feat(agent): autoMaintain config block + dashboard (#774)

[JSONbored]

Closes #774. Builds on #773 (autonomy framework) — the per-repo auto-maintain policy + a dashboard surface.

What

• AutoMaintainPolicy { requireApprovals, mergeMethod } + normalizeAutoMaintainPolicy (conservative defaults squash / 1 approval; requireApprovals clamped to [0,10]; invalid merge method → squash). Pure + 100% covered.
• Persisted on repository_settings as JSON (migration 0043, default '{}' → defaults), mirroring autonomy/commandAuthorization.
• Config-as-code: .gittensory.yml settings.autoMaintain (+ settings.autonomy from feat(agent): autonomy-levels framework (observe→…→auto) #773) resolved through the existing yml > DB > defaults resolver; a non-mapping block is ignored, never blanking the DB policy.
• Dashboard: a new "Auto-maintain (agent layer)" section in the maintainer settings editor (feat(control-panel): add maintainer control panel #130) — per-action autonomy selectors for all six action classes + approvals-before-auto-merge + merge method.
• Maintainer PUT /settings now accepts autonomy + autoMaintain (bounded: requireApprovals 0–10 rejected out of range; unknown autonomy action classes dropped by the DB normalizer).

# .gittensory.yml
settings:
  autonomy:
    merge: auto_with_approval
  autoMaintain:
    requireApprovals: 1
    mergeMethod: squash

Scope

This is config + dashboard only — nothing acts. The action layer that consults resolveAutonomy + this policy is #778.

Verification

typecheck clean · migration guard (0001..0043, no dup) · full suite 2014 passed, 1 skipped (pre-existing pngjs skip) · OpenAPI regenerated + drift-clean · UI lint/typecheck/build clean · the new policy module is 100% covered and every changed line is covered.

Note: migration 0043 follows #773's 0042 — both ahead of the open #833; whichever merges into a 0042/0043 collision rebases + renumbers.

Relates #768 (Phase 0), #773 (autonomy framework), #778 (write-actions consume this).

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	5430ebd	Commit Preview URL Branch Preview URL	Jun 17 2026, 09:31 PM

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#841 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

gittensory · advisory review

Reviewed 14 changed file(s) — two independent AI reviewers.

Changed files (14)

• apps/gittensory-ui/public/openapi.json
• apps/gittensory-ui/src/components/site/app-panels/maintainer-settings.tsx
• migrations/0043_agent_auto_maintain.sql
• src/api/routes.ts
• src/db/repositories.ts
• src/db/schema.ts
• src/openapi/schemas.ts
• src/settings/autonomy.ts
• src/signals/focus-manifest.ts
• src/types.ts
• test/integration/api.test.ts
• test/unit/autonomy.test.ts
• test/unit/data-spine.test.ts
• test/unit/focus-manifest.test.ts

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
This PR introduces an auto-maintain configuration block, adds UI controls, extends DB schema, normalization, API validation, and tests. The changes are well‑scoped, include defaults, input clamping, and comprehensive test coverage.

Suggestions

• Align the OpenAPI definition for autoMaintain with the API schema: make its fields optional or adjust the required list to match the Zod schema.
• Consider adding a unit test for the API schema validation of autoMaintain to ensure out‑of‑range values are rejected as expected.

Worth double-checking

• Inconsistent OpenAPI required fields could cause client generation mismatches.
• Future changes to autonomy keys rely on DB normalizer to drop unknown classes; ensure this behavior stays documented.

Reviewer B · mistral-small-3.1-24b-instruct — recommends ✅ merge
This PR adds a new 'auto-maintain' configuration block and dashboard for the agent layer, allowing maintainers to set autonomy levels and auto-merge policies. The changes are well-structured and include necessary updates to types, schemas, and tests. The overall quality is high, with clear and concise additions.

Suggestions

• Consider adding a brief description or tooltip for each autonomy level in the UI to help users understand the implications of each setting.
• Ensure that the new settings are documented in the project's documentation to inform users about the new features.

Worth double-checking

• Verify that the new settings are correctly validated and sanitized to prevent any security vulnerabilities.
• Check that the new settings do not introduce any performance issues, especially with the addition of new database columns.

Before = production · After = this PR's preview deploy.

Route	Viewport	Before	After
/	desktop
	mobile

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.59%. Comparing base (13c042b) to head (5430ebd).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #841   +/-   ##
=======================================
  Coverage   96.58%   96.59%           
=======================================
  Files          99       99           
  Lines       14215    14229   +14     
  Branches     5178     5182    +4     
=======================================
+ Hits        13730    13744   +14     
  Misses        105      105           
  Partials      380      380           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.