feat(rees): add performance guardrails and telemetry

[JSONbored]

Summary

• Fixes feat(rees): add performance guardrails and regression telemetry #1814.
• Adds safe REES response telemetry for analyzer timing/status, cache/external-call counters, and profile budget context.
• Adds request guardrails that reject oversized or malformed enrichment payloads before analyzer execution.

What changed

• Added per-request telemetry to ReviewBrief with profile, reserve budget, requested analyzer counts, per-analyzer timing/status, cache hit rate, external endpoint counts, skipped work, and capped work counters.
• Added profile, cost, and response reserve fields to analyzer Sentry context and tags.
• Added parseEnrichRequestBody guardrails for raw body size, file count, diff and patch sizes, analyzer list shape, repo slug, and PR number.
• Switched /v1/enrich to validate the raw request body before calling buildBrief.
• Added guardrail, telemetry, and Sentry context regression tests.

Why

A REES failure needs to show whether the request was too large, which analyzer consumed budget, which cost/profile path it used, and whether work was skipped, capped, timed out, or degraded, without logging request bodies, diffs, tokens, comments, prompts, or private config.

Validation

• npm --prefix review-enrichment test
• npx vitest run test/unit/enrichment-wire.test.ts test/unit/enrichment-wiring.test.ts
• npm run typecheck
• git diff --check

Notes

• Stacked on feat(rees): generate analyzer config metadata #1835 because telemetry uses the scheduler/profile metadata introduced earlier in the REES hardening sequence.

[superagent-security]

Superagent found 2 security concern(s).

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-06-30 06:56:50 UTC}

9 files · 1 AI reviewer · no blockers · readiness 75/100 · CI pending · clean

⏸️ Suggested Action - Manual Review

Review summary
The change adds a streaming request-size guard, shallow payload validation, and public-safe analyzer telemetry across the REES brief and Sentry degradation path. The main guardrail path is wired correctly in `server.ts` through `readEnrichRequestText` before parsing, so the visible diff does not have the buffered-body defect flagged by the external CI note. The remaining concern is that the validator only checks the fields it needs for routing and size limits; several optional fields that downstream analyzers may consume are still trusted after the cast.

Nits — 6 non-blocking

• nit: `review-enrichment/src/request-guardrails.ts:67` only validates `repoFullName`, `prNumber`, `files`, `diff`, and `analyzers`; add defensive validation for optional structured fields such as `budget`, `profile`, and `linkedIssue` before casting the parsed object to `EnrichRequest`.
• nit: `review-enrichment/src/request-guardrails.ts:102` accepts empty analyzer names because `entry.length <= 80` permits `""`; reject blank strings here so explicit analyzer lists cannot carry no-op entries downstream.
• nit: `review-enrichment/src/request-guardrails.ts:118` validates `previousPath` type but not its length, so rename metadata can bypass the same path-size guard applied to `path`.
• nit: `review-enrichment/src/brief.ts:137` intentionally collapses unsafe partial reasons to generic values; consider documenting that contract near `PUBLIC_PARTIAL_REASON_RE` because analyzer authors may expect their public-safe reason strings to survive unchanged.
• Tighten `parseEnrichRequestBody` with small validators for `budget.timeoutMs`, `budget.maxBriefChars`, `profile`, and `linkedIssue.number/title/body` so the runtime request contract matches `EnrichRequest` instead of relying on a shallow cast.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#1814
Related work	⚠️ 3 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (size label size:L; 1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 2 registered-repo PR(s), 2 merged, 273 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 2 PR(s), 273 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 2 PR(s), 273 issue(s).
• Related work: Items reference the same linked issue feat(rees): add performance guardrails and regression telemetry #1814. (issue #1814)
• Related work: Open PR work references issue feat(rees): add performance guardrails and regression telemetry #1814. (issue #1814)
• Related work: Items reference the same linked issue feat(rees): generate analyzer config and self-host profiles #1813. (issue #1813, PR #1835)
• Additional title-only matches omitted; title-only overlap does not block.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Review top overlaps.
• Add a concise scope and risk note.
• Triage stale or unlinked PRs.
• No action.
• Check active issues and PRs before submitting.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review