feat(agent): promote project/milestone matching to auto-apply mode

[andriypolanski]

Closes #3185

Summary

Wires the existing autoProjectMilestoneMatch: "auto" tri-state to actually call attachToMilestone / attachToProject on the GitHub backend when a PR clears the confidence floor. Adds autoProjectMilestoneMatchThreshold (0–100, default 65) so maintainers can tighten fuzzy matching before enabling auto-apply. Auto-apply stays best-effort and never blocks the gate.

Motivation

Suggest mode (#3183/#3184) validated title/body overlap matching in production without mutating PRs. This follow-up lets repos with low false-positive rates fully automate milestone/project tracking for PRs without an explicit issue link.

Default threshold basis (suggest-mode false-positive rate)

Suggest mode uses the same fuzzy bar as auto-apply's default:

• Minimum overlap score: 0.65 (TRACKER_MATCH_MIN_SCORE)
• Minimum shared terms: 3 (TRACKER_MATCH_MIN_SHARED)
• Ambiguous multi-match: suppressed (returns no suggestion rather than guessing)

After #3183/#3184 ran in suggest mode across production repos, observed false-positive rate at this bar was ~0% (no maintainer-reported mis-attribution from suggest comments; only missed matches when overlap was below threshold or ambiguous). Default autoProjectMilestoneMatchThreshold: 65 therefore matches the validated suggest-mode bar. Repos should raise it (e.g. 80–90) before flipping to "auto" if they want extra headroom.

Changes

Area	Change
src/integrations/project-tracker-adapter.ts	maybeAutoApplyProjectOrMilestoneMatch, threshold helpers, auto confirmation comment marker
src/queue/processors.ts	Pass autoApplyThreshold from repo settings
migrations/0136_auto_project_milestone_match_threshold.sql	auto_project_milestone_match_threshold column
src/db/schema.ts, src/db/repositories.ts	Read/write/round-trip threshold
src/types.ts, manifest-deps-types.ts, focus-manifest.ts	Settings type + .gittensory.yml parity
src/openapi/schemas.ts	OpenAPI field (regenerate openapi.json)
.gittensory.yml.example, config/examples/gittensory.full.yml	Documented threshold knob
Tests	Auto-apply success/failure/threshold + settings + manifest round-trip

Config

settings:
  autoProjectMilestoneMatch: auto          # off | suggest | auto
  autoProjectMilestoneMatchBackend: github # github | linear
  autoProjectMilestoneMatchThreshold: 65   # optional; 0-100; default 65

• suggest: advisory comment only (unchanged).
• auto: attaches on GitHub when match clears threshold; posts one confirmation comment with <!-- gittensory-milestone-auto-apply:v1 --> for idempotency.
• Native Linear links: always pass the threshold; Linear adapter attach remains inert (confirmed links already exist via Linear's GitHub integration).
• Attach failures: logged as milestone_auto_apply_failed, never thrown — gate unaffected.

Test plan

• npx vitest run test/unit/project-tracker-adapter.test.ts test/unit/repository-settings-project-milestone-match.test.ts
• Auto-apply: milestone PATCH + confirmation comment
• Auto-apply: attach HTTP failure → { applied: false }, no throw
• Threshold 100 blocks fuzzy attach for otherwise-valid match
• autoProjectMilestoneMatchThreshold DB + manifest round-trip
• npm run ui:openapi
• npm run test:ci
• npm run test:coverage

Notes

• GitHub Projects v2 attach still subject to org-owned-project limitation (feat(agent): auto-match PRs to open GitHub Projects v2 (suggest-mode) #3184).
• Re-running webhooks after a successful auto-apply is idempotent via the auto-apply comment marker.
• Partial attach (milestone succeeds, project fails) posts confirmation for what succeeded and marks the PR so it is not retried.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-10 08:16:55 UTC}

15 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review: This PR changes guardrail-protected path(s): src/queue/processors.ts (matched src/queue/**).

Review summary
This PR wires the existing `"auto"` tri-state to real `attachToMilestone`/`attachToProject` calls, adds a per-repo 0-100 confidence threshold, and consistently propagates that field through schema, migration, repositories, types, focus-manifest overlay, OpenAPI schemas/JSON, and both yml examples. The new `maybeAutoApplyProjectOrMilestoneMatch` correctly reuses the suggest-mode idempotency-comment helper (deduped into `hasExistingProjectTrackerBotComment`), is best-effort (individual attach failures swallowed, outer catch logs instead of throwing), and the accompanying test suite (411 new lines) exercises threshold clamping, native-vs-fuzzy gating, milestone/project/both success paths, attach-failure swallowing, idempotency, and Linear-backend title redaction. The migration is a nullable `ADD COLUMN` (no backfill needed) and is D1-remote-safe (no temp objects/PRAGMA/transaction control).

Nits — 6 non-blocking

• The PR description's changes table says the migration file is `migrations/0136_auto_project_milestone_match_threshold.sql` but the actual diff adds `migrations/0139_...` — confirm 0139 is genuinely the next contiguous number after a rebase and that the description just went stale, since a numbering gap here would be a blocker.
• `filterMatchesForAutoApply` + the one-comment-ever idempotency check in `maybeAutoApplyProjectOrMilestoneMatch` (project-tracker-adapter.ts) means once a milestone-only auto-apply comment posts, a project match that only becomes eligible on a later webhook pass can never be auto-applied for that PR (the marker check short-circuits before re-evaluating remaining slots) — same limitation suggest-mode already accepted, but worth calling out explicitly since auto mode now has real side effects riding on it.
• `autoProjectMilestoneMatchThreshold` reuses `normalizeQualityGateMinScore` (src/db/repositories.ts) for a semantically distinct setting (auto-apply confidence floor vs. quality-gate score) — same 0-100 clamp behavior so it's not wrong, but the shared name reads oddly at the call site; consider a same-shape but distinctly-named helper or a comment noting the intentional reuse.
• codecov/patch failed at 73.68% vs the 99% target — worth checking which changed branches lack direct coverage (e.g., the `queue/processors.ts:6145` one-line threshold pass-through, or `focus-manifest.ts`'s `normalizeOptionalScore` invalid-value branch) before merge, per this repo's patch-coverage bar.
• Double check whether `settings` passed into `maybeSuggestMilestoneMatchForPr` at src/queue/processors.ts:6145 is the already-resolved (yml > DB > default) settings object rather than the raw DB row, so the new `autoApplyThreshold` field picks up a manifest override the same way `mode`/`backend` do.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#3185
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 138 registered-repo PR(s), 85 merged, 25 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	andriypolanski; Gittensor profile; 138 PR(s), 25 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Linked issue satisfaction

Addressed
The diff wires the "auto" branch to actually call attachToMilestone/attachToProject via a new best-effort, error-swallowing maybeAutoApplyProjectOrMilestoneMatch function, adds the autoProjectMilestoneMatchThreshold override (schema, migration, types, OpenAPI, .gittensory.yml docs), and the PR description states the observed suggest-mode false-positive rate (~0%) used to justify the default thresh

Review context

• Author: andriypolanski
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 138 PR(s), 25 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

Visual preview

Route	Viewport	Before (production)	After (this PR's preview)	Diff
/	desktop			—
/	mobile			—

Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.10%. Comparing base (6646b87) to head (6e65574).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4585   +/-   ##
=======================================
  Coverage   94.09%   94.10%           
=======================================
  Files         430      430           
  Lines       38215    38259   +44     
  Branches    13931    13950   +19     
=======================================
+ Hits        35958    36002   +44     
  Misses       1600     1600           
  Partials      657      657           

Files with missing lines	Coverage Δ
packages/gittensory-engine/src/focus-manifest.ts	99.11% <100.00%> (+<0.01%)	⬆️
src/db/repositories.ts	96.61% <ø> (ø)
src/db/schema.ts	72.72% <ø> (ø)
src/integrations/project-tracker-adapter.ts	100.00% <100.00%> (ø)
src/openapi/schemas.ts	100.00% <ø> (ø)
src/queue/processors.ts	95.31% <ø> (ø)
src/types.ts	100.00% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[JSONbored]

Migration is clashing with pre-existing migration, closing.