fix(metagraphed): gittensory-consume-metagraphed

[Helios531]

Summary

This PR implements metagraphed consumption for gittensory, enabling validation of Bittensor subnet/netuid integration claims in pull requests and issues. When a contribution claims to integrate a specific subnet (e.g., "integrates subnet 42" or "uses SN74"), gittensory now validates that claim against the metagraphed API to verify:

• The subnet exists on the network
• The subnet's interface is healthy
  The feature operates in ADVISORY mode only — validation failures surface as warning-level findings in the advisory gate, never blocking contributions. This implements roadmap item roadmap: contribution quality & adoption wave #525 and resolves issue gittensory consumes metagraphed: validate subnet/netuid claims as gate evidence #697.

The integration is fail-open by design: metagraphed outages, timeouts, or unexpected responses map to "unavailable" status and produce no findings, ensuring external service health never disrupts the contribution flow.

Related Issue

Closes: #697

• Roadmap: roadmap: contribution quality & adoption wave #525 - metagraphed integration advisory-first design
• Related: feat(api): public SN74 contribution-interface descriptor for metagraphed discovery (#695, gittensory side) #709 - metagraphed discovery descriptor (upstream PR)
• Related: refactor(signals): shared public-safe redaction module #542 - public-safe redaction vocabulary

Change Type

Select all that apply:

• Feature - New metagraphed integration capability
• Enhancement - Adds subnet claim detection and validation
• Backend - New service layer and signal modules
• Testing - Comprehensive unit test coverage for new modules
• Documentation - Inline code documentation and comments

Real Behavior Proof

Detection Examples

The subnet claim detector matches common phrasings:

• "integrates subnet 42"
• "netuid 5", "net uid 9", "netuid: 12", "netuid=7"
• "subnet feat(scoring): add situational score projections #3", "subnet-8", "subnets 2"
• "SN74", "sn 11", "subnet number 7"

Validation Flow

1. PR/Issue opened or edited → webhook processor detects subnet claims in title + body
2. Metagraphed validation → each distinct netuid is validated against METAGRAPHED_API_URL/subnets/{netuid}
3. Advisory findings → validation verdicts map to warning-level findings:
   • Not found → subnet_claim_not_found finding
   • Exists but unhealthy → subnet_claim_unhealthy finding
   • Healthy → no finding (passes)
   • Unavailable → no finding (fail-open)

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#762 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

gittensory · advisory review

Reviewed 1 changed file(s) — two independent AI reviewers.

Changed files: package-lock.json

Suggested action: 🛠️ Request changes. (reviewers split: request changes / merge) Address the suggestions below before merging.

Reviewer A · gpt-oss-120b — recommends 🛠️ request changes
The PR updates the lockfile to newer Cloudflare and related package versions and removes the rosie-skills entries, but introduces no code changes.

Suggestions

• Confirm that the removal of rosie-skills (and its platform‑specific optional packages) is intentional and that package.json no longer lists it as a dependency.
• Run the full test suite and any build steps locally to ensure the newer versions do not introduce regressions.
• Check that the exact version pins (e.g., cjs-module-lexer, zod) do not conflict with any existing version ranges in package.json.

Worth double-checking

• Potential breakage of dev scripts or CI steps that relied on rosie-skills.
• Unexpected incompatibilities with the newer Cloudflare workers packages.

Reviewer B · nemotron-3-120b-a12b — recommends ✅ merge
The PR updates development dependencies (Cloudflare Workers tooling: vitest-pool-workers, workerd, wrangler, etc.) and removes the optional 'rosie-skills' package and its platform-specific variants. The changes are confined to package-lock.json and appear to be routine dependency updates and removal of an unused optional dependency.

Suggestions

• Verify that the removal of 'rosie-skills' does not break any development scripts or tooling (though it was an optional dependency of wrangler and likely unused).
• Ensure the updated dependency versions are compatible with the project's test suite (though no test changes are shown, the lockfile update alone should not break tests if updates are compatible).

Worth double-checking

• The removal of 'rosie-skills' might break a development workflow if it was actually used (unlikely given it was optional and not a direct dependency).
• Version bumps in development tooling could introduce minor incompatibilities (though updates appear to be patch/minor and likely safe).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.59%. Comparing base (c6d0cad) to head (a1a988f).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #762   +/-   ##
=======================================
  Coverage   96.59%   96.59%           
=======================================
  Files          91       91           
  Lines       13646    13646           
  Branches     4975     4975           
=======================================
  Hits        13182    13182           
  Misses         97       97           
  Partials      367      367           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[JSONbored]

PR #762 — fix(metagraphed): gittensory-consume-metagraphed
Verdict: MERGE
Resolves issue #697: FULLY
CI: All required checks green (validate, test 1/2, workers, mcp, ui, lint, security, codecov patch+project). gittensory/Context gates neutral = informational.

Highlights:

• Clean layering: pure detector/finding core (src/signals/subnet-claim.ts, no network) + HTTP client (src/services/metagraphed.ts), wired into both PR and issue webhook paths.
• Fail-open & advisory-only: 404 -> not_found finding; non-2xx/timeout/parse error -> unavailable -> NO finding; AbortSignal.timeout caps the request so a slow upstream can't stall the webhook.
• Dormant unless METAGRAPHED_API_URL is set; netuid regex dedups per netuid and bounds <=1023 to avoid matching years/PR numbers. Tests assert public-safe wording.

Concerns / required changes:

• Unrelated package-lock.json churn (wrangler/miniflare/workerd bump, drops rosie-skills) — scope creep on an XS feature; appears to be an upstream-sync artifact.
• Detection runs on title+body only, not changed code paths — matches the issue's wording but a claim only in code won't be caught.

Completeness vs issue: Fully satisfies #697 — a PR/issue claiming a non-existent/unhealthy subnet produces an advisory, public-safe finding; advisory-first, dormant by default, exercised directly by a test.

[Helios531]

@JSONbored I have mixed with other issue. I would like to contribute here, Could you reopen this PR?