feat(settings): distinguish assign-fallback outcome in audit_events

[JSONbored]

Summary

• src/services/agent-action-executor.ts's "assign" case (feat(agent): auto-assign PR opener as GitHub assignee (config + wiring) #3182) calls ensurePullRequestAssignee; when GitHub silently refuses the assignee (no push/triage access — the common case for an external contributor), it falls back to a by:<login> label. Both outcomes previously recorded the identical generic "completed" audit event with the planner's generic "auto-assign PR opener" reason, so audit_events had no way to tell whether a given PR actually got a real GitHub assignee or silently fell back to the label — the literal gap named in a recent repo-policy config audit ("auto-assign has unclear failure visibility when GitHub refuses assignees").
• Fix: performAction now returns an optional audit-detail override (string | undefined), used only by the assign fallback branch, so the caller's audit("completed", detailOverride ?? action.reason) records a distinct detail ("assignee refused by GitHub — fell back to a by:<login> label") when the fallback fires, and the original generic reason otherwise. Every other action class is unaffected — they implicitly return undefined.
• No issue filed — small, self-evident audit-visibility gap, found via direct investigation rather than a reported incident.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run typecheck (clean)
• npx vitest run test/unit/agent-action-executor.test.ts (120/120 passing, including the 2 updated assign tests asserting the new audit detail)
• npx vitest run test/unit/agent-approval-queue.test.ts (68/68 passing — this path also calls performAction on approval-queue accept)
• npm run test:workers / npm run build:mcp / npm run test:mcp-pack / npm run ui:openapi:check / npm run ui:build — not run individually this PR; no worker/MCP/OpenAPI/UI surface touched. Ran the full npm run test:ci gate once already this session (PR fix(settings): authorize circuit-breaker hold labels via merge/close autonomy #3363, same branch point) with no relevant failures; this PR's diff is a small, isolated change to one function's return type plus its one call site.
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries — both the "real assignee applied" and "GitHub refused, fell back to label" branches now assert their distinct audit_events.detail value directly.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics. (The new detail string is an internal audit_events row, never posted to GitHub.)
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. — N/A.
• API/OpenAPI/MCP behavior is updated and tested where needed. — N/A, no API/OpenAPI/MCP surface changed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. — N/A, no UI change.
• Visible UI changes include a UI Evidence section below. — N/A, no visible UI change (internal audit-log detail only).
• Public docs/changelogs are updated where needed. — N/A, internal audit-trail detail, no user-facing/documented behavior change.

Notes

• PR 3 of a small sequence auditing repo-policy config consistency (see PR fix(settings): authorize circuit-breaker hold labels via merge/close autonomy #3363 and PR fix(selfhost): recognize repoDocGeneration in the config-lint allowlist #3364 for PRs 1-2).

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review result - approve/merge recommended

_{Review updated: 2026-07-05 05:11:37 UTC}

2 files · 1 AI reviewer · no blockers · readiness 93/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
The change correctly threads an optional audit-detail override from `performAction` into the completed audit path and only uses it for the reachable assign fallback branch. The tests cover both real assignee and fallback outcomes against the audit table, so this closes the visibility gap without changing other action classes.

Nits — 2 non-blocking

• nit: `src/services/agent-action-executor.ts:665` adds a long JSDoc that mostly restates the nearby assign-case comment; keeping the contract comment short and leaving the GitHub behavior detail at the branch would reduce duplication.
• `src/services/agent-action-executor.ts:744`: consider extracting the fallback audit detail into a small helper or constant-producing function if this string becomes part of any reporting contract, so tests and implementation do not drift on wording.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 56 registered-repo PR(s), 46 merged, 416 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 56 PR(s), 416 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: Python, TypeScript, JavaScript, Ruby, Go, Kotlin, MDX, Shell
• Official Gittensor activity: 56 PR(s), 416 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• No action.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.88%. Comparing base (3e7390f) to head (c3c2365).
⚠️ Report is 3 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3366   +/-   ##
=======================================
  Coverage   93.88%   93.88%           
=======================================
  Files         282      282           
  Lines       30570    30571    +1     
  Branches    11136    11137    +1     
=======================================
+ Hits        28702    28703    +1     
  Misses       1211     1211           
  Partials      657      657           

Files with missing lines	Coverage Δ
src/services/agent-action-executor.ts	96.78% <100.00%> (+0.01%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.