fix: recover exact webhook commit lists

[f0rr0]

What changed

• recover exact push commit lists from durable GitHub App webhook/Event evidence when later compare or reachable history has moved
• hydrate each recorded SHA from GitHub and verify the provider response
• fail closed when the durable list is incomplete, duplicated, malformed, or does not end at the observed head
• validate count, order, and membership inside the recovery boundary, including force-push history

Production evidence

• Oliphaunt push observation 2db2fcb2-40c1-46d9-87cb-806614bfba36 recorded exactly 2 introduced SHAs
• the current GitHub compare now returns 3 commits, which previously exhausted retries as source_incomplete
• both recorded SHAs still resolve individually, are authored by f0rr0, and the patched acquisition returns precisely those 2 commits in order

Verification

• 245 tests passed with 1,534 assertions
• includes same-count contradictory comparison and force-push surplus-history regressions
• typecheck, lint, formatting, and production build passed
• read-only execution against the exact production observation passed

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
f0rr0-github-io	Ready	Preview	Aug 31, 2026 9:38am