feat(review): add a submission-cadence/inter-arrival-time signal to flag machine-paced submitters

[JSONbored]

Summary

• Every existing anti-abuse signal (reputation burst-floor, slop score) counts volume or ratios within a time window; none has an inter-arrival-time/rate term. A fast, well-formed, strategically low-value submitter is invisible to the one dimension (superhuman pace) that would otherwise be a strong tell.
• computeSubmissionCadence / isMachinePacedCadence (pure): the median gap between a submitter's recent review_targets rows, flagged only once both a real sample size (5+) AND a sub-10-minute median gap are present.
• getSubmitterCadence: queries created_at across ALL review_targets rows, not just terminal ones — a fresh burst of still-open submissions is exactly what this needs to catch, since by the time a PR becomes terminal the (paid) AI review has already run on it.
• Wired into shouldSkipAiForReputation as an independent, additional check alongside the existing quality/burst signal — a submitter whose individual PRs all look fine can still be caught on cadence alone. The extra cadence read is skipped once the quality/burst check alone already justifies downgrading.
• New migration adds the supporting (project, submitter, created_at) index — no existing index covers this shape.

Scoped to per-repo cadence for now. An install-wide variant (mirroring #4513's confirmed-miner-aware cross-repo pattern) is a natural fast-follow once #4513 merges — kept out of this PR to avoid depending on an unmerged branch.

Test plan

• test/unit/submitter-reputation.test.ts — 11 new tests for computeSubmissionCadence/isMachinePacedCadence/getSubmitterCadence (median-gap math, order-independence, even/odd gap counts, boundary thresholds, fail-safe paths)
• test/unit/reputation-wiring.test.ts — 4 new tests: machine-paced-but-quality-clean submitter is caught, comfortably-human-paced submitter is not, the cadence read is skipped once the quality/burst check already downgrades, null-submitter coalesce
• 100% statement/branch/function/line coverage on both touched source files
• npx tsc --noEmit clean

Fixes #4514

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.08%. Comparing base (80d623f) to head (a9b449a).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4549   +/-   ##
=======================================
  Coverage   94.08%   94.08%           
=======================================
  Files         427      427           
  Lines       37961    37981   +20     
  Branches    13864    13870    +6     
=======================================
+ Hits        35715    35736   +21     
  Misses       1586     1586           
+ Partials      660      659    -1     

Files with missing lines	Coverage Δ
src/review/reputation-wire.ts	100.00% <100.00%> (+8.33%)	⬆️
src/review/submitter-reputation.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review result - approve/merge recommended

_{Review updated: 2026-07-10 02:42:56 UTC}

5 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
AI review could not be completed for this PR head. Gittensory is holding this PR for manual review instead of relying on deterministic signals alone.

Nits — 1 non-blocking

• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#4514
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 48 registered-repo PR(s), 40 merged, 347 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 48 PR(s), 347 issue(s).
Gate result	✅ Passing	No configured blocker found.

Linked issue satisfaction

Addressed
The PR adds a pure median-inter-arrival-time signal (computeSubmissionCadence/isMachinePacedCadence) plus a D1-backed getSubmitterCadence, wires it as an independent additional check in shouldSkipAiForReputation (advisory-tier, only penalizing sustained sub-10-minute cadence over 5+ submissions, not merged into the existing burst/quality signal), adds a supporting index migration, and includes tes

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 48 PR(s), 347 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review