Harden federated compose against malformed member indexes (REUSE-WP-0020)

Repointing the production hub's 50 Gitea-hosted federation sources to Forgejo
ahead of the 2026-08-31 CoulombCore retirement took /v1/federated to HTTP 500.
One member index (evidence-binder) has capability rows with no `id`, and
compose_federated_index dereferenced item["id"] unguarded. Its Gitea copy was a
stale snapshot returning a non-mapping, so those rows had never been parsed.

A single malformed member index must not take down the whole endpoint. Extract
_read_index_entries(): unparseable YAML, a non-mapping body, an empty file, and
a non-list `capabilities` each degrade to a warning and an empty row list, and
rows without an `id` are skipped individually. A failed source stays listed with
count 0 so it remains visible to operators rather than silently disappearing.

Also fix wall-clock rot in tests/test_plan_check.py, which was already failing
at clean HEAD: three tests pinned the compose date to a literal that has now
aged past STALE_DAYS.

Add workplan REUSE-WP-0020 covering the full cutover.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_federation.py

@@ -205,4 +205,81 @@ def test_compose_merges_remote_capabilities(tmp_path, monkeypatch):
 def test_load_production_manifest_still_validates():
     manifest = load_federation_manifest()
     assert manifest["domain"] == "helix_forge"
-    assert any(source["repo"] == "reuse-surface" for source in manifest["sources"])
+    assert any(source["repo"] == "reuse-surface" for source in manifest["sources"])
+
+def _compose_with_remote_body(body: str, tmp_path, monkeypatch):
+    """Compose with the remote member index serving `body` verbatim."""
+    monkeypatch.setattr("reuse_surface.federation.CACHE_DIR", tmp_path / "cache")
+    payload = body.encode("utf-8")
+
+    class FakeResponse:
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *args):
+            return False
+
+        def read(self):
+            return payload
+
+    with patch("urllib.request.urlopen", return_value=FakeResponse()):
+        return compose_federated_index(_remote_manifest())
+
+
+def _local_ids_survived(federated) -> bool:
+    return any(item["source_repo"] == "local" for item in federated["capabilities"])
+
+
+def test_compose_skips_capability_without_id(tmp_path, monkeypatch):
+    body = """
+version: 1
+domain: helix_forge
+capabilities:
+  - type: library
+    title: No id at all
+  - id: capability.remote.sample
+    name: Remote Sample
+"""
+    federated, warnings = _compose_with_remote_body(body, tmp_path, monkeypatch)
+    ids = {item["id"] for item in federated["capabilities"]}
+    assert "capability.remote.sample" in ids
+    assert _local_ids_survived(federated)
+    assert any("remote-repo" in w and "no id" in w for w in warnings)
+
+
+def test_compose_skips_non_mapping_index(tmp_path, monkeypatch):
+    federated, warnings = _compose_with_remote_body(
+        "just a string, not a mapping\n", tmp_path, monkeypatch
+    )
+    assert _local_ids_survived(federated)
+    assert any("not a mapping" in w for w in warnings)
+
+
+def test_compose_skips_empty_index(tmp_path, monkeypatch):
+    federated, warnings = _compose_with_remote_body("", tmp_path, monkeypatch)
+    assert _local_ids_survived(federated)
+    assert any("remote-repo" in w for w in warnings)
+
+
+def test_compose_skips_unparseable_index(tmp_path, monkeypatch):
+    federated, warnings = _compose_with_remote_body(
+        "capabilities: [unclosed\n", tmp_path, monkeypatch
+    )
+    assert _local_ids_survived(federated)
+    assert any("unparseable" in w for w in warnings)
+
+
+def test_compose_skips_capabilities_not_a_list(tmp_path, monkeypatch):
+    federated, warnings = _compose_with_remote_body(
+        "version: 1\ncapabilities: not-a-list\n", tmp_path, monkeypatch
+    )
+    assert _local_ids_survived(federated)
+    assert any("not a list" in w for w in warnings)
+
+
+def test_malformed_source_still_listed_with_zero_count(tmp_path, monkeypatch):
+    federated, _ = _compose_with_remote_body(
+        "just a string, not a mapping\n", tmp_path, monkeypatch
+    )
+    remote = next(s for s in federated["sources"] if s["repo"] == "remote-repo")
+    assert remote["count"] == 0