feat(selfhost): wire Codex reviews and secure observability

[JSONbored]

Summary

• Add Codex CLI runtime support for self-hosted reviews while preserving Claude Code and Ollama paths.
• Make provider configuration explicit with CODEX_AI_*, CLAUDE_AI_*, OLLAMA_AI_*, OPENAI_COMPATIBLE_AI_*, OPENAI_AI_*, and ANTHROPIC_AI_* settings instead of shared ambiguous AI knobs.
• Reject deprecated shared AI env knobs at startup with a clear provider-specific migration error so stale AI_MODEL, AI_EFFORT, AI_BASE_URL, AI_API_KEY, or AI_TIMEOUT_MS values cannot silently steer the wrong backend.
• Prefer repo-scoped AGENTS.md for Codex review context while preserving CLAUDE.md fallback and skills loading.
• Restore the maintainer Reviews & PRs Grafana dashboard through a redacted reporting SQLite export instead of direct Grafana access to the live app database.
• Add Codex usage observability, Sentry-facing provider failure context, self-host docs, and default blank optional-profile env values so inactive profiles do not warn.
• Automate self-host Sentry release/source-map handling so release images bake a matching gittensory-selfhost@<version> release id and the release workflow uploads the exact built bundle maps.
• Fix maintainer-lane preflight handling so owner/member/collaborator self-host work is not held solely because repo registration is unavailable, while outside contributors still get the conservative hold.

Closes #1469.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires >=97% coverage of the lines AND branches you changed (aim for 98%+ on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

Additional validation:

• npm run test:ci
• npm run typecheck
• npx vitest run test/unit/selfhost-grafana-reporting.test.ts test/unit/selfhost-ai.test.ts test/unit/ai-review-advisory.test.ts
• npx vitest run test/unit/signals-coverage.test.ts test/unit/selfhost-ai.test.ts
• GRAFANA_ADMIN_PASSWORD=placeholder docker compose --profile observability config
• Reporting exporter smoke: missing source creates a valid empty redacted reporting database, real SQLite source exports dashboard-safe review and AI usage rows, quoted paths are handled safely, private review columns are absent, and AI metadata is reduced to repo/PR fields.
• Reporting exporter schema test: current source DBs export estimated_neurons; older source DBs without that column still materialize a valid dashboard-safe estimated_neurons = 0 column.
• node scripts/build-selfhost.mjs --all --sourcemap
• Release workflow source-map invariant: confirmed dist/server.mjs, dist/server.mjs.map, sourceMappingURL=server.mjs.map, non-empty original sources, and sourceRoot=/app/dist.
• Docker build smoke: default self-host image target and runtime-prebuilt release target both build successfully.
• Visual-review release image smoke: runtime-prebuilt with INSTALL_VISUAL_REVIEW=true installs puppeteer-core successfully.
• Release-target image check: confirmed baked GITTENSORY_VERSION, NODE_OPTIONS=--enable-source-maps, dist/server.mjs, dist/server.mjs.map, and source map sourceRoot=/app/dist.
• Grafana dashboard JSON parse check for resource hub, infra, Codex usage, and maintainer dashboards.
• Self-host smoke: rebuilt the app service, confirmed /ready, confirmed Codex review settings and auth mount behavior, confirmed Codex reviews completed, and confirmed Codex token/request metrics increased.

If any required check was skipped, explain why:

• A fresh live-stack redeploy was not repeated for the latest head; the current head is covered by local config, exporter, build, source-map, and image smoke checks.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

State / title	JPG/PNG evidence
Operator Grafana dashboard	Not an app UI surface; verified through Grafana provisioning and datasource checks. The dashboard uses the redacted reporting database instead of direct live database access.

Notes

• Grafana now reads a redacted reporting database produced by reporting-exporter; it does not mount the live application database, and the exporter now mounts the app data volume read-only.
• The reporting export always materializes the dashboard estimated_neurons column. Current source DBs copy the real value; older source DBs without the column export 0 so dashboards remain queryable while operators migrate.
• Deprecated shared AI env vars now fail startup by design. Self-host configs should use provider-specific keys such as CODEX_AI_MODEL, CODEX_AI_EFFORT, CLAUDE_AI_MODEL, CLAUDE_AI_EFFORT, OLLAMA_AI_MODEL, OPENAI_AI_MODEL, and matching provider-specific base URL/key/timeout settings.
• AI usage labels now come from the resolved reviewer plan instead of raw AI_PROVIDER, so uncredentialed or ignored provider entries are not reported as if they actually ran.
• If a self-hoster uses a non-default SQLite path, set GITTENSORY_REPORTING_SOURCE_DB. If the live store is not SQLite, the exporter emits a valid empty reporting database until a compatible reporting source is configured.
• Sentry GitHub code mapping for self-host stack traces should use Stack Trace Root /app and Source Code Root ..
• Official self-host releases require SENTRY_AUTH_TOKEN in the release environment; non-official forks skip Sentry upload when the token is absent.
• Codex USD cost metrics appear only when the CLI output includes a cost field. Token and request metrics are tracked.
• The maintainer-lane preflight change is included here because the production gate blocks this self-host setup PR on unavailable local repo registration. The branch keeps the conservative hold for outside contributors and only turns owner/member/collaborator unavailable-lane status into informational context.
• The self-host queue may remain elevated while historical webhook events drain into the local queue; the worker is processing them and dead-letter count was zero during smoke checks.
• Related roadmap/issues: build(selfhost): make host deploys Git-backed and image-ready #1660, roadmap(selfhost): harden review stack and reduce hosted cost #1667, feat(selfhost): complete Codex reviewer modes and fallbacks #1675, feat(observability): add Codex usage and cost tracking dashboard #1676, chore(cloudflare): inventory legacy hosted resources for cleanup #1668, feat(selfhost): complete review configuration control surface #1680, feat(review): test review controls end to end #1681, docs(selfhost): add complete and minimal review config templates #1682, feat(dashboard): design self-host review config generator #1683, feat(selfhost): expose REES analyzer controls and validation #1684.

[codecov]

Codecov Report

❌ Patch coverage is 98.61996% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 95.75%. Comparing base (29da3b1) to head (aaa824d).
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/queue/processors.ts	91.07%	1 Missing and 4 partials ⚠️
src/github/app.ts	94.28%	0 Missing and 4 partials ⚠️
src/services/ai-review.ts	97.14%	0 Missing and 2 partials ⚠️
src/selfhost/ai.ts	99.36%	0 Missing and 1 partial ⚠️
src/signals/engine.ts	98.55%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1678      +/-   ##
==========================================
+ Coverage   95.59%   95.75%   +0.16%     
==========================================
  Files         204      211       +7     
  Lines       22316    22972     +656     
  Branches     8067     8294     +227     
==========================================
+ Hits        21332    21997     +665     
+ Misses        408      401       -7     
+ Partials      576      574       -2     

Files with missing lines	Coverage Δ
src/config/gittensory-repo-focus-manifest.ts	100.00% <ø> (ø)
src/db/repositories.ts	96.16% <ø> (ø)
src/db/schema.ts	68.32% <ø> (ø)
src/github/backfill.ts	93.51% <100.00%> (+0.56%)	⬆️
src/github/comments.ts	100.00% <100.00%> (+3.22%)	⬆️
src/github/self-authored.ts	100.00% <100.00%> (ø)
src/github/webhook.ts	100.00% <100.00%> (ø)
src/index.ts	94.64% <100.00%> (+2.80%)	⬆️
src/queue/dlq.ts	100.00% <100.00%> (ø)
src/queue/retryable.ts	100.00% <100.00%> (ø)
... and 28 more

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[superagent-security]

Superagent found 1 security concern(s).

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-06-29 17:54:25 UTC}

118 files · 1 AI reviewer · 1 blocker · readiness 75/100 · CI green · blocked

⏸️ Suggested Action - Manual Review

• The AI review flagged a possible must-fix defect below the automatic close-confidence floor, so the gate is held for a human reviewer instead of passed automatically.

Review summary
This PR wires substantial self-host queue behavior plus provider-specific AI runtime configuration, including priority/coalescing, rate-limit cooldowns, durable queue stats, and Codex/Claude usage reporting. The Codex request metric concern in CI is not supported by the provided head content because attempted subprocess calls are counted from a finally block after spawn is attempted. The visible queue coalescing path has a correctness issue: fresh work can inherit stale retry/backoff state from an older pending row.

Blockers

• src/selfhost/sqlite-queue.ts:createSqliteQueue/enqueue and src/selfhost/pg-queue.ts:createPgQueue/enqueue update an existing pending coalesced job without resetting attempts and with run_after=max/GREATEST(run_after, newRunAfter), so a fresh webhook or manual regate merged into a previously failed or delayed row can be dead-lettered after one retry or remain delayed by stale backoff.

Nits — 7 non-blocking

• .github/workflows/release-selfhost.yml:Validate Sentry release should be guarded like the upload/finalize steps or the validation script should explicitly tolerate missing Sentry credentials for non-official releases.
• src/selfhost/sqlite-queue.ts/processOne and src/selfhost/pg-queue.ts/processOne capture an error for every expired lease reclamation; consider aggregating or rate-limiting that signal so one backlog does not create an alert burst.
• .env.example has two Sentry configuration sections with overlapping variables, which makes the intended operator-facing source of truth harder to follow.
• In both queue enqueue coalescing updates, reset attempts to 0 when replacing the payload and use the new run_after when the new job is earlier than the existing delayed row, unless you can justify preserving old retry state for fresh events.
• Add queue tests that cover coalescing a new immediate job into a pending retry row with attempts=maxRetries-1 and a future run_after for both SQLite and Postgres.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.
• AI reviewers agree on a likely critical defect: src/selfhost/sqlite-queue.ts:createSqliteQueue/enqueue and src/selfhost/pg-queue.ts:createPgQueue/enqueue update an existing pending coalesced job without resetting attempts and with run_after=max/GREATEST(run_after, newRunAfter), so a fresh webhook or manual regate merged into a previously failed or delayed row can be dead-lettered after one retry or remain delayed by stale backoff. — Resolve the flagged defect, or override if the AI reviewers are mistaken, then re-run the gate.

Concerns raised — review before merging

• src/selfhost/sqlite-queue.ts:createSqliteQueue/enqueue and src/selfhost/pg-queue.ts:createPgQueue/enqueue update an existing pending coalesced job without resetting attempts and with run_after=max/GREATEST(run_after, newRunAfter), so a fresh webhook or manual regate merged into a previously failed or delayed row can be dead-lettered after one retry or remain delayed by stale backoff.

Signal	Result	Evidence
Code review	❌ 1 blocker	1 reviewer
Linked issue	✅ Linked	#1469
Related work	⚠️ 2 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (size label size:XL; 1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 74 registered-repo PR(s), 57 merged, 280 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 74 PR(s), 280 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 74 PR(s), 280 issue(s).
• Related work: Items reference the same linked issue build(selfhost): Sentry source maps, env docs, and Grafana resource-hub link #1469. (issue #1469)
• Related work: Open PR work references issue build(selfhost): Sentry source maps, env docs, and Grafana resource-hub link #1469. (issue #1469)

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Review top overlaps.
• Add a concise scope and risk note.
• Triage stale or unlinked PRs.
• No action.
• Check active issues and PRs before submitting.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[superagent-security]

Superagent found 1 security concern(s).

[JSONbored]

@gittensory gate-override Maintainer-lane self-host setup PR: all CI, security, coverage, and self-host smoke checks are green. The remaining blocker is the deployed gate readiness/preflight hold for owner-authored work when repo registration is unavailable, and this PR includes the upstream fix for that false-positive.

[superagent-security]

\nSuperagent found 2 security concern(s).

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	9d7d044	Commit Preview URL Branch Preview URL	Jun 29 2026, 11:31 AM