fix(todos): scanner fails closed on push diffs over 16 MiB, turning main red #880

🤖 Generated by the Agentic Engineer

What happened

The TODOs workflow turned main red on devantler-tech/ksail at 6ef410b (ksail#8182, run 42510034075). The scanner logged Exception: Could not retrieve diff. Then the supervisor reported scanner incomplete: diff read failed.

The push changed 63 files and added about 487,000 lines, mostly generated Go notice data. The compare diff for that push is about 54 MB. The supervisor's API proxy (.scripts/todo-guard/guard.go) reads at most 16 MiB of any API response and fails anything larger. That is the documented fail-closed rule, so the guard did what it was built to do. But a push that adds no TODOs can still turn main red, and re-running gives the same result.

Why it matters

Every large generated or vendored change on any repository that uses the shared TODO workflow will leave a red default-branch head. It stays red until an unrelated later push supersedes it. That costs rung-0 attention, and it hides real breakage behind a known-noisy check.

Possible directions (to decide)

• Read the diff per file (compare files[].patch, paginated), skipping the action's ignore paths, instead of one unified diff. Each page stays under the cap.
• Or, when the diff is over the cap and no mutation has started, fall back to the bounded per-file read before failing closed.
• Keep failing closed whenever the guard cannot prove it saw the whole diff.

Acceptance

• A push whose full diff is over 16 MiB but whose non-ignored changes fit is scanned completely, and the workflow passes.
• Partial or unverifiable evidence still fails, and a test covers both cases.