feat(engine): extract settings leaf modules to loopover-engine

[real-venus]

Summary

Continues the settings/ slice extraction (#4879) by consolidating the pure leaf modules into @loopover/engine, following the established shim convention (see src/signals/check-summary.ts):

• global-contributor-cap.ts — a dependency-free pure leaf that was not yet extracted. Moved into packages/loopover-engine/src/settings/ (byte-identical git mv) with a thin re-export shim left at its old src/ path.
• auto-close-exempt.ts and moderation-rules.ts — already-extracted pure leaves that were still carried as hand-maintained twins (identical impl in both src/ and the engine). Converged each src/ copy to a thin re-export shim, so the single implementation now lives only in the engine.

Every consumer and test keeps its existing src/settings/<file> import and resolves through the shim — no consumer or test import changed.

Why these three, and why it's safe

• All three are pure (no imports, no Worker Env/D1) and at 100% coverage, so the moves are coverage-safe.
• The two converged twins are byte-identical to their engine copies (verified), so behavior is unchanged.
• They are directory-scanned engine-parity pairs, not hard-coded NAMED_TWIN_PAIRS (those are advisory, safe-url, review-diff, signals/engine, secret-patterns). The drift tripwire's isThinEngineReExportShim correctly skips the new shims, so no guarded scripts/ change is needed — the parity check still passes (20 pairs agree).
• The remaining settings/ files are deferred: agent-actions/agent-execution/agent-sweep/autonomy are guardrail paths, and the import-bearing files (automation-bot-skip → guarded agent-actions, effective-config-summary, repository-settings) need their dependencies handled first.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves — Closes Finish the settings/ slice extraction #4879.

Validation

• git diff --check
• npm run typecheck (root + @loopover/engine build both clean)
• npm run test:coverage — all three moved engine files and all three shims at 100% line + branch coverage (v8 JSON report); the direct settings tests and engine-twin tests pass unchanged (265), and consumer suites (agent-actions, agent-approval-queue, focus-manifest-loader, agent-action-executor, automation-bot-skip) resolve through the shims and pass (379 + more).
• Engine-parity check passes (20 hand-duplicated pairs agree); the parity discovery regression guard (>= 14 pairs) still holds.
• npm run command-reference:check and docs-drift check pass (unaffected).
• Rebased onto the latest main immediately before pushing — merges clean, no base conflict.

If any required check was skipped, explain why:

• actionlint, test:workers, ui:*, npm audit were not run — this change adds no workflow, worker, UI, or dependency surface. The full npm run test:ci runs them on CI.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed. This is a pure source relocation + re-export shim; behavior is byte-for-byte unchanged.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Public docs/changelogs are updated where needed; no changelog is edited.

Auth/CORS/session, API/OpenAPI/MCP, and UI safety boxes are not applicable — this PR changes none of those surfaces.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.06%. Comparing base (0e02a32) to head (6e16dfa).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5779      +/-   ##
==========================================
- Coverage   95.07%   95.06%   -0.01%     
==========================================
  Files         582      580       -2     
  Lines       46219    46156      -63     
  Branches    14822    14804      -18     
==========================================
- Hits        43943    43880      -63     
  Misses       1516     1516              
  Partials      760      760              

Flag	Coverage Δ
shard-1	43.92% <58.33%> (-0.02%)	⬇️
shard-2	35.80% <58.33%> (+0.03%)	⬆️
shard-3	32.26% <41.66%> (+0.01%)	⬆️
shard-4	33.56% <58.33%> (+0.63%)	⬆️
shard-5	31.20% <41.66%> (-0.53%)	⬇️
shard-6	44.59% <100.00%> (-0.06%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...over-engine/src/settings/global-contributor-cap.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-14 14:50:46 UTC}

4 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This is a mechanical extraction: global-contributor-cap.ts moves byte-identical to packages/loopover-engine/src/settings/, and auto-close-exempt.ts and moderation-rules.ts collapse from hand-maintained twins into thin `export *` re-export shims pointing at the existing engine copies. All exported symbols in the shims match what the original files exported (verified against the full moved file and the existing test/unit/global-contributor-cap.test.ts, which imports from src/settings/global-contributor-cap and will resolve transparently through the shim). No consumer import paths changed, and the relative-path re-export convention matches src/signals/check-summary.ts as claimed.

Nits — 5 non-blocking

• No new test files were added for this PR (0 test-path lines), relying entirely on pre-existing tests exercising the shims — worth a one-line confirmation in the PR body that `20 pairs agree` covers all three moved files, not just the two converged twins.
• packages/loopover-engine/src/settings/global-contributor-cap.ts:8,17 — the long-lived comment references 'global_contributor_blacklist'; if the repo is moving toward neutral terminology elsewhere, consider `denylist` here too, though this is inherited unchanged from the moved file and not introduced by this diff.
• Confirm in the PR description (not just inferred from `20 pairs agree`) that the drift tripwire was actually run against this commit, since that check isn't part of the visible diff.
• Consider adding a short changelog/README note in packages/loopover-engine listing which settings leaves are now canonical there, to help future contributors avoid recreating a twin.
• Code changes lack test evidence — Add focused regression tests or explain why existing coverage is sufficient.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#4879
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 106 registered-repo PR(s), 54 merged, 14 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	real-venus; Gittensor profile; 106 PR(s), 14 issue(s).
Gate result	✅ Passing	No configured blocker found.
Improvement	⚠️ ℹ️ None detected	risk: low · value: none — No structural-improvement signals were detected for this PR. LLM value judgment: minor — The change is a well-scoped, low-risk mechanical consolidation of duplicate implementations into a single source of truth, which reduces future drift risk but adds no new capability.

Linked issue satisfaction

Partially addressed
The PR extracts three pure leaf modules (global-contributor-cap, auto-close-exempt, moderation-rules) into the engine with working shims, following the established convention, but the issue asked for 'the confirmed-pure remainder of src/settings/' to be moved, and the PR description explicitly defers several other pure-seeming files (agent-actions/agent-execution/agent-sweep/autonomy, automation-b

Review context

• Author: real-venus
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 106 PR(s), 14 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

[BETA] Chat with Gittensory

Ask Gittensory a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @gittensory ask <question> answers contribution-quality Q&A with source citations and freshness.
• @gittensory chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @gittensory mention with a real question is routed to the closest matching read-only command automatically -- no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/gittensory-commands

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.