feat(enrichment): commit-signature / verified-author provenance analyzer

[GildardoDev]

What

A new REES (review-enrichment service) analyzer that flags head-commit signature and author-provenance risks the no-checkout reviewer cannot derive: an unsigned or unverified-signature head commit, an author/committer login mismatch, and a never-before-seen committer whose login has no verified history in a repo that otherwise carries verified commits. These are supply-chain and impersonation signals.

Data source

GitHub REST. It reads commit.verification.{verified, reason} and the author/committer login from GET /repos/{owner}/{repo}/commits/{headSha}, and establishes the new-committer-vs-verified-history signal with at most two bounded GET /commits?per_page=30 queries (author-filtered, then repo-wide). The output is public-safe: only GitHub's verified boolean, its reason string, boolean provenance flags, and the public commit-author login GitHub already shows on the PR. No tokens, emails, local paths, or private signals.

Behavior

Additive and fail-safe: it never throws, and returns no finding on a missing token or head SHA, an unresolvable repo slug, or any fetch error. A clean verified head with a matching author and no new-committer signal produces no finding. It follows the established analyzer pattern entirely within review-enrichment/ (finding type in types.ts, a pure analyzer with injected fetch in analyzers/commit-signature.ts, registration in brief.ts, a public-safe block in render.ts), outside the engine scope.

Tests

12 node:test cases with a mocked fetch cover verified and unverified heads, the reason passthrough, the author/committer mismatch, the new-committer-vs-verified-history signal, the fail-safe paths (no token, bad slug, fetch error), and a public-safe render assertion (no token prefixes, no emails). Full suite: rees build clean, 167 of 167 tests pass.

Closes #1517

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-06-29 22:14:27 UTC}

5 files · 1 AI reviewer · no blockers · readiness 55/100 · CI green · dirty

⏸️ Suggested Action - Manual Review

Review summary
The change adds a bounded GitHub-backed enrichment analyzer, wires it into the REES analyzer registry, and renders a public-safe provenance block. The fail-safe behavior, slug validation, token handling, and rendering sanitization are coherent in the visible code. The most notable implementation choice is that the history signal is intentionally shallow and best-effort, so it can miss cases but should not break existing brief generation.

Nits — 6 non-blocking

• nit: `review-enrichment/src/analyzers/commit-signature.ts:113` names the signal `newCommitter` but computes history from `authorLogin`, so rename the field/comment or switch the lookup to `committerLogin` to keep the contract unambiguous.
• nit: `review-enrichment/src/analyzers/commit-signature.ts:74` treats an empty author-filtered history page as definitive `false`; confirm that this is acceptable for private/fork/head-only commit visibility because the signal can become dependent on GitHub list-commits scope rather than prior repo history alone.
• nit: `review-enrichment/test/commit-signature.test.ts:64` does not cover the verified-head/new-author case, which is the edge most likely to expose whether the history query should exclude the head commit or use author versus committer identity.
• In `review-enrichment/src/analyzers/commit-signature.ts`, align `newCommitter` naming and type docs with the actual login used, or use `committerLogin` for the history query if the intended signal is truly committer provenance.
• Add a focused test in `review-enrichment/test/commit-signature.test.ts` for a verified head where the actor has no verified history but the repo does, so the analyzer's intended provenance semantics are locked down.
• Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#1517
Related work	⚠️ 3 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (size label size:L; 1 linked issue).
Validation posture	❌ 5/25	Preflight is holding this PR; address the blocker before review.
Contributor workload	✅ 10/10	Author activity: 82 registered-repo PR(s), 52 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	GildardoDev; Gittensor profile; 82 PR(s), 0 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: GildardoDev
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: JavaScript, MDX, Python, Rust
• Official Gittensor activity: 82 PR(s), 0 issue(s).
• Related work: Items reference the same linked issue feat(enrichment): Commit-signature / verified-author provenance #1517. (issue #1517)
• Related work: Open PR work references issue feat(enrichment): Commit-signature / verified-author provenance #1517. (issue #1517)
• Related work: Titles/paths share 6 meaningful terms. (PR #1751)
• Additional title-only matches omitted; title-only overlap does not block.

Contributor next steps

• Review top overlaps.
• Add a concise scope and risk note.
• Fix the blocker.
• Triage stale or unlinked PRs.
• Refresh registry data or choose a registered active repo.
• Check active issues and PRs before submitting.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[JSONbored]

Another feat(enrichment) (REES analyzer) was merged before yours, so there are merge conflicts.

This branch has conflicts that must be resolved
Use the [web editor](https://github.com/JSONbored/gittensory/pull/1764/conflicts) or the command line to resolve conflicts before continuing.

review-enrichment/src/brief.ts
review-enrichment/src/render.ts
review-enrichment/src/types.ts

I'd really recommend being careful submitting these, I wouldn't open a PR until you see no other PRs for this are open/awaiting review, as they all touch the same files and as such, bring a very high likelihood for merge conflicts.

Closing.