feat(observability): add dashboard panel + alert for review-floor clamps

[JSONbored]

Summary

• gittensory_ai_review_onmerge_clamped_total fires whenever a repo's .gittensory.yml tries to loosen the operator's onMerge/combine/reviewer-count floor and gets clamped back — per its own surrounding comment, this exists to ensure "a fired clamp increments a metric so it is surfaced, not silently ignored." The metric was registered and incremented correctly, but no Grafana panel queried it and no Prometheus alert referenced it — a counter nobody scrapes into a dashboard or alert is functionally silent for an operator not manually curling /metrics.
• This is a governance-relevant signal (a repo attempting to bypass an operator-set review-strictness floor), not routine noise — its sibling metric gittensory_ai_review_inconclusive_total (a very similar shape) already has both a panel-equivalent story and a Prometheus alert, confirming this was a real asymmetric gap.
• Added a stat panel to grafana/dashboards/gittensory.json and a new GittensoryAiReviewOnMergeFloorBypassAttempted alert to prometheus/rules/alerts.yml, mirroring the exact > 0 / for: 5m / severity: warning shape already used by GittensoryAiProviderCircuitOpen for the same "any occurrence over a window" alert style.

Found via a fresh performance/scalability/accuracy hardening audit of the self-host ORB stack. Tracked under #1667.

Scope

• grafana/dashboards/gittensory.json — new panel (appended at the end, its own gridPos row — no existing panel repositioned)
• prometheus/rules/alerts.yml — new alert rule
• test/unit/selfhost-grafana-dashboard.test.ts — cover both

Validation

• npm run typecheck
• npm run selfhost:validate-observability (dashboards + alert rules valid)
• npx vitest run test/unit/selfhost-grafana-dashboard.test.ts — 11/11 passing
• git diff --check clean

Safety

• Config-only change, no src/** lines, no secrets. New panel placed below every existing panel (its own gridPos) so no other panel was repositioned.

Closes #3901

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review result - approve/merge recommended

_{Review updated: 2026-07-07 07:11:58 UTC}

3 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This is a config-only observability addition: a new Grafana stat panel and Prometheus alert surfacing the previously-unmonitored `gittensory_ai_review_onmerge_clamped_total` counter, mirroring the existing `GittensoryAiProviderCircuitOpen` alert shape (increase over 1h > 0, for: 5m, severity warning). The added test asserts both the panel's `expr` and the alert's key fields exist in the respective files, and CI (including dashboard/alert validation and vitest) passed on this exact commit. The change is additive, low-risk, and internally consistent with the sibling `inconclusive_total` pattern the description cites.

Nits — 6 non-blocking

• Panel `id: 161` in grafana/dashboards/gittensory.json (diff line ~3076) isn't verifiable as unique against the other ~160 panels in this 3099-line file from the diff alone — worth double-checking no existing panel already uses that id, since Grafana silently misbehaves on id collisions.
• The runbook annotation in prometheus/rules/alerts.yml claims the counter 'is labeled by mode', but that label isn't visible anywhere in this diff — confirm the metric registration actually attaches a `mode` label before an operator relies on that runbook instruction.
• The panel title, test description, and alert comment all cite 'feat(observability): add Grafana panel + alert for gittensory_ai_review_onmerge_clamped_total #3901' as the tracking issue, but the PR footer says 'Closes feat(preflight): generate public-safe PR packets from metadata only #39' — worth confirming which issue number is correct so the auto-close reference doesn't point at the wrong issue.
• Add a quick grep/check in CI or the test for duplicate Grafana panel `id`s dashboard-wide, since this file is large enough that a collision is easy to introduce and hard to spot in review.
• Reconcile the 'feat(observability): add Grafana panel + alert for gittensory_ai_review_onmerge_clamped_total #3901' vs 'feat(preflight): generate public-safe PR packets from metadata only #39' references across the panel title, test name, and PR 'Closes' line so they all point at the same issue.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#3901
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 51 registered-repo PR(s), 43 merged, 343 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 51 PR(s), 343 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, JavaScript, Ruby, Go, Kotlin, MDX, Shell
• Official Gittensor activity: 51 PR(s), 343 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.58%. Comparing base (c433e59) to head (3fd0b5e).
⚠️ Report is 4 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3932   +/-   ##
=======================================
  Coverage   93.58%   93.58%           
=======================================
  Files         358      358           
  Lines       34342    34342           
  Branches    12570    12570           
=======================================
  Hits        32138    32138           
  Misses       1580     1580           
  Partials      624      624           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.