feat(enrichment): commit-signature / verified-author provenance analyzer

[GildardoDev]

What

A new REES (review-enrichment service) analyzer that flags head-commit signature and author-provenance risks the no-checkout reviewer cannot derive: an unsigned or unverified-signature head commit, an author/committer login mismatch, and a never-before-seen committer whose login has no verified history in a repo that otherwise carries verified commits. These are supply-chain and impersonation signals.

Data source

GitHub REST. It reads commit.verification.{verified, reason} and the author/committer login from GET /repos/{owner}/{repo}/commits/{headSha}, and establishes the new-committer-vs-verified-history signal with at most two bounded GET /commits?per_page=30 queries (author-filtered, then repo-wide). The output is public-safe: only GitHub's verified boolean, its reason string, boolean provenance flags, and the public commit-author login GitHub already shows on the PR. No tokens, emails, local paths, or private signals.

Behavior

Additive and fail-safe: it never throws, and returns no finding on a missing token or head SHA, an unresolvable repo slug, or any fetch error. A clean verified head with a matching author and no new-committer signal produces no finding. It follows the established analyzer pattern entirely within review-enrichment/ (finding type in types.ts, a pure analyzer with injected fetch in analyzers/commit-signature.ts, registration in brief.ts, a public-safe block in render.ts), outside the engine scope.

Tests

12 node:test cases with a mocked fetch cover verified and unverified heads, the reason passthrough, the author/committer mismatch, the new-committer-vs-verified-history signal, the fail-safe paths (no token, bad slug, fetch error), and a public-safe render assertion (no token prefixes, no emails). Full suite: rees build clean, 167 of 167 tests pass.

Closes #1517

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review result - approve/merge recommended

_{Review updated: 2026-06-29 22:27:51 UTC}

5 files · 1 AI reviewer · no blockers · readiness 57/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
The change adds a bounded GitHub-backed REES analyzer for head-commit verification and wires it through the brief renderer and analyzer registry. The fail-safe paths, slug validation, rendering sanitization, and registration are coherent in the provided files. The most notable issue is semantic drift in the provenance signal: the implementation and prompt text describe an author-history check while parts of the PR describe a committer-history check, which should be made consistent before reviewers rely on the signal.

Nits — 6 non-blocking

• nit: review-enrichment/src/analyzers/commit-signature.ts:120 and review-enrichment/src/types.ts:190 use the name `newCommitter` even though the implementation queries `authorLogin`, so rename it or explicitly document that the signal is author-based rather than committer-based.
• nit: review-enrichment/src/analyzers/commit-signature.ts:75 treats an empty author-filtered commit page as a definitive `false`; confirm that GitHub's default branch commit listing is the intended source for 'verified history' because PR-head-only commits may not be included there.
• nit: review-enrichment/src/render.ts:300 renders `item.reason` via `safeCodeSpan` but does not length-cap it; GitHub-controlled values are normally small, but a defensive clamp would keep malformed mocks or future API drift from consuming the brief budget.
• In review-enrichment/src/types.ts:198 and review-enrichment/src/render.ts:298, change `newCommitter` wording to `newAuthor`/`authorHasNoVerifiedHistory`, or switch the analyzer to query `committerLogin` if the intended signal is truly committer provenance.
• In review-enrichment/test/commit-signature.test.ts:93, add a regression case for a verified head with `authorHistory: []` and `repoHistory: [true]` so the intended behavior for first-time verified authors is locked down.
• Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#1517
Related work	⚠️ 3 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (size label size:L; 1 linked issue).
Validation posture	❌ 5/25	Preflight is holding this PR; address the blocker before review.
Contributor workload	✅ 10/10	Author activity: 82 registered-repo PR(s), 52 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	GildardoDev; Gittensor profile; 82 PR(s), 0 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: GildardoDev
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 82 PR(s), 0 issue(s).
• Related work: Items reference the same linked issue feat(enrichment): Commit-signature / verified-author provenance #1517. (issue #1517)
• Related work: Open PR work references issue feat(enrichment): Commit-signature / verified-author provenance #1517. (issue #1517)
• Related work: Items reference the same linked issue feat(enrichment): history analyzer — author track record, similar past PRs, linked-issue alignment #1478. (issue #1478, PR #1771)
• Additional title-only matches omitted; title-only overlap does not block.

Contributor next steps

• Review top overlaps.
• Add a concise scope and risk note.
• Fix the blocker.
• Triage stale or unlinked PRs.
• Refresh registry data or choose a registered active repo.
• Check active issues and PRs before submitting.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review