perf(rees): share analyzer request context

[JSONbored]

Summary

• Adds a request-scoped REES analysis context for shared parsed PR state, request caches, and safe metrics.
• Migrates representative local and external analyzers onto the new substrate.

What changed

• Parses changed files, paths, added lines, patch hunks, file categories, repo identity, and dependency manifest changes once per enrichment request.
• Adds request-scoped in-flight de-duplication for identical external lookups through cachedExternalCall.
• Migrates secret to shared added-line parsing and dependency to shared dependency parsing plus cached OSV calls.
• Adds aggregate cache/external/skipped/capped-work metrics to safe Sentry analyzer-degradation context.
• Documents the shared context contract for future analyzer work.

Why

• Reduces repeated parsing and duplicate package lookups inside a single REES run.
• Gives future analyzers a stable modular boundary for shared inputs, bounded fanout, and diagnostics without changing the public ReviewBrief response shape.

Validation

• git diff --check
• npm --prefix review-enrichment test (234 tests passed)
• npm run test:ci (passed; existing UI fast-refresh lint warnings remained warnings)
• npm audit --audit-level=moderate (0 vulnerabilities)

Notes

• Stacked on refactor(rees): add modular analyzer manifests #1815 because refactor(rees): add modular analyzer manifests #1815 is still open; retarget this PR to main after refactor(rees): add modular analyzer manifests #1815 lands.
• Closes perf(rees): add shared analysis context and request caches #1810.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review result - approve/merge recommended

_{Review updated: 2026-06-30 06:45:11 UTC}

12 files · 1 AI reviewer · no blockers · readiness 75/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This change adds a shared request-scoped analysis context and migrates the secret and dependency analyzers onto it. The visible wiring is coherent: `buildBrief` constructs the context once, passes it through `AnalyzerRunContext`, and the migrated analyzers preserve their existing parsing/scan behavior while adding request-local cache metrics. The notable detail is that the cache key implementation already uses JSON tuple encoding, so the cited delimiter-collision concern is not present in the post-change file.

Nits — 7 non-blocking

• nit: `review-enrichment/test/analysis-context.test.ts` includes a synthetic high-confidence token-shaped string, which predictably trips the repository's own secret detector even though it is test data; use a non-matching fixture helper or assemble the regex boundary differently.
• nit: `review-enrichment/src/analysis-context.ts:117` sanitizes cache categories before keying, so two distinct raw categories that normalize to the same metric category intentionally share cache entries; document that categories must be stable metric identifiers or key on the raw category and sanitize only metrics.
• nit: `review-enrichment/src/brief.ts:148` builds `AnalysisContext` even when no requested analyzer currently consumes it, which is acceptable for now but worth watching as more parsing gets added to the constructor.
• Change the token-shaped fixture in `review-enrichment/test/analysis-context.test.ts` so test coverage does not require suppressing the same detector this service is meant to enforce.
• In `review-enrichment/src/analysis-context.ts:117`, either key the request cache with the raw category or add a short comment stating that cache categories are canonical metric categories and may be normalized.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.
• Pull request duplicates other open work — Check for an existing pull request or issue covering this change and coordinate or consolidate before continuing.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#1810
Related work	⚠️ 3 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (size label size:XL; 1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 2 registered-repo PR(s), 2 merged, 273 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 2 PR(s), 273 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: Python, TypeScript, JavaScript, Ruby, Go, Kotlin, MDX, Shell
• Official Gittensor activity: 2 PR(s), 273 issue(s).
• Related work: Items reference the same linked issue perf(rees): add shared analysis context and request caches #1810. (issue #1810)
• Related work: Titles/paths share 6 meaningful terms. (PR #1833)
• Related work: Open PR work references issue perf(rees): add shared analysis context and request caches #1810. (issue #1810)
• Additional title-only matches omitted; title-only overlap does not block.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Review top overlaps.
• Add a concise scope and risk note.
• Triage stale or unlinked PRs.
• No action.
• Check active issues and PRs before submitting.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	edea2d5	Commit Preview URL Branch Preview URL	Jun 30 2026, 06:33 AM