[MakerFlyFly]

Summary

• Add magpie-discourse topic list --category <id|slug|url|slug/.../id> [--since <ISO-8601>] [--limit N] so projects can discover category discussions before reading individual topics. Include subcategories and reuse the existing GET client.
• Request descending activity order, filter on bumped_at and preserve native pinned positions. Only an extra unique match proves truncation; pinned topics, including old category About topics, count toward the limit.
• Resolve IDs and native category references directly, including rooted paths on root/subfolder installations; bare slugs match only catalog roots. Keep whole-page validation, separate activity and last-message times, and Coverage: partial.

Type of change

• Tool / bridge contract
• Python package
• Documentation

Test plan

• Final Linux package suite: 370 tests pass (91 list cases plus all 279 unchanged PR1 cases); ruff, format and mypy pass.
• Rooted-path follow-up: 7 failing/84 passing cases before the fix; all pass afterward. Cover trailing slash, both subfolder path forms, protocol-relative rejection, preserved full-URL boundaries and clear suffix errors.
• The inspected reviewer mock probe was rerun against this head: original P1/P2 fixes remain; /c/dev/7 succeeds; unsupported views still fail before HTTP.
• Five integration members pass: vendor-neutrality-score 42, skill-and-tool-validator 493, dev 372, spec-validator 87 and spec-inventory 31.
• All-file non-test hooks: 40 Passed; workspace pytest intentionally separate. Committed-diff pytest selects only Discourse and passes 370 cases.
• Magpie complete-PR A–E passes for all four commits, with 0 blocking / 0 advisory items.
• zizmor 1.30.1 offline: no unsuppressed findings (1 ignored, 18 suppressed).
• Historical anonymous rooted-path CLI verification on audited c2805481 used 2 actual HTTPS GETs, with no forum writes; its round budget was 10.
• Native Claude validation is internally skipped because its CLI is absent. Collections overlap and are not added as independent totals; full-workspace pytest was not run.
• Cloud results are separate: the previous a3794eff head has successful checks, including prek. Historical prek runs for 7f5d83d0 and 4e72eb9 were cancelled and are not counted as passed. Current-head checks are assessed separately.

RFC-AI-0004 compliance

• Sandbox — existing forum origin/path restrictions remain; no sandbox or host-allowance changes.
• Vendor neutrality — Discourse-specific behavior stays in the partial adapter.
• Write-access discipline — GET only, including redirects; automated HTTP tests use mocks.
• Privacy LLM — no model calls; callers establish visibility and apply existing privacy approval before sending content to a model.

Linked issues

Owner audit: MakerFlyFly/magpie#23.
Refs apache/magpie#307, following merged apache/magpie#1755.
This slice does not close the broader request.

Notes for reviewers

• Fixed audit base: b9e14009367f37efce807e473b95c331286036a1 (audit/discourse-topic-list-base). Head: c2805481f4635aaf9aa5807eafab2bb51d3714ac (feat/discourse-topic-list). Full PR: 10 files, +1046/-9.
• Rooted-path correction: only category parsing, list tests and README; three files, +38/-10. History is preserved.
• With a /forum base path, both /c/dev/7 and /forum/c/dev/7 select category 7. Complete URLs must include the configured forum path. References are validated, then only numeric-ID endpoints are requested.
• Protocol-relative references (//host/...) are rejected. ID-less manual ancestry paths and view/API suffixes (/none, /l/..., .json) are unsupported rather than silently changing their meaning.
• Continuations are signals only; requests retain locally fixed category/activity parameters and an increasing page. Empty or repeated complete pages claiming continuation fail.
• Without since there is no fixed recent-time window; filtering returned pins does not refill results. With since, only an older topic explicitly marked pinned: false establishes a cutoff.
• All received records are validated, including those beyond the limit or cutoff. The changing list is not a consistent snapshot.
• General budgets, retries, Hot/Top ranking, search, writes, shared-client refactoring and remaining archive verbs are outside this slice. Budgets remain a separate design after PR2 and before PR3.
• The owner confirmed completed manual review of audited c2805481 and authorized upstream publication. Upstream PR #1841 is open and Ready for review.
• Publication head: 888098ee6d535c993ee47718d1b9f285f7c1932e, based on 27597d574c5fad21b89448a99bae60582dc305e5. Four range-diff entries are equal; the full feature patch and all ten changed files are byte-identical to this audited version. This fork PR remains Draft on its original head and fixed audit base.
• All local checks listed above were rerun on the publication head: 370 package tests, the five integration members, ruff, format, mypy, all-file non-test hooks, affected-member pytest and Magpie pre-flight pass. Publication made no additional forum requests. Upstream CI is recorded separately and is not assumed to pass.

AI disclosure

AI-assisted audit record. Codex (GPT-6) assisted implementation, review-response analysis, tests, validation and publication.
The owner has confirmed completed manual review of c2805481 and authorized the byte-identical rebased upstream submission. This fork PR remains Draft for audit history; no formal Approve or merge was posted.