[luisleo526]

release-receipts: discover scheduled evidence from repository artifacts (fix the red schedule at the source)

Problem (measured by reading scripts/release_receipts.py at main fb133cf)

The release-receipts schedule (every 15 minutes) goes red on the third pass inside an hour. One pass issues about 2,200 GitHub REST calls for a consumer with ~2,200 historical runs: it lists every run of the consumer workflow (repos/{repo}/actions/workflows/{workflow}/runs, ~22 pages), then asks for the artifact list of EACH run (repos/{repo}/actions/runs/{id}/artifacts), then downloads a zip per receipt. At the cron rate that exceeds the App installation's hourly quota, so a later pass gets a 403 mid-enumeration and lands in the catch-all in main(), which prints one sentence for eight different exception types (the failing read looks like a timing race, but it is a race with the quota window created by the pass itself). Passes that fail are short (4m49, 8m46) against 11-18 min for green ones.

Change (one source file, +23 lines)

• collect() (scheduled path, no run_id) lists the consumer's artifacts ONCE at repository level (repos/{repo}/actions/artifacts), keeps those named like the policy artifact that are not expired, and takes the candidate runs from artifact["workflow_run"]["id"]; only candidates get a run fetch.
• Candidates whose run is not completed are skipped (this also removes the genuinely racy in-flight read).
• fetch_artifact() takes the already-listed artifacts; the callback path (--run-id) is unchanged and still requires a receipt artifact.
• The catch-all in main() now includes the exception text (diagnostics only).
• NOT changed: the workflow-path check, role/digest/schema validation, receipts, policy keys, stored assets, the workflow files, the cron, concurrency. NO retry loop, NO added wait or limit (L6 ruling: fix at the source by request count).

Tests (tests/test_release_receipts.py +310, tests/test_release_binding.py 5 lines, 4 new fixtures)

Route-set assertions for 60- and 600-run histories (no workflow-runs listing, no per-run artifact listing), stored bytes compared with fixed fixtures, pickup of a run once it completes, workflow refusal, artifact validation, callbacks, and the diagnostic text. Run: python3 -m unittest discover -s tests -p 'test_release_*.py' (this is python-test.yml's job; nothing here ran on a Mac).

Proof status (honest)

• PR CI on this head is the proof. A spot-box run (suite at this commit + a control with the old release_receipts.py where the new tests must fail) was ordered but its launcher was blocked by the merge-gate hook (carded for LAB-CX); not run.
• An independent Claude read is in progress and has two open questions: (a) the repository-level artifact listing has no ?name= filter, so a consumer repo that uploads many artifacts per run may still need many pages; (b) a candidate from ANOTHER workflow carrying the same artifact name now raises Invalid("unexpected reporting workflow") and aborts the whole pass (fail-closed, like the rest of collect; before, the workflow-specific listing made it impossible). Do not merge until that read is posted.

Base fb133cf (hub main); one commit 392c14f.

[luisleo526]

Old-source control run (the read's carried condition, Q4): GREEN

One spot box (i-02c077786bee123c9, c5.large, ap-southeast-1; terminated, read back), using TNX-CX's kit unmodified (box-run.sh sha256 0563ffbd…02dd, drive.sh sha256 d0a9f246…4335). Hub head d3b8e69e6b389d940a0527059664d528acfdc4be, 0 dirty lines.

• Sources: A = this branch's scripts/release_receipts.py (ba5fcba7…c348); B = the OLD source at fb133cf (207943ee…8d36).
• bytes-B (the stored-bytes test, run against the OLD source): test_schedule_writes_the_fixed_pre_change_receipt_bytes_and_replays_idempotently ... ok, Ran 1 test, OK, exit 0. The stored receipt fixtures are therefore produced by the pre-change code. They are real, not fitted to the change.
• suite-A (this branch): Ran 389 tests, OK (skipped=2), exit 0.
• Expected companions on B: suite-B fails 7, the route-set tests that the old code fails by design. binding-B has 1 error, the fixture route change.
• Two earlier kit runs on the same day were void on box environment (no python3-venv, then no apt package lists). The kit now runs apt-get update first and stops with KIT-ENV-FAILURE instead of reporting.

Gate met. Squash-merged on all checks green, with --match-head-commit.