feat(source): ship governed AIHOT REST v1 data ingestion

[1012839419a-alt]

Parent: #130
Source audit: #135 / commit 81ab347dc082954bf35d1cfe9d549ebf404e5533

Goal

Ship AIHOT as the first real, license-aware hot-data reference source through the existing Source -> WorkflowRun -> Record -> MCP evidence chain. This is one vertical slice; do not add a parallel hot-news API or per-provider MCP facade.

Execution contract

• Worktree: D:\projects\opencli-aihot-source-20260914
• Branch: codex/aihot-source-20260914
• Baseline: 6b7c69e0d7f1767d7101336cfeb68e869c772fdf
• Owned paths:
  • _bmad-output/implementation-artifacts/spec-gh-141-aihot-source.md
  • backend/channels/aihot_channel.py
  • backend/channels/registry.py
  • backend/schemas/source.py
  • backend/workflow/capability_projection.py
  • frontend/lib/workflow/node-contracts.ts
  • frontend/lib/workflow/studio-templates.ts
  • tests/unit/channels/test_aihot_channel.py
  • tests/unit/test_workflow_http_source_executor.py
  • tests/integration/test_records_api.py
  • tests/unit/test_mcp_server.py
• Do not change shared models/migrations, generic MCP tool names, research service, or package files. Unexpected need expands upward first.

Required behavior

• Anonymous read-only AIHOT REST v1 on aihot.news only; never old /api/public/*.
• Channel is incremental + paginated with explicit no-auth readiness and stable identity.
• Preserve opaque page/snapshot/change cursors, ETag/304 semantics, 409 snapshot_required rebootstrap, Problem JSON, Retry-After, and forward-compatible unknown fields.
• Preserve attribution, source/original links, publishedAt/discoveredAt/latestAt distinctions, raw/normalized/lineage/hash/identity; do not infer missing timestamps or heat.
• Publish one versioned intelligence.source.aihot capability with allowed_domains fixed to aihot.news and a Studio template.
• Usage/commercial authorization must be surfaced as a readiness/manifest condition: internal/non-commercial allowed; external commercial redistribution requires written authorization.
• Existing workflow/MCP tools execute/read the source; no duplicate AIHOT MCP tool.

Acceptance

Unit tests for 200/304, pagination, invalid/cross-query cursor, 400, 409 rebootstrap, 429/503 Retry-After, identity, schema addition, attribution and timestamps. Integration verifies update-by-identity without duplicate records and no credential leakage. Live canary: items first request + conditional request, then hot-topics provenance/freshness. Report fixture vs live evidence and keep worktree clean.

[1012839419a-alt]

Coordinator review: the implementation spec intentionally limits the new provider channel to REST v1. Existing generic RSS support remains reusable for AIHOT feeds and is not reimplemented in this slice; the Issue title is narrowed accordingly. Spec review found no placeholders or unresolved contract ambiguity.

[1012839419a-alt]

Draft specification revised and cross-reviewed. Commit: 17fa186df7c65131c34a6abaf7cf65582b4ce289. AIHOT is now explicitly an independently testable source adapter that later binds through #140 source.readiness -> collection.start -> run.get -> records.query and generic analysis/artifact commands, never a provider-specific MCP tool. Verification uses the current uv entry point until #136 lands; the live canary requires Project/Run/Record/Artifact evidence for ETag/304, cursor/409 rebootstrap, Problem JSON/Retry-After, provenance and licensing. Status remains draft; no implementation has started pending approval.

[1012839419a-alt]

Human approval received in the Codex closeout thread on 2026-09-14: A / Approve. Approved scope is revised AIHOT draft commit 17fa186d, including the generic #140 command bridge and final Project/Run/Record/Artifact live canary.