refactor(rees): add modular analyzer manifests

[JSONbored]

Summary

• Closes refactor(rees): introduce modular analyzer manifests #1809.
• Adds a descriptor-based REES analyzer registry with per-analyzer metadata for name, category, cost class, requirements, limits, docs, runner, and renderer hooks.
• Migrates dependency and secret as proof analyzers with descriptor-owned runtime wiring and prompt rendering.
• Documents the analyzer manifest contribution pattern so future analyzer work can avoid central-file conflicts.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥97% coverage of the lines AND branches you changed (aim for 98%+ on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

Also ran npm --prefix review-enrichment test directly before the full repo gate.

If any required check was skipped, explain why:

• None. npm run test:ci passed and includes the checked validation commands above plus npm run rees:test, npm run ui:version-audit, and the remaining repo gate steps.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session behavior was not changed.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• No UI behavior was changed.
• No visible UI changes are included.
• Public docs were updated where needed; changelogs were not edited.

UI Evidence

Not applicable. This changes REES runtime internals and service README text only; no visible UI, frontend route, or extension surface changed.

Notes

• The full analyzer migration is intentionally incremental. This PR establishes the descriptor substrate and migrates two analyzers as the pattern; follow-up issues can move the remaining renderers and generated docs/config onto the same registry.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review result - approve/merge recommended

_{Review updated: 2026-06-30 05:42:10 UTC}

9 files · 1 AI reviewer · no blockers · readiness 75/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This refactor moves REES analyzer runtime wiring into descriptor metadata and successfully keeps the existing brief execution and prompt rendering paths for the migrated dependency and secret analyzers. The runtime registry still preserves the analyzer order and the migrated renderer output is covered by the new tests. The main remaining concern is maintainability drift: the new descriptor metadata is not yet connected to the existing UI analyzer documentation source, so the PR adds another operator-facing catalog without making it authoritative.

Nits — 6 non-blocking

• nit: review-enrichment/src/analyzers/registry.ts:29 keeps most descriptor definitions centralized while the README presents per-analyzer descriptor files as the preferred pattern, so either migrate the remaining descriptors gradually in this PR or document that the central entries are temporary.
• nit: review-enrichment/src/render.ts:13 uses an `unknown`/`never` cast around descriptor renderers, which is acceptable for this refactor but weakens the type link between `AnalyzerName` and `BriefFindings[name]`.
• nit: review-enrichment/README.md:55 describes `src/analyzers/<name>.ts` as the scanner location, but the migrated examples use `dependency-scan.ts` and `secret-scan.ts`; update the table to match the actual naming convention or make it explicitly illustrative.
• Wire descriptor metadata into the UI/docs catalog in `apps/gittensory-ui/src/lib/rees-analyzers.ts` or add an explicit follow-up marker so this new manifest is not just a second copy of the same operator-facing text.
• Tighten `renderDescriptorSection` in `review-enrichment/src/render.ts` with a small generic helper so descriptor renderers receive `NonNullable<BriefFindings[Name]>` without the `never` cast.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#1809
Related work	⚠️ 3 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (size label size:XL; 1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 2 registered-repo PR(s), 2 merged, 263 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 2 PR(s), 263 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 2 PR(s), 263 issue(s).
• Related work: Items reference the same linked issue refactor(rees): introduce modular analyzer manifests #1809. (issue #1809)
• Related work: Open PR work references issue refactor(rees): introduce modular analyzer manifests #1809. (issue #1809)
• Related work: Titles/paths share 7 meaningful terms. (PR #1817)
• Additional title-only matches omitted; title-only overlap does not block.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Review top overlaps.
• Add a concise scope and risk note.
• Triage stale or unlinked PRs.
• No action.
• Check active issues and PRs before submitting.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review