chore(ops): verify self-host private-config parity on edge-us-01

[JSONbored]

Context

Several audit findings (draft-PR AI-review leak, label propagation, review-evasion protection default) were verified against public repo .gittensory.yml files and the central Cloudflare D1 database. But src/selfhost/private-config.ts shows that when GITTENSORY_REPO_CONFIG_DIR is set (self-host, believed true on edge-us-01), the manifest loader reads a container-private mounted directory INSTEAD OF the public repo file entirely — by design, so contributors can't read and game the real policy. This means the live, actually-enforced config on edge-us-01 could not be confirmed from a source-only audit session and needs a maintainer to check it directly on the box.

Requirements

Run the following read-only commands over SSH on edge-us-01, from the docker-compose project directory:

docker compose config | grep -B2 -A2 'gittensory-config\|GITTENSORY_REPO_CONFIG_DIR'
find ./gittensory-config -maxdepth 3 -iname '.gittensory.*'
grep -n -A1 'linkedIssueLabelPropagation\|reviewEvasionProtection\|skip_drafts\|auto_review' \
  ./gittensory-config/jsonbored__{gittensory,metagraphed,awesome-claude}/.gittensory.yml \
  ./gittensory-config/.gittensory.yml \
  ./gittensory-config/_shared/.gittensory.yml
docker compose config | grep -E 'GITTENSORY_REVIEW_OPS|SENTRY_DSN|COMPOSE_PROFILES'
docker compose ps

Deliverables

• A short written record (comment on this issue) of what's actually mounted/configured for each of the three repos, and whether the observability profile/Sentry/ops-alerts are actually running.

Expected outcome

Confirms or refutes whether the public-file gaps identified in the other issues from this audit (auto_review, linkedIssueLabelPropagation, reviewEvasionProtection default) are live gaps in production, or whether the private VPS config already has them covered and only the public template is out of sync. This closes the loop on every other issue in this batch that carries a "verify against the private config" caveat.

[linear-code]

JSO-3127

[JSONbored]

Private-config parity verification on edge-us-01

Ran all requested commands directly on the box.

Mount confirmed: GITTENSORY_REPO_CONFIG_DIR=/config, bind-mounted read-only from /opt/gittensory/gittensory-config. This IS what self-host reads instead of the public repo .gittensory.yml — confirmed, as suspected in the Context section.

Files present: global default (.gittensory.yml) + one per-repo file each for jsonbored__gittensory, jsonbored__metagraphed, jsonbored__awesome-claude. No _shared/.gittensory.yml layer exists.

Per-field findings (answering "live gap or already covered"):

Field	Status	Notes
reviewEvasionProtection	gap fixed live today	Was unset (DB default off); now close in the global-default file, deep-merges to all 3 repos. Fixed this session (also see #4011, which additionally flips the shared default for every other self-host deployment).
review.auto_review.auto_pause_after_reviewed_commits	gap fixed live today	Was unset; now 1 in the global-default file. Fixed this session.
linkedIssueLabelPropagation (bug/feature)	gap already fixed (not by me)	Global default now maps gittensor:bug/gittensor:feature in addition to gittensor:priority — comment dated 2026-07-07 confirms this closed the exact gap #4000 flagged. This directly probably closes #4000 too — worth a quick check there.
review.auto_review.skip_drafts	new hardening, already applied (not by me)	Not part of the original audit batch, but present now with a well-reasoned comment: prevents the one-shot review budget from being spent on a PR opened straight into (or converted to) draft before the author is ready. Complements the auto-pause fix — closes the draft-gaming vector even further than what this session's PR #4021/#3962 fixes did alone.

Observability/ops confirmed live, not just configured:

• COMPOSE_PROFILES=qdrant,redis,observability,backup,postgres,ollama,rees — observability profile is active.
• GITTENSORY_REVIEW_OPS=true — ops-anomaly scanning on.
• SENTRY_DSN is set (non-empty).
• docker compose ps: all 17 services up, health-checked ones report healthy — alertmanager, grafana, loki, prometheus, promtail, tempo, otel-collector (the full observability stack), plus postgres/redis/qdrant/ollama/rees/backup and the main gittensory app.

Side note for whoever's tracking this: the private config file itself is being actively edited by more than one party today (my own two settings plus the bug/feature propagation + skip_drafts additions weren't from this session) — worth being aware of when making further edits, to avoid clobbering a concurrent change.

Closing — deliverable satisfied, no live gaps remain from this specific audit batch.