feat(tools/discourse): category activity list audit (PR2) #23

AI-assisted audit issue. The owner confirmed completed manual review of audited c2805481 and authorized upstream submission.

Goal

Review PR2 of the Discourse bridge: read category discussions ordered by latest activity, optionally since a cutoff, before fetching individual topics.
This is the category-list slice of apache/magpie#307, following merged apache/magpie#1755.

Audit PR: MakerFlyFly/magpie#24.

Audit snapshot

• Fixed baseline: b9e14009367f37efce807e473b95c331286036a1, branch audit/discourse-topic-list-base.
• Candidate: c2805481f4635aaf9aa5807eafab2bb51d3714ac, branch feat/discourse-topic-list.
• Previous candidate: a3794eff6acfb9e9a2635da28fa3632ac65fe8ab; all earlier feature and fix commits remain in history.
• Rooted-path delta: 3 files, +38/-10. Complete PR: 10 files, +1046/-9.
• Scope remains category listing, stdlib-only and partial. Owner manual review of this candidate is complete; the fork audit PR stays Draft and its baseline/head are preserved.

Upstream publication

• apache/magpie#1841 is open and Ready for review, targeting apache/magpie:main.
• Publication branch: feat/discourse-topic-list-upstream; head 888098ee6d535c993ee47718d1b9f285f7c1932e; publication base 27597d574c5fad21b89448a99bae60582dc305e5.
• All four rebased commits have equal range-diffs. The complete feature patch and all ten changed files are byte-identical to the manually reviewed c2805481; Generated-by trailers are preserved.
• Local publication checks pass: 370 package tests, five integration members (42 / 493 / 372 / 87 / 31), ruff, format, mypy, all-file non-test hooks, affected-member pytest and Magpie A–E. The affected-member hook selects only Discourse.
• No new forum requests were made for publication. The 2-GET anonymous CLI result below belongs to audited c2805481, not the rebased SHA.
• Upstream CI is tracked separately; queued/running or approval-waiting checks are not passes. No formal Approve, reviewer request, auto-merge or merge was performed.

Local verification of audited c280548

370 package tests pass: 91 list cases and all 279 unchanged PR1 cases; ruff, format and mypy pass.
Five integration members pass (42 / 493 / 372 / 87 / 31 tests).
All-file non-test hooks pass (40 Passed; pytest intentionally separate); committed-diff pytest selects only Discourse and passes 370 cases.
Magpie complete-PR A–E passes for all four commits, with 0 blocking / 0 advisory items.
The optional native Claude check remains internally skipped because its CLI is absent.
zizmor 1.30.1 offline has no unsuppressed findings (1 ignored, 18 suppressed).
One final anonymous rooted-path CLI invocation used 2 actual HTTPS GETs, no forum writes; planning and mock probes used no real forum requests.
The previous a3794ef head's checks, including prek, succeeded. Historical prek cancellations for 7f5d83d and 4e72eb9 remain separate and are not passes. Current-head results are assessed separately.

Rooted-path follow-up

• Before the fix, four rooted-path cases and three error-hint cases failed; all now pass.
• On a root installation, accept /c/dev/7 and a trailing slash. With a /forum base path, accept both /forum/c/dev/7 and /c/dev/7.
• Complete URLs still require the configured forum path; protocol-relative references are rejected before any request.
• Reject view/API suffixes (/none, /l/..., .json) with a clear hint instead of ignoring their meaning.
• Only the category-reference path branch, list tests and README changed. Listing, shared client, CLI, specification, lockfile and PR1 remain unchanged.
• The inspected reviewer mock probe was rerun against this head: the original P1/P2 fixes remain correct.
• The re-review's approvable assessment was external feedback. The owner subsequently explicitly confirmed completed manual review of c2805481; no formal GitHub review was posted.

Owner audit checklist

• Read the full PR2 diff and explain category selection and pagination.
• Confirm activity-time filtering, inclusive time boundary, null handling and evidence-based truncation.
• Review local request construction, continuation signals, overlap handling and error-without-partial-success behavior.
• Review the exact validation scope and documented pinned-topic and snapshot limitations.
• Decide whether to prepare a separate upstream PR after manual review.

Source reports, patches, exact commands and Chinese explanations remain outside the feature repository in the local PR2 report directory.
General resource budgets remain a separate design after PR2 and before PR3; no retries, Hot/Top ranking, other commands or shared-client refactoring are added.

AI disclosure

Codex (GPT-6) assisted implementation, review-response analysis, audit preparation and publication.
The owner confirmed completed manual review of c2805481 and authorized the byte-identical rebased upstream submission; upstream maintainer review remains pending.