feat(miner-selfimprove): engine-parity drift detector — flag when gittensory-engine diverges from src/

[JSONbored]

A 2026-07-08 roadmap audit (recorded in #2353's Phase 7 checklist) found that most src/{review,settings,signals} logic is now a thin re-export shim over gittensory-engine (e.g. src/rules/predicted-gate.ts → packages/gittensory-engine/src/predicted-gate.ts), so shimmed files structurally can't diverge — importing a shim can't silently drift from what it re-exports. But roughly 15 file pairs are still independent, hand-duplicated copies rather than shims, e.g. src/review/guardrail-config.ts, cla-check.ts, unlinked-issue-guardrail-config.ts, settings/autonomy.ts, settings/contributor-blacklist.ts, settings/pr-type-label.ts, and signals/change-guardrail.ts — each has a same-named twin under packages/gittensory-engine/src/{review,settings,signals}/, and nothing currently checks the two stay identical.

Spot-checking two of those pairs directly confirms both halves of the risk this item needs to cover:

• src/review/guardrail-config.ts vs packages/gittensory-engine/src/review/guardrail-config.ts — currently only a 1-line import-path difference (../types vs ../types/predicted-gate-types.js), harmless today but proof the files are diffable, hand-kept-parallel copies, not shims.
• src/signals/change-guardrail.ts vs packages/gittensory-engine/src/signals/change-guardrail.ts — a real structural divergence: the src/ version does if (hasUnsafeWildcardCount(glob) || globToRegExp(glob).test(canonicalPath)) in one branch, while the engine version splits this into two separate if blocks with a continue in between. Turned out behaviorally equivalent this time (confirmed by reading both), but nothing would have caught it if it hadn't been.

There's a second, distinct sub-risk: version skew. packages/gittensory-miner/package.json pins "@jsonbored/gittensory-engine": ">=0.1.0 <1.0.0" — a wide open range — and the engine is already at 0.2.0 (packages/gittensory-engine/package.json). ENGINE_VERSION is a real exported constant (packages/gittensory-engine/src/version.ts:4, re-exported at packages/gittensory-engine/src/index.ts:7), and gittensory-miner's doctor check already reads it — runDoctorChecks in packages/gittensory-miner/lib/status.js:117-136 has an engine-resolves check (status.js:120,128-131) via readEngineVersion(). But that check only confirms the engine package resolves (is installed at all) — it does not compare the installed version against what the live gate server actually runs, and nothing surfaces the server's currently-deployed engine version for a miner to compare against (PredictedGateVerdict, defined at packages/gittensory-engine/src/predicted-gate.ts:43-61, currently carries no version field at all). A miner could run for months against a semantically-stale engine build inside that >=0.1.0 <1.0.0 range and nothing would flag it.

This item needs both checks:

1. A byte-diff check over the known un-shimmed file pairs (the ~15 duplicated, non-shim files).
2. A version-skew check comparing the miner's resolved @jsonbored/gittensory-engine version against a reference/expected version.

Scope note — do not duplicate #4257: #4257 ("test(engine): build a true live-gate-vs-predicted-gate cross-check", maintainer-only) is a much bigger, harder project: a real processors.ts test harness that replays a scenario through both the live enforcement path and the predicted-gate composer to prove behavioral agreement end-to-end. This item is the lighter-weight, contributor-safe piece — a CI script that diffs known file pairs textually and checks a version string, with no live-gate harness involved. #4257 owns the full behavioral cross-check; this item owns the cheap mechanical drift/skew tripwire.

Deliverables

• A CI script (e.g. scripts/check-engine-parity.mjs or similar) enumerating the known un-shimmed src/ <-> packages/gittensory-engine/src/ file pairs and byte-diffing each pair, failing (non-zero exit) on any difference.
• The pair list should start from the ~15 files identified in the 2026-07-08 audit (the 7 named above plus the remainder enumerable via the same src/{review,settings,signals}/*.ts vs packages/gittensory-engine/src/{review,settings,signals}/*.ts sweep — a file is "in scope" if both twins exist and the src/ copy is NOT a thin re-export of the engine module).
• A version-skew check comparing the resolved @jsonbored/gittensory-engine version (already readable via the same resolution readEngineVersion() uses in packages/gittensory-miner/lib/status.js) against a reference/expected version, surfaced as a new doctor check or a standalone script — should not require a network round-trip to the live server (a locally-pinned "expected minimum" is enough; matching the deployed server's version exactly is out of scope, that's closer to test(engine): build a true live-gate-vs-predicted-gate cross-check #4257 territory).
• Wire the byte-diff check into test:ci (or an equivalent existing drift-check step) so a future hand-edit to only one half of a pair fails CI instead of silently landing.
• Unit/script tests covering: identical pair (passes), a pair that differs (fails with a clear diff-pointing message), and the version-skew comparator's boundary cases (equal, behind, ahead).

References

• src/review/guardrail-config.ts / packages/gittensory-engine/src/review/guardrail-config.ts — spot-verified 1-line drift (import path only)
• src/signals/change-guardrail.ts / packages/gittensory-engine/src/signals/change-guardrail.ts (~line 146) — spot-verified real structural drift, behaviorally equivalent this time
• packages/gittensory-engine/src/version.ts:4 (ENGINE_VERSION constant), packages/gittensory-engine/src/index.ts:7 (re-export)
• packages/gittensory-miner/lib/status.js:117-136 (runDoctorChecks, existing presence-only engine-resolves check)
• packages/gittensory-miner/package.json ("@jsonbored/gittensory-engine": ">=0.1.0 <1.0.0") vs packages/gittensory-engine/package.json (currently 0.2.0)
• packages/gittensory-engine/src/predicted-gate.ts:43-61 (PredictedGateVerdict — currently no version field)
• 🧩 Wave 2 — Analyze, Plan, Create & Deploy (HELD tracker) #2353 (Phase 7, item 1's 2026-07-08 audit annotation — source of the un-shimmed file list and the "already diverged once" finding)
• test(engine): build a true live-gate-vs-predicted-gate cross-check #4257 (related, NOT duplicated: the heavier maintainer-only live-gate-vs-predicted-gate behavioral cross-check)

[linear-code]

JSO-3247