fix(coverage): classify Storybook development evidence

[seonghobae]

Purpose

Keep the central JavaScript coverage gate aligned with the product boundary: Storybook configuration and story modules are development evidence, while shipped runtime modules remain governed.

Exact current identity

• source head: 35df26759c54609a3387dc5200725adb6770eac1;
• base branch: main;
• exact base SHA: 731af58e954901c4f1cc853231c592abb1eaf617;
• current diff: 4 files, 169 additions, 1 deletion;
• the branch contains a non-destructive protected-main merge; no force-push or protected-branch direct push was used.

Evidence attached to earlier heads is historical only.

Product boundary

• exclude the exact .storybook path component;
• exclude exact *.stories.[cm]?[jt]sx? modules;
• keep ordinary shipped runtime governed, including src/foo.ts, stories/runtime.ts, src/Foo.story.tsx, src/Foo.stories-helper.ts, and src/storybook/main.ts;
• do not suppress arbitrary stories/ directories or weaken changed-runtime coverage;
• retain exact-head checkout, hash-pinned quality dependencies, and a clean-tree check in the dedicated quality workflow.

---

Exact-head verification

Local verification on 35df26759c54609a3387dc5200725adb6770eac1:

• uv run coverage run --branch -m pytest --import-mode=importlib tests -q: 1,306 passed, 16 subtests passed;
• javascript_coverage_gate.py: 256/256 statements and 118/118 branches (100%);
• focused classifier regression tests: 35 passed;
• public docstrings for the changed production module: 100%;
• compileall, git diff --check, and Semgrep: passed with 0 findings;
• actionlint .github/workflows/javascript-coverage-quality-ci.yml: passed.

The dedicated quality workflow uses the exact PR head and verifies the complete central test suite plus the changed classifier at 100%.

Hosted and review state

For exact head 35df2675:

• JavaScript Coverage Gate Quality CI: completed success (run 32471797026);
• Secret Scan, Scorecard PR, Security Scan, Python Security, CodeQL PR, SBOM Generation, SAST Semgrep, and OSV-Scanner PR: queued;
• current inline review threads: none unresolved;
• current formal review: COMMENTED only; no qualifying independent approval exists.

Normal merge remains blocked by non-terminal hosted security/supply-chain gates and missing independent approval. This PR is not a D1-D6 control-plane deadlock and is not eligible for guarded force merge.

Acceptance gate

Merge only after all required exact-head Checks are terminal-success, current findings are resolved, a qualifying independent approval exists, and live branch protection permits normal integration. After protected-main integration, rerun the current Inkspan consumer canary so Storybook development files are excluded without suppressing shipped runtime coverage.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fcdf0632-ca0f-4d66-b25b-def7e4bd6048

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 90442f27-9b4f-40d9-b021-680bf6a9b5df

📥 Commits

Reviewing files that changed from the base of the PR and between aa8503f and a419033.

📒 Files selected for processing (4)

• .github/workflows/javascript-coverage-quality-ci.yml
• scripts/ci/javascript_coverage_gate.py
• tests/test_javascript_coverage_gate.py
• tests/test_javascript_coverage_storybook_boundary.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

JavaScript 커버리지 게이트가 Storybook 경로를 런타임 소스에서 제외합니다. 커버리지 경계 조건 테스트와 정확한 pull request HEAD를 검증하는 GitHub Actions 품질 게이트를 추가합니다.

Changes

JavaScript 커버리지 품질 검증

Layer / File(s)	Summary
Storybook 런타임 소스 경계 scripts/ci/javascript_coverage_gate.py, tests/test_javascript_coverage_storybook_boundary.py	.storybook 경로와 .stories.* 파일을 런타임 소스에서 제외합니다. 일반 제품 모듈 경로는 런타임 소스로 유지합니다.
커버리지 게이트 계약 테스트 tests/test_javascript_coverage_gate.py	변경 헙크, 잘못된 statement 위치, 경로 정규화, 절대 경로 coverage JSON, 무관한 coverage 기록을 검증합니다.
정확한 HEAD 기반 CI 실행 .github/workflows/javascript-coverage-quality-ci.yml	Pull request HEAD SHA를 체크아웃하고, 해시 고정 의존성을 설치합니다. 전체 테스트와 100% branch coverage 보고를 실행한 뒤 컴파일 및 작업 트리 상태를 확인합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to a4190

The PR narrowly excludes Storybook development artifacts from coverage classification while preserving coverage checks for shipped runtime code. No actionable merge-blocking risk remains after normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant pytest
  participant coverage_report
  GitHubActions->>GitHubActions: PR HEAD SHA 체크아웃
  GitHubActions->>pytest: 전체 테스트를 branch coverage로 실행
  pytest-->>GitHubActions: 테스트 및 coverage 데이터 반환
  GitHubActions->>coverage_report: 게이트 스크립트의 coverage report 실행
  coverage_report-->>GitHubActions: 100% 미만이면 실패 상태 반환

Loading

Possibly related PRs

• ContextualWisdomLab/.github#1052: JavaScript 커버리지 게이트와 Storybook 경로 분류에 관한 관련 변경입니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 Storybook 개발용 파일을 커버리지 분류에서 제외하는 주요 변경을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/storybook-coverage-runtime-boundary

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent

Revalidated PR #1159 at current live head a67b9b67e8587975fd2a41feb7e51fd8baf624a6.

The Storybook classifier remains narrow: exact .storybook path components and exact *.stories.* modules are development evidence, while runtime near-misses remain governed.

Local proof at this head:

• 35 targeted tests passed.
• Branch coverage for scripts/ci/javascript_coverage_gate.py: 256 statements / 118 branches, 100%.
• interrogate --fail-under 100 scripts/ci/javascript_coverage_gate.py passed.
• actionlint .github/workflows/javascript-coverage-quality-ci.yml passed.
• compileall and git diff --check passed.

The hosted exact-head run cited in the PR body passed the full central suite (1249 tests plus 16 subtests). Please rerun the protected current-head Checks and independent review; this PR is not being marked merged while branch protection remains authoritative.

[seonghobae]

Integrated current main normally at a419033. Focused Storybook boundary suite passed (35 tests), actionlint, ruff, and diff checks passed. The previous Strix failure was an application readiness failure (loginAsGuest could not connect to 127.0.0.1:48080) after reporting zero vulnerabilities; rerun the exact-head required checks and reassess the runtime evidence.

@OpenCode review this exact HEAD and report only current-head findings.

[seonghobae]

@opencode-agent review this exact current HEAD. Use the current commit SHA, current Checks, and current diff; do not reuse prior approvals or prior-head evidence.

[seonghobae]

Independent current-head verification for a41903339f1df37bd1b7a7e8b969121c3598f5: focused Storybook/coverage tests 35 passed; Ruff, compileall, actionlint, and git diff --check passed. Please review this exact head and publish the required independent approval if no issues remain.

[seonghobae]

@opencode-agent Review only exact current head 43cde24b89e16ec8e9d64e0fd4a2b06f1a867c58 against live base 6479989bbff475404cc2cccc468d5fb1d6c632e5 after the non-destructive main integration. Local exact-candidate verification passed the focused Storybook/runtime-boundary suite (35 passed), the full central suite (1249 passed, 16 subtests), compileall, and git diff --check. Confirm that only exact .storybook components and *.stories.* modules are development evidence while ordinary runtime and near-miss paths remain governed. Current hosted checks are newly queued/in progress and therefore non-passing; publish a substantive formal Reviews API verdict bound to this SHA only after they settle. Do not mutate or merge.

[seonghobae]

Current-head review repair applied:

• Documented the Storybook boundary tests so the new cases meet the repository docstring standard.
• Verified .storybook/** and *.stories.* are excluded from shipped runtime coverage while nearby product modules remain governed.

Evidence at head 5775073735360250ba5ef7bfaaf30b8f50d6dc1d: 1,249 tests passed, 16 subtests passed, javascript_coverage_gate.py branch coverage 100%, focused docstring coverage 100%, Ruff, compileall, and diff-check passed.

[seonghobae]

@opencode-agent Review only exact current head 5775073735360250ba5ef7bfaaf30b8f50d6dc1d against protected base 6479989bbff475404cc2cccc468d5fb1d6c632e5. All nine repository-native exact-head workflow runs are terminal success and all review threads are resolved. Revalidate that only exact .storybook path components and *.stories.* modules are classified as development evidence while shipped runtime and near-miss paths remain governed. Publish a substantive formal Reviews API verdict bound to this SHA; do not reuse predecessor review/check evidence, mutate the branch, or merge.

[seonghobae]

@opencode-agent Please review exact current PR head 5775073. Re-check changed-file scope, current-head findings, unresolved threads, mergeability, and all required checks. Do not approve a stale head.

[seonghobae]

@opencode-agent review\nHead SHA: 5775073\nRe-run the current-head required workflow set and report the terminal result. Prior scan-pr-queue/Strix cancellation or failure must be distinguished from the latest exact-head run.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

@opencode-agent Please perform a review-only formal review of exact current head 7fbee6f482ec745b117f0d916a8de8dbb998e9e1. Hosted run 32422383319, job 96596970966, checked out that SHA and passed the full central suite (1298 passed, 16 subtests passed) with javascript_coverage_gate.py at 256/256 statements and 118/118 branches. The head only non-destructively incorporates protected main@55a8b576725451dfe0a21a57d36a2f1a41619b24 since the previously reviewed source tree. Please submit the substantive exact-head verdict through the Reviews API; do not mutate the branch or merge.

[seonghobae]

Current-head review (2026-08-21):

• Verified live HEAD 7fbee6f482ec745b117f0d916a8de8dbb998e9e1; CodeGraph/source review traced the changed is_runtime_source classifier before validation.
• Storybook configuration (.storybook/**) and story modules (*.stories.*) are excluded from shipped-runtime coverage, while near-miss product modules remain governed; the added workflow checks the exact PR head and keeps 100% coverage enforcement for the classifier.
• Focused proof: 35 tests passed, including Storybook boundary cases; compileall, actionlint, and git diff --check passed. All current hosted JavaScript, security, SBOM, secret, SAST, OSV, Scorecard, CodeQL, and Python Checks are terminal success with no failing check observed.
• Review threads are empty and only COMMENTED automated review is present. No independent APPROVED review exists, so this PR remains unmerged under protected governance.

[seonghobae]

@opencode-agent Review only exact current head 35df26759c54609a3387dc5200725adb6770eac1 against live protected base 731af58e954901c4f1cc853231c592abb1eaf617. This two-parent non-force merge preserves the previously verified Storybook runtime-boundary source and incorporates current protected main; the resulting tree differs from main only in the four canonical coverage-owner paths. Hosted JavaScript Coverage Gate Quality run 32471797026, job 96739933876, checked out this exact SHA, passed the full central suite (1306 passed, 16 subtests passed), and measured javascript_coverage_gate.py at 256/256 statements and 118/118 branches. Revalidate that exact .storybook/** components and *.stories.* modules are development evidence while ordinary runtime and near-miss paths remain governed. Security jobs are still queued and non-passing until terminal. Submit a substantive formal Reviews API verdict bound only to this SHA after current evidence settles; do not mutate or merge.

[seonghobae]

Current-head maintenance attestation

• Exact head: 35df26759c54609a3387dc5200725adb6770eac1
• Exact base: 731af58e954901c4f1cc853231c592abb1eaf617
• Local proof: 1,306 tests + 16 subtests passed; changed production module statement/branch coverage 100%; focused 35 tests; docstrings 100%; compileall, actionlint, diff check, and Semgrep 0 findings passed.
• Review: no unresolved inline threads; current formal review is COMMENTED only; no qualifying independent approval.
• Hosted: JavaScript Coverage Gate passed; security, supply-chain, and static-analysis runs remain queued.
• Decision: WAIT_AND_REMEDIATE. No D1-D6 control-plane deadlock is evidenced; do not bypass protection. Re-check the unchanged exact head before normal merge.

[seonghobae]

Exact-head maintainer review (2026-08-21): reviewed the coverage classifier and quality workflow. The change excludes Storybook configuration and *.stories.* evidence only, while keeping runtime modules and near-miss names governed; added tests also cover invalid locations, absolute-path loading, unrelated records, and changed-line boundaries. Local exact-head evidence: 35 coverage tests passed; actionlint passed; git diff --check passed; worktree clean. Hosted Checks remain queued and no formal exact-head APPROVED review is present. Decision: WAIT_AND_REMEDIATE; no merge or bypass.

[seonghobae]

@OpenCode Please perform an independent substantive review of exact head 35df267. Read the complete 4-file diff and report changed-file walkthrough, coverage-boundary risk, test gaps, residual uncertainty, and explicit verdict. Do not review an older head.

[seonghobae]

Exact-head failure RCA

• Exact head: 35df26759c54609a3387dc5200725adb6770eac1
• The only failed hosted gate is inherited pip-audit: its exact log reports pip==26.1.2, PYSEC-2026-3721, and fix 26.2.
• The four-file Storybook coverage diff is bounded and does not change the dependency lock; the same security repair is owned by fix(security): repair pip audit and schedule orchestrator review #1198.
• Required action: let fix(security): repair pip audit and schedule orchestrator review #1198's hash-locked pip remediation reach protected main, then rerun this exact head's checks.
• Decision: WAIT_AND_REMEDIATE; no bypass or force merge.