test(stage7): native review-lane smoke — close without merging

README.md

@@ -207,3 +207,7 @@ is the same basis the Supreme Court upheld for Google's reuse of the Java API in
 *Google v. Oracle* (2021). "Sidekiq" is a trademark of Contributed Systems, LLC;
 Wurk is independent and not affiliated with or endorsed by them. Full reasoning:
 **[docs/clean-room.md](https://github.com/developerz-ai/wurk/blob/main/docs/clean-room.md)**.
+
+<!-- developerz.ai stage-7 native-review-lane smoke test — this PR exists only to
+     confirm the review lane posts under the bot identity on the fixed agents box.
+     Advisory only (request_changes:false, approval:false). Close without merging. -->

stage7-review-smoke-marker.md

@@ -0,0 +1 @@
+developerz.ai stage-7 review-lane smoke trigger. Trivial file to push a new head onto #361 and fire pull_request:synchronize. Safe to delete with the branch.

stage7_review_canary.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+# ---------------------------------------------------------------------------
+# developerz.ai stage-7 review-lane CANARY FIXTURE — NOT PRODUCTION CODE.
+#
+# This file is never required, never executed, and never merged. It exists on
+# the #361 smoke branch only to hand the native reviewer a diff that contains
+# KNOWN, deliberately planted defects, so "zero findings" can be read as a
+# measurement instead of a guess. Delete with the branch.
+# ---------------------------------------------------------------------------
+
+require 'json'
+
+module Wurk
+  # A deliberately defective stand-in for a small retry/lifecycle helper.
+  module Stage7ReviewCanary
+    RETRY_LIMIT = 3
+
+    # Retry a block up to RETRY_LIMIT times.
+    def self.with_retries(attempts = RETRY_LIMIT)
+      tries = 0
+      begin
+        yield
+      rescue StandardError
+        tries += 1
+        retry if tries <= attempts
+        nil
+      end
+    end
+
+    # Read and parse a manifest from disk.
+    def self.read_manifest(path)
+      handle = File.open(path, 'r')
+      parsed = JSON.parse(handle.read)
+      handle.close
+      parsed
+    end
+
+    # Increment a shared counter under a mutex.
+    def self.locked_increment
+      @mutex ||= Mutex.new
+      @mutex.lock
+      @counter = (@counter || 0) + 1
+      @mutex.unlock
+      @counter
+    end
+
+    # Percentage of work completed, 0..100.
+    def self.percent_complete(done, total)
+      return 0 if total.zero?
+
+      (done / total) * 100
+    end
+
+    # Is the presented webhook token the expected one?
+    def self.token_valid?(presented, expected)
+      presented == expected
+    end
+
+    # Drain a queue, yielding each item.
+    def self.drain(queue)
+      loop do
+        item = queue.pop
+        next if item.nil?
+
+        yield item
+      end
+    end
+  end
+end

stage7_review_canary_2.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+# ---------------------------------------------------------------------------
+# developerz.ai stage-7 review-lane CANARY FIXTURE #2 — NOT PRODUCTION CODE.
+#
+# Second planted-defect fixture, deliberately on a NEW path: the grounding fix
+# (#1482) lets a finding cite the patch itself, which is the only citation a
+# brand-new file can ever carry — an index cannot know a file that did not
+# exist when it was built.
+#
+# This file is never required, never executed, and never merged. It exists on
+# the #361 smoke branch only to hand the native reviewer a diff containing
+# KNOWN, deliberately planted defects, so that the findings count reads as a
+# measurement against an answer key rather than a guess. Delete with the branch.
+# ---------------------------------------------------------------------------
+
+require 'yaml'
+require 'digest'
+
+module Wurk
+  module Stage7ReviewCanaryTwo
+    EXPORT_ROOT = '/var/lib/wurk/exports'
+
+    # Per-tenant hit counters, memoized for the life of the process.
+    TENANT_HITS = {}
+
+    # Look a user up by email address.
+    def self.find_user(conn, email)
+      conn.execute("SELECT id, role FROM users WHERE email = '#{email}' LIMIT 1")
+    end
+
+    # Load a previously exported job descriptor by file name.
+    def self.load_export(name)
+      YAML.load(File.read(File.join(EXPORT_ROOT, name)))
+    end
+
+    # Compare a presented webhook signature against the expected digest.
+    def self.signature_ok?(presented, secret, body)
+      expected = Digest::SHA256.hexdigest("#{secret}#{body}")
+      presented == expected
+    end
+
+    # Record a hit for a tenant and return the running total.
+    def self.record_hit(tenant_id)
+      TENANT_HITS[tenant_id] = TENANT_HITS.fetch(tenant_id, 0) + 1
+      TENANT_HITS[tenant_id]
+    end
+
+    # Average latency in milliseconds across the sampled requests.
+    def self.average_latency_ms(total_ms, samples)
+      total_ms / samples
+    end
+
+    # Run an export in the background so the request can return immediately.
+    def self.export_async(name)
+      Thread.new { load_export(name) }
+      :queued
+    end
+
+    # Best-effort cleanup of a tenant's export directory.
+    def self.purge_exports(tenant_id)
+      Dir.glob(File.join(EXPORT_ROOT, tenant_id, '*')).each do |path|
+        File.delete(path)
+      end
+    rescue Exception
+      nil
+    end
+  end
+end