From 049feeb7aef7cc0d980624c28c8458300dd3c5ab Mon Sep 17 00:00:00 2001 From: JSONbored <49853598+JSONbored@users.noreply.github.com> Date: Sat, 4 Jul 2026 00:39:51 -0700 Subject: [PATCH 1/2] fix(selfhost): make hard guardrails authoritative --- .gittensory.yml | 5 -- apps/gittensory-ui/public/openapi.json | 7 -- .../site/app-panels/maintainer-settings.tsx | 2 +- .../src/routes/docs.how-reviews-work.tsx | 11 ++-- .../src/routes/docs.privacy-security.tsx | 4 +- apps/gittensory-ui/src/routes/docs.tuning.tsx | 24 +++---- config/examples/README.md | 4 +- src/config/gittensory-repo-focus-manifest.ts | 5 -- src/openapi/schemas.ts | 1 - src/queue/processors.ts | 5 -- src/review/parity-wire.ts | 5 +- src/rules/advisory.ts | 33 ++-------- src/rules/predicted-gate.ts | 2 +- src/selfhost/config-lint.ts | 1 - src/services/contributor-issue-draft.ts | 2 +- src/services/decision-pack.ts | 6 -- .../miner-dashboard-recommendations.ts | 3 +- src/services/remediation-plan.ts | 2 +- src/signals/focus-manifest-loader.ts | 1 - src/signals/focus-manifest.ts | 48 +++----------- src/signals/repo-policy-readiness.ts | 13 ---- src/types.ts | 5 +- .../engine-parity/predicted-gate/README.md | 2 +- .../predicted-gate/manifest-blocked-path.ts | 11 ++-- test/integration/api.test.ts | 13 ++-- test/unit/contributor-issue-draft.test.ts | 4 +- test/unit/decision-pack.test.ts | 7 +- test/unit/focus-manifest-loader.test.ts | 8 +-- test/unit/focus-manifest.test.ts | 31 ++++----- test/unit/gate-check-policy.test.ts | 66 +++++++------------ test/unit/gittensory-focus-manifest.test.ts | 20 +++--- test/unit/local-branch.test.ts | 8 +-- test/unit/mcp-predict-gate.test.ts | 8 +-- .../miner-dashboard-recommendations.test.ts | 10 +-- test/unit/parity-wire.test.ts | 4 +- test/unit/policy-sanitizer.test.ts | 5 +- test/unit/pr-body-draft.test.ts | 1 - test/unit/predicted-gate.test.ts | 17 +++-- .../unit/public-safe-manifest-finding.test.ts | 19 +----- test/unit/queue.test.ts | 8 +-- test/unit/repo-policy-readiness.test.ts | 6 +- test/unit/routes-focus-manifest.test.ts | 7 +- test/unit/routes-remediation-plan.test.ts | 2 +- test/unit/selfhost-config-lint.test.ts | 12 +++- test/unit/unified-comment.test.ts | 4 +- 45 files changed, 146 insertions(+), 316 deletions(-) diff --git a/.gittensory.yml b/.gittensory.yml index 296ff074d6..e1825a7c4c 100644 --- a/.gittensory.yml +++ b/.gittensory.yml @@ -14,11 +14,6 @@ wantedPaths: - wrangler.jsonc - apps/gittensory-ui/ -blockedPaths: - - site/ - - CNAME - - "**/lovable/**" - preferredLabels: - bug - enhancement diff --git a/apps/gittensory-ui/public/openapi.json b/apps/gittensory-ui/public/openapi.json index 59d8272122..117103dc38 100644 --- a/apps/gittensory-ui/public/openapi.json +++ b/apps/gittensory-ui/public/openapi.json @@ -6266,12 +6266,6 @@ "type": "string" } }, - "matchedBlockedPaths": { - "type": "array", - "items": { - "type": "string" - } - }, "preferredLabelHits": { "type": "array", "items": { @@ -6334,7 +6328,6 @@ "linkedIssuePolicy", "issueDiscoveryPolicy", "matchedWantedPaths", - "matchedBlockedPaths", "preferredLabelHits", "findings", "publicNextSteps", diff --git a/apps/gittensory-ui/src/components/site/app-panels/maintainer-settings.tsx b/apps/gittensory-ui/src/components/site/app-panels/maintainer-settings.tsx index 9d108ed1e2..919f9c0b14 100644 --- a/apps/gittensory-ui/src/components/site/app-panels/maintainer-settings.tsx +++ b/apps/gittensory-ui/src/components/site/app-panels/maintainer-settings.tsx @@ -766,7 +766,7 @@ function FocusManifestEditor({ base }: { base: string | null }) { Focus manifest (config-as-code)

- The repo's maintainer focus policy as JSON — wanted/blocked paths, linked-issue policy, + The repo's maintainer focus policy as JSON — wanted paths, linked-issue policy, test expectations, and gate overrides. Mirrors{" "} .gittensory.yml.

diff --git a/apps/gittensory-ui/src/routes/docs.how-reviews-work.tsx b/apps/gittensory-ui/src/routes/docs.how-reviews-work.tsx index 6c97de8d88..dc4f01d1ae 100644 --- a/apps/gittensory-ui/src/routes/docs.how-reviews-work.tsx +++ b/apps/gittensory-ui/src/routes/docs.how-reviews-work.tsx @@ -115,8 +115,9 @@ function HowReviewsWork() {
  • Manifest-policy gate (manifestPolicyGateMode, default{" "} - off) — when block, the repo's declared policy (blocked paths, - required linked issue, test expectations) becomes enforceable. + off) — when block, the repo's declared policy (required linked + issue and test expectations) becomes enforceable. Manual-review path holds are controlled + separately by settings.hardGuardrailGlobs.
  • @@ -228,9 +229,9 @@ function HowReviewsWork() { reviewer reads it.

  • - manifest_blocked_path — the PR touches a path listed in the repo's{" "} - blockedPaths. Enforceable when manifestPolicy is{" "} - block. + guardrail_hold — the PR touches a path listed in{" "} + settings.hardGuardrailGlobs. This is a manual-review hold, not an + auto-close reason.
  • manifest_missing_tests — code changed but the expected test paths ( diff --git a/apps/gittensory-ui/src/routes/docs.privacy-security.tsx b/apps/gittensory-ui/src/routes/docs.privacy-security.tsx index fceab499f2..c7c2a34b43 100644 --- a/apps/gittensory-ui/src/routes/docs.privacy-security.tsx +++ b/apps/gittensory-ui/src/routes/docs.privacy-security.tsx @@ -63,8 +63,8 @@ function PrivacySecurity() { Per-repo settings — gate modes, score thresholds, and guardrails, stored in the operator's database (set through the dashboard/API) or declared as config-as-code in a repo's .gittensory.yml. Choosing gate.slop.minScore or - marking a path under blockedPaths tightens the gate without telling a - contributor how to pass it. + setting settings.hardGuardrailGlobs tightens the gate without telling a + contributor how to bypass it.
  • Operator feature flags — the GITTENSORY_REVIEW_* family of diff --git a/apps/gittensory-ui/src/routes/docs.tuning.tsx b/apps/gittensory-ui/src/routes/docs.tuning.tsx index 27de1f1853..c372000e90 100644 --- a/apps/gittensory-ui/src/routes/docs.tuning.tsx +++ b/apps/gittensory-ui/src/routes/docs.tuning.tsx @@ -248,8 +248,8 @@ function Tuning() {
  • gate.manifestPolicy — when block, the manifest's declared policy - (blocked paths, required linked issue, test expectations) becomes an enforceable blocker. - Default off. + (required linked issue and test expectations) becomes an enforceable blocker. Manual-review + path holds use settings.hardGuardrailGlobs instead. Default off.
  • gate.firstTimeContributorGrace — when true, softens a would-be @@ -294,21 +294,16 @@ function Tuning() {

    Guardrails and scope

    - Top-level keys in .gittensory.yml declare the repo's focus and guardrails. - These feed the deterministic findings (such as manifest_blocked_path and{" "} - manifest_missing_tests) and — when gate.manifestPolicy: block — - can become enforceable blockers. + Top-level keys in .gittensory.yml declare the repo's focus and validation + expectations. These feed deterministic findings such as manifest_missing_tests{" "} + and — when gate.manifestPolicy: block — can become enforceable blockers. Manual + path holds are configured only through settings.hardGuardrailGlobs.