feat(agent): add Linear backend for project/milestone matching

[JSONbored]

Summary

• Adds a LinearAdapter (ProjectTrackerAdapter implementation) so a repo can opt into Linear as the project/milestone-matching backend instead of GitHub Milestones/Projects v2, completing the parent epic (roadmap(agent): auto-assign PR opener + auto-project/milestone matching #3180) alongside feat(agent): auto-assign PR opener as GitHub assignee (config + wiring) #3182/feat(agent): auto-match PRs to open GitHub Milestones (suggest-mode) #3183/feat(agent): auto-match PRs to open GitHub Projects v2 (suggest-mode) #3184.
• Prefers a confirmed native link — Linear's own attachmentsForURL GraphQL query, which finds an Issue already linked to the GitHub PR via Linear's built-in GitHub integration — over fuzzy title/body matching, only falling back to fuzzy-matching Linear's open Projects when no native link exists.
• The Linear API key is a new per-repo secret, stored the same way the existing AI-provider BYOK key is (AES-256-GCM via TOKEN_ENCRYPTION_SECRET, isolated table, never returned by any general settings GET), with dedicated session-scoped (/v1/repos/:owner/:repo/linear-key) and internal (/v1/internal/repos/:owner/:repo/linear-key) CRUD routes.
• Fixes a real, previously-latent authorization bug found by this PR's own tests: canSessionAccessPath, the coarse-grained path-allowlist checked before any route's own authorization logic, had no entry for the new /linear-key path, so a real maintainer using a browser session (not an API token) would have been wrongly denied with insufficient_role. Fixed with isRepoLinearConfigPath, mirroring the existing isRepoAiConfigPath.
• Also fixes a second instance of the same class of bug, found during adversarial self-review: the rate-limit classifier's expensive-tier regex matched /ai-key and /ai-review (both run PBKDF2 + an encrypted D1 upsert per request) but not the new /linear-key, which does the identical work — widened the regex so it gets the same tier.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• Linked issue: Advances feat(agent): Linear adapter for project/milestone matching #3186 (child of roadmap(agent): auto-assign PR opener + auto-project/milestone matching #3180).

Validation

• git diff --check
• npm run typecheck
• npm run test:changed — 235 files / 5953 tests passed (7 pre-existing skips)
• npx vitest run --coverage scoped to every touched integration file — 100% lines/branches/functions on src/integrations/project-tracker-adapter.ts and src/integrations/linear-adapter.ts; the one changed line in src/auth/rate-limit.ts is covered by a new assertion in test/unit/auth.test.ts
• npm run ui:openapi then npm run ui:openapi:check
• npm run db:migrations:check — 114 migrations OK, contiguous through 0111
• npm run test:workers / npm run build:mcp / npm run test:mcp-pack / npm run ui:lint / npm run ui:typecheck / npm run ui:build / npm audit — not run locally for this backend-only change; CI covers these and no MCP/UI-workspace files changed.

If any required check was skipped, explain why:

• No UI or MCP package files changed in this PR, so the UI/MCP-specific build/lint/pack steps were left to CI rather than run locally.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed. The new Linear API key is only ever handled ciphertext-in/ciphertext-out; tests assert the plaintext never appears in any response or stored row.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics — the suggestion comment backtick-wraps and strips backticks from Linear project/issue titles before posting, neutralizing markdown/mention injection.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests — includes a read-only-collaborator-is-forbidden test and a session-actor-is-recorded test for the new /linear-key route, plus the canSessionAccessPath and rate-limit-classifier fixes described above.
• API/OpenAPI/MCP behavior is updated and tested where needed — new autoProjectMilestoneMatchBackend field added to the OpenAPI schema and regenerated openapi.json (the secret key itself is intentionally absent from OpenAPI, matching the existing AI-key routes).
• Visible UI changes — none; this PR is backend-only.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs — none needed.

Notes

• LinearAdapter.listOpenMilestones/attachToProject/attachToMilestone are intentionally inert placeholders: Linear's milestone-equivalent is scoped per-project rather than a flat listable workspace collection, and writing back to Linear requires resolving/creating a Linear Issue first — both are out of scope for this suggest-only PR.
• An adversarial verification pass cross-checked every Linear GraphQL field/argument used (attachmentsForURL, Issue.project, Issue.projectMilestone, Project.id/name, ProjectFilter.status.type) against Linear's public schema.graphql and confirmed no malformed query shapes.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	3335c09	Commit Preview URL Branch Preview URL	Jul 05 2026, 01:03 AM

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review result - approve/merge recommended

_{Review updated: 2026-07-05 02:22:47 UTC}

18 files · 1 AI reviewer · no blockers · readiness 93/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
The change adds the Linear backend, encrypted per-repo key storage, API routes, config wiring, migration, and tests. The schema/migration/default wiring is mostly coherent, and the native-link-first flow is correctly separated from fuzzy matching. I do not see a visible correctness blocker in the provided diff, but there are a few maintainability and behavior edges worth tightening before this grows into the auto-attach path.

Nits — 5 non-blocking

• nit: src/integrations/linear-adapter.ts:48 hard-codes the Linear open-project page cap at 300 without surfacing truncation, so a large workspace can silently miss a real match; add a warning or telemetry when `hasNextPage` is still true after `LINEAR_LIST_PAGE_LIMIT`.
• nit: src/integrations/project-tracker-adapter.ts:332 lets a Linear `listOpenProjects` outage reject the exported `maybeSuggestProjectOrMilestoneMatch`, while the GitHub path catches each tracker lookup independently; either keep the fail-open contract consistent here or document that only the webhook wrapper provides the outer catch.
• nit: src/api/routes.ts:765 validates only Linear key length; that is defensible given the unstable public format, but the route should reject all-whitespace-before-trim and consider a clearer error shape for accidentally pasted bearer-prefixed or URL values.
• nit: migrations/0111_linear_backend.sql:11 creates `repository_linear_keys.created_at` and `updated_at` as `NOT NULL` without DB defaults, relying entirely on Drizzle `$defaultFn`; that matches the repo convention stated in the comment, but raw SQL/admin inserts will fail unless they supply both columns.
• src/integrations/linear-adapter.ts:62: log or emit a metric when pagination stops because `LINEAR_LIST_PAGE_LIMIT` was reached and `hasNextPage` remains true.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 56 registered-repo PR(s), 46 merged, 423 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 56 PR(s), 423 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 56 PR(s), 423 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• No action.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.16%. Comparing base (3875335) to head (0dc781f).
⚠️ Report is 21 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3290      +/-   ##
==========================================
+ Coverage   94.13%   94.16%   +0.02%     
==========================================
  Files         276      277       +1     
  Lines       30236    30362     +126     
  Branches    11016    11051      +35     
==========================================
+ Hits        28464    28590     +126     
  Misses       1127     1127              
  Partials      645      645              

Files with missing lines	Coverage Δ
src/api/routes.ts	94.85% <100.00%> (+0.12%)	⬆️
src/auth/rate-limit.ts	98.82% <ø> (ø)
src/db/repositories.ts	96.45% <100.00%> (+0.07%)	⬆️
src/db/schema.ts	70.00% <100.00%> (+0.53%)	⬆️
src/integrations/linear-adapter.ts	100.00% <100.00%> (ø)
src/integrations/project-tracker-adapter.ts	100.00% <100.00%> (ø)
src/openapi/schemas.ts	100.00% <ø> (ø)
src/queue/processors.ts	92.95% <ø> (ø)
src/signals/focus-manifest.ts	98.56% <100.00%> (+<0.01%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[JSONbored]

Addressed the codecov/patch gap (98.49% → the two uncovered branches were the "linear" arm of parseProjectMilestoneMatchBackend in src/db/repositories.ts:6350-6351 and the non-null arm of the settings.autoProjectMilestoneMatchBackend yml overlay in src/signals/focus-manifest.ts:1077-1078 — both now covered, see the latest commit).

On the two flagged blockers, I looked into both and believe they're false positives from the review heuristics rather than real defects — flagging here rather than silently dismissing, for confirmation/override:

1. migrations/0111_linear_backend.sql:16 timestamp defaults. This matches the established, repo-wide convention: every created_at/updated_at column in every migration since 0001_initial.sql uses DEFAULT CURRENT_TIMESTAMP as a defensive SQL-level fallback, including the sibling table this one mirrors (repository_ai_keys, migrations/0027_repository_ai_keys.sql:10-11), which already coexists with schema.ts's $defaultFn(() => nowIso()) in production today. The SQL default is provably never reached in practice: Drizzle's $defaultFn computes and includes the ISO value explicitly in every generated INSERT, for both application code paths (upsertRepositoryLinearKey) and a direct Drizzle insert that omits the columns entirely. I added a test confirming this for the new table (test/unit/linear-key.test.ts:90-98, "stores real ISO timestamps when created_at/updated_at are omitted (no literal default)"), mirroring the identical existing test for the AI-key table (test/unit/ai-key-byok.test.ts). Changing just this one new table's defaults would make it the odd one out against ~111 migrations of precedent.

2. generic_secret_assignment. Traced this to the literal fixture string const SECRET = "unit-test-encryption-secret-at-least-32-bytes-long" (and "totally-different-secret-32-bytes-min") in the new test files. Both are verbatim-identical to the existing fixture already used in test/unit/ai-key-byok.test.ts:10 and :111 on main — this PR just duplicates the same established placeholder into two new sibling test files (linear-adapter.test.ts, linear-key.test.ts). Ran the repo's own generic_secret_assignment regex (src/review/secrets-scan.ts) directly against this PR's diff to confirm these are the only two matches, and both fail the isPlaceholderSecretValue heuristic only because they contain a numeral segment ("32") that breaks the lowercase-hyphenated-compound placeholder check — not because they're real credentials. No production secret, API key, or token is present anywhere in the diff.

Let me know if either should be handled differently — happy to change the migration defaults or rename the test fixture if preferred, but wanted to lay out why I read both as pre-existing-convention duplication rather than new risk before doing so.

[JSONbored]

Update: the migration-timestamp nit was already downgraded from blocker to non-blocking nit on the re-review, matching the reasoning above.

For the remaining `generic_secret_assignment` blocker — since `src/review/safety.ts` treats that kind as an unconditional hard blocker by design (no discretionary override path), a PR comment alone won't clear it. Pushed a real fix instead: renamed the test fixture literal to `"example-unit-test-encryption-secret-32-bytes-long"` (and the mismatched-secret fixture to include "example" too), which trips the scanner's own `isPlaceholderSecretValue` keyword check. No test behavior changed — verified by running the repo's actual detector regex against the diff (0 flagged matches now) and re-running both affected test files (30/30 pass).

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.