feat(gate): configurable advisory check-runs (#4372)

[RealDiligent]

Summary

• Add gate.advisoryCheckRuns ({ name, appSlug }[]) so operators can declare third-party check-runs advisory per repo.
• Exclude matched completed check-runs from CI pass/fail/pending aggregation; route non-pass conclusions to the existing manual-review hold with comment/audit surfacing.
• Document the field in config/examples/loopover.full.yml and .loopover.yml.example; add unit tests with synthetic fixtures only.

Closes #4372

Test plan

• Targeted vitest for advisory-check-runs, backfill CI aggregate, agent-actions hold routing, focus-manifest parse, unified comment
• npm run test:engine-parity
• CI green on fork PR

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

❌ Patch coverage is 5.68182% with 83 lines in your changes missing coverage. Please review.
✅ Project coverage is 47.93%. Comparing base (7d59907) to head (282aef4).

Files with missing lines	Patch %	Lines
src/github/advisory-check-runs.ts	5.00%	19 Missing ⚠️
packages/loopover-engine/src/focus-manifest.ts	0.00%	15 Missing and 2 partials ⚠️
src/github/backfill.ts	0.00%	16 Missing ⚠️
src/queue/ci-resolution.ts	0.00%	10 Missing ⚠️
src/queue/processors.ts	0.00%	9 Missing ⚠️
src/review/unified-comment.ts	36.36%	6 Missing and 1 partial ⚠️
src/settings/agent-actions.ts	0.00%	4 Missing ⚠️
src/signals/focus-manifest.ts	0.00%	0 Missing and 1 partial ⚠️

❗ There is a different number of reports uploaded between BASE (7d59907) and HEAD (282aef4). Click for more details.

HEAD has 4 uploads less than BASE

Flag	BASE (7d59907)	HEAD (282aef4)
shard-4	1	0
shard-2	1	0
shard-6	1	0
shard-1	1	0

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #5780       +/-   ##
===========================================
- Coverage   95.06%   47.93%   -47.14%     
===========================================
  Files         580      581        +1     
  Lines       46156    46230       +74     
  Branches    14804    14839       +35     
===========================================
- Hits        43880    22160    -21720     
- Misses       1516    21597    +20081     
- Partials      760     2473     +1713     

Flag	Coverage Δ
shard-1	?
shard-2	?
shard-3	32.23% <5.68%> (-0.04%)	⬇️
shard-4	?
shard-5	31.71% <5.68%> (-0.05%)	⬇️
shard-6	?

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/types.ts	100.00% <ø> (ø)
src/signals/focus-manifest.ts	53.14% <0.00%> (-46.51%)	⬇️
src/settings/agent-actions.ts	6.25% <0.00%> (-91.48%)	⬇️
src/review/unified-comment.ts	42.85% <36.36%> (-56.73%)	⬇️
src/queue/processors.ts	11.81% <0.00%> (-83.87%)	⬇️
src/queue/ci-resolution.ts	0.00% <0.00%> (-100.00%)	⬇️
src/github/backfill.ts	30.58% <0.00%> (-65.78%)	⬇️
packages/loopover-engine/src/focus-manifest.ts	47.34% <0.00%> (-51.76%)	⬇️
src/github/advisory-check-runs.ts	5.00% <5.00%> (ø)

... and 375 files with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Caution

🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥

🛑 LoopOver review result - fixes required

_{Review updated: 2026-07-14 15:24:19 UTC}

18 files · no blockers · readiness 100/100 · CI failing · blocked

🛑 Suggested Action - Fix Blockers

• AI review already in progress for this PR head: Another Gittensory pass is already running the AI review for this exact PR head. This pass is skipping to avoid a duplicate LLM call.

Review summary
AI review is already running for this PR head in another LoopOver pass. LoopOver is holding this PR for manual review until that pass completes.

Nits — 1 non-blocking

• AI review already in progress for this PR head — The gate is held for a human reviewer rather than passed automatically; it re-evaluates once the in-flight review completes or on the next update.

CI checks failing

• validate
• codecov/patch — 5.68% of diff hit (target 99.00%)
• validate-tests (4)
• validate-tests (1)
• validate-tests (2)
• validate-tests (6)
• validate-code

Signal	Result	Evidence
Code review	✅ No blockers	No AI review summary
Linked issue	✅ Linked	#4372
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 295 registered-repo PR(s), 137 merged, 28 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	RealDiligent; Gittensor profile; 295 PR(s), 28 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.
Improvement	✅ Minor	risk: clean · value: minor — Code changes are accompanied by test evidence.

Linked issue satisfaction

Addressed
The PR adds a fully config-driven gate.advisoryCheckRuns ({name, appSlug}[]) list, excludes matched completed check-runs from CI pass/fail/pending in the backfill aggregate reducer, and routes non-pass conclusions through a new manual-review hold wired into the disposition planner, review-trigger, and unified comment surface, with no hardcoded vendor names in behavior-triggering logic (only docs/e

Review context

• Author: RealDiligent
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 295 PR(s), 28 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

[BETA] Chat with Gittensory

Ask Gittensory a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @gittensory ask <question> answers contribution-quality Q&A with source citations and freshness.
• @gittensory chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @gittensory mention with a real question is routed to the closest matching read-only command automatically -- no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/gittensory-commands

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

Gittensory is closing this pull request on the maintainer's behalf (CI is failing (validate, codecov/patch, validate-tests (4), validate-tests (1), validate-tests (2), validate-tests (6), validate-code)). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.