feat(review): persist a login-keyed predict-gate-vs-live-gate disagreement ledger as the review stack's own calibration ground truth

[JSONbored]

Context

A maintainer review-stack × Autonomous Miner System (AMS) integration audit (2026-07-09) found that no review-stack-owned ledger correlates a miner's self-reported predict-gate verdict against the PR's eventual live-gate outcome — the one calibration signal the review stack itself could uniquely own (because it terminates both the self-review call and the live gate for the same login/repo) is never captured.

Evidence

• src/mcp/server.ts — computePredictedGateVerdict (~2882-2919) performs a pure, unpersisted computation with no INSERT/persist call anywhere in its body or call chain.
• migrations/0126_contributor_gate_history.sql and src/review/contributor-calibration.ts — contributor_gate_history is the one table shaped to hold the live side of this join, but its own header comment and the code's own comment at src/queue/processors.ts:3163-3165,10152 state plainly: "Currently write-only; nothing reads contributor_gate_history yet" — and even that table only stores the live gate's own decision per login, never a miner's self-reported prediction.
• packages/gittensory-miner/lib/prediction-ledger.js (from closed issue feat(miner-selfimprove): local prediction-ledger schema — record every predicted-gate verdict for later scoring #4263) is explicitly miner-local — by design, per the merged self-improve design note (packages/gittensory-miner/docs/miner-selfimprove-calibration.md, docs(miner-selfimprove): self-improve phase design note — calibration, value-weighting, anti-farming boundaries #4265/PR docs(miner-selfimprove): self-improve phase design note — calibration, value-weighting, anti-farming boundaries (#4265) #4471), every contributor-safe calibration tool is read-only/local-only specifically because a write-capable, server-trusted version would itself be an anti-farming vector (maintainer: fleet-wide anti-farming detector — flag a miner/fleet gaming the calibration score #2350).

Why this matters for the Autonomous Miner System

Because gittensory controls both ends of this pipeline (the self-review call and the live gate), it's uniquely positioned to compute an authoritative "self-review honesty" metric a miner cannot spoof or locally fabricate — unlike a miner-local confidence score, this one is measured from the review stack's own two independent observations, and a miner never gets write access to it. This is the data substrate that would make trust-tiering (lighter review for a well-calibrated actor) possible without trusting anything the actor reports about itself.

Deliverables

• Design and add a login-keyed table (or extend contributor_gate_history) to hold: the self-reported predict-gate verdict, the eventual live-gate decision, and whether they agreed — written server-side only, never by the miner
• Wire the write path from wherever feat(docs): add analytics and mcp version widget #6 (predicted-gate recording) lands, or build it together with feat(docs): add analytics and mcp version widget #6 if the two are implemented as one PR
• Explicitly scope this as maintainer/server-owned data — not exposed back to the miner as a writable or self-reportable value, to preserve its value as an anti-farming-resistant ground truth
• Tests: agreement/disagreement recorded correctly across repos for the same login, cold-start (no prior history) behavior, immutability from the miner side

---

Surfaced by a maintainer review-stack × AMS integration audit (2026-07-09). Related: #6 above (the measurement mechanism this ledger's data would feed), #2349 (personalized gate-prediction tuning, the natural consumer of this ledger), #4263 (the miner-local prediction ledger this is deliberately NOT a duplicate of — that one is client-side/self-reported, this one is server-side/tamper-resistant).

[linear-code]

JSO-3358