feat(github-app): new maintainer @gittensory commands

[oktofeesh1]

Fixes #553

What

Adds four new maintainer-only @gittensory commands that surface already-computed maintainer intelligence directly into the PR thread, where maintainers work:

• @gittensory burden-forecast — projected review load and queue-growth risk
• @gittensory intake-health — contributor-intake health
• @gittensory outcome-patterns — what this repo actually merges vs closes
• @gittensory noise-report — queue noise sources to triage first

These are thin renderers over existing builders — no new RepositorySettings field and no DB migration.

How

• src/github/commands.ts — adds the 4 ids to MAINTAINER_QUEUE_DIGEST_COMMAND_CATALOG and computes the reports inside buildMaintainerQueueDigest by reusing the existing builders buildBurdenForecast, buildContributorIntakeHealth, buildRepoOutcomePatterns, and buildMaintainerNoiseReport (fed the already-computed collision report). Each renders to a public-safe section via the existing publicBlockerDetail sanitizer. The command summary / next-action / help / section switches are extended for the new ids.
• src/settings/command-authorization.ts — registers the 4 commands as ["maintainer", "collaborator"], matching the existing maintainer digest commands (maintainer-only; the default policy handles the rest automatically).
• src/api/routes.ts — lists the 4 commands as maintainer-audience entries in the command catalog.

No changes to the webhook command pipeline (processors.ts) or routes preview were needed — the reports are computed inside the existing digest builder, which both call sites already invoke.

Output boundaries

All output flows through the existing public-safe filter; no reward/trust internals. Authorization is automatic via the default [maintainer, collaborator] policy.

Tests

• test/unit/github-commands.test.ts — renders each new command and asserts the section content plus forbidden-term-free output; parse + maintainer-only assertions.
• Existing command, authorization, queue, and API suites stay green.

npm run validate (typecheck + coverage) is green at the 97%+ branch threshold; build:mcp, test:mcp-pack, test:workers, and ui:openapi:check also pass.

🤖 Generated with Claude Code

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#623 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[ghost]

gittensory · advisory review

Reviewed 4 changed file(s) — two independent AI reviewers.

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

What changed

• src/api/routes.ts: added four new maintainer command entries and extended filter list.
• src/github/commands.ts: imported new signal builders, extended command catalog, updated MaintainerQueueDigest type, added handling for new commands in summaries, sections, help text, and digest building.
• src/settings/command-authorization.ts: added new commands to default authorization policy.
• test/unit/github-commands.test.ts: added tests to ensure new commands render safely and are recognized.

Reviewer A · gpt-oss-120b — recommends ✅ merge
This PR adds four new maintainer‑only commands (burden‑forecast, intake‑health, outcome‑patterns, noise‑report) with public‑safe boundaries, extending the API routes, command catalog, authorization policy, and digest generation logic. The changes compile cleanly and include tests verifying safe rendering and command parsing.

Suggestions

• Add unit tests for the new signal builder functions (e.g., buildBurdenForecast) to ensure they produce the expected shape.
• Consider refactoring the long ternary chain in maintainerDigestSections into a clearer switch or map for readability.
• Verify that the new imports from '../signals/engine' and '../signals/private context-risk' are exported in those modules to avoid runtime import errors.

Worth double-checking

• If the newly imported builder functions are not exported, the build will fail.
• The sampleMaintainerDigest used in tests must include the new fields; otherwise the test may break.
• The added recentMergedPullRequests variable could shadow an existing one if the function already defines it elsewhere.

Reviewer B · mistral-small-3.1-24b-instruct — recommends ✅ merge
This PR adds new maintainer commands to the Gittensory GitHub app, enhancing the maintainer dashboard with additional insights. The changes are well-structured and include necessary updates to the API routes, command logic, and tests. The public/private boundary is maintained, and the new commands are properly authorized.

Suggestions

• Consider adding more detailed comments to the new functions in src/github/commands.ts to explain their purpose and logic.
• Ensure that the new commands are documented in the user guide or help section of the application.

Worth double-checking

• Verify that the new commands do not introduce any performance bottlenecks, especially with large repositories.
• Check that the new commands handle edge cases, such as repositories with no pull requests or issues.
• Ensure that the tests cover all possible scenarios for the new commands.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

🔎 Gittensory inline review — 2 line-level note(s). Advisory only; a maintainer merges. See the summary comment for the full review.

[ghost]

Gittensory review · advisory — a maintainer merges

1 actionable · 5 nitpick(s) · 4 file(s) · two independent AI reviewers

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

📋 Walkthrough

This PR expands the maintainer command set with four new intelligence commands, updates routing and authorization, builds the corresponding data in the maintainer digest, renders them safely for public comments, and adds tests to verify correct rendering and sanitization.

Changes

File	Summary
src/api/routes.ts	Adds new maintainer command entries to the APP_COMMANDS list and includes them in the filter.
src/github/commands.ts	Extends command catalogs, types, rendering sections, and digest builder to support the four new commands.
src/settings/command-authorization.ts	Adds the new commands to the default authorization policy for maintainers and collaborators.
test/unit/github-commands.test.ts	Adds tests for rendering the new commands safely and handling populated/empty report variants.

🔍 Reviewer notes

Reviewer A · gpt-oss-120b — recommends ✅ merge
The PR adds four new maintainer‑only commands (burden‑forecast, intake‑health, outcome‑patterns, noise‑report), integrates them into the API routes, command catalog, authorization policy, digest builder, rendering logic, and tests. The changes are comprehensive and appear type‑safe, with public‑safe rendering and no forbidden terms.

Suggestions

• Verify that the newly imported symbols (buildBurdenForecast, buildContributorIntakeHealth, buildRepoOutcomePatterns, buildMaintainerNoiseReport, and their types) are exported from their respective modules.
• Add a unit test covering the case where the new sections receive empty findings to ensure graceful rendering.
• Consider extracting the long nested ternary in maintainerDigestSections into a clearer switch or map for readability.

Worth double-checking

• Missing or mismatched exports in the signals modules could cause compile‑time errors.
• If any of the new report objects lack the expected repoFullName field, the new tests will fail.
• The added rendering functions rely on publicBlockerDetail; ensure it correctly sanitizes all dynamic content.

Reviewer B · mistral-small-3.1-24b-instruct — recommends ✅ merge
This PR adds four new maintainer commands to the Gittensory GitHub app, enhancing the maintainer dashboard with new insights. The changes are well-structured and follow the project's conventions. The new commands are thoroughly tested.

Suggestions

• Consider adding a brief description of each new command in the documentation to help maintainers understand their purpose and usage.

Worth double-checking

• Ensure that the new commands do not inadvertently leak any private or sensitive information.
• Verify that the new commands handle edge cases, such as empty or incomplete data, gracefully.

🤖 Prompt for AI agents

Copy this to your coding agent to fix everything flagged:

Address the following in this PR:

1. src/github/commands.ts (line 1130): The nested ternary in `maintainerDigestSections` is difficult to read and maintain. Suggested fix: Replace the ternary chain with a `switch` statement that returns the appropriate section function.
2. src/github/commands.ts (line 143): The new command titles follow the existing naming convention, ensuring consistency.

Nitpicks:
- Verify that the newly imported symbols (buildBurdenForecast, buildContributorIntakeHealth, buildRepoOutcomePatterns, buildMaintainerNoiseReport, and their types) are exported from their respective modules.
- Add a unit test covering the case where the new sections receive empty findings to ensure graceful rendering.
- Consider extracting the long nested ternary in `maintainerDigestSections` into a clearer `switch` or map for readability.
- Consider adding a brief description of each new command in the documentation to help maintainers understand their purpose and usage.

---

🤖 Automated advisory review · a maintainer makes the final call.

[ghost]

Gittensory review · advisory — a maintainer merges

0 actionable · 3 nitpick(s) · 4 file(s) · two independent AI reviewers

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

📋 Walkthrough

The PR expands the maintainer command set with four new intelligence commands, updates routing, authorization, and digest generation to include their data, adds safe rendering functions, and introduces comprehensive tests to verify public‑safe output.

Changes

File	Summary
src/api/routes.ts	Added new maintainer command entries to APP_COMMANDS and extended filter to exclude them from generic handling.
src/github/commands.ts	Imported new signal builders, extended command catalogs, digest type, rendering logic, and digest construction to support new commands.
src/settings/command-authorization.ts	Authorized new maintainer commands for maintainer and collaborator roles.
test/unit/github-commands.test.ts	Added tests for rendering new commands safely and handling populated/empty report variants.

🔍 Reviewer notes

Reviewer A · gpt-oss-120b — recommends ✅ merge
This PR adds four new maintainer‑only commands (burden‑forecast, intake‑health, outcome‑patterns, noise‑report) with corresponding API routes, command catalog entries, digest fields, rendering logic, authorization rules, and tests. The changes are well‑scoped, type‑safe, and include public‑safe rendering safeguards.

Suggestions

• Verify that the newly imported builder functions (e.g., buildBurdenForecast) exist and are exported from their modules.
• Consider adding unit tests for the edge case where any of the new report builders return empty or undefined data to ensure graceful rendering.
• Run the full test suite to confirm no TypeScript type errors arise from the expanded MaintainerQueueDigest shape.

Worth double-checking

• If any of the new signal builders emit private terminology, it could leak through the public comment rendering.
• Adding fields to MaintainerQueueDigest may affect downstream consumers that expect the exact shape; ensure they tolerate extra properties.

Reviewer B · nemotron-3-120b-a12b — recommends ✅ merge
The PR adds four new maintainer-only commands (@gittensory burden-forecast, intake-health, outcome-patterns, noise-report) to the Gittensory app. Changes include updating command catalogs, authorization policies, maintaining queue digest with new fields, adding rendering functions, and adding unit tests. The changes appear consistent with the project's public/private boundary as commands are marked 'public-safe' and tests verify no forbidden terms leak.

Worth double-checking

• Verify signal builder functions (in ../signals/*) correctly sanitize outputs before reaching publicBlockerDetail
• Ensure maintainer digest computation remains efficient with added report generation
• Confirm authorization policy aligns with intended access controls (maintainer/collaborator only)

---

🤖 Automated advisory review · a maintainer makes the final call.