refactor(engine): extract the deny-hook pure logic into gittensory-engine

[jeffrey701]

What & why

Closes #5667.

lib/deny-hooks.js's rule evaluator and lib/deny-hook-synthesis.js's proposal-synthesis logic are pure, deterministic business logic (each self-documented as "no IO, no globals, no Date/random") but lived directly in the self-host gittensory-miner package with no gittensory-engine counterpart — unlike every other business-logic module (governor/chokepoint, portfolio-queue selection, worktree planning, …), which already follow the "pure engine function + thin miner-lib wrapper" split. A hosted service wanting per-tenant deny-hook enforcement had to depend on the whole SQLite-backed miner package just to reach one pure function.

How (mirrors governor/chokepoint.ts's split)

• New packages/gittensory-engine/src/miner/deny-hooks.ts — the pure rule evaluator (DEFAULT_DENY_RULES, evaluateDenyHooks + DenyRule/DenyVerdict/ProposedToolCall types).
• New packages/gittensory-engine/src/miner/deny-hook-synthesis.ts — the pure proposal-synthesis logic (synthesizeDenyRuleProposals, aggregateBlockerHistory, resolveEffectiveDenyRules, setProposalStatuses, the normalize/canonicalize helpers, DEFAULT_SYNTHESIS_CONFIG + types).
• Clock injected — the engine's buildPathProposal / synthesizeDenyRuleProposals take an explicit nowMs, so the extracted logic is fully deterministic given its inputs (no direct new Date()), matching iterate-loop.ts's own injected-clock convention.
• Re-exported through @loopover/engine's public barrel.
• lib/deny-hooks.js is now a thin re-export; lib/deny-hook-synthesis.js keeps ONLY the SQLite store (initDenyHookSynthesisStore, forge-scope migration, resolveDenyHookSynthesisDbPath, …) plus a 2-arg synthesizeDenyRuleProposals wrapper that defaults nowMs to Date.now() — so its public API and behavior are unchanged.

Acceptance criteria

• Pure rule-evaluation + proposal-synthesis functions live in gittensory-engine/src, re-exported through the barrel
• lib/deny-hooks.js / deny-hook-synthesis.js reduced to thin wrappers, existing behavior unchanged
• Existing deny-hook/synthesis suites pass unchanged against the refactored call path
• The extracted engine functions have no IO, no globals, no direct Date/random (clock injected)

Tests

• The four existing suites (miner-deny-hooks, miner-deny-hook-synthesis, deny-hooks-fixtures, miner-cli-deny-check) pass unchanged, and downstream consumers (miner-pretooluse-hook, miner-local-store-readme) stay green.
• New test/unit/deny-hook-engine-extraction.test.ts — the required regression test: imports only from @loopover/engine (no miner/SQLite in the graph), asserts block/allow behavior, and proves the injected clock makes audit.synthesizedAt deterministic (synthesizeDenyRuleProposals(records, {}, 1_700_000_000_000)).
• npm run build --workspace @loopover/engine, tsc --noEmit, engine-parity:drift-check, manifest:drift-check, and the @loopover/engine unit suite all pass.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.02%. Comparing base (21d13b2) to head (9f8ee5d).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5701   +/-   ##
=======================================
  Coverage   95.02%   95.02%           
=======================================
  Files         577      578    +1     
  Lines       45978    45982    +4     
  Branches    14724    14779   +55     
=======================================
+ Hits        43689    43694    +5     
+ Misses       1530     1529    -1     
  Partials      759      759           

Flag	Coverage Δ
shard-1	44.06% <2.58%> (+<0.01%)	⬆️
shard-2	35.72% <100.00%> (-0.07%)	⬇️
shard-3	32.35% <2.58%> (-0.07%)	⬇️
shard-4	33.03% <25.80%> (-0.03%)	⬇️
shard-5	31.66% <2.58%> (-0.11%)	⬇️
shard-6	44.32% <2.58%> (-0.10%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...gittensory-engine/src/miner/deny-hook-synthesis.ts	100.00% <100.00%> (ø)
packages/gittensory-engine/src/miner/deny-hooks.ts	100.00% <100.00%> (ø)
...ckages/gittensory-miner/lib/deny-hook-synthesis.js	86.44% <100.00%> (-7.83%)	⬇️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-14 05:36:23 UTC}

6 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review: This PR changes guardrail-protected path(s): packages/gittensory-engine/src/index.ts (matched packages/gittensory-engine/**), packages/gittensory-engine/src/miner/deny-hooks.ts (matched packages/gittensory-engine/**), packages/gittensory-engine/src/miner/deny-hook-synthesis.ts (matched packages/gittensory-engine/**).

Review summary
This is a clean mechanical extraction: the pure `evaluateDenyHooks` and `synthesizeDenyRuleProposals`/helpers move verbatim from `packages/gittensory-miner/lib/*.js` into new TypeScript modules under `packages/gittensory-engine/src/miner/`, re-exported through the engine barrel, with the miner-lib files reduced to thin re-export wrappers (the SQLite store stays miner-local). The only behavioral change is that `synthesizeDenyRuleProposals` now takes an injected `nowMs` at the engine layer, with the miner wrapper defaulting it to `Date.now()` to preserve the old 2-arg signature and wall-clock behavior — this is a legitimate purity improvement, not a regression. A new test suite drives the extracted logic through the engine barrel alone (no SQLite in the import graph) and exercises the branches called out with `/* v8 ignore */` comments. CI is green across build/typecheck/tests/coverage, and the diff closes issue #5667 as described.

Nits — 6 non-blocking

• packages/gittensory-engine/src/miner/deny-hook-synthesis.ts:47 and :169 use bare magic numbers (20, 16); consider named constants for the proposal cap and hash-slice length, though both are already documented via DEFAULT_SYNTHESIS_CONFIG/comments so this is minor.
• The old `test/unit/miner-deny-hooks.test.ts` still imports from `packages/gittensory-miner/lib/deny-hooks.js` — worth confirming that suite and the new engine-barrel suite aren't duplicating full coverage of the same rules long-term, though keeping both for now is reasonable during the transition.
• packages/gittensory-miner/lib/deny-hook-synthesis.js re-exports several engine helpers (aggregateBlockerHistory, canonicalizeChangedPath, etc.) that may now have no remaining miner-local callers — worth double-checking these re-exports are still consumed somewhere in the miner package rather than being dead surface.
• Consider a follow-up to trim the miner-lib re-export list in deny-hook-synthesis.js to only what miner-side code actually still imports, keeping the wrapper's public surface minimal.
• If the two-clock design (engine requires nowMs, miner defaults it) is meant to be permanent, a one-line note in the engine module's public doc comment stating 'callers other than the miner wrapper must supply their own clock' would help future consumers avoid accidentally hardcoding Date.now() again.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#5667
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 122 registered-repo PR(s), 62 merged, 32 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	jeffrey701; Gittensor profile; 122 PR(s), 32 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.
Improvement	✅ Minor	risk: clean · value: minor — Code changes are accompanied by test evidence.

Review context

• Author: jeffrey701
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: TypeScript, Clojure, JavaScript, Rust
• Official Gittensor activity: 122 PR(s), 32 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

[BETA] Chat with Gittensory

Ask Gittensory a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @gittensory ask <question> answers contribution-quality Q&A with source citations and freshness.
• @gittensory chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @gittensory mention with a real question is routed to the closest matching read-only command automatically -- no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/gittensory-commands

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review