feat(selfhost): add a read-only pre-deploy diff-summary script

[JSONbored]

Summary

• New `scripts/selfhost-pre-deploy-summary.sh`: a read-only preview of what `selfhost-update.sh` would pull in from the remote -- commit list, file-change stat, and a flag on any incoming commit touching a path with a history of breaking a self-host deploy (`docker-compose*.yml`, `grafana/provisioning/`/`grafana/dashboards/`, `migrations/**`, `Dockerfile*`, the deploy scripts themselves, `.env.example`).
• Only runs `git fetch` -- never a merge or checkout -- so it's safe to run anytime, including with a dirty working tree, unlike `selfhost-update.sh` itself.
• Documented in the self-hosting operations guide, alongside `selfhost-update.sh`/`selfhost-post-update-check.sh`.

Test plan

• `npx tsc --noEmit`
• `npx tsx scripts/check-docs-drift.mjs`
• Real end-to-end script execution against a throwaway git remote (11 test cases: up-to-date, incoming commits, sensitive-path flagging including a mixed change, dirty-tree safety, branch/detached-HEAD/missing-branch error paths, diverged-history fallback)

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	loopover-ui	f21f65c	Commit Preview URL Branch Preview URL	Jul 14 2026, 11:02 AM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.07%. Comparing base (c3d07a3) to head (77a5220).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5747   +/-   ##
=======================================
  Coverage   95.07%   95.07%           
=======================================
  Files         581      581           
  Lines       46181    46181           
  Branches    14811    14811           
=======================================
  Hits        43905    43905           
  Misses       1516     1516           
  Partials      760      760           

Flag	Coverage Δ
shard-1	43.95% <ø> (-0.01%)	⬇️
shard-2	35.74% <ø> (+0.02%)	⬆️
shard-3	32.27% <ø> (-0.01%)	⬇️
shard-4	32.95% <ø> (-0.61%)	⬇️
shard-5	31.76% <ø> (+0.58%)	⬆️
shard-6	44.64% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-14 12:03:56 UTC}

3 files · 1 AI reviewer · 2 blockers · readiness 93/100 · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
This adds a read-only, git-fetch-only preview script that shows the commit/file diff selfhost-update.sh would pull in and flags historically-sensitive paths (docker-compose, grafana provisioning, migrations, Dockerfiles, deploy scripts, .env.example), plus docs and a real end-to-end test suite exercising the actual fetch/diff/flag logic against a throwaway git remote. The branch/detached-HEAD/missing-branch guards mirror selfhost-update.sh's existing checks, and the fallback to a merge-base range on diverged history is functionally equivalent to the original two-dot range (just adds a warning) rather than a bug. The bash `case` pattern matching for sensitive paths (e.g. `grafana/provisioning/*`) correctly matches nested paths since case-pattern globbing isn't restricted to filesystem pathname-expansion slash boundaries, and this is confirmed by a genuine end-to-end test rather than a fabricated one.

Nits — 5 non-blocking

• docs.self-hosting-operations.tsx:~1108 claims the script 'always exits 0', but scripts/selfhost-pre-deploy-summary.sh:32-46 clearly `exit 1`s on branch mismatch, detached HEAD, and missing remote branch (and the test file confirms non-zero exit codes for these) — reword to scope the 'always exits 0' claim to the sensitive-path-flag case, not error handling.
• The PR body references issue chore(release): cut mcp v2.0.0 #5735 only via inline script/doc comments (`(chore(release): cut mcp v2.0.0 #5735)`) rather than an explicit 'Closes chore(release): cut mcp v2.0.0 #5735' — worth confirming chore(release): cut mcp v2.0.0 #5735 is the actual open, maintainer-authorized issue this closes.
• The merge-base fallback range recomputes `commit_count`/`range` (scripts/selfhost-pre-deploy-summary.sh:57-63) even though two-dot `HEAD..REMOTE/BRANCH` already yields the same commit set as `merge_base..REMOTE/BRANCH` — harmless but could be simplified to just emitting the warning without recomputing.
• Rephrase the 'always exits 0' claim in docs.self-hosting-operations.tsx to distinguish the informational sensitive-path-flag (never blocks) from genuine misconfiguration errors (branch mismatch, detached HEAD, bad remote) which do exit non-zero.
• Consider a short 'Closes chore(release): cut mcp v2.0.0 #5735' line in the PR description for unambiguous issue linkage, per repo convention.

Concerns raised — review before merging

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

📋 Copy for AI agents — paste into your coding agent

Fix the following blocker(s) from this PR review:

1. No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.

2. Maintainer requires a linked issue — Link the relevant issue (for example `Closes #123`) before opening the PR.

Signal	Result	Evidence
Code review	❌ 2 blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 45 registered-repo PR(s), 37 merged, 338 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 45 PR(s), 338 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.
Improvement	✅ Minor	risk: clean · value: minor — Code changes are accompanied by test evidence.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 45 PR(s), 338 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

[BETA] Chat with Gittensory

Ask Gittensory a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @gittensory ask <question> answers contribution-quality Q&A with source citations and freshness.
• @gittensory chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @gittensory mention with a real question is routed to the closest matching read-only command automatically -- no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/gittensory-commands

Visual preview

Route	Viewport	Before (production)	After (this PR's preview)	Diff
/docs/self-hosting-operations	desktop			—
/docs/self-hosting-operations	mobile			—

Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review