fix: discovery counts stars before it spends the search budget

[croviatrust]

What

The Sunday discovery run was not updating the public list.

• 2026-09-27 finished: 400 candidates, 383 under 100 stars, search-counted before they were dropped.
• 2026-10-04 failed in actions/checkout@v7 and wrote nothing.
• 2026-10-11 was cancelled at the 120 minute limit during the discover step and wrote nothing.
• Report chore(deps): bump colored from 2.2.0 to 3.1.1 #5 measured that unchanged list. The date on it is still 2026-09-27.

Fix

Stars are read first. Repositories that cannot enter the list are not search-counted. Checkout is retried once. If the deadline passes, the list is left as it is and last_attempt is written.

The list in this pull request is still the 2026-09-27 selection. last_attempt records the two runs that did not finish.

Signed-off-by: Crovia Trust info@croviatrust.com

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T18:21:15.886027Z	25ed678	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

∵ causari · AI code survival

278 commits analyzed (git metadata only, retroactive, no setup).

AI-tagged (metadata matched): 82.0% line-weighted (5142 of 6267 lines still at HEAD, 14 commits) · 82.0% capped · median 92.5%

Of the lines introduced by metadata-matched commits, this percentage is the share git blame -w -M -C still attributes to those commits. It is not the share of the repository and it is not a quality score. Metadata matched does not prove who wrote each line. UNKNOWN and untagged are commits with no such signal; they are not a finding that a human wrote them.

Age-matched gap: +3.4 percentage points (AI-tagged 84.6% minus untagged 81.2% in the matched age windows). Positive means the metadata-matched lines have the higher line-weighted survival in those windows, over 1 matched age window holding 75% of the AI-tagged lines. Lines outside those windows are not in this gap.

Same repository, untagged lines: 192669 of 241804 still at HEAD (79.7% line-weighted, 264 commits).

Line age	AI-tagged	Untagged
0-30 d	84.6% (13 commits)	81.2% (183 commits)
30-90 d	—	63.0% (41 commits)
90-180 d	74.3% (1 commit)	63.9% (40 commits)

Agent	Commits	Introduced	Survived	Line-weighted	Capped	Median
cursor	14	6267	5142	82.0%	82.0%	92.5%

_{PROBABLE = heuristic. Counts lines from AI-tagged commits still attributed to them by git blame -w -M -C; inline completions leave no git trace and are not measured. Capped: each commit weighs at most min(p95 of per-commit introduced lines, 10000 lines); median: median of per-commit rates. Untagged = commits with no AI signal (human, inline-completed and untagged-agent code alike); age = commit date to HEAD date. absent means no introduced lines are included in the measurement (JSON null), not a measured zero and not a claim that the commits introduced nothing. An unavailable age-matched gap is not a gap of zero. Method v4: causari.dev/method. --json stores the commit, method, blame flags and counts. It does not store refs/notes/ai. The JSON field is still verified: metadata matched, not authorship proved.}

Read the age-matched gap as the comparison. An agent line marked below floor is not comparable. Meeting the floor is not a reliability guarantee.

Export: re audit <target> --json (the counts and commit d11909045e5307b80e481c1b3efa2b077914643e), --summary for this Markdown, --seal to sign those JSON bytes for that commit and method v4. --badge and --card write SVGs. re report is the local ledger, not this audit.

The export stores the counts, commit d11909045e5307b80e481c1b3efa2b077914643e, method v4, blame -w -M -C, and the coverage flags. It does not store refs/notes/ai. That ref is not part of the commit; adding or removing it can change the counts while the stored SHA stays the same. A repository that has moved has a different commit, and this export does not reproduce it.

Sealed: cs_2026_6PN275C7KNPGQIJ6ON2BGJ3PDM (crovia.seal.v1) over this audit of d11909045e53, written to causari-audit.seal.json. Verify offline with re seal verify causari-audit.seal.json or at https://causari.dev/verify — the seal proves these exact numbers were signed for this commit, not that they are true.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 25ed678ec4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".