refactor(marketplace): extract ref-propagation helpers from resolve_marketplace_plugin

[danielmeppiel]

Context

Follow-up deferred from the apm-review-panel on #1880 (python-architect lens).

#1880 adds registered---ref propagation logic inline in resolve_marketplace_plugin (GitHub canonical #ref suffix; GitLab DependencyReference injection; main/HEAD exclusion guards; dict-source non-overwrite guard). The logic is correct and tested, but the ref-resolution concern is now spread across the resolver and would read more clearly extracted into a shared, independently-testable helper.

Why deferred (not folded into #1880)

Architectural refactor beyond bug-fix scope. Tracked here so the panel verdict on #1880 carries no loose follow-up.

Suggested scope

• Extract the ref-propagation/exclusion/non-overwrite logic into a small shared utility used by both GitHub-family and GitLab paths.
• Behavior-preserving; the existing TestMarketplaceRegisteredRefPropagation suite should pass unchanged.

Source: panel recommendation on #1880

[github-actions]

Triage Verdict

Classification: type/refactor | theme/portability | area/marketplace
Priority: priority/low
Milestone: v0.23.0

Panel assessments

DevX UX Expert: Purely internal code-quality improvement with no user-facing impact. The inline ref-propagation logic is correct and tested (per #1880), so this is a bounded housekeeping task. No urgency, but worth completing before the marketplace resolver grows further and the logic becomes harder to trace.

Python Architect: Clear extraction candidate. The GitHub canonical #ref suffix logic, GitLab DependencyReference injection, main/HEAD exclusion guards, and dict-source non-overwrite guard can be moved to a small _resolve_ref() or _apply_ref_to_source() utility shared by both the GitHub-family and GitLab paths. The TestMarketplaceRegisteredRefPropagation suite acts as the regression harness. This is behavior-preserving with no API surface change.

Supply Chain Security Expert: Low security risk. The refactor must not change the ref-validation semantics -- specifically, the main/HEAD exclusion guards and the dict-source non-overwrite guard are security-adjacent (they prevent ref poisoning). Reviewers must verify those guards are preserved verbatim in the extracted helper.

APM CEO (arbiter): Accept. Bounded quality investment with a clear acceptance criterion (existing test suite passes unchanged). The extracted helper should be co-located in the marketplace resolver module, not buried in a deeply nested utility, so the security properties remain visible to future reviewers.

Suggested next action

Implement the extraction as described. The TestMarketplaceRegisteredRefPropagation suite is the acceptance gate. Add a brief docstring on the extracted helper naming the security properties it must preserve.

Labels applied

theme/portability area/marketplace priority/low status/triaged
(Note: type/refactor was already present and is retained.)

---

Triage status: agentic proposal pending human ratification.
Silence is approval. Maintainers can:

• Override any label or milestone above by editing it directly --
  human edits are authoritative and will not be reverted on
  subsequent runs.
• Re-trigger triage by applying the status/needs-triage label, or
  by removing status/triaged to enroll the issue in the next
  daily sweep.

Posted by the Triage Panel workflow. See .apm/skills/apm-triage-panel for the panel skill.

Generated by Triage Panel · 124.8 AIC · ⌖ 11.5 AIC · ⊞ 9.2K · ◷