feat(review): add .gittensory.yml review.pre_merge_checks (deterministic pre-merge assertions)

[JSONbored]

Summary

A CodeRabbit-parity pre-merge checks gate — the deterministic, safe interpretation. A maintainer declares content assertions a PR must satisfy before merge: the title/description must contain a phrase, or a label must be present, optionally gated to a path glob.

review:
  pre_merge_checks:
    - name: "Migrations documented"
      when_paths: ["migrations/**"]
      description_contains: "migration"
    - name: "Breaking changes labeled"
      require_label: "breaking-change"
      enforce: true   # a failure HARD-BLOCKS the gate (default: advisory only)

• No AI judgment — purely title/description/label substring + glob matching. This cannot cause an AI false-close (the class the fix(agent): AI CI-refutation — an AI-judgment failure never closes (or visibly blocks) a green-CI PR #1331 calibration defused).
• Advisory by default — a failed check surfaces a pre_merge_check_failed finding that never blocks; enforce: true makes it a hard pre_merge_check_required blocker (the per-check flag is the opt-in, mirroring secret_leak).
• Config-only — manifest.review, no DB migration / OpenAPI. Empty (default) ⇒ no finding (byte-identical).

Changes

• focus-manifest.ts — PreMergeCheck type + preMergeChecks; parse (name + ≥1 assertion required, all public-safe, when_paths via a shared parseManifestGlobList, capped at 50, per-entry warnings) + serialize; resolveReviewPreMergeChecks(manifest) centralizes the null-manifest default.
• review/pre-merge-checks.ts (new) — evaluatePreMergeChecks(checks, ctx): pure; one finding per failed check, case-insensitive matching, when_paths gating.
• rules/advisory.ts — isConfiguredGateBlocker treats pre_merge_check_required as a hard blocker.
• processors.ts — evaluate over the PR (title/body/labels/changed files) and append findings to the advisory before the gate evaluates; uses the already-cached manifest.

No linked issue — a config-as-code review enhancement in the CodeRabbit-parity series (follows #1347 review.profile, #1350 review.path_instructions, #1353 review.exclude_paths).

Scope

• src/ only — config parse + a pure evaluator + one gate-blocker code + threading; no migration/OpenAPI/binding
• No secrets/site/CNAME/lovable; no CHANGELOG — all check strings pass the manifest public-safe filter at parse

Validation

• npm run test:ci — exit 0; 4366 tests pass
• npm audit --audit-level=moderate — 0 vulnerabilities
• Every changed src line + branch covered (lcov BRDA across focus-manifest.ts, pre-merge-checks.ts, advisory.ts, processors.ts)
• Tests: parse (valid / non-mapping / missing-name / non-string-name / no-assertion / non-array / cap / when_paths label / round-trip); evaluator (pass / advisory-fail / enforce-code / when_paths gating / null defaults); gate (pre_merge_check_required blocks, pre_merge_check_failed never blocks); integration (an enforced failing check produces a failing gate that names the check)

Safety

• Deterministic only — no AI judgment, so no AI false-close risk; advisory by default, enforce is per-check opt-in
• Cannot weaken any existing blocker; byte-identical when unset; capped at 50 checks

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.32%. Comparing base (18881ba) to head (0d7d225).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1357      +/-   ##
==========================================
+ Coverage   95.31%   95.32%   +0.01%     
==========================================
  Files         189      190       +1     
  Lines       20491    20554      +63     
  Branches     7394     7421      +27     
==========================================
+ Hits        19530    19593      +63     
  Misses        378      378              
  Partials      583      583              

Files with missing lines	Coverage Δ
src/queue/processors.ts	87.64% <100.00%> (+0.05%)	⬆️
src/review/pre-merge-checks.ts	100.00% <100.00%> (ø)
src/rules/advisory.ts	97.28% <100.00%> (+0.01%)	⬆️
src/signals/focus-manifest.ts	97.85% <100.00%> (+0.18%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.