fix(reddit): admit committed source packages in CI

[Sam-24-dev]

Summary

• Add committed Reddit source-package admission using trusted base code and exact immutable Git blobs, not worktree hashes.
• Publish a separate Checks API result on the explicit event head SHA: the pull_request_target job itself is base-bound, not exact-head admission evidence.
• Preserve producer publication, Monday consumer, secret scanning and deployment gates. This is NOT a staged producer/prepublication gate.

Scope: four files, 498 lines

File	Added / deleted	Responsibility
backend/reddit_source_package.py	11 / 3	Shared strict byte-reader validation and producer coverage helper
scripts/check_reddit_package_admission.py	133 / 0	Committed blob/mode/diff admission, frozen event bindings and exact-head publication
.github/workflows/reddit_package_admission.yml	30 / 0	Trusted-base execution, contents-read/checks-write only
tests/test_reddit_package_admission.py	321 / 0	Real disposable Git/bare-ref and mocked external-service regressions

495 additions + 3 deletions = 498. No data, frontend assets, dependency pins, production environment or Scheduler changes.

Contract

• Any package-path change requires an A/M-only subset of the two CSV paths and receipt, with all three valid regular 100644 files present. Unchanged CSVs are allowed. Reject mixed code/data changes, unrelated paths, deletions, renames and bad/symlink modes.
• Reuse recursive JSON duplicate/schema checks, exact scope/UTC window, derivable counts and committed CSV bytes/hashes. Receipt JSON LF/CRLF conversion is semantically valid. posts_count_claim is a producer claim, not cryptographic proof of raw extraction.
• Derive admission date from the real current UTC clock, not receipt or PR creation time. No production fake-clock override or extraction-finish-as-now substitution; preserve 192h freshness and same-UTC-date rules. Monday consumer independently checks its actual aggregate date.
• Coverage comes from the exact event base SHA's canonical topics blob: max(400, integer-ceil(85% baseline)). Ratio boundaries301->256 and300->255 do not waive the400 floor. Remote consumer policy is unchanged.
• Fetch the numbered PR-head ref into an explicit capture and verify event head SHA; never select FETCH_HEAD or a synthetic merge SHA. Candidate code/dependencies/hooks are never checked out or executed. No PAT, cache, credential persistence, broader write permissions or automatic API retry.
• Code-only changes skip package admission; unchanged historical packages do not fail freshness. A failed validation cannot publish admission success. Failure diagnostics expose top-level reasons, not raw nested CSV/receipt values.

CI correction

• Checkout uses the trusted pull_request_target trigger commit (no PR-expression checkout ref). The runtime still fails closed unless checkout HEAD equals the exact event base, before candidate fetch or validation.
• Base: a58ecab8a34269c4bff4da33b3f16260f471817b. Production reviewed at ef3b56ab05ccbdcdff9a633b6b4de7ccea695f5f; published test-only amendment HEAD: ed89fd9ef639df05c50736414224e55b59a48034.

Owner-authorized test-only size:exception

• Hard cap: 500 cumulative additions + deletions against verified base a58ecab8a34269c4bff4da33b3f16260f471817b.
• Measured complete scope: four files, 495 additions + 3 deletions = 498 lines.
• This amendment changes ONLY tests/test_reddit_package_admission.py: 114 additions + 15 deletions = 129 (net +99). All existing meaningful cases remain covered.
• The three production-file Git blobs and 100644 modes are unchanged from the reviewed HEAD. This exception authorizes no production edits, another PR, merge, activation, native-gate override or protection change.
• Committed test blob: f9f32339925e058cd003b42b5846b09df11c6e39.

Added causal regressions

• Successful complete CLI admission in both autocrlf modes using an actual UTC extraction window, real main/admit/shared-validator code, real local Git objects and a disposable bare remote. Only external GitHub publication is mocked; the actual Checks API request must name the exact candidate head and success.
• The real-clock summary names the verified event base and current UTC date. HEAD, index, package bytes and all prior refs are preserved except the expected capture; native Git trace confirms no candidate checkout.
• Baseline 501 requires minimum 426 (including the existing 400 floor). Valid 425 packages reject specifically at coverage; valid 426 packages pass the real admission gate in both autocrlf modes. Date/schema/hash failures do not substitute for coverage evidence.
• Native Windows fixture forwarding and POSIX fixture routing delegate actual Git commands/results, confining fetch transport to the owned local bare repository. No production fake-clock override, live service or real package re-dating.

Verification of the frozen amendment

• Exactly one explicitly authorized complete focused execution: 57 passed, 0 skipped, 110.85s; pytest exit 0, wrapper exit 0, owned temporary cleanup COMPLETE.
• Only after that entire execution succeeded, exactly one backend execution: 533 passed, 0 skipped, 405.72s; one existing Pandera warning; pytest exit 0, wrapper exit 0, owned temporary cleanup COMPLETE.
• Candidate bytes/index/refs were frozen before those runs and verified identical afterward. Publication did not edit or normalize the validated candidate; its staged and hosted test blob both match the expected hash.
• Established safe stdin harness: existing isolated Python/dependencies, dotenv reads disabled, process-only credential clearing, external fixtures/settings/logging, filesystem containment, file-only Git transport and denied live gh. Cleanup touched only this run's owned directories, not previous auditor leftovers.
• Earlier focused execution remains recorded: 56 passed, 1 real Git cat-file timeout, 585.06s; pytest/wrapper exit 1 with successful cleanup. The scheduling/runtime-delay cause remains UNKNOWN. The successful repetition does not explain or erase it. The production Git timeout remained 60s; no assertions, timeouts or skip policies were weakened.
• Successful repetition timings: focused monotonic 111.047s; backend monotonic 406.000s. Slowest observed outer Git calls were 0.609s/0.625s. No new timeout occurred.
• Check-only Ruff, Bandit -ll, scoped detect-secrets, compile and diff checks passed on these unchanged candidate bytes. Semgrep is unavailable locally; actual new-head CI below executed it.
• Existing deterministic real-admit fixtures causally cover tampering/date/freshness. The older fixed-date failed-CLI fixture may reject provenance before content on later dates; the new successful real-clock path and fractional coverage regressions do not rely on that earlier failure.

Bootstrap / authority

• The new trusted-base target workflow is absent from current main and will NOT execute for this implementation PR. Standard exact-pushed-candidate Backend, Frontend, Bandit/Semgrep and detect-secrets CI remain required evidence; no new admission PASS is claimed.
• After merge, the separate exact-head check remains advisory until branch protection is separately configured. No protection changes, merge or auto-merge are requested.
• Native receipt-driven development remains off/default: ordinary repository policy applies, not a fabricated review receipt.
• Automatic CI for exact published HEAD ed89fd9ef639df05c50736414224e55b59a48034: all four checks SUCCESS. These are new executions, not inherited old-head checks.
  • Backend: 533 collected; 523 passed, 10 skipped, 1 warning in 89.98s. Eight Windows-only preparation cases and two secret-hook-availability cases skipped in Linux CI; all passed locally.
  • Frontend: 145 tests passed; current/base coverage 84.06%; analyze, assets, coverage/no-drop and debug web build succeeded.
  • Bandit/Semgrep: both executed successfully; Semgrep 267 rules on 145 files, 0 findings/0 blocking.
  • detect-secrets: tracked-file scan, optional receipt scan and receipt identity check succeeded.
• No manual CI rerun, ETL dispatch, recovery, deploy, protected-clone update or real package admission was performed. The new admission workflow is not on main yet; no live admission PASS is claimed.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.