feat(merge_coordinator): add paginated list_pr_files + contamination gate Refs #2409

Step 1: Paginated list_pr_files() using X-Total-Count header and page loop
Step 2: Added check_contamination() to detect .sessions/, .review_tmp/, .handoff/, .beads/ patterns
Step 3: Wired contamination check into evaluate_one() before mergeability evaluation
Tests: 35 pass, 0 fail. Clippy clean.

Author: Test User

crates/terraphim_merge_coordinator/src/evaluator.rs

@@ -42,6 +42,7 @@ pub async fn evaluate_all(
     Ok(out)
 }
 
+#[allow(clippy::collapsible_match)]
 async fn evaluate_one(
     gitea: Option<&GiteaClient>,
     owner: &str,
@@ -50,6 +51,19 @@ async fn evaluate_one(
 ) -> PrEvaluation {
     let mergeable = pr.mergeable.unwrap_or(false);
     let fixes_issues = extract_fixes(pr.body.as_deref().unwrap_or(""));
+
+    // Check contamination before mergeability to prevent artefact PRs from merging.
+    if let Some(c) = gitea
+        && let Err(reason) = check_contamination(c, owner, repo, pr.number).await {
+            return PrEvaluation {
+                pr_index: pr.number,
+                mergeable,
+                fixes_issues,
+                verdict: EvalVerdict::Hold(reason),
+                blocker_kind: None,
+            };
+        }
+
     let (verdict, blocker_kind) = if !mergeable {
         let kind = classify_blocker(gitea, owner, repo, pr).await;
         let reason = format!("not mergeable ({kind})");
@@ -66,6 +80,40 @@ async fn evaluate_one(
     }
 }
 
+/// Check PR file list for contamination (artefacts, session dumps, etc.).
+///
+/// Returns `Ok(())` if clean, `Err(reason)` if contaminated.
+async fn check_contamination(
+    gitea: &GiteaClient,
+    owner: &str,
+    repo: &str,
+    pr_index: u64,
+) -> Result<(), String> {
+    const CONTAMINATED_PATTERNS: &[&str] = &[
+        ".sessions/",
+        ".review_tmp/",
+        ".handoff/",
+        ".beads/",
+    ];
+
+    let files = gitea
+        .list_pr_files(owner, repo, pr_index)
+        .await
+        .map_err(|e| format!("contamination check failed: {e}"))?;
+
+    for file in &files {
+        for pattern in CONTAMINATED_PATTERNS {
+            if file.starts_with(pattern) || file.contains(pattern) {
+                return Err(format!(
+                    "contaminated: {file} (pattern: {pattern})"
+                ));
+            }
+        }
+    }
+
+    Ok(())
+}
+
 /// Query CI status and classify why a PR is blocked.
 async fn classify_blocker(
     gitea: Option<&GiteaClient>,
@@ -230,4 +278,21 @@ mod tests {
         assert_eq!(last.verdict, EvalVerdict::Merge);
         assert_eq!(last.blocker_kind, None);
     }
+
+    #[test]
+    fn contamination_patterns_match_artefact_files() {
+        let patterns: &[&str] = &[".sessions/", ".review_tmp/", ".handoff/", ".beads/"];
+
+        // Positive matches
+        assert!(patterns.iter().any(|p| ".sessions/session-123.md".contains(p)));
+        assert!(patterns.iter().any(|p| ".review_tmp/pr123/file.diff".contains(p)));
+        assert!(patterns.iter().any(|p| ".handoff/pr2664-review.md".contains(p)));
+        assert!(patterns.iter().any(|p| ".beads/issues.jsonl".contains(p)));
+
+        // Negative matches
+        assert!(!patterns.iter().any(|p| "src/main.rs".contains(p)));
+        assert!(!patterns.iter().any(|p| "crates/terraphim_rlm/src/lib.rs".contains(p)));
+        assert!(!patterns.iter().any(|p| "Cargo.toml".contains(p)));
+        assert!(!patterns.iter().any(|p| ".github/workflows/ci-pr.yml".contains(p)));
+    }
 }

crates/terraphim_merge_coordinator/src/gitea.rs

@@ -123,23 +123,49 @@ impl GiteaClient {
     }
 
     /// List files changed in a PR by index. Returns the `filename` of each
-    /// changed file.
+    /// changed file, paginating through all pages.  Gitea defaults to 50
+    /// files per page; PRs with more changes would silently miss
+    /// contamination checks without pagination (issue #2409).
     pub async fn list_pr_files(
         &self,
         owner: &str,
         repo: &str,
         index: u64,
     ) -> Result<Vec<String>, MergeCoordinatorError> {
-        let url = format!(
-            "{}/api/v1/repos/{}/{}/pulls/{}/files",
-            self.base_url, owner, repo, index
-        );
-        let resp = self.get_with_retry(&url).await?;
-        let files = resp
-            .json::<Vec<PrFile>>()
-            .await
-            .map_err(|e| MergeCoordinatorError::Api(format!("decode pr files: {e}")))?;
-        Ok(files.into_iter().map(|f| f.filename).collect())
+        const PER_PAGE: u32 = 50;
+        let mut all_files = Vec::new();
+        let mut page: u32 = 1;
+
+        loop {
+            let url = format!(
+                "{}/api/v1/repos/{}/{}/pulls/{}/files?page={page}&limit={PER_PAGE}",
+                self.base_url, owner, repo, index,
+            );
+            let resp = self.get_with_retry(&url).await?;
+
+            // Use X-Total-Count header to detect last page.
+            let total_count: Option<u32> = resp
+                .headers()
+                .get("x-total-count")
+                .and_then(|v| v.to_str().ok())
+                .and_then(|v| v.parse().ok());
+
+            let page_files: Vec<PrFile> = resp
+                .json()
+                .await
+                .map_err(|e| MergeCoordinatorError::Api(format!("decode pr files: {e}")))?;
+
+            let page_len = page_files.len();
+            all_files.extend(page_files.into_iter().map(|f| f.filename));
+
+            // Stop when we've fetched all items or this page was empty.
+            if total_count.is_some_and(|t| all_files.len() as u32 >= t) || page_len == 0 {
+                break;
+            }
+            page += 1;
+        }
+
+        Ok(all_files)
     }
 
     async fn get_with_retry(&self, url: &str) -> Result<reqwest::Response, MergeCoordinatorError> {