feat(review): make gittensor subnet integration an opt-in experimental plugin

[JSONbored]

Closes #5035

Summary

• Adds experimental: as a new top-level .gittensory.yml block, structurally parallel to the existing features: block but for optional ecosystem/network plugins rather than converged review capabilities. gittensor — the original gittensor-subnet mining-registry/scoring integration — is the first plugin, resolved via the established resolveManifestOnlyFeature precedence shape (env kill-switch AND per-repo opt-in, no allowlist fallback).
• Self-host's refresh-registry cron job (which fetches the entire upstream gittensor subnet registry from entrius/gittensor) is now skipped entirely when no repo on the instance has opted into the gittensor plugin, so a plain self-host instance makes zero outbound contact with the gittensor subnet registry by default. Cloud is completely unaffected — it always enqueues, unchanged.
• Ground floor only: this PR does not yet scope which repos get written to isRegistered=true when refresh-registry does run (that's tracked separately, see below) — it only controls whether the job runs at all.

Why this shape

Investigated why a self-hosted instance's job queue kept growing despite low PR traffic — traced it to the periodic refresh-registry/backfill-registered-repos cron jobs unconditionally tracking the entire gittensor subnet's miner registry (18 repos on the live box, only 3 of which the operator actually installed/reviews). Attempting to scope registry/sync.ts's writes directly surfaced a deeper problem: repositories.isRegistered is also load-bearing for several unrelated core features (signal snapshots, fidelity repair, the regate sweep, ops-alerts, selftune, maintainer-recap) — scoping it broke 130 tests. That untangling is now tracked as its own epic (#5016, 10 sub-issues) since it's a larger, higher-risk change. This PR ships the safe, additive part now: the plugin-toggle infrastructure and the cron gate that don't touch isRegistered semantics at all.

Scope

• Conventional Commit title.
• Focused — engine manifest parsing, one new wire module, cron gating, config docs, tests. No unrelated changes.
• Follows CONTRIBUTING.md.
• Linked issue: Closes Make gittensor subnet integration an opt-in experimental plugin #5035.

Validation

• git diff --check
• npm run typecheck
• npm run test:coverage (full, unsharded) — 100% branch coverage on every changed line; gittensor-wire.ts at 100% stmts/branch/funcs/lines.
• npm run test:ci (full local gate — actionlint, migrations/schema-drift checks, cf-typegen:check, typecheck, test:coverage, test:workers, MCP build+pack, miner build+pack, REES tests, UI openapi/lint/typecheck/test/build, docs/command-reference drift checks)
• npm audit --audit-level=moderate — clean
• New behavior (manifest parsing, wire activation, cron gate) has dedicated unit tests covering both sides of every branch, including the fail-open per-repo error path.

Safety

• No secrets/wallets/hotkeys/trust-scores/reward values anywhere.
• Public-facing text unaffected — this is internal scheduling/config plumbing.
• No auth/cookie/CORS/session changes.
• No UI changes.
• Docs updated: config/examples/gittensory.full.yml and .gittensory.yml.example both document the new experimental: block; wrangler.jsonc documents the new GITTENSORY_EXPERIMENTAL_GITTENSOR var.

Notes

• Part of the isRegistered/isInstalled untangling initiative — see epic Untangle gittensor-subnet integration from core self-host review features #5016 for the full plan and sub-issues, including the follow-up (Re-introduce registry/sync.ts self-host scoping to gittensor-opted-in repos (final step) #5027) that will scope registry/sync.ts's writes once the epic's core-feature migrations land.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	c686328	Commit Preview URL Branch Preview URL	Jul 11 2026, 10:00 AM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.28%. Comparing base (87d36a2) to head (c686328).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5030   +/-   ##
=======================================
  Coverage   94.28%   94.28%           
=======================================
  Files         461      462    +1     
  Lines       39331    39361   +30     
  Branches    14351    14360    +9     
=======================================
+ Hits        37083    37113   +30     
  Misses       1593     1593           
  Partials      655      655           

Flag	Coverage Δ
shard-1	46.69% <29.03%> (-0.02%)	⬇️
shard-2	33.37% <74.19%> (+0.03%)	⬆️
shard-3	31.44% <29.03%> (-0.01%)	⬇️
shard-4	32.78% <9.67%> (-0.02%)	⬇️
shard-5	33.40% <9.67%> (-0.02%)	⬇️
shard-6	45.09% <93.54%> (+0.03%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
packages/gittensory-engine/src/focus-manifest.ts	99.19% <100.00%> (+0.01%)	⬆️
src/index.ts	95.65% <100.00%> (+0.14%)	⬆️
src/review/gittensor-wire.ts	100.00% <100.00%> (ø)
src/signals/focus-manifest-loader.ts	99.18% <ø> (ø)
src/signals/focus-manifest.ts	99.64% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Caution

🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥

🛑 Gittensory review result - fixes required

_{Review updated: 2026-07-11 09:57:08 UTC}

15 files · 1 AI reviewer · no blockers · readiness 100/100 · CI failing · unstable

🛑 Suggested Action - Manual Review

• Touches a guarded path — held for manual review: This PR changes guardrail-protected path(s): wrangler.jsonc (matched wrangler.jsonc), wrangler.jsonc (matched **/wrangler.jsonc).

Review summary
This PR adds a well-isolated `experimental:` manifest block and a `gittensor-wire.ts` module that gates both per-repo plugin activation and the hourly `refresh-registry` cron enqueue behind an env kill-switch AND per-repo manifest opt-in, mirroring the existing `resolveManifestOnlyFeature`/`impact-map-wire.ts` pattern. The wiring is traced correctly end-to-end (index.ts only enqueues when `gittensorEnabledRepoFullNames` returns a non-empty set on self-host; cloud path is untouched) and the deliberate choice not to filter by `isRegistered` (to avoid the circular chicken-and-egg dependency) is explained and tested. Tests are substantive, not fabricated — they exercise the real DB-backed `gittensorEnabledRepoFullNames` path including a poisoned-query fail-safe test and an actual scheduled-job assertion in index.test.ts.

Nits — 7 non-blocking

• The PR description references only the tracking epic (Untangle gittensor-subnet integration from core self-host review features #5016) for future scoping work but doesn't show a concrete 'Closes #NNNN'/'Fixes #NNNN' line for the issue this PR itself resolves — worth confirming there's an eligible open issue this PR is explicitly linked to before merge.
• codecov/patch failed at 93.54% against a 99% target; worth identifying which changed branch in `src/index.ts` or `gittensor-wire.ts` is uncovered (e.g. the `else` console.log branch at src/index.ts:216) rather than letting the gap ride.
• `gittensorEnabledRepoFullNames` (src/review/gittensor-wire.ts) loops over every locally-known repo via `listRepositories` and awaits `loadRepoFocusManifest` sequentially per repo rather than in parallel — fine at today's cron cadence and repo counts, but worth a `Promise.all` if the self-host repo count grows meaningfully.
• The PR explicitly discloses that `refresh-registry`, once enqueued, still fetches/writes the *entire* upstream registry rather than scoping to opted-in repos — that's an accepted 'ground floor' limitation per the description, but it means the 'zero footprint' framing in comments (e.g. gittensor-wire.ts's top-of-file comment) is only true for a zero-opt-in instance, not for a partially-opted-in one; a one-line clarifying comment there would avoid future confusion.
• Confirm and link the specific issue this PR closes (or amend the description) per repo convention before merge.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

CI checks failing

• codecov/patch — 96.77% of diff hit (target 99.00%)

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#5035
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 47 registered-repo PR(s), 39 merged, 428 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 47 PR(s), 428 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.
Improvement	✅ Minor	risk: clean · value: minor — Code changes are accompanied by test evidence.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 47 PR(s), 428 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review