test(assurance): report GitHub API HTTP status (signed DCO)

Merged
TH
7d ago
+43-2

Signed, DCO-compliant replacement for original PR #193

Captures and reports actual HTTP status on externally fetched immutable AF-02 authority evidence without retry, fallback or bypass. Test covers 403, 000 and 200 status parsing. Diagnostic exposure is not a root-cause repair or waiver for #192 or historical missing artifact #100.

Original #193 is historically technically qualified but its GitHub API commits were unsigned. This candidate recreates its exact byte-identical Git tree in a single fresh commit signed with SSH key and DCO, using the authorized online Windows device. It does not rebase, amend, force-push or rewrite original commits and does not modify protected main or workflows.

  • Signed SHA: 85f13b1e3decd1495b19977b896bbe02e92a15b9 — GitHub API verified=true, reason=valid.
  • DCO signoff: Signed-off-by: Abdulaziz M. Shehri <alshehriofficial@gmail.com>.
  • Tree: 93e784c265a172a38d0c060ef80f0abb8dabc662, exactly equal to original PR #193 head.
  • Parent: f82565cca917d119e1c774b2c470e2ac20e0d6dd.
  • Windows validation: ephemeral shallow main clone, fetched current original PR head, git apply --index --check, whitespace diff check, cargo fmt --all -- --check, exact pre/post-sign tree comparison, git commit -S -s and normal git push; prior GitHub CLI active account restored.

Qualification is not inherited. The original green CI is only evidence for identical file bytes, not this new commit identity. All GitHub technical checks must pass at 85f13b1e3decd1495b19977b896bbe02e92a15b9 independently. Actual independent eligible human Code Owner APPROVED review after last push, all resolved threads, normal merge commit, fresh main CI, and any separate AF-02 FD-1/FD-2 governance gates remain mandatory. No self-review, bot comment as approval, ruleset bypass or false product completion is authorized. The original candidate should be closed without merge after this replacement is publicly documented.

CommandF remains incomplete: full consumer-specific decision and atomic signed receipts, release qualification and Studio are not claimed.

Summary by cubic

Improves AF-02 authority reconstruction tests so GitHub API fetch failures report the actual HTTP status instead of only the curl error. A 403 or connection failure still fails the reconstruction — this is diagnostic-only exposure, not a pass condition.

Adds --write-out to curl invocations to emit COMMANDF_GITHUB_HTTP_STATUS=<code> to stderr, parses it in failure messages, and adds a unit test that verifies 403/000/200 parsing.