Epic: config-as-code should fully control every review feature, not just restrict it

[JSONbored]

Motivation

Stated mandate: "Everything needs to be config as code - every aspect should be able to be controlled globally / per repo, and never required other than our core engine/whatever base defaults should be needed to run bare necessities." Env vars should be reserved for true bootstrap concerns — not for feature enablement, which should be fully controllable through .gittensory.yml (global default + per-repo override).

Corrected state (2026-07-08 — supersedes the 2026-07-07 survey, which had a methodology gap)

A shared per-feature config-as-code resolver already exists and is already proven in production: src/review/feature-activation.ts — resolveConvergedFeature/convergedFeatureActive, keyed by CONVERGED_FEATURE_KEYS in packages/gittensory-engine/src/focus-manifest.ts. Shipped in #1555, refined in #2386 (a repo-controlled features.safety: false override downgrades to "no opinion" rather than an active force-off, since .gittensory.yml is repo-writable and lower-trust than the operator). Precedence: env kill-switch (off ⇒ always off) → per-repo features: override (true/false) → GITTENSORY_REVIEW_REPOS allowlist default (byte-identical to today when unset). rag, reputation, unifiedComment, and safety are ALL already fully wired through it — confirmed by reading their actual call sites in src/queue/processors.ts and src/services/ai-review.ts, not just their own isXEnabled() definitions (the earlier survey's mistake — it checked only the latter and missed that the former already route through the resolver). The 5 sub-issues originally filed for this (#4094-#4098) are closed as already-resolved.

Confirmed still-needed work, now well-defined instead of speculative:

1. Not yet migrated onto the existing resolver at all (still raw isXEnabled(env) && isConvergenceRepoAllowed(env, repo), zero config-as-code surface): grounding (Add config-as-code coverage for the grounding feature #4100 — feature-activation.ts's own header comment already flags this as deferred, "coupled to the merge/close disposition path"), selftune (Add config-as-code coverage for the selftune feature #4104), parityAudit (Add config-as-code coverage for the parityAudit feature #4105).
2. Already read the manifest for the on/off decision, but only as a REQUIRED additional AND-gate (config can restrict, can't fully replace the env var — confirmed by direct code-check, not guesswork): inlineComments/fixHandoff (Upgrade inlineComments + fixHandoff from required-AND opt-in to full config-as-code substitutes #4099), reviewMemory (Investigate + close the config-as-code gap for reviewMemory #4101), impactMap (Investigate + close the config-as-code gap for impactMap #4102), cultureProfile (Investigate + close the config-as-code gap for cultureProfile #4103). All 5 need the same upgrade to the resolver's full precedence; Upgrade inlineComments + fixHandoff from required-AND opt-in to full config-as-code substitutes #4099 makes the namespace call (migrate into features: vs. keep the existing top-level field names) that the other 4 should follow for consistency.
3. Design questions, not known gaps: ops/sweep_watchdog/pr_reconciliation (Investigate + design config-as-code for ops / sweep_watchdog / pr_reconciliation #4106 — background jobs, is per-repo framing even meaningful?), GITTENSORY_REVIEW_DRAFT (Investigate + design config-as-code for the GITTENSORY_REVIEW_DRAFT public draft-submission flow #4107 — public API surface, may be legitimate bare-necessity).
4. Chore: remove the vestigial GITTENSORY_REVIEW_TEST_GENERATION declaration (chore: remove vestigial GITTENSORY_REVIEW_TEST_GENERATION env var declaration #4108) — testGeneration is already 100% config-driven (review.testGeneration, no env var involved at all), a genuinely-correct reference example alongside contentLane.

Already fully correct, no issue needed: testGeneration, contentLane, and now rag/reputation/unifiedComment/safety.

Goal

Every remaining converged review feature migrated onto the existing feature-activation.ts resolver (or, for #4106/#4107, an explicit reasoned decision that env-var-only is correct for that one). GITTENSORY_REVIEW_REPOS + the individual flags become convenience defaults, not hard requirements, for every feature where per-repo config genuinely makes sense.

Sub-issues

• Core: generic per-feature config-as-code resolver — closed, already existed (feature-activation.ts)
• Wire review.features.rag — closed, already wired
• Wire review.features.reputation — closed, already wired
• Wire review.features.unifiedComment — closed, already wired
• Wire review.features.safety — closed, already wired
• Upgrade inlineComments + fixHandoff from required-AND opt-in to full config-as-code substitutes #4099 — Upgrade inlineComments + fixHandoff from required-AND opt-in to full config-as-code substitutes — shipped in feat(review): upgrade inlineComments + fixHandoff to full config-as-code substitutes #4116
• Add config-as-code coverage for the grounding feature #4100 — Migrate grounding onto the existing resolver — shipped in feat(review): migrate grounding onto the per-repo feature-activation resolver #4117
• Investigate + close the config-as-code gap for reviewMemory #4101 — Migrate reviewMemory onto the existing resolver — closed not-planned after investigation
• Investigate + close the config-as-code gap for impactMap #4102 — Migrate impactMap onto the existing resolver — closed not-planned after investigation
• Investigate + close the config-as-code gap for cultureProfile #4103 — Migrate cultureProfile onto the existing resolver — closed not-planned after investigation
• Add config-as-code coverage for the selftune feature #4104 — Migrate selftune onto the existing resolver — shipped in feat(review): add per-repo review.selftune force-off for the auto-tune cron #4118
• Add config-as-code coverage for the parityAudit feature #4105 — Migrate parityAudit onto the existing resolver — closed not-planned after investigation
• Investigate + design config-as-code for ops / sweep_watchdog / pr_reconciliation #4106 — Investigate + design config-as-code for ops/sweep_watchdog/pr_reconciliation — closed not-planned, env-var-only is correct
• Investigate + design config-as-code for the GITTENSORY_REVIEW_DRAFT public draft-submission flow #4107 — Investigate + design config-as-code for the GITTENSORY_REVIEW_DRAFT public draft-submission flow — closed not-planned, legitimate bare-necessity
• chore: remove vestigial GITTENSORY_REVIEW_TEST_GENERATION env var declaration #4108 — Chore: remove the vestigial GITTENSORY_REVIEW_TEST_GENERATION env var declaration — shipped in chore(review): remove never-wired test-generation dead slice #4126

Expected outcome

Any self-hoster can fully configure which review features run, per-repo, entirely through .gittensory.yml — no env var or redeploy required for feature enablement, using the ALREADY-PROVEN resolver rather than a new mechanism.

Effort

Epic — down from 15 to 10 active sub-issues after the 2026-07-08 correction; each independently shippable.

[linear-code]

JSO-3143