Fix predicted gate public manifest loading

[JSONbored]

Motivation

• The local pre-submission predictedGate used a cached focus manifest that could be an api_record (maintainer-supplied) snapshot, potentially exposing maintainer-only gate policy to contributors.
• Contributor-facing routes must only use repository-published manifests (public .gittensory.yml) when predicting gate behavior so private overrides cannot be inferred.
• The prediction result must still preserve parity with the real gate with respect to contributor confirmation status.

Description

• Added loadPublicRepoFocusManifest and an internal loadRepoFocusManifestWithCachePolicy wrapper to load manifests with a cache policy that can exclude non-repo_file snapshots.
• Updated readCachedManifest to accept a publicOnly option and return null when the cached snapshot is not repo_file and public-only is requested.
• Switched contributor-facing routes (POST /v1/local/branch-analysis and /v1/local/remediation-plan) to call loadPublicRepoFocusManifest so predictedGate is computed from public repo files only, while maintainer paths keep using the original loader.
• Preserved the confirmed-contributor parity by continuing to pass confirmedContributor: Boolean(context.gittensorSnapshot) into buildPredictedGateVerdict.
• Added unit tests to cover ignoring API-backed manifests for public loads and falling back to safe public defaults when no public manifest exists (test/unit/focus-manifest-loader.test.ts).

Testing

• Ran unit tests for the changed areas with npx vitest run test/unit/focus-manifest-loader.test.ts test/unit/predicted-gate.test.ts, and all tests passed.
• Ran static type checking with npm run typecheck and it succeeded.
• Verified no linter/diff issues with git diff --check (local verification command run as part of development).

---

Codex Task

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#903 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.70%. Comparing base (5d9d73a) to head (3e7bf54).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #903      +/-   ##
==========================================
- Coverage   96.71%   96.70%   -0.01%     
==========================================
  Files         108      108              
  Lines       14641    14648       +7     
  Branches     5298     5302       +4     
==========================================
+ Hits        14160    14166       +6     
  Misses        102      102              
- Partials      379      380       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ghost]

gittensory · advisory review

Reviewed 3 changed file(s) — two independent AI reviewers.

Changed files: src/api/routes.ts, src/signals/focus-manifest-loader.ts, test/unit/focus-manifest-loader.test.ts

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
The PR introduces a new public‑only focus manifest loader, updates routing to use it, and adds unit tests verifying that API‑backed records are ignored and safe defaults are returned when no public file exists. The implementation is clean and respects the public/private boundary.

Suggestions

• Add a brief comment in the module index or README documenting the purpose of loadPublicRepoFocusManifest for future developers.
• Consider adding a test that verifies the cache respects the publicOnly flag (e.g., cached API‑record is ignored).

Worth double-checking

• If other internal modules call readCachedManifest directly, they now receive an extra optional parameter – ensure they still behave as expected (default parameter should preserve current behavior).
• Confirm that no UI components inadvertently rely on the previously loaded api_record source when the public loader is used.

Reviewer B · mistral-small-3.1-24b-instruct — recommends ✅ merge
This PR adds a new function to load only the public focus manifest, ensuring that contributor-facing previews do not infer private gate policies. The changes are well-documented and include corresponding tests.

Suggestions

• Consider adding a comment explaining why the publicOnly option is necessary and how it affects the caching policy.
• Ensure that the new function loadPublicRepoFocusManifest is used consistently across the codebase where appropriate.

Worth double-checking

• Verify that the caching policy correctly handles the publicOnly option in all edge cases.
• Check that the new function does not introduce any performance regressions, especially with the increased caching logic.