truf-server/openspec/changes/restore-openai-discovery-coverage/tasks.md

1. Query-scoped controls

• 1.1 Add validated allowlisted per-query overrides for pages, page size, and maximum targets.
• 1.2 Add focused tests proving exact-query overrides apply and ordinary queries remain unchanged.

2. OpenAI discovery coverage

• 2.1 Add literal openai queries and source-specific safety bounds for GitHub, GitLab, and DockerHub.
• 2.2 Test canonical configuration coverage, Docker isolation, and rollout limits.

3. Verification and rollout

• 3.1 Run focused and full regression suites with bytecode writes disabled.
• 3.2 Run strict OpenSpec validation and verify implementation against artifacts.
• 3.3 Coordinately restart the authority-managed runtime and verify PostgreSQL, pipeline, and core sources.
• 3.4 Observe the first bounded exact-query cycles and measure admissions, scan outcomes, OpenAI candidates, API outcomes, and pipeline drain.