fix(analysis): score C major acceptance from decoded WAV bytes

[cursor]

Summary

Tier 1 real-audio acceptance writes license-clean C-major and 120 BPM click WAVs, verifies and decodes the on-disk bytes, then scores the production ChordRecognizer / TemporalAnalyzer. The branch fail-closes malformed metric, timing, fixture-generation, decoded-PCM, digest, and report-provenance evidence instead of allowing Python coercions or derived numeric overflow to become buyer-facing accuracy evidence.

Protected base: develop@acdbea6344fe1231c39535b575f4de35e4c607c9.
Exact current head: 304684a7422288cbe5d32bce1e59cd17a08eb16b.
Branch remains Draft. Do not mix #884 Stem Lab, #783 dependency remediation, #861 Python branch-coverage authority, #866 audio-resource policy authority, or #894 protected-base checkout-credential lifecycle work onto this branch.

Current test-first repairs

• Report provenance: strict 64-hex SHA-256, finite numeric metric values, non-empty/trim-stable identities, and exact non-empty product VERSION provenance.
• Chord recall: clips and unions matching intervals so overlap cannot double-count annotated time; rejects Boolean/non-finite/reversed annotation or estimate timing.
• Tempo Acc1: rejects Boolean/non-finite estimate, truth, or tolerance evidence.
• Fixture generation/WAV serialization: rejects Boolean/non-finite/non-positive duration, BPM, and sample-rate inputs before allocation, loops, or write authority.
• Derived fixture timing: rejects finite raw inputs whose duration×sample-rate overflows, durations that quantize below one sample, and BPM values whose derived beat interval is non-finite.
• Decoded C-major PCM: requires one-dimensional non-empty finite floating-point mono PCM and a finite positive non-Boolean sample rate before production recognition or duration division.

Derived fixture timing authority — RED → GREEN

Exact-current-code inspection found two distinct failure modes that raw-input validation did not cover.

1. A finite duration_seconds=1e308 could overflow duration_seconds * sample_rate before allocation. A tiny positive BPM could likewise make 60 / bpm non-finite and break loop timing.
   • RED/test-only b44af346648e8a331a6774c99c72ccbcdf477c52 reproduced three exact failures as OverflowError in release run 31983981110, job 95255654864.
   • GREEN bec94965f00945601d2da4e54bd80d64bf2cc46e added one derived sample-count boundary and finite beat-interval admission.
2. A positive duration smaller than one sample still quantized to zero. The triad factory returned empty evidence and the click factory reached a zero-size reduction.
   • RED/test-only d2625a7b16187d18d02214132128abef28a08f47 failed exactly two new cases in release run 31984374899, job 95256679147 (2 failed, 730 passed, 24 skipped).
   • GREEN code head c1baa4718b50102f7d96c5afe7a9c3c873f45727 requires the derived sample count to be finite and at least one sample.

The branch later advanced seven descendant commits from 77b7cb88af1be9a7857d1aca86900c3a2dcc9219 to current 304684a7422288cbe5d32bce1e59cd17a08eb16b without divergence. That delta remains within the same accuracy-fixture/test/doctoring ownership surface; no predecessor check is transferred to the new head.

Exact-current-head verification

Fresh repository workflows are bound to exact head 304684a7422288cbe5d32bce1e59cd17a08eb16b and merge tree 89993b83c1a0ffb44cce7143914818921c16b13a against protected develop@acdbea6344fe1231c39535b575f4de35e4c607c9.

Terminal-success on this unchanged head: ci 31987016893, release 31987016812, build-baseline 31987016868, sbom 31987016836, bandit 31987016717, SAST Semgrep 31987016823, and secret-scan-gate 31987016723.

Exact ci / build-and-test job 95263670237 proves desktop 194/194 and shared-types 20/20 with statement/branch/function/line coverage all at 100%; Python reports 757 passed / 1 skipped and 3254/3254 production statements at 100%, including accuracy/fixtures.py 85/85. Public Python docstring checks D100–D107, Ruff, mypy, Bandit, documentation/security/supply-chain gates, native Rust numeric build, 23 numeric-parity tests, and frontend production build all pass. Current protected Python tooling is statement-only; #861 remains the canonical Python branch-measurement owner, so Python branch 100% is not inferred from this evidence.

There are currently no formal PR reviews and no inline review threads on this exact head. Absence of findings is not approval.

Security / dependency classification

The two exact-current-head repository security failures were inspected at job/log level before classification:

• security-audit run 31987016861, job 95263670060, checks out merge tree 89993b83... and fails first at npm audit --workspaces --audit-level=high on protected-base nanoid <3.3.18, pdfjs-dist >=5.6.83 <6.2.108, and undici 7.0.0–7.28.0; later Python/Rust audit stages are skipped and are not success. The inherited workflow checkout also shows persist-credentials: true; that protected-base workflow authority is fix(security): drop persisted credentials before dependency lifecycle code #894-owned rather than a reason for an accuracy-lane workaround.
• aggregate Security Scan run 31987016778 has successful Dependency Review, OSV base-vs-head, and Scorecard jobs. Its only failed job is Trivy 95263671871, which scans successfully and then reports exactly one HIGH finding: CVE-2026-16633 for protected-base pdfjs-dist at package-lock.json:6370, directing remediation to the shared base.

This branch has no JavaScript dependency/root-lock or vulnerability-suppression delta. These are canonical #783-owned inherited protected-base findings; they are not suppressed, duplicated, or counted as success.

Security / evidence boundary

Untrusted inputs include on-disk WAV bytes, decoded buffer structure and sample-rate evidence, recognizer intervals, tempo values, fixture numeric inputs and derived timing, digests, report-builder inputs, and parsed report mappings. Mitigations include checksum-before-score, finite/non-Boolean numeric admission, finite ≥1 derived sample-count admission, finite beat-interval admission, one-dimensional mono PCM admission, overlap-safe recall, strict digest/report provenance, no network or shell authority, and license-clean deterministic fixtures. APA 7 MIR references and the bounded claim remain recorded in docs/doctoring/real-audio-accuracy-acceptance.md.

Dependency / merge gate

Keep Draft and unmerged until the unchanged then-current head has realistic focused/full tests GREEN; exact 100% owned production statement and branch coverage where the configured tooling exposes it plus other exposed metrics; public docstring evidence; all applicable repository/central SAST/security/SBOM/supply-chain/package/release gates terminal-success; zero valid unresolved findings; #783 and #861 integrated/revalidated, #894 inherited where its workflow authority applies, and then-current central required-workflow prerequisites inherited; a qualifying independent non-author last-push approval; and ordinary branch-protection acceptance. Current read-only central prerequisite lanes include .github#939 and .github#1020; historical #1008 is closed unmerged and transfers no evidence. Never count queued, cancelled, skipped-required, failed, predecessor-head, protected-base, model-only, self/author, or bypass evidence as success.