feat(review): one-shot AI review cadence, configurable globally + per repo

[JSONbored]

Summary

• AI-generated review content (main review, slop advisory, linked-issue satisfaction) now freezes after its first pass by default — no further automatic synchronize/CI-completion/sweep trigger spends a fresh AI call for that content, only an explicit maintainer retrigger (the PR-panel checkbox or @gittensory review as a maintainer) does. Root-caused a real production leak where a draft PR and a couple of long-lived non-draft PRs burned $6-$76 in repeat AI spend from automatic re-triggers that never should have re-run.
• Configurable both globally (new GITTENSORY_REVIEW_CONTINUOUS fleet-wide env default) and per repo (review.auto_review.cadence in .gittensory.yml, wins in either direction over the fleet default), so self-hosters who prefer the traditional re-review-on-every-push behavior can opt back in per repo or fleet-wide.
• The deterministic gate (CI status, mergeability, static-rule blockers) is completely unaffected — it always re-evaluates on every pass regardless of cadence, so a PR that fixes its CI failure is still correctly recognized as mergeable.
• Config-as-code only (no new DB column/migration/dashboard route): the new cadence field sits directly in the existing AutoReviewConfig/review.auto_review manifest block, alongside skipDrafts — the exact same shape, same nullable-inherits-fleet-default semantics.
• Slop and linked-issue-satisfaction get their own independent "already had a pass" existence checks (not a single unified marker), so a repo that enables one of these features later still gets that feature's own legitimate first pass, and a PR whose linked issue changes still gets a fresh assessment for the new issue.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Fixes #4636

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

Also ran the complete npm run test:ci chain (all jobs) twice from a freshly rebased origin/main, fully green: 13,479 tests passed, 0 failed. Manually cross-referenced coverage/lcov.info against the exact diff hunks for every changed line in src/queue/processors.ts and src/db/repositories.ts — the two new DB existence-check functions are 100% line+branch covered; the handful of remaining zero-hit lines in processors.ts are .catch(() => fallback) fail-safe arrow-function bodies that never reject in tests, the identical pre-existing pattern already used (and accepted) by the unmodified frozen-reuse/paused-reuse audit events immediately above my new code in the same function — verified this directly by comparing hit counts on both.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed. (No OpenAPI/dashboard surface — this is config-as-code only, see Summary.)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots — see note below.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence note: the only UI-adjacent changes are two new <li> bullet entries on the existing docs.tuning.tsx/docs.privacy-security.tsx documentation pages, describing the new env var and manifest field — plain text using the exact same pre-existing <li><code>…</code> — description</li> / plain-code-block patterns already used by 15+ sibling entries on the same pages (no new component, layout, or styling). Verified the rendered output via an accessibility-tree snapshot of the live dev server (correct structure, correct text) and a clean ui:build/ui:typecheck/ui:lint; the screenshot capture tool hit a resource-contention issue in this session (this branch also ran the full test:ci suite twice back to back) and I didn't want to block the PR chasing that further for a pure-text change with no visual risk.

Notes

• Design note on why this is config-as-code only, not a DB/dashboard field: AutoReviewConfig (the review.auto_review manifest block housing the existing skipDrafts, ignoreAuthors, autoPauseAfterReviewedCommits, etc.) is already a manifest-only, no-DB-backing structure — cadence is a direct sibling field in that same block, reusing its existing parse/overlay/round-trip machinery end-to-end rather than inventing new DB schema, OpenAPI schema, or a dashboard route for a single enum toggle.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	a6b84b9	Commit Preview URL Branch Preview URL	Jul 10 2026, 10:23 AM

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.12%. Comparing base (450e314) to head (a6b84b9).
⚠️ Report is 4 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4657   +/-   ##
=======================================
  Coverage   94.12%   94.12%           
=======================================
  Files         434      434           
  Lines       38496    38525   +29     
  Branches    14038    14048   +10     
=======================================
+ Hits        36233    36262   +29     
  Misses       1604     1604           
  Partials      659      659           

Files with missing lines	Coverage Δ
packages/gittensory-engine/src/focus-manifest.ts	99.11% <100.00%> (+<0.01%)	⬆️
src/db/repositories.ts	96.62% <100.00%> (+<0.01%)	⬆️
src/queue/processors.ts	95.29% <100.00%> (+0.03%)	⬆️
src/signals/focus-manifest.ts	99.64% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Caution

🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥

🛑 Gittensory review result - fixes required

_{Review updated: 2026-07-10 10:15:10 UTC}

16 files · 1 AI reviewer · no blockers · readiness 100/100 · CI failing · unstable

🛑 Suggested Action - Manual Review

• Touches a guarded path — held for manual review: This PR changes guardrail-protected path(s): src/queue/processors.ts (matched src/queue/**), wrangler.jsonc (matched wrangler.jsonc), wrangler.jsonc (matched **/wrangler.jsonc).

Review summary
This PR adds a well-designed, config-driven one-shot AI review cadence (global env var + per-repo yml override, correctly overlaid via pickOverlayNullable) that suppresses repeat automatic AI spend on main review, slop advisory, and linked-issue satisfaction, while leaving the deterministic gate untouched and preserving an explicit maintainer-retrigger bypass. The three skip/reuse sites (processors.ts) are each guarded correctly — first-pass-never-blocked, per-issue-number scoping for linked issues, fail-open on DB errors — and are covered by a thorough new test suite exercising both defaults and the per-repo/env override in both directions. Two soft issues stand out: codecov/patch failed at 81.81% against this repo's 99% target, and there is no confirmed link to an eligible open issue for this PR (external history check reports only partial coverage of #4636), which this repo's contribution policy requires to close before merge.

Nits — 7 non-blocking

• src/queue/processors.ts (linked-issue skip site): `primaryLinkedIssueNumber !== undefined` is unreachable given the enclosing `pr.linkedIssues.length > 0` guard — if this is only a TS noUncheckedIndexedAccess artifact, fine, but say so in the comment; otherwise it's dead code padding the branch count.
• src/queue/processors.ts (main-review reuse): the `oneShotPriorReview && hasPublicReviewAssessment(...)` false arm (a one-shot prior review row exists but lacks a public assessment) is untested — worth a test pinning that this PR then shows no review at all until a manual retrigger, since that's a real, if inherited, behavior gap.
• The 81.81%/99% patch-coverage gap (codecov/patch FAILED) likely traces to the two branches above plus the several `?? null` v8-ignored fallbacks — worth a quick pass to close before merge given this repo's coverage bar.
• Confirm this PR closes or links an eligible open issue per repo contribution policy (external history shows only partial linkage to feat(review): one-shot AI review cadence, configurable globally + per-repo #4636) before treating it as merge-ready.
• Consider unifying the slop/linked-issue 'existence' audit events with the main-review reuse audit event naming (`*_one_shot_skip` vs `*_one_shot_reuse`) into a short shared helper — three near-identical `recordAuditEvent(...).catch(() => undefined)` blocks with the same `headSha ?? null` v8-ignore comment repeated verbatim is a DRY opportunity.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

CI checks failing

• codecov/patch — 81.81% of diff hit (target 99.00%)

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#4636
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 48 registered-repo PR(s), 40 merged, 330 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 48 PR(s), 330 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Linked issue satisfaction

Partially addressed
The PR implements the core one-shot cadence mechanism well (gates at all three AI dispatch sites, env var default, per-repo yml override, main-review SHA-independent reuse, new existence-check helpers for slop/linked-issue with silent skip, forceAiReview bypass, and substantial test coverage), but it explicitly deviates from the issue's stated scope by shipping the cadence field only in `.gittenso

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 48 PR(s), 330 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

Visual preview

Route	Viewport	Before (production)	After (this PR's preview)	Diff
/docs/privacy-security	desktop			—
/docs/privacy-security	mobile			—
/docs/tuning	desktop			—
/docs/tuning	mobile			—

Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.