github-backup: drainer needs an owner allowlist — public App admits foreign installs #3326

Problem

The backup GitHub App developing-today-backup (ID 5562183) was made public on 2026-10-31 — GitHub does not allow a private App to be installed by organizations, and org installs were a hard requirement. A side effect: anyone can now install the App on their own repositories.

Their webhook deliveries verify against the App secret (it is genuinely our App), reach the Worker queue, and bin/drain_queue.py currently acts on any queued event whose repo appears in plan.json — and files fetch attempts / state for anything else it is handed. A foreign install could make the laptop drainer clone/fetch strangers' repositories into ~/backups/github, burning disk, bandwidth, and the App installation rate limit, and polluting the backup tree.

Fix

Drop foreign events at the drainer door, before any fetch work:

• Determine each queued event's owner (repository.owner.login; fall back to the installation account login where the payload carries it; the queued repo full_name carries the owner for Worker-flattened events).
• Allowed set = owners in infra/github-backup/config.json (the same set reconcile plans from). Case-insensitive compare.
• Foreign owner (or owner not determinable — malformed event): DROP — ack it as handled-by-policy (never retried, never counted toward the github-backup(drain): webhook events are acked even when the fetch failed or the mirror is missing — freshness signal silently dropped #3219 DRAIN-CHRONIC failure streak), log one loud greppable line DRAIN-DROP foreign owner=<login> repo=<full_name> delivery=<id>, and count drops in the run summary.
• Allowed-owner behavior is unchanged, including the github-backup(drain): webhook events are acked even when the fetch failed or the mirror is missing — freshness signal silently dropped #3219/github-backup(inventory): a null repositoryOwner is silently read as 'this owner has no repos' — reconcile drops the owner's mirrors from plan.json and MANIFEST.json and exits 0 #3229 ack semantics.

Tests

Extend tests/test_drain_queue.py: allowed owner proceeds exactly as today; foreign owner dropped + acked + logged (even if the repo is in plan.json); missing-owner payload dropped; repository-owner precedence over installation account; #3219 failure semantics unchanged for allowed owners.

Deploy / proof

Merge → pull on the laptop primary → just github-backup-units → one drain run Result=success → hand-inject one foreign event through the Worker and show the DRAIN-DROP line with no clone attempted.

Refs #3215 (system issue). Approved by Drew 2026-10-31 23:08 CDT.