Execution: enforce Cloud Tasks authentication before payload validation (PR #1132)

[groupthinking]

Parent program: #898

Objective

Bind and verify the existing Cloud Tasks validation-order repair without creating a competing implementation. Unauthorized malformed calls to /api/v3/process-video-task must return 403 before request-body validation; authorized malformed calls must retain strict 422 validation; authorized valid calls must preserve existing behavior.

Acceptance criteria

• Authentication gate executes before payload parsing.
• Unauthorized malformed payload is covered and returns 403.
• Authorized malformed payload is covered and returns 422.
• Required exact-head CI, Coverage, CodeQL, Security, Secret Scan, and Dependency Review pass; repository E2E is skipped.
• Exact-head Vercel preview is READY.
• Zero unresolved substantive review threads.
• PR remains draft until the repository truth gate is terminal.

Declared file scope

• src/youtube_extension/backend/cloud_api_endpoints.py
• tests/unit/test_cloud_routes.py

Focused test paths

• tests/unit/test_cloud_routes.py

Canonical implementation

• PR: fix(cloud): authenticate task requests before payload validation (#1134) #1132
• Branch: copilot/fix-payload-parameter-issue
• Adopted exact head: 5746ba2387498b53b347dde630a1efe41323781e
• No competing implementation was found.

Agent login

groupthinking

Agent run ID

eventrelay-daily-control-20260731-1317z

Claimed timestamp

2026-07-31T13:22:24Z

Latest heartbeat

2026-07-31T13:25:30Z

Current gate state

The implementation predates this focused issue. The rebound truth-gate attempt 30618812433 resolved the issue-number defect but still rejects the missing issue-side agent policy fields. This issue adds those required fields. Any remaining requirement that the intent snapshot predate the PR is a legitimate non-retroactive provenance blocker and must remain fail-closed; it must not be fabricated or bypassed.

No production mutation or merge is authorized by this issue.

[linear-code]

GRV-198

[github-actions]

👋 Thanks for opening this issue! It has been automatically labeled for triage.

[groupthinking]

Execution receipt — focused unit adopted

• Agent login: groupthinking
• Run ID: eventrelay-daily-control-20260731-1317z
• Canonical branch/PR: copilot/fix-payload-parameter-issue / fix(cloud): authenticate task requests before payload validation (#1134) #1132
• Claimed: 2026-07-31T13:22:24Z
• Latest heartbeat: 2026-07-31T13:23:30Z
• Exact head: 5746ba2387498b53b347dde630a1efe41323781e

Copilot authored the existing two-file implementation. This control pass adopted that exact artifact, bound it to #1134, and verified CI, Coverage, CodeQL, Security, Secret Scan, Dependency Review, zero unresolved threads, current-head approval, and READY preview dpl_DEMZ8GhpYWqRWygt4r3YbCMF8xBH. No code, branch history, production state, or merge state changed. The PR remains draft pending terminal truth-gate evidence.