Webhook-driven reindex on push (GitHub)

[webdevtodayjason]

Thread Assignment

Thread C (Codex)

Problem

Index goes stale after code changes. Manual re-indexing is error-prone and blocks agents from getting fresh symbol data.

Requirements

• Add /webhook HTTP endpoint that accepts GitHub push events
• Validate webhook signature (HMAC SHA-256 with configurable secret)
• On valid push: trigger incremental reindex of the changed repo
• Reindex runs async — webhook returns 202 immediately
• Add reindex status tracking (in-progress, last-success, last-failure)
• CLI argentmunch reindex <repo> for manual trigger
• Rate limit: max 1 reindex per repo per 60 seconds

Acceptance Criteria

1. Configure GitHub webhook → push to repo → index updates within 30 seconds
2. Invalid webhook signature → 403, no reindex triggered
3. Rapid pushes (5 in 10 seconds) → only 1 reindex executes (debounce/rate limit)
4. argentmunch list shows last_reindexed_at timestamp per repo
5. Reindex failure does not corrupt existing index (atomic swap)

Merge Gate

• Tests for webhook validation, reindex trigger, rate limiting, atomic swap
• PR linked to this issue
• Depends on: multi-repo indexing (Multi-repo indexing + repo allowlist enforcement #4) must land first

Execution Order

#5 in Sprint Slice 2 — after multi-repo indexing.

[webdevtodayjason]

Sprint Slice 2 — Thread Update (2026-03-05)

Execution order updated. See full coordinator summary: https://github.com/ArgentAIOS/argentos/issues/76#issuecomment-4002350291

Reassigned from Thread C → Thread F (depends on #4). Priority 6.

[webdevtodayjason]

Integrated in PR #7: async webhook-triggered reindex scheduling/status included.