[clubanderson]

Supersedes #10677 — carries @arteeh's commit with authorship preserved, rebased onto v5.

Refs #10667 (closed by #10683) and #10734.

Summary

• Carries forward @arteeh's exact-document runs.spektacular.recheck.sources discovery path with durable drift.drift_source evidence.
• Keeps the security envelope from ✨ feat: add opt-in Spektacular recheck discovery #10677: explicit relay proxy, exact HTTPS host allow-list, GET-only reads, no redirects, no NO_PROXY bypass, 16-source / 30s / 10s / 32 KiB bounds.
• Rebases onto v5 after ✨ add Spek recheck outward discovery sources #10683 by layering exact document snapshots alongside the existing typed runs.spektacular.recheck.discovery release/activity/feed evidence.
• Keeps TestRecheckDiscoveryFeedFiltersSinceAndCaps active; it is no longer skipped on current v5.

Validation

• gofmt -l on touched Go files
• git diff --check HEAD~1..HEAD
• Per repository AGENTS.md, Go tests/vet/coverage are left to CI.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign danathar for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

PR	Title	Relation	Files
#10677	✨ feat: add opt-in Spektacular recheck discovery	same files	changelog.d/added-spektacular-discovery.md src/docs/adr/0020-spek-continuous-convergence.md src/docs/spektacular.md src/pkg/config/runs_config.go src/pkg/config/spektacular_discovery.go src/pkg/config/spektacular_discovery_test.go src/pkg/config/validate.go src/pkg/dashboard/api_campaigns.go src/pkg/dashboard/campaign_discovery.go src/pkg/dashboard/campaign_discovery_test.go src/pkg/dashboard/campaign_recheck.go src/pkg/knowledge/inception.go

[hivecommons-hive]

Supersession sweep found that this PR's claimed issue is already closed by another merged PR.

• Claimed issue: hive#10667
• Closing PR: #10683

A different merged PR closed the claimed issue. Leaving this contributor PR open for a human to review.

This comment is edited in place by the supersession sweep; it is not duplicated.

[hivecommons-hive]

hive/awaiting-ci: CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

The code does what the body says — I read the new files and the v5 callers, not just the diff. The egress envelope checks out: http.ProxyURL ignores NO_PROXY, exact-host allowlist, HTTPS/443 only, userinfo and fragments rejected, redirects refused, LimitReader(32 KiB+1) + UTF-8 check. And the "evidence only" claim holds on this head: drift_source[] is persisted and projected via campaignDriftFromArchive, but recheckSpecStageTitle (src/pkg/dashboard/stage_leases.go:901-907) iterates only Drift.External, so nothing fetched here reaches a spec prompt.

What I can't settle, and think a maintainer should before this lands: v5 already carries an outward-discovery schema from #10683 — runs.spektacular.recheck.discovery.sources[] with kinds upstream_release/repo_activity/standards_feed/landscape and field url_or_repo (src/pkg/config/runs_config.go:180-194), validated against variables.security.http_allowlist (src/pkg/config/validate.go:42-43). This PR adds a sibling schema: runs.spektacular.recheck.sources[] with kinds release/changelog/repo/standards/landscape and field url, plus discovery_proxy and egress_allowlist, validated by a separate ValidateDiscovery (src/pkg/config/spektacular_discovery.go:20) that never consults http_allowlist. Net effect: two source lists with overlapping kind vocabulary and two allowlists for one feature, and the proxy/no-redirect envelope applies only to the new path while the existing collector still uses http.DefaultClient (src/pkg/dashboard/recheck_discovery.go:51).

The one-sentence question: should exact-document snapshots be a fourth kind under the existing recheck.discovery.sources (reusing variables.security.http_allowlist), or is a separate recheck.sources + egress_allowlist surface intended — and if the latter, should the stricter proxy envelope also be applied to the #10683 path?

Smaller, verified: the spektacular.md rewrite deletes the "Supported source kinds" prose for the existing discovery.sources (those kinds are still implemented at recheck_discovery.go:79-84 and still appear in the YAML example), so readers can no longer learn what url_or_repo accepts per kind. Worth restoring alongside the new section.

Since this supersedes #10677, a maintainer may want to close that one once this is decided. I have not closed or changed anything.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback