feat(review): decouple e2e-test-gen auto-trigger and widen checkbox auth (#4199)

[JSONbored]

Summary

• manifest_missing_tests auto-trigger and the maintainer-initiated command/checkbox paths shared one flag (features.e2eTests), so enabling on-demand test generation for a repo also silently enabled unprompted auto-firing. Add review.e2e_test_auto_trigger (default off, per-repo) as a separate, explicit opt-in required in addition to features.e2eTests.
• The generate-tests checkbox hardcoded a maintainer-only commandAuthorization override, ignoring whatever a repo's own .gittensory.yml configured — unlike the identical text command, which already respects settings.commandAuthorization. Remove the override so the checkbox resolves the same, already-safely-clamped policy (still maintainer-only by default; widenable per repo to collaborator/confirmed_miner, never to the spoofable raw pr_author role).
• Add a [BETA] badge to the checkbox label.

Advances #4199. Follow-up to #4196 and #4589 (both closed/shipped, this corrects a gap in each).

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• Owner PR — no separate linked-issue requirement, but see "Advances chore(review): enable + validate E2E test generation end-to-end #4199" above.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally (full npm run test:ci, unsharded) — 94.42% statements / 93.39% branches globally; every touched file at 100% line+branch within its own tests; both new gates bug-injection verified (temporarily reverted each fix and confirmed the new regression test fails, then restored and confirmed green).
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate — 0 vulnerabilities
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth/authorization change (command-authorization de-hardcode) includes negative-path tests: default-still-maintainer-only denial, and the pr_author clamp still denying the PR's own author even when a repo tries to configure it.
• API/OpenAPI/MCP behavior is updated and tested where needed — no OpenAPI/DB surface touched; the new field lives entirely in the .gittensory.yml/FocusManifest config layer, mirroring review.e2e_test_delivery's existing precedent.
• No UI changes (backend + config-layer only).

Notes

• Also fixed the gittensory repo's own self-host config (GITTENSORY_REVIEW_E2E_TESTS stays off on the deployed instance until this ships and a new ORB image is cut/deployed).

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	075fcc0	Commit Preview URL Branch Preview URL	Jul 11 2026, 12:19 AM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.22%. Comparing base (9277537) to head (075fcc0).
⚠️ Report is 4 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4757   +/-   ##
=======================================
  Coverage   94.22%   94.22%           
=======================================
  Files         441      441           
  Lines       38745    38748    +3     
  Branches    14106    14107    +1     
=======================================
+ Hits        36508    36511    +3     
  Misses       1577     1577           
  Partials      660      660           

Files with missing lines	Coverage Δ
packages/gittensory-engine/src/focus-manifest.ts	99.11% <100.00%> (+<0.01%)	⬆️
src/queue/processors.ts	95.70% <100.00%> (ø)
src/signals/focus-manifest.ts	99.64% <100.00%> (+<0.01%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-11 00:12:31 UTC}

8 files · 2 blockers · readiness 93/100 · CI green · dirty

⏸️ Suggested Action - Manual Review

• AI review already in progress for this PR head: Another Gittensory pass is already running the AI review for this exact PR head. This pass is skipping to avoid a duplicate LLM call.

Review summary
AI review is already running for this PR head in another Gittensory pass. Gittensory is holding this PR for manual review until that pass completes.

Nits — 1 non-blocking

• AI review already in progress for this PR head — The gate is held for a human reviewer rather than passed automatically; it re-evaluates once the in-flight review completes or on the next update.

Concerns raised — review before merging

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Signal	Result	Evidence
Code review	❌ 2 blockers	No AI review summary
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 48 registered-repo PR(s), 40 merged, 275 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 48 PR(s), 275 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 48 PR(s), 275 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review