feat(miner-ui): add queue release/requeue actions, completing the miner-ui action controls

[galuis116]

Summary

• The miner-ui was 100% read-only until feat(miner-ui): add governor pause/resume controls #5611 added the first write-capable half of this issue: governor
  pause/resume controls (API + UI). That PR's own header comment deliberately deferred the OTHER half — queue
  release/requeue — noting that acting on a specific queue item needs its repoFullName/identifier, which
  the read-only portfolio-queue API (vite-portfolio-queue-api.ts) intentionally never republishes over the
  wire (by design, to avoid leaking the queue's rank-derived priority ordering). This PR resolves that
  follow-up and completes the issue.
• Added apps/gittensory-miner-ui/vite-queue-actions-api.ts, a narrow, purpose-built route:
  • GET /api/queue/actionable — exposes ONLY the two slices an operator actually needs to act on: in-flight
    items (releasable) and completed items (requeueable), and only the fields needed to identify + act on
    them (apiBaseUrl/repoFullName/identifier, plus a leasedAt/enqueuedAt timestamp for context).
    priority is stripped from every response on this route, matching the read-only sibling's own rule.
  • POST /api/queue/release / POST /api/queue/requeue — bridge directly to
    packages/gittensory-miner/lib/portfolio-queue.js's existing reclaimStuckItem/requeueItem store
    methods, the SAME functions gittensory-miner queue release/queue requeue already use. No new queue
    semantics are invented here.
  • A fresh-install fast path (mirroring the read-only siblings) avoids creating the SQLite file as a side
    effect of a doomed-to-fail action: acting on an item in a store that doesn't exist yet can never succeed.
• Added apps/gittensory-miner-ui/src/lib/queue-actions.ts (client, mirrors governor.ts's shape) and wired a
  new "Queue actions" section into the portfolio page, mirroring the governor control section's
  pending-state/error-handling pattern — each row tracks its own pending state (a Set of item keys) rather
  than one global flag, since multiple different rows can plausibly be acted on independently.
• Verified end-to-end against the real dev server (not just unit tests): started vite dev, confirmed
  /api/queue/actionable correctly rejects an unauthenticated request (401, via the existing vite-auth.ts
  cookie gate) and returns an empty snapshot on a fresh install; then enqueued/claimed/completed real items via
  portfolio-queue.js directly, confirmed they appeared correctly in /api/queue/actionable, released one and
  requeued the other via the real POST routes, and confirmed both disappeared from the actionable snapshot
  afterward exactly as designed.

Fixes #4857

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage — this PR's surface is apps/gittensory-miner-ui/**, covered by that app's own real coverage gate (Bring the miner-ui and extension under a coverage gate #4865/test(miner-ui): bring the miner-ui under a real coverage gate #5613), not the root Codecov config. npm --workspace @loopover/ui-miner run test (vitest run --coverage): 149/149 tests pass, well above the app's threshold (85/85/75/85). The three new/changed files are essentially fully covered: vite-queue-actions-api.ts 97.33/98.03/95/98.46 (the one gap is the real default dependency's dynamic import, the same class of gap vite-governor-api.ts itself has), queue-actions.ts 100/100/100/100, portfolio.tsx 100/100/100/100.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run build:miner
• npm run test:miner-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

Ran the full local gate: npm run test:ci (0 failures) and npm audit --audit-level=moderate (0 vulnerabilities), both clean on the final commit.

New/extended apps/gittensory-miner-ui/src/queue-actions.test.tsx (32 tests), mirroring governor.test.tsx's exact structure: QueueActionsSection rendering (loading/error/empty states, per-row release/requeue button wiring, per-row-not-global pending disable, action-error alert, null-leasedAt em-dash fallback); fetchQueueActionable/releaseQueueItem/requeueQueueItem client-lib tests including malformed-payload and non-Error-throw branches; matchQueueActionsRoute route matching; handleQueueActionsRequest covering the fresh-install fast path for BOTH read and write routes, priority-stripping, business-outcome failures (not-actionable) vs. real errors (500), body validation (empty/malformed/missing-field → 400), an explicit-apiBaseUrl-threading test, and a non-Error-throw test; the raw queueActionsApiPlugin Vite middleware wiring (fall-through, real POST body handling, configurePreviewServer); and PortfolioPage-level wiring tests confirming a successful action re-fetches the actionable snapshot while a business-outcome failure does not, and that the Requeue button is wired to requeueAction distinctly from Release.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. — no auth/session/CORS surface CHANGED, but this is the miner-ui's second write-capable surface (after governor pause/resume), so the negative path (an unauthenticated request) was verified live against the real dev server (see Summary) — vite-auth.ts's existing cookie gate covers these new routes automatically with no per-endpoint wiring, exactly as it did for the governor routes.
• API/OpenAPI/MCP behavior is updated and tested where needed. — this is the local miner-ui dev-server API only, not the public gittensory API/OpenAPI/MCP surface; no changes needed there.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. — the new "Queue actions" section has real loading/error/empty states, matching the rest of the page.
• Visible UI changes include a UI Evidence section below. — see below.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. — no doc changes needed; this completes an already-documented issue's scope.

UI Evidence

Verified live against the real vite dev server rather than a screenshot tool (no browser available in this
environment): GET /api/queue/actionable correctly returns 401 without the auth cookie, and with it returns
{"releasable":[...],"requeueable":[...]} reflecting real enqueued/claimed/completed items created directly
via portfolio-queue.js; POST /api/queue/release and POST /api/queue/requeue against those real items both
returned {"ok":true,"entry":{...}}, and a follow-up GET /api/queue/actionable confirmed both items no
longer appeared in the actionable snapshot. The UI component tests (queue-actions.test.tsx) render and
interact with the actual QueueActionsSection/PortfolioPage components via @testing-library/react,
covering the loading/error/empty/populated render states, button wiring, and the pending/error UI feedback the
underlying API calls above drive.

Notes

• Deliberately did NOT touch vite-governor-api.ts, vite-portfolio-queue-api.ts, or the ledgers page — this
  PR is scoped strictly to the queue release/requeue half feat(miner-ui): add governor pause/resume controls #5611 left open.
• Deliberately did NOT modify the read-only portfolio-queue-api.ts's aggregation to add identifiers to its
  existing route — instead added a SEPARATE, narrowly-scoped /api/queue/actionable route so the existing
  read-only endpoint's privacy contract (status counts only, never raw identifiers/priority) stays completely
  unchanged for any other caller.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Caution

🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥

🛑 LoopOver review result - reject/close recommended

_{Review updated: 2026-07-13 18:06:40 UTC}

5 files · 1 AI reviewer · 1 blocker · readiness 100/100 · CI green · clean

🛑 Suggested Action - Reject/Close

• AI review could not be completed: The dual-model AI review did not return a usable verdict for this change.

Review summary
This PR adds a narrow, purpose-built API route and client for releasing/requeuing portfolio-queue items, mirroring the existing governor pause/resume pattern and bridging directly to existing store methods (reclaimStuckItem/requeueItem) rather than inventing new queue semantics. The implementation is well-scoped: it strips priority from responses to match the read-only sibling's privacy rule, avoids creating the SQLite file on a fresh install for actions that can't succeed anyway, and ships with extensive tests covering route matching, fresh-install paths, business-outcome failures, and UI wiring. It explicitly closes issue #4857 (the deferred queue half of #4857/#5611), satisfying the issue-link requirement.

Nits — 6 non-blocking

• apps/gittensory-miner-ui/vite-queue-actions-api.ts:100 — parseActionTarget returns null for both an empty body and a malformed/missing-field body, collapsing distinct failure modes into one generic 400 `invalid_request_body`; consider a more specific error code if operators will need to debug malformed vs. empty POSTs.
• apps/gittensory-miner-ui/vite-queue-actions-api.ts and portfolio.tsx use several magic HTTP status literals (200/400/500) inline rather than named constants — minor readability nit, consistent with the existing governor-api sibling's style though.
• apps/gittensory-miner-ui/src/routes/portfolio.tsx:260 and vite-queue-actions-api.ts:130 have moderately deep nesting (map inside conditional inside try) — readable as-is given the small scope, but worth flagging if this file grows more routes.
• Consider extracting the repeated releasable/requeueable table-rendering block in QueueActionsSection into a small shared row-renderer to cut duplication, though the current size is still readable.
• The `stripPriority` helper's return type `Omit<QueueEntry, never>` is equivalent to `QueueEntry` — likely meant as documentation intent but could just be typed directly as `QueueEntry` for clarity.
• AI review could not be completed — The gate is held for a human reviewer rather than passed automatically; it re-evaluates on the next update.

Why this is blocked

• Linked issue overlaps another open PR — Review the related PRs before spending reviewer time on duplicate work.

📋 Copy for AI agents — paste into your coding agent

Fix the following blocker(s) from this PR review:

1. Linked issue overlaps another open PR — Review the related PRs before spending reviewer time on duplicate work.

Signal	Result	Evidence
Code review	❌ 1 blocker	1 reviewer
Linked issue	✅ Linked	#4857
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 1873 registered-repo PR(s), 1240 merged, 49 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	galuis116; Gittensor profile; 1873 PR(s), 49 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.
Improvement	✅ Minor	risk: clean · value: minor — Code changes are accompanied by test evidence. LLM value judgment: significant — This completes the deliberately-deferred write half of the miner-ui action controls issue (#4857) with a narrow, well-tested API surface that reuses existing store methods rather than inventing new queue semantics.

Linked issue satisfaction

Addressed
The PR completes the queue-actions half of this issue (governor pause/resume was already merged in #5611): it adds a narrow release/requeue API bridged to the existing portfolio-queue store methods, wires a client and a 'Queue actions' UI section into the portfolio page using shared design-system Button/Card/Table components, and includes tests covering the read/write routes and UI interactions.

Review context

• Author: galuis116
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: JavaScript, Python, Dart, TypeScript, HTML, MDX, Rust, C++
• Official Gittensor activity: 1873 PR(s), 49 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

[BETA] Chat with Gittensory

Ask Gittensory a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @gittensory ask <question> answers contribution-quality Q&A with source citations and freshness.
• @gittensory chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @gittensory mention with a real question is routed to the closest matching read-only command automatically -- no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/gittensory-commands

Visual preview

Route	Viewport	Before (production)	After (this PR's preview)	Diff
/portfolio	desktop			—
/portfolio	mobile			—

Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

Gittensory is closing this pull request on the maintainer's behalf (Linked issue overlaps another open PR; duplicate of another open PR). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.