The affected boundary determines whether exact a11y/RTL evidence runs: both exact filters now consume the canonical analysis projection, and their legacy-parser mutant fails. The actual RTL harness input itself still produces no exact or deferred scope.

VERDICT: BLOCKS — the exact filters are fixed, but the shared RTL audit input remains outside the total path contract

JUDGEMENT

slot	verdict
PROBLEM	BLOCKS — one-source/fail-closed goal remains incomplete
SOLUTION	BLOCKS — declared inventory does not enforce the actual consumers
ARCHITECTURE	BLOCKS — one visual parser and malformed invocation remain independent
IMPACT	BLOCKS — green tests can certify drifted scope/readiness
API	BLOCKS — internal contract is incomplete
THEMING	clear
BREAKING	BLOCKS — intended CI behavior is incomplete
PERFORMANCE	clear
VISUAL	clear
A11Y & I18N	BLOCKS — RTL harness input still has no outcome

GOAL: partly met — a11y/RTL consume affectedScope, Lab and cross-checkout fallback mutants fail, and missing/malformed-export/throwing helpers return no roots; the actual Stable visual consumer is omitted and its drift mutant survives, malformed current commands return roots, and the RTL harness path remains no-scope. DISPOSITION: the standing one-source architecture finding still blocks now. Acceptance criteria: (1) every actual PR visual/a11y/RTL/readiness consumer is inventoried from executable use and consumes the shared result; (2) mutating any former parser makes a contract test fail; (3) current helper syntax is matched/executed exactly and rejects missing, malformed, throwing, mistyped, or extra-argument forms; (4) the RTL harness input resolves to explicit protected-main coverage; (5) the passing nested-barrel, shared-parser, Node/workspace, mixed, Lab, and legacy cases remain. ADVICE: bounded contraction criteria — remove the remaining shadow parser and derive the inventory/syntax check from actual executable wiring; do not add another list. AUTHOR CAN PROCEED: yes — the failing consumer, commands, path, and regression outcomes are deterministic. WORST OUTCOME: “all consumer-contract tests stay green while a real Stable visual job no longer receives the canonical exact scope.” → request changes.

JUDGEMENT NEEDED: none — correctness and architecture defect inside an existing CI contract.

request changes

1. The declared consumer inventory omits a real Stable visual scope parser. → a maintainer can receive broad or divergent visual evidence while the shared classifier and all consumer-contract tests stay green · ci.yml:633
2. Readiness recognizes malformed current commands and the RTL harness path has no scope outcome. → a Lab promotion can be certified against wiring CI would not execute, while a change to the audit implementation receives no explicit coverage route · automated.mjs:143

REVIEW

Semantic verdict: request changes

We asked for every scope consumer to use one executable owner. The a11y/RTL filters and helper loading now do, but the consumer inventory still misses pr-visual.

Stable visual regression still builds its component plan from newComponents + modifiedComponents. Mutating only that parser to return no components left all 13 consumer-contract tests green; a stable-story-only change likewise has exact story scope in visual-scope.mjs but falls into this job’s broad full-surface arm.

Lab readiness also accepts component-roots-broken and component-roots --unexpected: its prefix match recognizes either, then executes the canonical command instead. Both returned Core + Lab in the fail-closed probe. The real RTL harness path still yields neither exact scope nor protected-main deferral.

Please include every PR visual consumer in the executable contract, make each drift mutant fail, and reject malformed current helper invocations.

[Reviewed by Robohands]

INLINE (0–3, only when genuinely line-anchored)

None — both defects cross inventory, workflow, and readiness boundaries.

EVIDENCE I DID NOT SPEND

• Exact-head path matrix: nested Calendar barrel exact; parseStyleKey.ts, .nvmrc, and workspace config defer; mixed Button + Node keeps exact plus broad; Lab/Drawer reaches both exact a11y/RTL consumers.
• Exact PR test plan: 9 files / 162 tests passed; an additional compare suite brings the focused total to 10 files / 182 tests. Twelve changed runtime/test scripts pass syntax; exact actionlint, git diff --check, and check:repo pass.
• Exact-head Actions: 17 checks/statuses pass and 5 are path-skipped, with 0 pending/failed. Stable visual, pr-a11y, and pr-rtl did not exercise an exact component consumer on this head.

TIME

TIME total 12m setup 3m exact heads, claim, fresh code/wiki worktrees, current rules/rubric, trust screening reading 3m every parent/current review round, five-file delta, full consumer and workflow dataflow measuring 4m path/readiness matrix, four mutations, 182 tests, syntax, actionlint, repo checks, exact CI writing 2m presentation, literal template gate, two critic passes, GitHub/wiki delivery waste 1m four mutation probes were first launched with a reserved shell variable and repeated serially

WHAT I COULD NOT VERIFY

• Modified PR workflow code cannot execute from the PR head; exact-head Actions prove repository checks and broad path-skips, not these exact consumer paths.
• The protected scheduled Release Gate was not dispatched, and no automation state was changed. No Storybook/browser run was needed for this non-rendering CI delta.

What changed before posting

Posted as drafted in the exact-head self-authored GitHub COMMENT review; GitHub recorded COMMENTED at a5676f81cab6fe9ecaa1352ff0b73aa2e8338e82.

---

Round 5 — exact green-head final delta re-review

PR

#5632 — fix(ci): trace affected PR check dependencies by @cixzhang (bucket: the maintainer)

HEAD REVIEWED

e0148bb94091ff082ff77dd8d92bdf0e36a1009c — direct child of approved #5630 head d7681c97aa7c1c2567c7f36ac91860a9bb7a18dc, stacked on approved #5608 head 37d70566fd5203763877d8f93f8e8469255f9005.

VERSIONS

LOOP VERSION: 1.9.1 AUDIT RUBRIC: 1.14.4

LANE

LANE: full WHY: this final round must clear four standing scope/architecture findings across every PR visual, a11y, RTL, and readiness consumer, and must verify a rewritten functional delta plus an exact green header-only tip.

PRIOR REVIEW AND CURRENT MAIN

Our Round 4 review at a5676f81cab6fe9ecaa1352ff0b73aa2e8338e82 asked for every actual PR visual/a11y/RTL/readiness consumer to use the executable shared result; every former parser drift mutant to fail; malformed current helper invocations to fail closed; the RTL harness to receive explicit protected-main coverage; and the nested-barrel, shared-parser, Node/workspace, mixed, Lab, exact, and legacy cases to remain.

The replacement functional head 8f37fbb650116265d5b5476ffe00e315cb1268b1 shares the approved parent d7681c97 and changes 10 files, +406/−69 from Round 4. Exact head e0148bb9 differs from it by only the required two-line copyright header on the new composite action; failed CI run 33178767409 identifies that single missing header, and current exact-head CI is green. Current main remains 936256386b74d67f88a41adee235b91699977b2f; no touched path moved after Round 4.

PROBLEM

WHY 1: PR visual, a11y, and RTL jobs previously rebuilt component scope through separate parsers, so one consumer could drift while another stayed green. WHY 2: a maintainer could receive skipped, broadened, or misleading review evidence for the same changed path even though the advertised classifier was correct. WHY 3: required evidence is trustworthy only when every workflow consumer enters through one executable scope contract and broad inputs fail visibly into protected-main coverage. USER-FACING PROBLEM: a maintainer reviewing component or rendering-infrastructure work needs every browser/audit job to use the same exact-or-deferred decision; otherwise a green review can omit the path that changed. PROBLEM SEVERITY: broken task — Round 4 proved one real visual consumer and malformed readiness syntax could diverge while the contract tests stayed green. NEW FEATURE CASE: not a new feature — this repairs existing CI evidence routing. EARLY STOP: clear — prior findings, exact-head source, action-use inventory, path probes, mutation failures, and CI establish the need and result.

VERDICT: clear

SOLUTION

One local composite action now runs the shared changed-path classifier in both changed-file and analysis-artifact modes. The check-components, accessibility, stable visual, and RTL jobs consume that action’s outputs instead of rebuilding component identity. Lab readiness validates the action, every current workflow entry, the helper schema, and a representative classification while retaining the explicit legacy pathspec branch.

SOLUTION (3 decisions · 10-file functional delta, +406/−69)

1. Add one executable workflow entry over the existing shared classifier.
2. Replace all four PR workflow component parsers with the action’s exact outputs.
3. Make readiness reject missing action fields, missing consumers, direct/shadow helper commands, malformed current wiring, and helper/schema drift.

BURDEN: medium — one 55-line composite action, one extended classifier result, four workflow invocations, one readiness contract check, and focused source/workflow mutation tests. BURDEN MATCH: proportionate — the standing defect was cross-workflow drift; one shared entry plus fail-closed consumer checks is the smallest model that removes it.

VERDICT: clear

ARCHITECTURE

OWNER: .github/scripts/lib/affected-scope.js owns component identity and exact/broad dependency classification; .github/actions/affected-scope/action.yml is its sole PR workflow entry. TIER 1: changed paths, Core/Lab roots, exact component filters, stable visual supplemental story/theme classification, a11y/RTL jobs, and protected-main deferral. TIER 2: none. SEAMS: direct changed-file input, analysis artifact input, nested barrels, shared theme parser, Node/workspace globals, mixed exact+broad input, Lab components, stable visual Core filtering, RTL harness inputs, malformed/shadow commands, and legacy readiness syntax. BEHAVIOR UNIT: pure utility plus a local composite action — deterministic from a path list and testable without a browser. COMPLEXITY BUDGET: one classifier, one workflow entry, four current PR job consumers, one stable-visual supplement for story/theme metadata, zero workflow component parsers, and one fail-closed readiness contract. ACTUAL BURDEN: 15 top-commit files, +1438/−217 against approved #5630; Round 5 functional delta is 10 files, +406/−69; one new action; four action call sites; 169 focused tests across nine files; four banked mutation classes. BURDEN TREND: Round 4 had one shared classifier plus three inline consumer representations and permissive readiness parsing. Round 5 adds one projection action while deleting every workflow component parser; runtime owners contract to one and every current job mutation is rejected. RESET TRIGGER: cleared by the requested architecture reset — no additional writable classifier or fallback source remains in a PR visual/a11y/RTL workflow.

domain fact	one authoritative writable source	generated / immutable projections	other writable copies
exact component identity	affected-scope.js	composite action outputs, analysis.affectedScope, visual-scope’s imported result	report-only newComponents/modifiedComponents remain, but no workflow gate consumes them
PR workflow scope entry	local composite action	four ci.yml uses; workflow/readiness contract tests	none
stable story/theme visual scope	visual-scope.mjs, layered over the shared classifier	check-components flags and trusted PR-comment scope	none
broad/global and RTL-harness deferral	affected-scope.js inputKind()	visual/a11y/RTL booleans and reasons	none
readiness compatibility	current composite-action contract; explicit legacy pathspec branch	helper schema/root/sample validation	no catch-all or cross-checkout fallback

seam	driven result
packages/core/src/Button/Button.tsx	exact Core/Button; no broad deferral
packages/lab/src/Drawer/index.ts	exact Lab/Drawer; a11y/RTL consume the shared output
packages/core/src/Calendar/hooks/index.ts	exact Core/Calendar nested-barrel scope
packages/core/src/utils/parseStyleKey.ts	no exact component; visual, a11y, and RTL broad-defer as shared theme infrastructure
.nvmrc	all three lanes broad-defer as browser-version input
pnpm-workspace.yaml	all three lanes broad-defer as lockfile ambiguity
Button + .nvmrc	exact Button and all broad-defer flags coexist
RTL script, targets, weekly workflow, summary, and rtlStyles.ts	all classify rtl-harness-input and broad-defer
component-roots-broken / component-roots --unexpected	readiness returns no roots; injected shadow command fails the workflow contracts
action input modes	stdin changed-files and analysis.json produce byte-equivalent classifier results

Four action uses are present in ci.yml: check-components, pr-a11y, pr-visual, and pr-rtl. Repository-wide workflow inspection found no direct affected-scope.js invocation and no newComponents + modifiedComponents or affectedScope.components component parser in any workflow; visual-scope.mjs remains only for stable story/theme metadata and imports the shared classifier.

VERDICT: clear

IMPACT

Maintainers now get one component set in every PR visual/a11y/RTL job, while shared or ambiguous inputs retain explicit protected-main deferral. Removing an action consumer, restoring the old visual parser, adding a direct malformed helper command, or dropping a declared contract consumer fails focused tests before the drift can ship. NEW FEATURE IMPACT: not a new feature.

VERDICT: clear

API

No published package API changes. Internal CI adds the local action inputs/outputs and an rtl deferral projection; both action input modes are pinned to the same helper output.

	change	public?	class	doc'd?	verdict
+	composite changed-files / analysis-file inputs	internal workflow contract	existing changed-path classifier	action/test	clear
+	exact component/core-component, a11y/RTL deferral, reasons, and JSON outputs	internal workflow contract	existing affected-scope result	action/test	clear
~	readiness current action contract + explicit legacy pathspec	internal audit contract	existing compatibility path	source/test	clear

OSSIFICATION: no consumer package surface. Workflow consumers now share one executable projection, and the two input forms are parity-tested.

VERDICT: clear

THEMING

No CSS, token, target, variable, selector, or rendered theme output changes. The existing shared-theme path remains broad: parseStyleKey.ts produces shared-theme-token-infrastructure deferral in visual, a11y, and RTL.

VERDICT: clear

BREAKING

BEHAVIOR: yes inside CI — all four PR scope jobs now consume one action, malformed current wiring fails closed, and RTL harness changes explicitly defer. API: no published package API change. VISUAL: no product pixels, DOM, styles, stories, assets, or rendered theme output change. THEME: no theme contract change; only evidence routing for shared theme inputs remains broad.

VERDICT: clear

PERFORMANCE & RESOURCES

EFFECTS: zero.

Effect + deps	external system	why render/handler cannot do it	measured render cost	lifetime + cleanup	focused test
none	none	n/a	n/a	n/a	n/a

RENDER: no product render path. LISTENERS/OBSERVERS: none. LAYOUT: none. BUNDLE: no dependency or lockfile delta. Scope work remains one bounded pass over changed paths; the action invokes the same helper once per consumer.

VERDICT: clear

VISUAL EVIDENCE

VISUAL CHECK: not applicable WHY: the functional delta changes CI scripts/tests, one local action, one workflow, and lab-readiness tooling only. It changes no component implementation, story, style, asset, theme package, DOM, or rendered app path. Storybook/browser capture was not required.

VERDICT: clear

REMEDY SEARCH

REMEDY SEARCH: not triggered — no proven visual defect

A11Y & I18N

No product role, accessible state, focus path, string, locale, direction, or rendered behavior changes. The evidence gate itself is repaired: exact a11y and RTL filters consume the action outputs, and the RTL harness script, targets, weekly workflow, summary, and shared RTL utility all broad-defer. Their broad-defer and mixed-exact cases were driven directly.

VERDICT: clear

JUDGEMENT

slot	verdict
PROBLEM	clear
SOLUTION	clear
ARCHITECTURE	clear
IMPACT	clear
API	clear
THEMING	clear
BREAKING	clear
PERFORMANCE	clear
VISUAL	clear
A11Y & I18N	clear

GOAL: met — all four actual PR jobs enter through the composite action; repository-wide workflow search finds no shadow component parser; four independent mutants fail; malformed command probes fail closed; and every prior exact/broad/mixed/RTL path returns its intended outcome. DISPOSITION: every Round 4 finding is satisfied; no new blocking finding. The PR remains a draft, so the self-authored public disposition is a semantic COMMENT approving once undrafted. ADVICE: omitted — no corrective action remains. AUTHOR CAN PROCEED: yes — undraft when the approved parent stack is ready; this review authorizes no merge or auto-merge. WORST OUTCOME: none found → approve once undrafted.

JUDGEMENT NEEDED: none — correctness repair inside the existing CI contract.

approve once undrafted

REVIEW

Semantic verdict: approve once undrafted

Thanks — one action now owns four PR scope jobs. Drift mutants fail, the exact/deferred matrix holds, and the tip is header-only.

[Reviewed by Robohands]

INLINE (0–3, only when genuinely line-anchored)

None.

EVIDENCE I DID NOT SPEND

• Exact-head focused Vitest passed 9 files / 169 tests. Consumer-removal, pr-visual shadow-parser, malformed direct-command, and declared-inventory mutants each failed the intended workflow/readiness contracts; the restored pair passed 40/40.
• Exact action input parity and 14-case path matrix passed; the nested barrel, parseStyleKey.ts, .nvmrc, workspace, mixed, Core, Lab, and five RTL-harness cases produced the intended exact/broad outcomes. Twelve changed scripts passed node --check; exact PR-plan actionlint, git diff --check, and check:repo passed.
• Exact-head CI run 33180678847 has 17 passing and 5 intentionally skipped checks, with 0 failed/pending. Its check-components log runs the new action and broad-defers this workflow/script stack; the prior red run and 8f37fbb..e0148bb diff independently prove the final tip is copyright-only.

TIME

TIME total 12m setup 2m exact heads, fresh code/wiki worktrees, current rules/rubric, fork trust screening, dependency seed reading 3m all four prior rounds, PR body, functional/header deltas, every workflow consumer, readiness/action contracts measuring 5m path matrix, four mutations, 169 tests, syntax, actionlint, repository gate, exact CI logs writing 2m presentation, literal template gate, two critic passes, GitHub/wiki delivery waste 1m first actionlint run emitted known repository shell/runner diagnostics before the PR’s exact flags were used

WHAT I COULD NOT VERIFY

• Exact-head Actions path-skipped Stable visual, pr-a11y, and pr-rtl because this stack changes shared workflow/scripts; their exact component branches were verified locally through clean tests and mutations rather than a live exact-component PR run.
• The protected scheduled Release Gate, weekly RTL/a11y sweeps, and disabled Automations were not dispatched or changed. No Storybook/browser run was required for this non-rendering CI delta.

What changed before posting

Posted as drafted in the exact-head self-authored GitHub COMMENT review; GitHub recorded COMMENTED at e0148bb94091ff082ff77dd8d92bdf0e36a1009c.

---

Round 6 — authoritative post-#5608 restack review

PR

#5632 — fix(ci): trace affected PR check dependencies by @cixzhang (bucket: the maintainer)

HEAD REVIEWED

1763ae1bc9ef4b5f8e1c8f802146da31869b0334 — direct child of code-approved #5630 exact head 04246c0051029d017e6aa76b3b649bc55bb622dc, whose parent is landed #5608 merge commit a83c559a51fb86260f8309f695b68acd612b2eef.

AUTHORITATIVE ROUND: Round 5's approval at e0148bb9 is invalidated. #5608 landed one minute after that review, changing the stack parent; this round reviews the restacked exact head fresh.

VERSIONS

LOOP VERSION: 1.9.1 AUDIT RUBRIC: 1.14.4

LANE

LANE: full WHY: this is a fresh restack review of a cross-workflow exact/deferred scope authority after the prior approval was invalidated by a parent landing.

PRIOR REVIEW AND CURRENT MAIN

Round 5 approved e0148bb94091ff082ff77dd8d92bdf0e36a1009c on parent d7681c97. That approval cannot carry across #5608's land without restack proof and a current-head contract review.

The restack itself is exact: old and landed #5608 trees are both 3d673168; old/new #5630 trees are both d696514f; old/new #5632 trees are both f98f0264; the old/new #5632 top patches are byte-identical and share stable patch id 7ba1fbfb; git range-diff reports e0148bb = 1763ae1. The current head is a direct child of the separately re-approved #5630 head. No #5608 implementation byte is charged to this top commit.

Fresh review found a standing top-commit contract gap that Round 5 missed: generic shared Core hooks/utilities receive neither exact scope nor protected-main a11y/RTL deferral, while the separate visual wrapper broad-defers them. The helper CLI also accepts malformed command forms with exit 0.

PROBLEM

WHY 1: every changed path that can alter shared visual, accessibility, or RTL behavior needs one truthful exact-or-deferred decision. WHY 2: shared focus and behavior utilities feed many components, so treating them as irrelevant skips the precise jobs most likely to catch regressions. WHY 3: a maintainer must not see visual deferral beside a no-component/no-deferral a11y result for the same file. USER-FACING PROBLEM: a maintainer changing useFocusTrap, useListFocus, useLayer, or a shared runtime utility can receive no exact a11y/RTL run and no explicit protected-main deferral, while the visual lane independently says the change is broad. PROBLEM SEVERITY: broken task — the new one-source contract produces contradictory coverage decisions for reachable shared infrastructure. NEW FEATURE CASE: not a product feature — this repairs CI evidence routing. EARLY STOP: clear — source tracing, direct production-module probes, the clean focused suite, and exact-head CI establish the mismatch.

VERDICT: BLOCKS — shared runtime inputs still have a silent third outcome in a11y/RTL

SOLUTION

The PR correctly centralizes named component and global path cases behind one helper and one composite action. Four CI jobs use the action, current readiness validates those call sites, and named exact/broad/mixed cases work. The helper's global classifier remains enumerative, while visual-scope.mjs keeps a separate catch-all for non-component Core runtime; that split leaves ordinary shared hooks/utilities broad only in visual scope. The executable CLI also defaults unknown commands to empty-stdin classification and ignores extra arguments to component-roots.

SOLUTION (3 decisions · 15-file top delta, +1438/−217)

1. Add one executable classifier and composite action for exact component/global scope.
2. Route four PR jobs through the action and validate the wiring from readiness.
3. Retain a visual-only shared-Core catch-all and permissive CLI dispatch, leaving the one-source/fail-closed model incomplete.

BURDEN: medium — one classifier, one composite entry, four action call sites, one visual supplement, one readiness contract, and 169 focused tests. BURDEN MATCH: disproportionate at the remaining boundary — one visual-only path parser exists because the shared classifier does not own the class.

VERDICT: BLOCKS — the action is not the sole owner of broad shared-runtime classification

ARCHITECTURE

OWNER: .github/scripts/lib/affected-scope.js should own exact component identity and broad/global classification; the composite action should project that result to every PR consumer. TIER 1: Core/Lab component roots, shared Core runtime, Storybook/theme/browser/RTL inputs, exact component filters, and protected-main deferral. TIER 2: none. SEAMS: component source, nested barrels, named theme infrastructure, ordinary shared hooks/utilities, Node/workspace inputs, mixed exact+broad input, RTL harness input, action input parity, current/legacy readiness syntax, and malformed helper CLI arguments. BEHAVIOR UNIT: one pure classifier plus one strict executable projection. COMPLEXITY BUDGET: one classifier, one action entry, four CI job consumers, one source-identified story/theme supplement, zero independent broad-runtime parsers, and fail-closed command dispatch. ACTUAL BURDEN: 15 files, +1438/−217; one helper/action; four action uses; visual-scope.mjs still owns isRuntimeCoreFile() and broadens non-component Core runtime independently; the helper's inputKind() returns null for generic hooks/ and utils/ runtime files; unknown or extra CLI command arguments exit 0. BURDEN TREND: Round 5 → current restack is byte-flat, but fresh class verification finds the prior one-source reset incomplete. No restack byte added the gap; it remains in #5632's unchanged functional patch. RESET TRIGGER: triggered — the approved model still has a second executable owner for broad shared-runtime scope, the same architecture class prior rounds required this PR to remove.

domain fact	one authoritative writable source	generated / immutable projections	other writable copies
exact component identity	affected-scope.js	action outputs, analysis metadata, visual scope	none found
named global/uncertain deferral	affected-scope.js	action and report outputs	none found
generic shared Core runtime deferral	none	visual-only broad flag	visual-scope.mjs:isRuntimeCoreFile(); absent from helper a11y/RTL result
action consumers	readiness workflow contract	four ci.yml action uses	helper CONSUMERS names pr-comment.visual but not ci.pr-visual
helper CLI grammar	implicit branch on argv[2]	roots or default JSON	unknown commands fall into default mode; extra root args are ignored

seam	driven result
Core Button.tsx	exact Core/Button; no deferral
Lab Drawer/index.ts	exact Lab/Drawer for a11y/RTL; no stable visual scope
nested Calendar/hooks/index.ts	exact Core/Calendar
parseStyleKey.ts	visual/a11y/RTL broad-defer as shared theme infrastructure
.nvmrc	all three broad-defer as browser-version input
pnpm-workspace.yaml	all three broad-defer as lockfile ambiguity
Button + .nvmrc	exact Button plus all broad flags
RTL harness	all three broad-defer as rtl-harness-input
useLayer.tsx, useFocusTrap.ts, useListFocus.ts, sharedResizeObserver.ts	zero components; visual/a11y/RTL helper deferral all false; visual wrapper independently broad true
missing/malformed-export/throwing readiness helper	returns no roots in the explicit fixture test
legacy pathspec / current action syntax	both return Core + Lab roots
removed action consumer / shadow parser / direct malformed command / missing declared consumer	each mutation reds the two current readiness contract tests; restored head is clean
component-roots-broken	exits 0 and emits empty-scope JSON
component-roots --unexpected	exits 0 and emits Core + Lab roots

The split is between inputKind(), which returns null for generic shared runtime, and isRuntimeCoreFile(), which broadens the same files only for visual scope. Permissive CLI dispatch is at affected-scope.js lines 197–214.

VERDICT: BLOCKS — one shared-runtime fact still has two outcomes and malformed commands do not fail closed

IMPACT

A maintainer changing a shared focus/navigation hook can see Stable visual defer while has_components=false, a11y_deferred=false, and rtl_deferred=false. Exact a11y/RTL jobs skip, and the generated accessibility section can report no violations instead of naming protected-main coverage. A malformed helper command can also succeed with an unrelated result rather than expose broken wiring. NEW FEATURE IMPACT: not a new feature.

VERDICT: BLOCKS — required evidence can silently disappear for shared runtime changes

API

No published package API changes. Internal CI adds action inputs/outputs, helper result/schema, consumer metadata, and the component-roots CLI mode.

	change	public?	class	doc'd?	verdict
+	exact component and visual/a11y/RTL deferral result	internal CI contract	existing PR checks	source/tests	BLOCKS — shared runtime is not total
+	composite action inputs/outputs	internal workflow contract	existing classifier	action/tests	clear for the four current call sites
+	component-roots command	internal readiness contract	current/legacy root discovery	source/tests	BLOCKS — unknown/extra arguments succeed

OSSIFICATION: no consumer package surface. This internal contract gates whether required evidence exists, so silent success is a correctness failure rather than a documentation nit.

VERDICT: BLOCKS — the internal executable scope contract is incomplete and permissive

THEMING

No CSS, token, target, variable, selector, or rendered theme output changes. The named parseStyleKey.ts and theme infrastructure cases correctly broad-defer in all three lanes.

VERDICT: clear

BREAKING

BEHAVIOR: yes inside CI — named component/global paths are centralized, but generic shared runtime still gets inconsistent lane behavior. API: no published package API change. VISUAL: no product pixels, DOM, styles, stories, assets, or theme output change. THEME: no theme contract change; only evidence routing for shared infrastructure changes.

VERDICT: BLOCKS — intended one-source CI behavior remains incomplete

PERFORMANCE & RESOURCES

EFFECTS: zero.

Effect + deps	external system	why render/handler cannot do it	measured render cost	lifetime + cleanup	focused test
none	none	n/a	n/a	n/a	n/a

RENDER: no product render path. LISTENERS/OBSERVERS: none added. LAYOUT: none. BUNDLE: no dependency or lockfile delta. Classification remains bounded by changed paths.

VERDICT: clear

VISUAL EVIDENCE

VISUAL CHECK: not applicable WHY: all top-commit files are CI scripts/tests, workflows, one local action, docs, and lab-readiness tooling. No component implementation, story, style, asset, theme package, DOM, or rendered app path changes. No Storybook/browser capture was required.

VERDICT: clear

REMEDY SEARCH

REMEDY SEARCH: not triggered — no proven visual defect

A11Y & I18N

No product role, accessible state, focus path, string, locale, direction, or rendered behavior changes. The changed boundary determines whether a11y/RTL evidence runs. Named exact and RTL-harness cases work, but shared focus/navigation hooks receive neither exact scope nor explicit deferral.

VERDICT: BLOCKS — the new gate can silently omit the exact evidence class it protects

JUDGEMENT

slot	verdict
PROBLEM	BLOCKS — shared runtime has a silent third outcome
SOLUTION	BLOCKS — visual retains an independent broad parser
ARCHITECTURE	BLOCKS — the one-source reset is incomplete
IMPACT	BLOCKS — a11y/RTL evidence can disappear
API	BLOCKS — internal command/scope contract is permissive
THEMING	clear
BREAKING	BLOCKS — intended routing remains incomplete
PERFORMANCE	clear
VISUAL	clear
A11Y & I18N	BLOCKS — shared hooks skip exact and deferred coverage

GOAL: partly met — the four action consumers, requested exact/broad/mixed path matrix, readiness failure fixtures, and four drift mutations pass; generic shared Core runtime still splits visual from a11y/RTL, and malformed helper commands succeed. DISPOSITION: the prior one-source architecture finding blocks again. Acceptance criteria: (1) the executable classifier owns generic shared runtime classification for every lane; (2) visual supplements consume that source rather than independently broadening the class; (3) unknown commands and extra arguments exit nonzero; (4) shared focus/utility and malformed-command regression cases are pinned; (5) all currently passing named cases and mutants remain. ADVICE: bounded outcome criteria — contract the remaining broad parser into the executable owner and fail closed at its CLI boundary. AUTHOR CAN PROCEED: yes — failing files, commands, and expected outcomes are deterministic. WORST OUTCOME: “a shared focus-hook change receives no exact a11y/RTL run and no protected-main deferral while the PR report looks clean” → request changes.

JUDGEMENT NEEDED: none — correctness and architecture defect inside the new CI contract.

request changes

1. Generic shared Core runtime is broad only in the visual wrapper, not the executable classifier. → maintainers changing shared focus/navigation behavior can lose a11y and RTL evidence while the report looks irrelevant/clean · affected-scope.js:49
2. The helper accepts unknown commands and extra component-roots arguments with exit 0. → malformed wiring can return an unrelated valid-looking result instead of failing closed · affected-scope.js:197

REVIEW

Semantic verdict: request changes

Thanks — the restack itself is byte-identical, but the one-source scope contract still has a silent shared-infrastructure lane.

inputKind() defers only named utilities. Changes to shared runtime such as useFocusTrap.ts, useListFocus.ts, or sharedResizeObserver.ts return no component and all three deferred flags false; visual-scope.mjs independently broad-defers those same paths, so visual coverage defers while a11y/RTL skip and the PR report can say no violations. The helper also exits 0 for component-roots-broken and component-roots --unexpected.

Please make the executable classifier total for shared runtime inputs, reject unknown/extra CLI arguments, and pin both classes.

[Reviewed by Robohands]

INLINE (0–3, only when genuinely line-anchored)

None — both failures cross the executable owner and consumer boundary.

EVIDENCE I DID NOT SPEND

• Exact restack proof: #5608 old/landed trees 3d673168; #5630 old/new trees d696514f; #5632 old/new trees f98f0264; stable patch id 7ba1fbfb; byte-identical top patches; range-diff equality; direct parent 04246c00.
• Exact-head focused Vitest passed 9 files / 169 tests. Consumer-removal, visual shadow-parser, malformed direct-command, and declared-inventory mutants each failed the intended readiness contract; restored worktree is clean. Missing/malformed/throwing helper, current/legacy syntax, and action contract fixtures passed 3/3.
• Action stdin/analysis-file results were byte-identical. Named path matrix passed for Core, Lab, nested barrel, parseStyleKey, .nvmrc, workspace, mixed exact+broad, and RTL harness. The added shared-hook/shared-utility control exposed the contradictory lane result.
• Twelve changed JS/MJS files pass node --check; the three interacting workflows pass exact actionlint; git diff --check and check:repo pass.
• Exact-head CI run 33183590319 has 17 passing checks/statuses, 5 intentional skips, and 0 pending/failed. Its log proves the new action executed on the top stack and broad-deferred the listed workflow/visual-gate files.

TIME

TIME total 13m setup 3m exact heads, fresh code/wiki worktrees, current kit/rubric, trust screening, dependency seed reading 3m all Review-5632 rounds, parent authoritative records, restack topology, action/workflow/readiness dataflow measuring 5m 169 tests, path/CLI matrix, four mutations, fail-closed fixtures, syntax/actionlint/repo gates, exact CI writing 2m presentation, two critic passes, exact-head GitHub/wiki delivery waste 1m two shell probes used a reserved scalar/argument form and were immediately rerun correctly

WHAT I COULD NOT VERIFY

• PR-head workflow code cannot fully exercise the trusted default-branch publisher path; local source-identified contracts and mutations cover it instead.
• The protected Release Gate, weekly RTL/a11y sweeps, and disabled Automations were not dispatched or changed. No Storybook/browser run was needed for this non-rendering CI delta.

What changed before posting

Posted as drafted in the exact-head self-authored GitHub COMMENT review; GitHub recorded COMMENTED at 1763ae1bc9ef4b5f8e1c8f802146da31869b0334. This Round 6 record supersedes the invalidated Round 5 approval. No merge or auto-merge was enabled.

---

Round 7 — one-time manual final review at exact green head

PR

#5632 — fix(ci): trace affected PR check dependencies by @cixzhang (bucket: the maintainer)

HEAD REVIEWED

341632258626f824ebc978fdf415d88322615fd0 — direct child of the exact-patch #5630 copy 6413ca02d148085ae130f282d7304437d09e7589 on main 1b706d5d2d35cf141fd8384ce9952d660d0a9221.

AUTHORITATIVE ROUND: Round 7 supersedes Round 6 at 1763ae1bc9ef4b5f8e1c8f802146da31869b0334. Round 5's invalidated approval remains historical; this is the current exact-head disposition.

VERSIONS

LOOP VERSION: 1.9.1 AUDIT RUBRIC: 1.14.4 (the page header and newest history row; its stale Current line still says 1.14.3)

LANE

LANE: full WHY: this is a final re-review of a repeatedly-blocked cross-workflow scope authority, its CLI trust boundary, every prior path/consumer/mutation case, and a current-main restack.

PRIOR REVIEW AND CURRENT MAIN

Our Round 6 review asked for generic shared Core runtime to broad-defer in visual, a11y, and RTL from the executable owner; visual scope to stop independently owning that class; unknown and extra CLI arguments to fail; focused path/CLI regressions to be pinned; and every prior named case and drift mutant to remain.

The Round 6 head 1763ae1b and fixed pre-restack candidate 73e0a60c share parent 04246c00; their functional delta is 7 files, +198/−32. The current parent 6413ca02 has the same stable patch id 8aa2e884 as approved #5630 head 04246c00. 73e0a60c → 34163225 range-diff changes only the expected ci.yml context from the old theme-layer step to the current guest fixture-contrast job. Current main f0043d8f adds only the canonical setup-composition step immediately before that job on the overlapping path; a synthetic merge is clean, and its two scope-contract suites plus actionlint pass.

PROBLEM

WHY 1: every shared runtime change needs the same exact-or-deferred answer in visual, accessibility, and RTL checks. WHY 2: a path one classifier misses can make exact checks skip while another classifier reports broad coverage, producing contradictory green-looking evidence. WHY 3: a maintainer needs malformed workflow wiring to fail immediately rather than execute with an unrelated valid result. USER-FACING PROBLEM: a maintainer changing shared direction, translation, or naming behavior can still receive visual deferral while accessibility and RTL silently skip; a malformed action command can also be certified as ready. PROBLEM SEVERITY: broken task — required review evidence can disappear for real shared runtime files and command drift can remain green. NEW FEATURE CASE: not a new feature — this repairs an existing CI evidence contract. EARLY STOP: clear — direct production-path and action-command probes establish both reachable failures.

VERDICT: BLOCKS — the exact-or-deferred and fail-closed contracts remain incomplete

SOLUTION

A single classifier is intended to decide whether a change has a bounded component scope or needs protected-main coverage. The new delta broadens four named shared-runtime directories and gives the helper explicit commands, while the composite action remains the common workflow entry. The classification still enumerates selected directories rather than owning the whole shared-runtime class, and its argument parser rejects unknown flags but silently ignores bare tokens.

SOLUTION (3 decisions · 7-file Round 6 delta, +198/−32)

1. Broad-defer shared hooks/, utils/, focus/, and runtime/ inputs in all three lanes.
2. Require explicit helper subcommands and changed-file input modes.
3. Preserve the composite action, four CI consumers, readiness contract, and prior regression matrix.

BURDEN: medium — one classifier, one action, four CI workflow consumers, one visual supplement, one readiness contract, and 178 focused tests. BURDEN MATCH: disproportionate at the remaining boundary — selected directory and token checks still encode a class that already has another broader visual owner.

VERDICT: BLOCKS — the repair closes named examples but not the shared-runtime or CLI grammar class

ARCHITECTURE

OWNER: .github/scripts/lib/affected-scope.js should own exact component identity and broad shared-runtime classification; .github/actions/affected-scope/action.yml should be its strict executable projection. TIER 1: Core/Lab component roots, non-component Core runtime, Storybook/theme/browser/RTL inputs, exact component filters, and protected-main deferral. TIER 2: none. SEAMS: component source, nested barrels, hooks, utilities, focus/runtime helpers, i18n, root shared modules, Node/workspace inputs, exact+broad unions, RTL harness paths, action inputs, current/legacy readiness, and malformed CLI tokens. BEHAVIOR UNIT: pure utility plus one local composite action — deterministic from a changed-path list and directly testable. COMPLEXITY BUDGET: one classifier, one workflow entry, four CI consumers, one source-identified story/theme supplement, zero independent shared-runtime parsers, and zero ignored CLI tokens. ACTUAL BURDEN: 15 top-commit files, +1604/−217; Round 6 → fixed candidate is 7 files, +198/−32; one new broad-directory regex and three CLI parsing helpers; 178 focused tests. visual-scope.mjs:isRuntimeCoreFile() still broadens real Core runtime that inputKind() does not classify. BURDEN TREND: Round 6 → current grows to cover four named roots and explicit flag forms, but the number of owners for generic non-component Core runtime stays at two and the strict grammar remains partial. RESET TRIGGER: remains triggered — this is the next round of the same one-source finding, and the repair remains an enumerated subset rather than contracting the whole class into its owner.

domain fact	one authoritative writable source	generated / immutable projections	other writable copies
exact component identity	affected-scope.js	action/analysis/visual projections	none found
named shared runtime deferral	affected-scope.js directory regex	visual/a11y/RTL outputs	none for the four named roots
all non-component Core runtime deferral	none	visual-only broad flag	visual-scope.mjs:isRuntimeCoreFile(); helper omits actual i18n/ and root naming.ts
workflow entry and consumers	composite action + readiness contract	four ci.yml action uses	no direct helper or shadow component parser found
CLI grammar	affected-scope.js dispatch/parser	action command lines	bare positional tokens are silently ignored; action validation uses substring matching

seam	driven result
Core Button.tsx / Lab Drawer/index.ts	exact component scope, no deferral
nested Calendar/hooks/index.ts	exact Core/Calendar
parseStyleKey.ts, .nvmrc, workspace config	all three lanes broad-defer with the expected reason
shared hooks/, utils/, focus/, runtime/	all three lanes broad-defer as shared runtime
Button + .nvmrc + RTL harness	exact Button plus visual/a11y/RTL broad union
i18n/useDirection.ts	no component and all helper deferrals false; visual supplement alone marks broad
root naming.ts	no component and all helper deferrals false; it is consumed by components, themes, and build tooling
four CI consumers	each uses the composite action; no workflow direct-helper or legacy component parser found
prior consumer-removal, visual-shadow-parser, direct-helper, and inventory mutants	each reds the intended contract tests
classify unexpected --changed-files-stdin / trailing unexpected	both exit 0; adding the token to both action commands leaves the workflow/readiness contract suite green

VERDICT: BLOCKS — shared runtime still has two executable owners and malformed action syntax can be certified

IMPACT

A change to useDirection.ts or useTranslator.ts can affect direction, locale, and accessible strings across many components. Current outputs are has_components=false, a11y_deferred=false, and rtl_deferred=false, while only the separate visual supplement says broad; exact a11y/RTL work therefore skips without protected-main attribution. A stray positional token in either action command also exits successfully and survives readiness validation. NEW FEATURE IMPACT: not a new feature.

VERDICT: BLOCKS — maintainers can still receive incomplete evidence for real shared runtime or malformed wiring

API

No published package API changes. Internal CI changes the affected-scope CLI grammar and broad-dependency classification.

	change	public?	class	doc'd?	verdict
~	shared runtime classification	internal CI contract	existing exact/deferred scope	source/tests	BLOCKS — actual i18n/root runtime remains outside the owner
~	explicit component-roots / classify grammar	internal executable contract	existing action/readiness seam	source/tests	BLOCKS — unconsumed positional tokens succeed
=	composite action inputs/outputs	internal workflow contract	existing four-consumer entry	action/tests	clear

OSSIFICATION: no consumer package surface. These internal contracts decide whether required evidence exists, so silent acceptance creates durable false-green behavior.

VERDICT: BLOCKS — the internal classifier and CLI contracts are not total

THEMING

No product CSS, tokens, targets, selectors, or rendered theme output changes. The omitted root naming.ts owns class, data-attribute, CSS-variable, and layer names and is consumed by component and theme generation, yet receives no helper deferral.

VERDICT: BLOCKS — one real shared theme/runtime source remains outside affected-scope ownership

BREAKING

BEHAVIOR: yes inside CI — the named shared roots and strict flag forms now route correctly, but actual i18n/root runtime and bare-token syntax still do not. API: no published package API change. VISUAL: no product pixel, DOM, story, style, or asset change. THEME: no theme output change; only its evidence routing is incomplete.

VERDICT: BLOCKS — intended one-source and fail-closed CI behavior remains incomplete

PERFORMANCE & RESOURCES

EFFECTS: zero.

Effect + deps	external system	why render/handler cannot do it	measured render cost	lifetime + cleanup	focused test
none	none	n/a	n/a	n/a	n/a

RENDER: no product render path. LISTENERS/OBSERVERS: none added. LAYOUT: none. BUNDLE: no dependency or lockfile delta; classification remains one bounded pass over changed paths.

VERDICT: clear

VISUAL EVIDENCE

VISUAL CHECK: not applicable WHY: the functional delta changes CI scripts/tests, one local action, one workflow, and lab-readiness tooling only. It changes no component implementation, story, style, asset, theme package, DOM, or rendered app output. No Storybook/browser capture was required.

VERDICT: clear

REMEDY SEARCH

REMEDY SEARCH: not triggered — no proven visual defect

A11Y & I18N

No product accessibility or localization implementation changes. This PR controls whether those changes receive evidence: i18n/useDirection.ts and i18n/useTranslator.ts are actual shared runtime consumers across the component set, but currently produce neither exact scope nor a11y/RTL deferral.

VERDICT: BLOCKS — the changed gate can silently omit a11y/RTL evidence for its own shared i18n runtime

JUDGEMENT

slot	verdict
PROBLEM	BLOCKS — real shared runtime and malformed wiring retain silent outcomes
SOLUTION	BLOCKS — named cases do not close either class
ARCHITECTURE	BLOCKS — generic runtime still has two owners
IMPACT	BLOCKS — required evidence can disappear
API	BLOCKS — internal classifier/CLI contracts are incomplete
THEMING	BLOCKS — shared naming source is omitted
BREAKING	BLOCKS — intended CI behavior remains partial
PERFORMANCE	clear
VISUAL	clear
A11Y & I18N	BLOCKS — shared i18n changes can skip both lanes

GOAL: partly met — all twelve requested named exact/broad/mixed/RTL cases pass, action input parity holds, four prior drift mutants fail, and four CI jobs use the action; actual i18n/root runtime still splits visual from a11y/RTL, while two bare-token command forms and the matching action mutant remain green. DISPOSITION: shared-runtime totality blocks now; unconsumed CLI tokens block now. ADVICE: bounded outcome criteria — make the shared classifier own the same non-component Core runtime class visual scope treats as broad, reject every token not consumed by the command grammar, and pin the real-path/action-command controls. AUTHOR CAN PROCEED: yes — both failing path/command forms and expected outputs are deterministic. WORST OUTCOME: “a maintainer changing shared direction behavior can receive visual deferral while accessibility and RTL silently skip” → request changes.

JUDGEMENT NEEDED: none — correctness and architecture defects inside the existing CI contract.

request changes

1. Actual shared Core runtime remains outside the executable owner. → direction, translation, or naming changes can lose a11y/RTL evidence while visual scope alone says broad · affected-scope.js:67
2. The strict parser ignores bare positional tokens. → malformed action wiring can execute successfully and be certified by readiness · affected-scope.js:183

REVIEW

Semantic verdict: request changes

Thanks — we asked for one total scope owner and strict CLI. The four named shared-runtime roots and all four CI consumers now pass, but two parts remain.

inputKind() omits real shared Core runtime under i18n/ and the root naming.ts. useDirection.ts returns no component and no visual/a11y/RTL deferral, while visual-scope.mjs independently broadens it; a11y and RTL can still skip. Please make the shared classifier own the same non-component Core runtime class that visual scope treats as broad.

assertNoUnknownArgs() ignores bare tokens, so malformed classify action wiring can succeed and pass readiness. Please reject every unconsumed token and pin that action-command mutation.

[Reviewed by Robohands]

INLINE (0–3, only when genuinely line-anchored)

None — both failures cross classifier, action, and consumer boundaries.

EVIDENCE I DID NOT SPEND

• Exact-head focused Vitest passed 9 files / 178 tests; the 12-case exact/broad/mixed/RTL matrix and action stdin/analysis parity passed. Four prior drift mutants red; a new extra-positional action-command mutant stayed green in both contract suites (40/40).
• Twelve changed JS/MJS files pass node --check; exact actionlint, git diff --check, and check:repo pass. The worktree returned byte-clean after every mutation.
• Exact-head CI has 18 successful and 5 intentionally skipped checks/statuses, 0 failed/pending. The shared action executed and deferred this workflow/script stack; fixture contrast passed in both modes. Current-main synthetic integration changes only the added canonical setup step and passes 40 scope-contract tests plus actionlint.

TIME

TIME total 16m setup 3m exact heads, untrusted CI screening, fresh code/wiki checkouts, current kit/rubric, dependency seed reading 4m all six prior rounds/invalidation, fixed/restacked delta, classifier/action/workflow/readiness dataflow measuring 6m 178 tests, path/CLI probes, five mutations, syntax, actionlint, repo gate, current-main merge, exact CI logs writing 3m presentation, literal template gate, two critic passes, exact-head GitHub/wiki delivery waste 1m initial broad patch and review-page reads were truncated, so direct files and bounded chunks were reread

WHAT I COULD NOT VERIFY

• PR-head Actions path-skipped exact Stable visual, pr-a11y, and pr-rtl because this stack itself broad-defers; their exact and mixed branches were driven locally.
• Protected scheduled Release Gate and weekly RTL/a11y jobs were not dispatched. Scheduled Automations remained disabled and untouched. No Storybook/browser run was required for this non-rendering CI delta.

What changed before posting

Posted as drafted in the exact-head self-authored GitHub COMMENT review; GitHub recorded COMMENTED at 341632258626f824ebc978fdf415d88322615fd0. This Round 7 record supersedes Round 6 at the prior head. No merge or auto-merge was enabled.

---

Round 8 — one-time manual final re-review at exact green head

PR

#5632 — fix(ci): trace affected PR check dependencies by @cixzhang (bucket: the maintainer)

HEAD REVIEWED

185dc58b5ac39629d813789ebd6e2cccef7faaa9 — direct child of the exact-patch #5630 copy 6413ca02d148085ae130f282d7304437d09e7589 on branch base 1b706d5d2d35cf141fd8384ce9952d660d0a9221.

AUTHORITATIVE ROUND: Round 8 supersedes Round 7 at 341632258626f824ebc978fdf415d88322615fd0. Round 5's invalidated approval remains historical; this is the current exact-head disposition.

VERSIONS

LOOP VERSION: 1.9.1 AUDIT RUBRIC: 1.14.4 (the official page header and newest history row; its stale Current line still says 1.14.3)

LANE

LANE: full WHY: this is a repeatedly blocked cross-workflow scope and CLI trust boundary; the final round must re-run every prior path, consumer, mutation, current-main, and exact-CI invariant.

PRIOR REVIEW AND CURRENT MAIN

Our Round 7 review at 341632258626f824ebc978fdf415d88322615fd0 asked for i18n/** and root naming.ts to broad-defer visual, a11y, and RTL from the executable owner; every unconsumed CLI token to fail; the real path and malformed-action cases to be pinned; and all prior exact/broad/mixed/consumer/RTL behavior to remain.

The current three-file delta is +52/−5. Current main is 8e2751be7c1595506e43a8514527811a58e9e28b; its only post-base commit on a touched path is f0043d8f in ci.yml. A synthetic merge is clean and passes the four scope-contract files (103/103), syntax, and actionlint. The parent 6413ca02 and approved #5630 head 04246c00 share stable patch id 8aa2e884.

PROBLEM

WHY 1: shared runtime changes need the same exact-or-deferred answer in visual, accessibility, and RTL, and the action CLI must reject malformed wiring. WHY 2: otherwise required review evidence can silently skip or a workflow can run with an unintended command shape. WHY 3: maintainers rely on the focused contract suite to prove those failures remain impossible after later parser or action edits. USER-FACING PROBLEM: a maintainer changing the scope parser can currently re-allow stray positional tokens while the test named for malformed invocations remains green. PROBLEM SEVERITY: broken task — the strictness repair works now, but its regression test does not distinguish the intended parser error from a later malformed-path error. NEW FEATURE CASE: not a new feature — this repairs and regression-proofs an existing CI evidence contract. EARLY STOP: clear — prior acceptance criteria, exact-head execution, and two independent mutations establish the remaining test defect.

VERDICT: clear

SOLUTION

The classifier now treats shared translation and naming code as broad infrastructure, so all three review lanes defer together. The CLI rejects unknown commands, stray positionals, duplicate or missing options, malformed JSON, and unsafe changed paths. The new table intends to pin those failures, but gives every case a second malformed input that can throw after the grammar check is removed.

SOLUTION (3 decisions · 9 net runtime lines + 43 test lines; 3 files, +52/−5)

1. Broad-defer packages/core/src/i18n/** and root naming.ts in visual, a11y, and RTL.
2. Make classify consume exactly one known command/input grammar with no stray positional tokens.
3. Add path and CLI regressions for the fixed cases.

BURDEN: low for this round — one classifier condition, one parser branch, and two focused test tables; the full top commit remains one helper/action owner with four CI job consumers. BURDEN MATCH: proportionate in implementation, incomplete in evidence — the added positional rows are green under the prior permissive behavior.

VERDICT: BLOCKS — the malformed-CLI regression passes when positional rejection is removed, so Round 7's action-command mutation is not pinned

ARCHITECTURE

OWNER: .github/scripts/lib/affected-scope.js owns exact component identity, broad shared-runtime classification, and CLI grammar; .github/actions/affected-scope/action.yml is its sole PR workflow entry. TIER 1: Core/Lab roots, non-component Core runtime, Storybook/theme/browser/RTL inputs, four PR job consumers, and protected-main deferral. TIER 2: none. SEAMS: exact Core/Lab files, nested barrels, shared theme parser, all current i18n runtime files, root naming, Node/workspace inputs, mixed exact+broad input, five RTL inputs, action input parity, consumer inventory, and malformed action commands. BEHAVIOR UNIT: pure utility plus one local composite action — deterministic from changed paths and directly executable in both action modes. COMPLEXITY BUDGET: one classifier, one action entry, four workflow consumers, one visual story/theme supplement, zero shadow component parsers, zero ignored CLI tokens, and one red regression per grammar defect. ACTUAL BURDEN: top commit 15 files, +1651/−217; Round 7→8 is 3 files, +52/−5; owner count is flat. Exact source inventory compared 456 Core runtime-looking paths: the only visual/helper mismatches are type declarations, BaseProps.ts, and __tests__ support—not another shipped runtime owner. BURDEN TREND: Round 7→8 shrinks the production gap without adding an owner; i18n/naming and runtime command behavior now contract into the helper. Test authority remains incomplete because malformed cases share an unrelated failure input. RESET TRIGGER: cleared for runtime ownership; not triggered by the remaining focused test-evidence defect.

domain fact	one authoritative writable source	generated / immutable projections	other writable copies
exact component identity	affected-scope.js	action outputs, analysis metadata, visual scope	no workflow parser found
broad shared-runtime deferral	affected-scope.js	visual/a11y/RTL flags and report reasons	visual supplement has only non-runtime false-positive remainder
workflow entry/consumers	composite action + readiness contract	four ci.yml uses	no direct helper or legacy parser found
CLI grammar	affected-scope.js dispatch/parser	two action command lines	tests do not isolate each grammar failure

seam	driven result
11 non-test/doc files under packages/core/src/i18n/	zero exact components; visual/a11y/RTL all broad-defer as shared Core runtime
root packages/core/src/naming.ts	zero exact components; visual/a11y/RTL all broad-defer as shared Core runtime
Core Button / Lab Drawer / nested Calendar barrel	exact component scope; no broad deferral
parseStyleKey.ts, .nvmrc, workspace config	all three lanes broad-defer with the expected reason
Button + Node version + RTL harness	exact Button plus all broad flags and reasons
four action consumers / prior removal, shadow-parser, direct-helper, and inventory mutants	four uses found; every prior mutant reds the intended workflow/readiness tests
27 strict CLI/JSON/path cases with otherwise valid controls	256 assertions pass; each observed failure carries its expected message
malformed action, analysis and stdin arms	executing either arm exits 1 with unexpected positional argument stray-action-token
malformed action contract mutant	all 70 helper/workflow/readiness tests remain green
positional parser mutant	classify stray-before --changed-files-stdin succeeds for valid Button input; all 30 helper tests remain green

VERDICT: clear — runtime ownership and command behavior contract to one source; the remaining defect is regression-test fidelity

IMPACT

Current maintainers get explicit visual/a11y/RTL deferral for shared translation and naming files, and malformed action commands fail closed in both input modes. The remaining gap reaches the next maintainer: removing positional rejection or appending a token still leaves the focused suites green, so the promised regression signal is absent until live action execution. NEW FEATURE IMPACT: not a new feature.

VERDICT: BLOCKS — a future parser/action regression can pass the contract suite that claims to guard it

API

No published package API changes. Internal CI changes the shared-runtime classification and the affected-scope.js command grammar.

	change	public?	class	doc'd?	verdict
~	i18n/** and naming.ts → shared-runtime deferral	internal CI contract	existing broad dependency classification	source/tests	clear
~	strict component-roots / classify grammar	internal executable contract	existing action/readiness seam	source/tests	clear at runtime; test finding is in SOLUTION/IMPACT

OSSIFICATION: no consumer package surface. The internal runtime meanings are now total for every requested real path and strict command case.

VERDICT: clear

THEMING

No product CSS, token, target, selector, or rendered theme output changes. Root naming.ts and shared parseStyleKey.ts now both receive explicit broad deferral across visual, a11y, and RTL; direct probes and focused tests agree.

VERDICT: clear

BREAKING

BEHAVIOR: yes inside CI — i18n/naming now defer consistently and stray positionals fail instead of being ignored. API: no published package API change. VISUAL: no product pixel, DOM, story, style, asset, or rendered theme change. THEME: no theme contract change; only evidence routing for shared naming/theme inputs changes.

VERDICT: clear — the intended current-head behavior is correct and fail-closed

PERFORMANCE & RESOURCES

EFFECTS: zero.

Effect + deps	external system	why render/handler cannot do it	measured render cost	lifetime + cleanup	focused test
none	none	n/a	n/a	n/a	n/a

RENDER: no product render path. LISTENERS/OBSERVERS: none added. LAYOUT: none. BUNDLE: no dependency or lockfile delta; classification remains one bounded pass over changed paths.

VERDICT: clear

VISUAL EVIDENCE

VISUAL CHECK: not applicable WHY: the top commit changes CI scripts/tests, one local action, workflows, and lab-readiness tooling only. It changes no component implementation, story, style, asset, theme package, DOM, or rendered app output. Exact-head visual/a11y/RTL jobs intentionally skip because this workflow/script stack broad-defers; no manual Storybook/browser capture was required.

VERDICT: clear

REMEDY SEARCH

REMEDY SEARCH: not triggered — no proven visual defect

A11Y & I18N

No product accessibility, localization, locale, or direction implementation changes. This PR controls whether those changes receive evidence: every current non-test/doc i18n file and root naming source now broad-defer visual, a11y, and RTL; nested/exact/mixed/RTL controls remain clean.

VERDICT: clear

JUDGEMENT

slot	verdict
PROBLEM	clear
SOLUTION	BLOCKS — malformed grammar regressions are not isolated or pinned
ARCHITECTURE	clear
IMPACT	BLOCKS — future parser/action drift can leave focused suites green
API	clear
THEMING	clear
BREAKING	clear
PERFORMANCE	clear
VISUAL	clear
A11Y & I18N	clear

GOAL: partly met — all requested runtime path/grammar outcomes, exact/broad/mixed cases, action parity, prior mutants, current-main integration, repository checks, and exact CI pass; the positional-parser and malformed-action mutants still pass the committed regression/contract suites. DISPOSITION: the false-positive malformed invocation test blocks now. Acceptance criteria: (1) each grammar case runs with otherwise valid input and asserts its expected stderr/exit; (2) removing positional rejection makes the helper test red; (3) appending a stray token to either composite-action command makes a checked-in action/readiness contract test red for that command shape; (4) all passing path, consumer, JSON/path, current-main, and CI behavior remains. ADVICE: bounded outcome criteria — isolate the failing variable in the existing test table and validate the full action command, rather than adding another parser owner. AUTHOR CAN PROCEED: yes — both surviving mutations, the false-positive input, and the required red outcomes are deterministic. WORST OUTCOME: “a positional-parser regression returns exact Button scope while all 30 malformed-invocation tests stay green” → request changes.

JUDGEMENT NEEDED: none — test correctness for an existing CI contract.

request changes

1. The malformed invocation table fails later on the same invalid changed path, so it does not prove the grammar error it names. → a maintainer can remove positional rejection or drift an action command while all focused contract tests remain green · .github/scripts/lib/affected-scope.test.mjs:95-135 → confirmed independently by a parser mutant that succeeds on a valid Button path with 30/30 tests green, and an action-command mutant with 70/70 tests green while both executed arms fail on the stray token.

REVIEW

Semantic verdict: request changes

Thanks — runtime behavior is now right: the shared i18n runtime and root naming source defer together, and both action arms reject a stray token. The regression still is not pinned.

The malformed-CLI table gives every case ../bad/path.ts. Replacing positional rejection with continue lets a valid Button path accept stray-before, while all 30 tests stay green. Appending a stray token to both action commands likewise leaves all 70 helper/workflow/readiness tests green; only executing the action fails.

Could you give each grammar case otherwise-valid input, assert its expected error, and make the action-command mutant red?

[Reviewed by Robohands]

INLINE (0–3, only when genuinely line-anchored)

None — the defect spans the helper test and action/readiness contract.

EVIDENCE I DID NOT SPEND

• Exact head: 9 focused files / 182 tests; 12 changed JS/MJS syntax checks; exact actionlint, git diff --check, and check:repo pass. Custom matrix passes 256 assertions over 11 i18n runtime files, naming, exact Core/Lab, nested barrel, shared parser, Node/workspace, mixed, RTL, unique options, JSON, and changed paths.
• Prior consumer-removal, consumer-inventory, shadow-parser, direct-helper, and i18n/naming mutants each red the intended suites; the restored exact worktree is byte-clean after every arm.
• Current-main synthetic integration passes 4 files / 103 tests, actionlint, syntax, and diff check; the temporary worktree was removed.
• Exact-head CI run 33193068818 has 18 successful checks/statuses, 5 intentional skips, and 0 failed/pending. Its check-components log executes the composite action and broad-defers the workflow/script stack as browser-version-input.

TIME

TIME total 21m setup 4m exact head/parent, untrusted diff screening, fresh code/wiki worktrees, current kit/rubric, dependency clone reading 6m all seven Review-5632 rounds, full diff, repo authorities, classifier/action/workflow/readiness dataflow measuring 7m 182 tests, 256 assertions, seven mutations, syntax/actionlint/repo gates, exact CI, current-main integration writing 4m presentation, literal template gate, two critic passes, exact-head GitHub/wiki delivery waste 2m broad rubric/review reads truncated and were reread in bounded chunks; first mutation harness stopped before its final action arm

WHAT I COULD NOT VERIFY

• PR-head Actions intentionally skipped exact Stable visual, pr-a11y, and pr-rtl because this workflow/script stack broad-defers; their exact and mixed branches were driven locally.
• The protected Release Gate and weekly RTL/a11y jobs were not dispatched. No Storybook/browser run was required for this non-rendering CI delta.

What changed before posting

Critic pass 1 made three precision-only edits; critic pass 2 passed. Posted the exact final text in the self-authored GitHub COMMENT review; GitHub recorded COMMENTED at 185dc58b5ac39629d813789ebd6e2cccef7faaa9. This Round 8 record supersedes Round 7 at the prior head. No merge or auto-merge was enabled.

---

Round 9 — one-time manual final review at exact green head

PR

#5632 — fix(ci): trace affected PR check dependencies by @cixzhang (bucket: the maintainer)

HEAD REVIEWED

ffe38f07ba7fd0761d35f70f15185b8aaeb7e263 — direct child of the exact-patch #5630 copy 6413ca02d148085ae130f282d7304437d09e7589; that parent's stable patch id 8aa2e884f0376fb120174a200871317dcf6658e8 matches approved #5630 head 04246c0051029d017e6aa76b3b649bc55bb622dc.

AUTHORITATIVE ROUND: Round 9 supersedes Round 8 at 185dc58b5ac39629d813789ebd6e2cccef7faaa9. Round 5's invalidated approval remains historical; this is the current exact-head disposition.

VERSIONS

LOOP VERSION: 1.9.1 AUDIT RUBRIC: 1.14.4 (the official page header and newest history row; its stale Current line still says 1.14.3)

LANE

LANE: full WHY: this is a repeatedly blocked cross-workflow scope and CLI trust boundary; it requires the prior exact/broad/mixed/path/mutation matrix, real action execution, untrusted workflow screening, current-main integration, and exact-CI inspection.

PRIOR REVIEW AND CURRENT MAIN

Our Round 8 review at 185dc58b5ac39629d813789ebd6e2cccef7faaa9 found current runtime behavior correct but asked for each malformed grammar case to use otherwise-valid input, the positional-rejection mutant to turn red, and the malformed action command shape to be regression-pinned.

The current six-file delta is +183/−53: the composite shell wrapper becomes a 98-line ESM Node action, its metadata becomes using: node20 / main: index.mjs, and focused tests/readiness validation move to that contract. Current main is 7cb5bac59e62b8879a2cf036976204192d6055aa; only f0043d8f touches a reviewed path, adding five independent lines to ci.yml. A synthetic merge is clean and its four scope-contract files pass 104/104 with actionlint and syntax clean. Exact-head CI also ran the action from the GitHub merge ref against base d51dbad8009607dea1853b920071dc218d8d4362.

PROBLEM

WHY 1: strict parser behavior needs a regression test that fails when each rejected grammar form becomes accepted. WHY 2: a test that fails later on an unrelated malformed path gives maintainers a false green signal after positional validation is removed. WHY 3: the next maintainer must be able to change the parser and trust the focused suite to expose an accidental widening before CI scope becomes permissive. USER-FACING PROBLEM: the next maintainer can remove positional rejection, run the specifically named malformed-invocation suite, and be told all 31 tests pass while stray-before is accepted. PROBLEM SEVERITY: broken task — the regression suite does not detect the defect it claims to pin. NEW FEATURE CASE: not a new feature — this repairs and regression-proofs an existing CI evidence contract. EARLY STOP: clear — the prior finding, exact-head test source, a one-variable parser mutant, and a valid-input direct probe establish the failure.

VERDICT: clear

SOLUTION

The workflow now calls the shared classifier through a JavaScript action instead of assembling shell commands. The action accepts either changed-file text or an analysis artifact, validates paths, writes one JSON result, and exposes the same outputs to all four jobs. Its new happy-path test proves the entry executes; the unchanged malformed-CLI table still lets a parser bug hide behind a second invalid input.

SOLUTION (1 current-head runtime decision · 6 files, +183/−53)

1. Replace the composite shell transport with one ESM Node action and update its metadata, readiness contract, and focused tests.

BURDEN: low for this round — one 98-line adapter, one metadata switch, one end-to-end test, and contract-fixture updates; no new dependency or workflow consumer. BURDEN MATCH: proportionate in runtime, incomplete in evidence — the new action removes the malformed shell-command seam, but the prior positional regression remains unpinned.

VERDICT: BLOCKS — removing positional rejection still leaves the focused helper suite green

ARCHITECTURE

OWNER: .github/scripts/lib/affected-scope.js owns dependency classification and helper CLI grammar; .github/actions/affected-scope/index.mjs is the environment-to-result adapter for PR workflows. TIER 1: changed paths, Core/Lab roots, shared runtime/theme/browser/RTL inputs, four PR jobs, and protected-main deferral. TIER 2: none. SEAMS: changed-files action input, analysis-file action input, exact components, broad shared inputs, mixed exact+broad input, CLI subcommands/options/JSON/paths, action metadata, and current/legacy readiness parsing. BEHAVIOR UNIT: pure utility plus one Node action adapter — deterministic and directly executable without a browser. COMPLEXITY BUDGET: one classifier, one strict CLI, one shell-free action entry, four workflow consumers, zero shadow component parsers, and one failing regression per grammar defect. ACTUAL BURDEN: #5632's top commit is 16 files, +1781/−217; Round 8→9 is 6 files, +183/−53. The action has one helper import and one result projection; all four workflows still use it; the focused suite is 9 files / 183 tests. The malformed CLI table uses one invalid path for every grammar row. BURDEN TREND: Round 8→9 contracts the action transport from two shell command strings to one imported Node entry and leaves classifier ownership flat. Test authority does not contract: positional grammar can still drift without a red suite. RESET TRIGGER: not triggered — runtime ownership is smaller and coherent; the remaining defect is one isolated regression-test false positive.

domain fact	one authoritative writable source	generated / immutable projections	other writable copies
dependency classification	affected-scope.js	action/analysis/visual outputs	none found
action transport	index.mjs	GitHub outputs + temp JSON	no shell run remains
workflow consumer set	action contract/readiness checks	four ci.yml uses	no direct helper or legacy component parser found
helper CLI grammar	affected-scope.js	malformed-invocation tests	test inputs do not isolate each grammar rule

seam	driven result
action metadata	using: node20, main: index.mjs, zero shell run keys
action changed-files / analysis-file	both execute end to end and produce byte-equivalent classifier JSON; Node 20.20.2 passes locally
malformed action environment	both-input, unsafe path, and missing-output controls exit 1 with the intended message
action shell-run / no-op mutants	metadata mutant reds 3/40 contract assertions; no-op entry mutant reds the end-to-end test 1/31
prior consumer removal/inventory/shadow-parser/direct-helper mutants	all red their intended workflow/readiness assertions
prior i18n/naming omission mutant	reds 4/64 exact helper/visual assertions
positional-rejection mutant	helper test remains 31/31 green; direct valid Button input accepts stray-before and returns exact Button scope

VERDICT: clear — runtime ownership and action transport are coherent; the surviving defect is test fidelity

IMPACT

Current CI behavior is correct: malformed helper invocations fail and the Node action produces the expected exact/deferred outputs. The remaining gap reaches the next maintainer: removing one positional guard still passes the focused suite advertised as the contract, so permissive scope grammar can return without a regression signal. NEW FEATURE IMPACT: not a new feature.

VERDICT: BLOCKS — the regression suite can certify a parser that accepts stray positional input

API

No published package API change. Internal CI changes the action execution model from composite shell steps to a Node entry while keeping the existing input/output names.

	change	public?	class	doc'd?	verdict
~	runs.using: composite → node20; main: index.mjs	internal action contract	existing affected-scope transport	metadata/tests	clear
=	changed-files / analysis-file and seven outputs	internal workflow contract	existing four-consumer scope result	metadata/tests	clear
=	strict helper subcommands/options/JSON/path behavior	internal executable contract	existing readiness/helper seam	source/tests	clear at runtime; regression test blocks in SOLUTION/IMPACT

OSSIFICATION: no consumer package surface. The internal action preserves its established names and outputs; the production contract is correct at this head.

VERDICT: clear

THEMING

No product CSS, token, target, selector, or rendered theme output changes. parseStyleKey.ts, root naming.ts, and every current non-test/doc i18n runtime file still broad-defer visual, a11y, and RTL from the shared classifier.

VERDICT: clear

BREAKING

BEHAVIOR: yes inside CI — the action transport changes from shell to Node, while direct changed-files and analysis-file outputs remain equivalent and malformed action inputs fail closed. API: no published package API change. VISUAL: no product pixel, DOM, story, style, asset, or rendered theme change. THEME: no theme contract change; only evidence routing remains.

VERDICT: clear — current-head behavior is preserved and the removed shell-command seam is covered

PERFORMANCE & RESOURCES

EFFECTS: zero.

Effect + deps	external system	why render/handler cannot do it	measured render cost	lifetime + cleanup	focused test
none	none	n/a	n/a	n/a	n/a

RENDER: no product render path. LISTENERS/OBSERVERS: none added. LAYOUT: none. BUNDLE: no package or lockfile change. Each job invokes one Node process, reads one input, classifies one bounded changed-path list, writes one temporary JSON file, and appends seven outputs; no network or child process is added by the action.

VERDICT: clear

VISUAL EVIDENCE

VISUAL CHECK: not applicable WHY: the delta and full top commit change CI scripts/tests, workflows, one local action, docs, and lab-readiness tooling only. No component implementation, story, style, asset, theme package, DOM, or rendered app output changes. No Storybook/browser capture was required.

VERDICT: clear

REMEDY SEARCH

REMEDY SEARCH: not triggered — no proven visual defect

A11Y & I18N

No product accessibility, localization, locale, or direction implementation changes. This PR controls whether those changes receive evidence: all 11 current non-test/doc i18n files, root naming.ts, four shared runtime representatives, parseStyleKey.ts, .nvmrc, workspace metadata, and five RTL inputs produce the expected visual/a11y/RTL outcomes. Mixed Button + Node-version + RTL input retains exact Button scope and all broad reasons.

VERDICT: clear

JUDGEMENT

slot	verdict
PROBLEM	clear
SOLUTION	BLOCKS — positional regression remains unpinned
ARCHITECTURE	clear
IMPACT	BLOCKS — focused tests can certify permissive grammar
API	clear
THEMING	clear
BREAKING	clear
PERFORMANCE	clear
VISUAL	clear
A11Y & I18N	clear

GOAL: partly met — the action is a real shell-free Node action, changed-files/analysis parity and malformed-action mutants pass, every prior runtime/path/consumer mutation remains red, current-main integration passes, and exact CI is green; removing positional rejection still leaves all 31 helper tests green. DISPOSITION: the Round 8 positional-regression finding still blocks now. The malformed shell-action finding is resolved by construction and by red metadata/no-op mutants. ADVICE: bounded outcome criteria — give each grammar case otherwise-valid input and assert its intended stderr/exit so the one-variable positional mutant turns red. AUTHOR CAN PROCEED: yes — the surviving mutant, valid control input, expected error, and acceptance test are deterministic. WORST OUTCOME: “the next maintainer removes positional rejection and the focused contract suite says all 31 tests pass” → request changes.

JUDGEMENT NEEDED: none — regression-test correctness for an existing CI contract.

request changes

1. The malformed invocation table still fails later on the same unsafe path instead of proving each grammar rejection. → a maintainer can re-allow positional tokens while the focused contract suite stays green · .github/scripts/lib/affected-scope.test.mjs:129-168 → confirmed independently by replacing the positional failure with continue: valid Button input succeeds and the committed helper suite remains 31/31 green.

REVIEW

Semantic verdict: request changes

Thanks — the Node action is now a real shell-free action; its metadata and end-to-end mutants fail. We previously asked for the positional regression to turn red, and that finding remains.

The malformed-CLI table still gives every case ../bad/path.ts. Replacing positional rejection with continue lets classify stray-before --changed-files-stdin accept valid Button.tsx, while all 31 helper tests stay green. That lets a future parser regression pass the suite meant to guard it.

Could each grammar case use otherwise-valid input and assert its intended stderr, so the positional mutant turns red?

[Reviewed by Robohands]

INLINE (0–3, only when genuinely line-anchored)

None — the defect is in the cross-case test setup rather than one product line.

EVIDENCE I DID NOT SPEND

• Exact head passes 9 focused files / 183 tests, check:repo, action-entry ESLint, 19 changed-script syntax checks, exact actionlint, and diff-check. A direct 15-case grammar matrix verifies every current subcommand/option/JSON/path error by message; Node 20 action execution verifies both input forms and malformed environment errors.
• Seven regression mutants red for their intended reason: consumer removal, inventory drift, shadow parser, direct helper, i18n/naming omission, action shell run, and action-entry no-op. The positional mutant alone survives 31/31 and accepts valid Button input.
• Exact-head CI run 33199258727 has 18 successful checks/statuses and 5 intentional skips, with 0 failed/pending; the real local action executes in check-components. Latest-main synthetic integration is clean and passes 104/104 focused contracts plus actionlint/syntax.

TIME

TIME total 18m setup 4m exact head/parent, untrusted workflow screening, fresh code/wiki checkouts, current authorities, dependency seed reading 5m all eight prior rounds, full diff, exact six-file delta, action/helper/workflow/readiness dataflow measuring 6m 183 tests, direct matrices, eight mutants, Node 20 action, repository gates, exact CI logs, current-main integration writing 3m presentation, literal template gate, two critic passes, GitHub/wiki delivery waste 2m large authority reads needed smaller chunks; one syntax command and the first mutation harness invocation were corrected and rerun

WHAT I COULD NOT VERIFY

• Exact Stable visual, pr-a11y, and pr-rtl jobs intentionally skipped because this workflow/script stack broad-defers; their exact and mixed branches were driven locally, and the action itself ran in exact-head CI.
• Protected Release Gate and weekly RTL/a11y jobs were not dispatched. Scheduled Automations remained disabled and untouched. No Storybook/browser run was required for this non-rendering CI change.

What changed before posting

Critic pass 1 added the explicit prior-review reconciliation; critic pass 2 passed. Posted the exact final text in the self-authored GitHub COMMENT review; GitHub recorded COMMENTED at ffe38f07ba7fd0761d35f70f15185b8aaeb7e263. This Round 9 record supersedes Round 8 at the prior head. No merge or auto-merge was enabled.

---

Round 10 — one-time manual final test-only re-review at exact green head

PR

#5632 — fix(ci): trace affected PR check dependencies by @cixzhang (bucket: the maintainer)

HEAD REVIEWED

ad79df2334de751fa54586ce17afb5985b4cee0f — direct child of the exact-patch #5630 copy 6413ca02d148085ae130f282d7304437d09e7589.

AUTHORITATIVE ROUND: Round 10 supersedes Round 9 at ffe38f07ba7fd0761d35f70f15185b8aaeb7e263. Round 5's invalidated approval remains historical; this is the current exact-head disposition.

VERSIONS

LOOP VERSION: 1.9.1 AUDIT RUBRIC: 1.14.4 (the official page header and newest history row; its stale Current line still says 1.14.3)

LANE

LANE: full WHY: this is a repeatedly blocked cross-workflow scope and CLI test boundary; the final round must prove the prior surviving mutant turns red without losing runtime, action, path, deferral, drift, current-main, or exact-CI invariants.

PRIOR REVIEW AND CURRENT MAIN

Our Round 9 review at ffe38f07ba7fd0761d35f70f15185b8aaeb7e263 found the shell-free action and every prior runtime/path/consumer mutant sound, but asked for each malformed grammar case to use otherwise-valid input and assert its own stderr so removing positional rejection turns the focused helper test red.

The ffe38f07 → ad79df23 tree delta is exactly one test file, +100/−26: .github/scripts/lib/affected-scope.test.mjs. Every runtime, action, workflow, path classifier, visual/a11y/RTL consumer, parent-stack, and documentation byte is unchanged. Current main is c84106ba267929a9e7c4ad11e1fcda7895b9808e; only f0043d8f overlaps a PR path, the same independent ci.yml setup context already exercised by exact-head CI. A fresh synthetic merge is clean and its four scope-contract suites pass 104/104 with actionlint and syntax clean.

PROBLEM

WHY 1: each rejected CLI grammar form needs a regression assertion that fails if that exact rejection disappears. WHY 2: reusing one malformed changed path across every row lets a parser bug pass because a later path check still exits nonzero. WHY 3: the next maintainer must be able to edit the parser and trust the focused suite to distinguish strict grammar from unrelated setup failure. USER-FACING PROBLEM: the next maintainer previously could remove positional rejection and receive 31 green helper tests while classify stray-before --changed-files-stdin accepted an otherwise-valid Button path. PROBLEM SEVERITY: broken task — the regression suite at the prior head did not detect the defect it claimed to pin. NEW FEATURE CASE: not a new feature — this is test-only protection for an existing CI contract. EARLY STOP: clear — the prior review, exact semantic delta, current test table, direct grammar matrix, and one-variable mutant establish the problem and fix.

VERDICT: clear

SOLUTION

Each malformed CLI row now provides only the input needed for that case: otherwise-valid Button stdin or analysis JSON for grammar errors, malformed JSON only for JSON parsing, and unsafe paths only for path validation. Every row names its expected stderr as well as requiring nonzero exit and empty stdout. The production parser and action are untouched.

SOLUTION (1 decision · 0 runtime lines; 1 test file, +100/−26)

1. Isolate the malformed CLI table so each grammar, JSON, and path case proves its own failure.

BURDEN: low — one existing test rewritten as case records with explicit input and expected stderr; no runtime owner, workflow, schema, dependency, or public surface changes. BURDEN MATCH: proportionate — the prior defect was a false-positive regression test, and the repair changes only that test's fixtures and assertions.

VERDICT: clear

ARCHITECTURE

OWNER: .github/scripts/lib/affected-scope.js remains the sole dependency-classification and helper-grammar owner; .github/actions/affected-scope/index.mjs remains the sole PR workflow adapter. TIER 1: Core/Lab roots, shared runtime/theme/browser/RTL inputs, four PR job consumers, and protected-main deferral. TIER 2: none. SEAMS: CLI command, options, positional tokens, JSON and changed paths; action changed-files/analysis-file inputs; exact, broad, mixed, consumer, and current/legacy readiness paths. BEHAVIOR UNIT: unchanged pure classifier plus Node action adapter; this round changes only its focused test oracle. COMPLEXITY BUDGET: zero runtime decisions, zero new owners/representations/workflows, one isolated test table, and one red regression per grammar defect. ACTUAL BURDEN: 1 test file, +100/−26 from Round 9; the full #5632 top commit remains 16 files, +1855/−217; no runtime, action, workflow, dependency, schema, or documentation delta from the reviewed runtime head. BURDEN TREND: Round 9 → Round 10 is runtime-flat and test-only; the test oracle contracts each case to one failing variable instead of sharing an unrelated malformed path. RESET TRIGGER: not triggered — runtime ownership was already coherent, and this repair adds no owner, representation, or guard.

domain fact	one authoritative writable source	generated / immutable projections	other writable copies
dependency classification	affected-scope.js	action, analysis, visual/a11y/RTL outputs	none found
helper CLI grammar	affected-scope.js	case-specific immutable test expectations	none
action transport	index.mjs	GitHub outputs and temporary JSON	no shell path
workflow consumer set	local action plus readiness/workflow contracts	four ci.yml uses	no direct helper or shadow parser found

seam	driven result
prior positional mutant	valid Button stdin succeeds under the mutant, then the committed test fails at expect(result.status).not.toBe(0) with received 0 — the intended grammar assertion
action shell-run metadata mutant	3/40 workflow/readiness assertions fail, including the explicit no-run: contract
action-entry no-op mutant	the real E2E test fails at has_components=true, not at static metadata
consumer path / inventory / visual shadow parser / direct helper mutants	each fails its intended workflow/readiness contract
i18n + root naming omission mutant	4/64 helper/visual assertions fail on the real paths
direct helper grammar	15/15 command, option, positional, JSON, and path errors exit nonzero with the expected stderr and empty stdout
Node 20 action	changed-files and analysis-file modes produce equivalent exact Button + broad Node-version output; both-input, unsafe-path, and missing-output controls fail closed
path/deferral matrix	171 assertions pass across 11 i18n runtime files, root naming, exact Core/Lab/nested barrel, shared parser, Node/workspace, mixed, and five RTL controls

VERDICT: clear

IMPACT

The next maintainer now gets a red focused test when positional rejection is removed, and the failure points at the nonzero-status assertion for the otherwise-valid positional case. JSON and path rows still fail only for their own malformed inputs. The action, consumer, scope, and deferral contracts retain their prior mutation coverage. NEW FEATURE IMPACT: not a new feature.

VERDICT: clear

API

No published or runtime API changes. The internal CLI/action contract is byte-identical to Round 9; only its malformed-invocation test data and stderr assertions change.

	change	public?	class	doc'd?	verdict
~	malformed CLI case fixtures and expected stderr	test-only	existing strict helper grammar	test source	clear
=	helper CLI, action metadata/entry, seven outputs	internal runtime contract	existing affected-scope owner	source/tests	clear

OSSIFICATION: no consumer or new internal runtime surface; this round only strengthens the test oracle for an existing contract.

VERDICT: clear

THEMING

No CSS, token, target, selector, theme package, or rendered theme output changes. The unchanged shared parser and root naming paths still broad-defer visual, a11y, and RTL in the direct matrix and omission mutant.

VERDICT: clear

BREAKING

BEHAVIOR: no runtime behavior change from Round 9; helper, action, workflow, and scope bytes are identical. API: no published or internal runtime API change. VISUAL: no product pixels, DOM, stories, styles, assets, or rendered output change. THEME: no theme contract change.

VERDICT: clear

PERFORMANCE & RESOURCES

EFFECTS: zero.

Effect + deps	external system	why render/handler cannot do it	measured render cost	lifetime + cleanup	focused test
none	none	n/a	n/a	n/a	n/a

RENDER: no product render path. LISTENERS/OBSERVERS: none added or changed. LAYOUT: none. BUNDLE: no runtime, package, or lockfile delta; test execution adds only case-specific subprocess assertions.

VERDICT: clear

VISUAL EVIDENCE

VISUAL CHECK: not applicable WHY: the entire Round 9 → Round 10 delta is one non-rendering .test.mjs file. No component, story, style, asset, theme, DOM, or visible behavior changes; manual frames and Storybook are not applicable.

VERDICT: clear

REMEDY SEARCH

REMEDY SEARCH: not triggered — no proven visual defect

A11Y & I18N

No product accessibility, localization, locale, direction, or rendered behavior changes. The unchanged evidence-routing contract was re-driven: every current i18n runtime file plus root naming broad-defers visual/a11y/RTL, exact and mixed controls remain, and the omission mutant fails four intended assertions.

VERDICT: clear

JUDGEMENT

slot	verdict
PROBLEM	clear
SOLUTION	clear
ARCHITECTURE	clear
IMPACT	clear
API	clear
THEMING	clear
BREAKING	clear
PERFORMANCE	clear
VISUAL	clear
A11Y & I18N	clear

GOAL: met — the semantic delta is test-only; the positional mutant now fails at the intended status assertion on valid Button input; malformed action and all prior scope/path/drift mutants remain red; clean focused, direct, current-main, repository, and exact-CI checks pass. DISPOSITION: the Round 9 positional-regression finding is satisfied; no new negative finding remains. ADVICE: omitted — no corrective action remains. AUTHOR CAN PROCEED: yes — undraft when the approved parent stack is ready. WORST OUTCOME: none found → approve once undrafted.

JUDGEMENT NEEDED: none — test-only repair of an existing CI contract.

approve once undrafted

REVIEW

Semantic verdict: approve once undrafted

Thanks — ad79df23 isolates every CLI error. Positional, action, and prior scope mutants fail; focused tests and exact-head CI are green.

[Reviewed by Robohands]

INLINE (0–3, only when genuinely line-anchored)

None.

EVIDENCE I DID NOT SPEND

• Exact head passes 9 focused files / 183 tests; the restored post-mutation contract subset passes 4 files / 104 tests; direct Node 20 grammar/action checks pass 15/15 errors, both action input modes, and three malformed-environment controls.
• Eight inspected one-variable mutants all turn red: positional rejection 1/31 at the intended status assertion; action shell metadata 3/40; action no-op 1/31 at the output assertion; consumer path, inventory, visual shadow parser, direct helper, and i18n/naming omission at their named contracts.
• Nineteen changed scripts pass syntax; action-entry ESLint, exact actionlint, diff-check, and check:repo pass. Current-main synthetic integration passes 104/104. Exact-head CI run 33202404798 has 18 successes and 5 intentional skips, with the real local action executing on the merge ref.

TIME

TIME total 20m setup 4m exact head/parent, untrusted workflow screening, fresh code/wiki worktrees, current kit/rubric, dependency seed reading 5m all nine prior rounds, full diff, exact test-only delta, source/action/workflow/readiness contracts measuring 8m 183 clean tests, 171 path assertions, direct Node 20 matrix, eight mutants, repository gates, CI logs, current-main integration writing 3m presentation, literal template gate, two critic passes, GitHub/wiki delivery waste 1m one mutation-output marker and one integration donor argument were corrected and rerun

WHAT I COULD NOT VERIFY

• Exact Stable visual, pr-a11y, and pr-rtl jobs intentionally skipped because this workflow/script stack broad-defers; their exact and mixed scope branches were driven locally.
• Protected Release Gate and weekly RTL/a11y jobs were not dispatched. No Storybook/browser run was applicable.

What changed before posting

Critic pass 1 tightened length and public-safe wording; critic pass 2 passed. Posted the exact final text in the self-authored GitHub COMMENT review; GitHub recorded COMMENTED at ad79df2334de751fa54586ce17afb5985b4cee0f. This Round 10 record supersedes Round 9 at the prior head.