docs(ci): explain JavaScript materializer trust boundaries

[seonghobae]

Summary

• document trusted JavaScript lock discovery and validation boundaries with multiline contracts
• add an AST-based docstring contract for security-sensitive materializer symbols
• wire the contract into the existing agent-review quality workflow

Related to #1543

Verification

• python -m pytest -q tests/test_javascript_materializer_docstrings.py tests/test_materialize_base_javascript_packages.py (71 passed)
• python -m compileall -q scripts/ci/materialize_base_javascript_packages.py tests/test_javascript_materializer_docstrings.py
• git diff --check

[coderabbitai]

Warning

Review limit reached

Next included review available in 44 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: d426964f-176f-4fc8-9759-6ff102013f6a

📥 Commits

Reviewing files that changed from the base of the PR and between cb0872c and a6160ab.

📒 Files selected for processing (4)

• .github/workflows/agent-review-runtime-quality-ci.yml
• CHANGELOG.d/20260912-javascript-materializer-docstrings.md
• scripts/ci/materialize_base_javascript_packages.py
• tests/test_javascript_materializer_docstrings.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cwl-noema-review]

Noema LLM review

The PR adds explanatory multiline docstrings to JavaScript materializer functions and enforces them via a new AST-based CI contract test. The workflow correctly gates the new test on the opencode suite and includes a formatting-only adjustment to a coverage command. No correctness, security, or behavioral regressions were found.

Reviewed changed lines

• .github/workflows/agent-review-runtime-quality-ci.yml:19 (RIGHT): The path filter now includes scripts/ci/materialize_base_javascript_packages.py so the opencode suite triggers when the materializer changes.
• .github/workflows/agent-review-runtime-quality-ci.yml:353 (RIGHT): New verification step runs tests/test_javascript_materializer_docstrings.py and compileall on the materializer and test, conditioned on the opencode suite, ensuring the contract is enforced exactly when relevant.
• scripts/ci/materialize_base_javascript_packages.py:61 (RIGHT): Multiline docstring added to _git explaining that git failures remain bounded diagnostics; satisfies the new explanatory docstring contract.
• tests/test_javascript_materializer_docstrings.py:1 (RIGHT): New AST-based test walks all function/class nodes and requires multiline docstrings, ensuring the trust-boundary documentation contract is enforced by CI.

Adversarial validation

• scripts/ci/materialize_base_javascript_packages.py:61 (RIGHT) falsified: The new AST test would fail because at least one function in the diff still has a single-line docstring. — Every function modified in this PR (lines 61-64, 78-81, 111-114, 195-198, 283-286, 297-300, 393-396, 540-543, 651-654 on the RIGHT side) has a multiline docstring; no symbol in the diff remains single-line.
• .github/workflows/agent-review-runtime-quality-ci.yml:353 (RIGHT) falsified: The verification step would either not run when the materializer changes or run when unrelated files change. — Path filters at lines 19-20 and 190-191 include the materializer script and its test, and the step at lines 353-359 uses the same steps.affected_suites.outputs.opencode == 'true' condition as neighboring opencode steps, so it runs exactly when the materializer changes and not otherwise.
• Residual risk: Low. The docstring contract test is simple and the workflow gating is correct; minor risk that future functions added without docstrings would fail the test, which is the intended behavior.

Findings

• No blocking findings.

• Result: APPROVE
• Head SHA: a6160ab6d4a5708781d2d842094de9a7a07d4ace
• Reviewer credential: noema-review-github-app-refresh
• Actor: cwl-noema-review[bot]