[sodre]

Summary

Refs #44. The notifier reported a Spot reclaim for jobs that were not lost. Two causes, two fixes:

 Spot interruption warning (EC2 or Fargate Spot)
   notifier
     read the machine's tags (the job it was launched for, or took in a swap)
+    GET the job from GitHub
+    ignore unless the job is in_progress on THIS machine's CI runner   # idle runner: nothing to report
     POST check run "ci-runner / <job>" = failure
+    GET the job again; if it already succeeded, clear the check run

 workflow_job `completed` (GitHub already delivers it, ~3 deliveries per job)
   webhook
+    if success on a runner of this stack: invoke notifier async
+  notifier
+    find the reclaim failure(s) under the job's run, set them neutral   # job survived the 2-minute warning, or a re-run passed

• Idle CI runner: another CI runner took its launch job, so its tags still named a job it never ran.
• Job survives the warning: AWS warns 2 minutes ahead and the job can finish inside that. The check run turns neutral. A re-run that passes clears the earlier attempt's report too.
• Webhook gains lambda:InvokeFunction on the notifier only. Notifier timeout stays 30 s.

Evidence

• Before: the live logs for the two stale checks on a consumer PR: i-0c718b… had no Swap and no job on its runner, yet the notifier reported its launch job. i-042f94… ran its job, which passed 95 s after the warning, and the check stayed failure.
  After: the tests that pin each case (make test: 182 pass, 0 skipped, including the aws-emulator ones):

idle runner (launch job taken by another runner)        -> no check run     (was: failure posted)
job queued / already completed                          -> no check run
swapped runner (re-tagged job in_progress on its runner)-> names the job it took
job succeeded after the warning (webhook word)          -> check run neutral (was: stays failure)
job already succeeded when the report is posted         -> neutral
re-run attempt succeeds, first attempt's report stands  -> neutral
job failed / cancelled                                  -> stays failure (webhook never forwards it)
success word for a repo outside the org                 -> ignored, no GitHub call

• Not yet proven live: the canary run from "Proving a change live" (acceptance criterion 2 of Reclaim notifier reports a job its machine never ran, or one that survives the warning #44). This PR does not close Reclaim notifier reports a job its machine never ran, or one that survives the warning #44.

Merge Danger

Door: two-way

Merging to main deploys nothing: the live stack runs whatever was deployed last. Reverting the commits restores the old notifier.

Blast Radius: notifier

After the next deploy, every successful CI runner job invokes the notifier, which mints an App token and lists check runs (about 300 GitHub calls an hour at today's volume). A failed invoke makes the webhook answer 502 for that completed delivery; redeliver it from the App's settings. Known gap: a job that finishes just after the post-report re-read, with a failed invoke, stays failure until redelivered.

🤖 Generated with Claude Code