@loopover/engine 1.0.0

package/dist/review/advisory-ai-routing-config.js

@@ -0,0 +1,40 @@
+export const DEFAULT_ADVISORY_AI_ROUTING = {
+    slop: false,
+    e2eTestGen: false,
+    planner: false,
+    summaries: false,
+    chatQa: false,
+    chatQaFrontierFallback: false,
+    intentRouting: false,
+};
+function normalizeField(value, field, warnings) {
+    if (value === undefined)
+        return DEFAULT_ADVISORY_AI_ROUTING[field];
+    if (typeof value === "boolean")
+        return value;
+    warnings.push(`settings.advisoryAiRouting.${field} must be a boolean; using the default "${DEFAULT_ADVISORY_AI_ROUTING[field]}".`);
+    return DEFAULT_ADVISORY_AI_ROUTING[field];
+}
+/**
+ * Normalize a raw `.gittensory.yml settings.advisoryAiRouting` value into a typed config, fail-safe: any
+ * malformed field falls back to its own (false) default and pushes a warning rather than rejecting the
+ * whole block. Mirrors `normalizeUnlinkedIssueGuardrailConfig`'s per-field discipline.
+ */
+export function normalizeAdvisoryAiRoutingConfig(input, warnings) {
+    if (input === undefined)
+        return { ...DEFAULT_ADVISORY_AI_ROUTING };
+    if (typeof input !== "object" || input === null || Array.isArray(input)) {
+        warnings.push("settings.advisoryAiRouting must be an object; using the default (every capability off).");
+        return { ...DEFAULT_ADVISORY_AI_ROUTING };
+    }
+    const record = input;
+    return {
+        slop: normalizeField(record.slop, "slop", warnings),
+        e2eTestGen: normalizeField(record.e2eTestGen, "e2eTestGen", warnings),
+        planner: normalizeField(record.planner, "planner", warnings),
+        summaries: normalizeField(record.summaries, "summaries", warnings),
+        chatQa: normalizeField(record.chatQa, "chatQa", warnings),
+        chatQaFrontierFallback: normalizeField(record.chatQaFrontierFallback, "chatQaFrontierFallback", warnings),
+        intentRouting: normalizeField(record.intentRouting, "intentRouting", warnings),
+    };
+}

package/dist/review/check-names.d.ts

@@ -0,0 +1 @@
+export declare const LOOPOVER_GATE_CHECK_NAME = "LoopOver Orb Review Agent";

package/dist/review/check-names.js

@@ -0,0 +1 @@
+export const LOOPOVER_GATE_CHECK_NAME = "LoopOver Orb Review Agent";

package/dist/review/cla-check.d.ts

@@ -0,0 +1,49 @@
+import type { AdvisoryFinding } from "../types/predicted-gate-types.js";
+/** Finding code raised when `gate.claMode` is opted in (advisory/block) and neither configured detection method
+ *  (the PR body consent phrase, or the named CLA-bot check-run) confirms consent. ALWAYS severity "warning" at
+ *  generation time — mirrors `manifest_missing_tests`/`manifest_linked_issue_required` (focus-manifest.ts): a
+ *  single finding code whose escalation to a hard blocker is decided entirely by the configured gate MODE
+ *  (isConfiguredGateBlocker, src/rules/advisory.ts), not by this evaluator. */
+export declare const CLA_CONSENT_MISSING_CODE = "cla_consent_missing";
+/** Finding code emitted when check-run detection is the ONLY configured method and its conclusion could not be
+ *  resolved (a transient fetch failure, not a resolved "no such check-run"). Mirrors `pre_merge_check_unresolved`
+ *  (review/pre-merge-checks.ts): isEvaluationBlocker (advisory.ts) treats this as a NEUTRAL gate (HELD,
+ *  re-evaluates automatically) — never silently skipping a hard requirement and never hard-closing the
+ *  contributor on a transient resolution miss. */
+export declare const CLA_CHECK_UNRESOLVED_CODE = "cla_check_unresolved";
+export type ClaCheckConfig = {
+    /** Public-safe-filtered consent phrase a maintainer requires somewhere in the PR body (case-insensitive
+     *  substring match), e.g. "I have read and agree to the CLA". `null` ⇒ phrase-match detection is not configured. */
+    consentPhrase: string | null;
+    /** Name of a separate CLA-bot check-run this repo also runs (e.g. "CLA Assistant Lite"). When set, a
+     *  `success`/`neutral` conclusion for a check-run with this exact name (case-insensitive) also satisfies
+     *  consent. `null` ⇒ check-run detection is not configured. */
+    checkRunName: string | null;
+};
+/**
+ * Evaluate `.gittensory.yml gate.claMode` + `gate.cla` (consentPhrase / checkRunName) against a PR —
+ * DETERMINISTICALLY, mirroring the pre-merge-checks title/description phrase-match pattern (review/pre-merge-checks.ts)
+ * exactly: a case-insensitive substring match against already-resolved PR data, no AI judgment. Consent is
+ * satisfied when EITHER configured method holds (an "either" contract, not "all", because a repo may only be able
+ * to detect ONE method for a given PR — e.g. no check-run data was resolved): the PR body contains
+ * `consentPhrase`, OR a check-run named `checkRunName` concluded `success`/`neutral`. When NEITHER method is
+ * configured (both null), there is nothing to evaluate — no finding (byte-identical, matches `pre_merge_checks`'
+ * empty-checks behavior).
+ *
+ * `checkRunConclusion` is `undefined` when the caller could not resolve check-run data at all (a transient
+ * fetch failure, or the predicted-gate metadata-only path, which never sees live check-runs) — that is NOT the
+ * same as a resolved-but-absent check-run (`null`, "no check-run with this name exists"). When check-run
+ * detection is configured and its conclusion is unresolved (a transient fetch failure, or "not yet run"), this
+ * HOLDS (`cla_check_unresolved`) instead of failing closed — exactly like an unresolved changed-file set HOLDS
+ * a path-gated pre-merge check rather than silently skipping (auto-merge bypass) or hard-closing on a
+ * transient miss. This applies EVEN WHEN `consentPhrase` is ALSO configured but not (yet) satisfied: per the
+ * "either method holds ⇒ satisfied" contract above, an unresolved check-run might still satisfy consent, so
+ * deciding purely from a not-yet-satisfied phrase would hard-fail a PR the check-run could have saved (#2564
+ * gate-review finding). A hold only degrades to a hard `cla_consent_missing` once EVERY configured method has
+ * been definitively resolved and none of them is satisfied. Pure + side-effect-free; the caller pushes the
+ * finding into the advisory before the gate evaluates.
+ */
+export declare function evaluateClaCheck(config: ClaCheckConfig, ctx: {
+    body?: string | null | undefined;
+    checkRunConclusion?: string | null | undefined;
+}): AdvisoryFinding[];

package/dist/review/cla-check.js

@@ -0,0 +1,71 @@
+/** Finding code raised when `gate.claMode` is opted in (advisory/block) and neither configured detection method
+ *  (the PR body consent phrase, or the named CLA-bot check-run) confirms consent. ALWAYS severity "warning" at
+ *  generation time — mirrors `manifest_missing_tests`/`manifest_linked_issue_required` (focus-manifest.ts): a
+ *  single finding code whose escalation to a hard blocker is decided entirely by the configured gate MODE
+ *  (isConfiguredGateBlocker, src/rules/advisory.ts), not by this evaluator. */
+export const CLA_CONSENT_MISSING_CODE = "cla_consent_missing";
+/** Finding code emitted when check-run detection is the ONLY configured method and its conclusion could not be
+ *  resolved (a transient fetch failure, not a resolved "no such check-run"). Mirrors `pre_merge_check_unresolved`
+ *  (review/pre-merge-checks.ts): isEvaluationBlocker (advisory.ts) treats this as a NEUTRAL gate (HELD,
+ *  re-evaluates automatically) — never silently skipping a hard requirement and never hard-closing the
+ *  contributor on a transient resolution miss. */
+export const CLA_CHECK_UNRESOLVED_CODE = "cla_check_unresolved";
+/**
+ * Evaluate `.gittensory.yml gate.claMode` + `gate.cla` (consentPhrase / checkRunName) against a PR —
+ * DETERMINISTICALLY, mirroring the pre-merge-checks title/description phrase-match pattern (review/pre-merge-checks.ts)
+ * exactly: a case-insensitive substring match against already-resolved PR data, no AI judgment. Consent is
+ * satisfied when EITHER configured method holds (an "either" contract, not "all", because a repo may only be able
+ * to detect ONE method for a given PR — e.g. no check-run data was resolved): the PR body contains
+ * `consentPhrase`, OR a check-run named `checkRunName` concluded `success`/`neutral`. When NEITHER method is
+ * configured (both null), there is nothing to evaluate — no finding (byte-identical, matches `pre_merge_checks`'
+ * empty-checks behavior).
+ *
+ * `checkRunConclusion` is `undefined` when the caller could not resolve check-run data at all (a transient
+ * fetch failure, or the predicted-gate metadata-only path, which never sees live check-runs) — that is NOT the
+ * same as a resolved-but-absent check-run (`null`, "no check-run with this name exists"). When check-run
+ * detection is configured and its conclusion is unresolved (a transient fetch failure, or "not yet run"), this
+ * HOLDS (`cla_check_unresolved`) instead of failing closed — exactly like an unresolved changed-file set HOLDS
+ * a path-gated pre-merge check rather than silently skipping (auto-merge bypass) or hard-closing on a
+ * transient miss. This applies EVEN WHEN `consentPhrase` is ALSO configured but not (yet) satisfied: per the
+ * "either method holds ⇒ satisfied" contract above, an unresolved check-run might still satisfy consent, so
+ * deciding purely from a not-yet-satisfied phrase would hard-fail a PR the check-run could have saved (#2564
+ * gate-review finding). A hold only degrades to a hard `cla_consent_missing` once EVERY configured method has
+ * been definitively resolved and none of them is satisfied. Pure + side-effect-free; the caller pushes the
+ * finding into the advisory before the gate evaluates.
+ */
+export function evaluateClaCheck(config, ctx) {
+    if (config.consentPhrase === null && config.checkRunName === null)
+        return []; // nothing configured ⇒ no finding
+    const phraseSatisfied = config.consentPhrase !== null && (ctx.body ?? "").toLowerCase().includes(config.consentPhrase.toLowerCase());
+    const checkRunSatisfied = config.checkRunName !== null && (ctx.checkRunConclusion === "success" || ctx.checkRunConclusion === "neutral");
+    if (phraseSatisfied || checkRunSatisfied)
+        return [];
+    // A configured check-run whose conclusion is unresolved: cannot confirm OR deny consent via that method, so
+    // HOLD rather than fail closed — regardless of whether consentPhrase is ALSO configured (a not-yet-satisfied
+    // phrase does not mean consent is definitively absent while the check-run could still satisfy it).
+    if (config.checkRunName !== null && ctx.checkRunConclusion === undefined) {
+        return [
+            {
+                code: CLA_CHECK_UNRESOLVED_CODE,
+                severity: "warning",
+                title: `CLA check held — "${config.checkRunName}" not resolved`,
+                detail: `Gittensory could not resolve the "${config.checkRunName}" check-run's conclusion for this PR; the gate is held and re-evaluates automatically.`,
+                action: "No action needed — the gate re-evaluates once the check-run's conclusion is available.",
+            },
+        ];
+    }
+    const missing = [];
+    if (config.consentPhrase !== null)
+        missing.push(`the PR description must contain "${config.consentPhrase}"`);
+    if (config.checkRunName !== null)
+        missing.push(`the "${config.checkRunName}" check must pass`);
+    return [
+        {
+            code: CLA_CONSENT_MISSING_CODE,
+            severity: "warning",
+            title: "CLA consent not confirmed",
+            detail: `This PR does not confirm contributor license agreement consent: ${missing.join(" or ")}.`,
+            action: "Add the required CLA consent phrase to the PR description, or complete the CLA check, then re-run the gate.",
+        },
+    ];
+}

package/dist/review/diff-file-priority.d.ts

@@ -0,0 +1 @@
+export declare function diffFilePriority(path: string): number;

package/dist/review/diff-file-priority.js

@@ -0,0 +1,12 @@
+import { isTestPath } from "../signals/test-evidence.js";
+export function diffFilePriority(path) {
+    if (/(^|\/)(package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lock|bun\.lockb|cargo\.lock|poetry\.lock|pipfile\.lock|composer\.lock|gemfile\.lock|go\.sum|go\.work\.sum|uv\.lock|packages\.lock\.json|flake\.lock|deno\.lock|pubspec\.lock|podfile\.lock|mix\.lock|package\.resolved|gradle\.lockfile|pdm\.lock|conan\.lock|pixi\.lock|cartfile\.resolved|gopkg\.lock|shard\.lock|rebar\.lock|renv\.lock|chart\.lock)$|\.(min\.(js|css)|map|snap)$/i.test(path))
+        return 4;
+    if (/(^|\/)(dist|build|out|coverage|vendor|node_modules)\//i.test(path))
+        return 4;
+    if (/\.(md|mdx|markdown|rst|adoc|asciidoc|txt)$/i.test(path))
+        return 2;
+    if (isTestPath(path))
+        return 1;
+    return 0;
+}

package/dist/review/enrichment-analyzer-names.d.ts

@@ -0,0 +1,3 @@
+export declare const REES_ANALYZER_NAMES: readonly ["dependency", "dependencyDiff", "lockfileDrift", "secret", "license", "installScript", "heavyDependency", "hardcodedUrl", "actionPin", "eol", "redos", "provenance", "codeowners", "secretLog", "assetWeight", "typosquat", "commitSignature", "iacMisconfig", "nativeBuild", "history", "docCommentDrift", "duplication", "churnHotspot", "blameLink", "approvalIntegrity", "ciCheckSignals", "undocumentedExport", "staleBranch", "commitHygiene", "pendingReviewRequests", "testRatio", "migrationSafety", "looseRange", "terminology", "todoMarker", "magicNumber", "conflictMarker", "debugLeftover", "sizeSmell", "floatingPromise", "deepNesting", "errorSwallow", "complexity", "complexityDelta", "unsafeAny", "a11y", "i18n", "unusedExport", "exhaustiveness", "flakyTest", "commitLint", "apiBreak", "deprecatedDep", "revertRecurrence", "coverageDelta", "callerImpact"];
+export type ReesAnalyzerName = (typeof REES_ANALYZER_NAMES)[number];
+export declare const REES_ANALYZER_NAME_SET: ReadonlySet<string>;

package/dist/review/enrichment-analyzer-names.js

@@ -0,0 +1,63 @@
+// Canonical REES enrichment-analyzer name registry (#2050). The single source of truth for the analyzer keys that
+// both the operator `REES_ANALYZERS` env list and the per-repo `.gittensory.yml` `review.enrichment` toggles are
+// validated against. A leaf module with no imports, so the review wiring and the signals-layer manifest parser can
+// share it without a heavy or circular dependency.
+export const REES_ANALYZER_NAMES = [
+    "dependency",
+    "dependencyDiff",
+    "lockfileDrift",
+    "secret",
+    "license",
+    "installScript",
+    "heavyDependency",
+    "hardcodedUrl",
+    "actionPin",
+    "eol",
+    "redos",
+    "provenance",
+    "codeowners",
+    "secretLog",
+    "assetWeight",
+    "typosquat",
+    "commitSignature",
+    "iacMisconfig",
+    "nativeBuild",
+    "history",
+    "docCommentDrift",
+    "duplication",
+    "churnHotspot",
+    "blameLink",
+    "approvalIntegrity",
+    "ciCheckSignals",
+    "undocumentedExport",
+    "staleBranch",
+    "commitHygiene",
+    "pendingReviewRequests",
+    "testRatio",
+    "migrationSafety",
+    "looseRange",
+    "terminology",
+    "todoMarker",
+    "magicNumber",
+    "conflictMarker",
+    "debugLeftover",
+    "sizeSmell",
+    "floatingPromise",
+    "deepNesting",
+    "errorSwallow",
+    "complexity",
+    "complexityDelta",
+    "unsafeAny",
+    "a11y",
+    "i18n",
+    "unusedExport",
+    "exhaustiveness",
+    "flakyTest",
+    "commitLint",
+    "apiBreak",
+    "deprecatedDep",
+    "revertRecurrence",
+    "coverageDelta",
+    "callerImpact",
+];
+export const REES_ANALYZER_NAME_SET = new Set(REES_ANALYZER_NAMES);

package/dist/review/guardrail-config.d.ts

@@ -0,0 +1,10 @@
+import type { RepositorySettings } from "../types/predicted-gate-types.js";
+export declare const CONFIG_AS_CODE_GUARDRAIL_GLOBS: string[];
+export declare const WORKFLOW_AND_RUNTIME_GUARDRAIL_GLOBS: string[];
+export declare const ENGINE_DECISION_GUARDRAIL_GLOBS: string[];
+export declare const DEFAULT_HARD_GUARDRAIL_GLOBS: string[];
+/**
+ * Resolve hard-guardrail path globs from the already-effective repo settings. Built-in config-as-code,
+ * workflow/runtime, and engine decision guardrails are invariants; repo settings may only add globs.
+ */
+export declare function resolveHardGuardrailGlobs(settings: Pick<RepositorySettings, "hardGuardrailGlobs"> | null | undefined): string[];

package/dist/review/guardrail-config.js

@@ -0,0 +1,62 @@
+// New-brand (`loopover`) and legacy (`gittensory`) entries are both listed — this is a Set-membership guardrail
+// list (order doesn't matter, unlike the loaders' priority-ordered candidate lists), so a contributor PR touching
+// EITHER the new canonical `.loopover.*` config file or a still-supported legacy `.gittensory.*` one gets the same
+// hard-guardrail protection (#4773 — dual-read, additive; the legacy globs are never removed).
+export const CONFIG_AS_CODE_GUARDRAIL_GLOBS = [
+    ".loopover.yml",
+    ".loopover.yaml",
+    ".loopover.json",
+    ".github/loopover.yml",
+    ".github/loopover.yaml",
+    ".github/loopover.json",
+    ".gittensory.yml",
+    ".gittensory.yaml",
+    ".gittensory.json",
+    ".github/gittensory.yml",
+    ".github/gittensory.yaml",
+    ".github/gittensory.json",
+    "**/codecov.yml",
+    "**/codecov.yaml",
+    "**/.codecov.yml",
+];
+export const WORKFLOW_AND_RUNTIME_GUARDRAIL_GLOBS = [
+    ".github/workflows/**",
+    "scripts/**",
+    "wrangler.jsonc",
+    "src/selfhost/**",
+];
+export const ENGINE_DECISION_GUARDRAIL_GLOBS = [
+    "src/rules/**",
+    "src/services/**",
+    "src/settings/agent-actions.ts",
+    "src/settings/agent-execution.ts",
+    "src/settings/agent-sweep.ts",
+    "src/settings/autonomy.ts",
+    "src/queue/**",
+    "src/github/pr-actions.ts",
+    "src/github/app.ts",
+    "src/github/backfill.ts",
+    // #4197: writes a real commit onto a CONTRIBUTOR's own PR branch (not a branch gittensory owns) — the same
+    // guardrail tier as pr-actions.ts/app.ts for the same reason, a new GitHub-write surface.
+    "src/github/e2e-test-commit.ts",
+    "src/scoring/**",
+    "src/auth/**",
+    "src/review/safety.ts",
+    "src/review/guardrail-config.ts",
+    "src/review/cutover-gate.ts",
+    "src/review/linked-issue-hard-rules.ts",
+    "src/review/outcomes-wire.ts",
+];
+export const DEFAULT_HARD_GUARDRAIL_GLOBS = [
+    ...CONFIG_AS_CODE_GUARDRAIL_GLOBS,
+    ...WORKFLOW_AND_RUNTIME_GUARDRAIL_GLOBS,
+    ...ENGINE_DECISION_GUARDRAIL_GLOBS,
+];
+/**
+ * Resolve hard-guardrail path globs from the already-effective repo settings. Built-in config-as-code,
+ * workflow/runtime, and engine decision guardrails are invariants; repo settings may only add globs.
+ */
+export function resolveHardGuardrailGlobs(settings) {
+    const configured = settings?.hardGuardrailGlobs;
+    return Array.from(new Set([...DEFAULT_HARD_GUARDRAIL_GLOBS, ...(Array.isArray(configured) ? configured : [])]));
+}

package/dist/review/linked-issue-hard-rules-config.d.ts

@@ -0,0 +1,4 @@
+import type { LinkedIssueHardRulesConfig, LinkedIssueHardRulesMode } from "../types/manifest-deps-types.js";
+export declare const DEFAULT_LINKED_ISSUE_HARD_RULES: LinkedIssueHardRulesConfig;
+export declare function isLinkedIssueHardRuleMode(value: unknown): value is LinkedIssueHardRulesMode;
+export declare function normalizeLinkedIssueHardRulesConfig(input: unknown, warnings: string[]): LinkedIssueHardRulesConfig;

package/dist/review/linked-issue-hard-rules-config.js

@@ -0,0 +1,79 @@
+const VALID_LINKED_ISSUE_HARD_RULE_MODES = ["block", "off"];
+const DEFAULT_CLOSE_DELAY_SECONDS = 30;
+const MAX_CLOSE_DELAY_SECONDS = 300;
+export const DEFAULT_LINKED_ISSUE_HARD_RULES = {
+    ownerAssignedClose: "off",
+    assignedIssueClose: "off",
+    missingPointLabelClose: "off",
+    maintainerOnlyLabelClose: "off",
+    pointBearingLabels: [],
+    maintainerOnlyLabels: [],
+    defaultLabelRepo: false,
+    verifyBeforeClose: true,
+    closeDelaySeconds: DEFAULT_CLOSE_DELAY_SECONDS,
+};
+export function isLinkedIssueHardRuleMode(value) {
+    return typeof value === "string" && VALID_LINKED_ISSUE_HARD_RULE_MODES.includes(value);
+}
+function normalizeStringList(value, field, warnings) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value)) {
+        warnings.push(`settings.linkedIssueHardRules.${field} must be an array; using no labels.`);
+        return [];
+    }
+    const labels = [];
+    for (const [index, item] of value.entries()) {
+        if (typeof item !== "string" || item.trim().length === 0) {
+            warnings.push(`settings.linkedIssueHardRules.${field}[${index}] must be a non-empty string; ignoring it.`);
+            continue;
+        }
+        labels.push(item.trim());
+    }
+    return labels;
+}
+function normalizeMode(value, field, warnings) {
+    if (value === undefined)
+        return DEFAULT_LINKED_ISSUE_HARD_RULES[field];
+    if (isLinkedIssueHardRuleMode(value))
+        return value;
+    warnings.push(`settings.linkedIssueHardRules.${field} must be one of block, off; using the default "${DEFAULT_LINKED_ISSUE_HARD_RULES[field]}".`);
+    return DEFAULT_LINKED_ISSUE_HARD_RULES[field];
+}
+function normalizeBoolean(value, field, warnings) {
+    if (value === undefined)
+        return DEFAULT_LINKED_ISSUE_HARD_RULES[field];
+    if (typeof value === "boolean")
+        return value;
+    warnings.push(`settings.linkedIssueHardRules.${field} must be a boolean; using the default "${DEFAULT_LINKED_ISSUE_HARD_RULES[field]}".`);
+    return DEFAULT_LINKED_ISSUE_HARD_RULES[field];
+}
+function normalizeCloseDelaySeconds(value, warnings) {
+    if (value === undefined)
+        return DEFAULT_LINKED_ISSUE_HARD_RULES.closeDelaySeconds;
+    if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+        warnings.push(`settings.linkedIssueHardRules.closeDelaySeconds must be a non-negative number; using the default "${DEFAULT_CLOSE_DELAY_SECONDS}".`);
+        return DEFAULT_CLOSE_DELAY_SECONDS;
+    }
+    return Math.min(MAX_CLOSE_DELAY_SECONDS, Math.floor(value));
+}
+export function normalizeLinkedIssueHardRulesConfig(input, warnings) {
+    if (input === undefined)
+        return { ...DEFAULT_LINKED_ISSUE_HARD_RULES, pointBearingLabels: [], maintainerOnlyLabels: [] };
+    if (typeof input !== "object" || input === null || Array.isArray(input)) {
+        warnings.push("settings.linkedIssueHardRules must be an object; using the default all-off policy.");
+        return { ...DEFAULT_LINKED_ISSUE_HARD_RULES, pointBearingLabels: [], maintainerOnlyLabels: [] };
+    }
+    const record = input;
+    return {
+        ownerAssignedClose: normalizeMode(record.ownerAssignedClose, "ownerAssignedClose", warnings),
+        assignedIssueClose: normalizeMode(record.assignedIssueClose, "assignedIssueClose", warnings),
+        missingPointLabelClose: normalizeMode(record.missingPointLabelClose, "missingPointLabelClose", warnings),
+        maintainerOnlyLabelClose: normalizeMode(record.maintainerOnlyLabelClose, "maintainerOnlyLabelClose", warnings),
+        pointBearingLabels: normalizeStringList(record.pointBearingLabels, "pointBearingLabels", warnings),
+        maintainerOnlyLabels: normalizeStringList(record.maintainerOnlyLabels, "maintainerOnlyLabels", warnings),
+        defaultLabelRepo: normalizeBoolean(record.defaultLabelRepo, "defaultLabelRepo", warnings),
+        verifyBeforeClose: normalizeBoolean(record.verifyBeforeClose, "verifyBeforeClose", warnings),
+        closeDelaySeconds: normalizeCloseDelaySeconds(record.closeDelaySeconds, warnings),
+    };
+}

package/dist/review/linked-issue-label-propagation.d.ts

@@ -0,0 +1,9 @@
+import type { LinkedIssueLabelPropagationConfig, LinkedIssueLabelPropagationMode } from "../types/manifest-deps-types.js";
+export type { LinkedIssueLabelPropagationConfig, LinkedIssueLabelPropagationMapping, LinkedIssueLabelPropagationMode } from "../types/manifest-deps-types.js";
+export declare const DEFAULT_LINKED_ISSUE_LABEL_PROPAGATION: LinkedIssueLabelPropagationConfig;
+export declare const VALID_LINKED_ISSUE_LABEL_PROPAGATION_MODES: readonly LinkedIssueLabelPropagationMode[];
+/** Defaults-fill a per-repo `linkedIssueLabelPropagation` override into an always-complete, safe config —
+ *  mirrors `normalizeCommandAuthorizationPolicy`'s defaults-fill pattern
+ *  (`src/settings/command-authorization.ts`). Malformed mapping entries are dropped with a warning; valid
+ *  entries in the same array are kept (matches `commandAuthorization`'s per-entry `commands` validation). */
+export declare function normalizeLinkedIssueLabelPropagationConfig(input: unknown, warnings: string[]): LinkedIssueLabelPropagationConfig;

package/dist/review/linked-issue-label-propagation.js

@@ -0,0 +1,114 @@
+// Linked-issue label PROPAGATION (#priority-linked-issue-gate). Generic, config-driven mechanism: when a
+// linked/closing issue already carries a configured label, copy a mapped label onto the PR. Built specifically
+// so a maintainer-reward/bonus label (e.g. `gittensor:priority`) can NEVER be inferred from a PR's title,
+// changed files, AI output, or existing PR labels — only ever from a linked issue that ALREADY carries it.
+// Generic beyond that one use case: any self-hoster can map any issue label to any PR label, exclusive
+// (replaces the normal bug/feature type label, like priority does) or additive (applied alongside it).
+//
+// PURE config types + normalizer only — no GitHub/fetch/Env-dependent imports. `focus-manifest.ts`'s YAML
+// parser imports this module directly, and `focus-manifest.ts` is itself pulled into the gittensory-ui
+// workspace's isolated typecheck (via `apps/gittensory-ui/src/lib/registration-workspace.ts`), which has no
+// visibility into the Worker's ambient `Env` type. The actual GitHub fetch orchestrator
+// (`fetchLinkedIssueLabelsForPropagation`) lives in `linked-issue-label-propagation-fetch.ts` instead, kept
+// out of this file specifically so the UI workspace's typecheck never has to resolve `Env`.
+// Fail-SAFE default: propagation OFF, no mappings. A self-hoster must explicitly opt in per repo.
+export const DEFAULT_LINKED_ISSUE_LABEL_PROPAGATION = {
+    enabled: false,
+    mode: "exclusive_type_label",
+    mappings: [],
+};
+// Exported so `focus-manifest.ts`'s sparse-override parser can check whether a raw `mode` value is
+// actually valid before deciding to copy the normalizer's (possibly defaults-filled-on-invalid) result.
+export const VALID_LINKED_ISSUE_LABEL_PROPAGATION_MODES = ["exclusive_type_label"];
+function normalizeMapping(input, index, warnings) {
+    if (typeof input !== "object" || input === null || Array.isArray(input)) {
+        warnings.push(`settings.linkedIssueLabelPropagation.mappings[${index}] must be an object; ignoring it.`);
+        return null;
+    }
+    const record = input;
+    const issueLabel = typeof record.issueLabel === "string" ? record.issueLabel.trim() : "";
+    const prLabel = typeof record.prLabel === "string" ? record.prLabel.trim() : "";
+    if (issueLabel.length === 0 || prLabel.length === 0) {
+        warnings.push(`settings.linkedIssueLabelPropagation.mappings[${index}] must have non-empty "issueLabel" and "prLabel" strings; ignoring it.`);
+        return null;
+    }
+    // `removeOtherTypeLabels` picks exclusive (replaces the type label, the gittensor:priority case) vs.
+    // additive (applied alongside it) -- silently coercing a present-but-wrong-shaped value (e.g. a quoted
+    // `"true"` string) to `false` could flip an intended-exclusive mapping to additive without any signal,
+    // so a present, non-boolean value drops the whole entry with a warning instead (omitted is still a
+    // normal, unwarned default of `false`).
+    if (record.removeOtherTypeLabels !== undefined && typeof record.removeOtherTypeLabels !== "boolean") {
+        warnings.push(`settings.linkedIssueLabelPropagation.mappings[${index}].removeOtherTypeLabels must be a boolean; ignoring this mapping.`);
+        return null;
+    }
+    // Unlike `removeOtherTypeLabels`, a malformed value here can only ever be warned-and-defaulted (never
+    // dropped) -- defaulting to `undefined`/strict is always the SAFE direction (no mapping accidentally
+    // starts trusting maintainer-authored issues), so there is no silent-flip risk that would justify
+    // discarding an otherwise-valid mapping over it.
+    let trustMaintainerAuthoredIssue;
+    if (record.trustMaintainerAuthoredIssue !== undefined) {
+        if (typeof record.trustMaintainerAuthoredIssue === "boolean") {
+            trustMaintainerAuthoredIssue = record.trustMaintainerAuthoredIssue;
+        }
+        else {
+            warnings.push(`settings.linkedIssueLabelPropagation.mappings[${index}].trustMaintainerAuthoredIssue must be a boolean; ignoring it.`);
+        }
+    }
+    // Same parse contract as trustMaintainerAuthoredIssue just above (#priority-reward-maintainer-trust):
+    // malformed is warned-and-defaulted to undefined/strict, never silently coerced, never a reason to drop
+    // an otherwise-valid mapping.
+    let trustMaintainerAuthoredIssueForReward;
+    if (record.trustMaintainerAuthoredIssueForReward !== undefined) {
+        if (typeof record.trustMaintainerAuthoredIssueForReward === "boolean") {
+            trustMaintainerAuthoredIssueForReward = record.trustMaintainerAuthoredIssueForReward;
+        }
+        else {
+            warnings.push(`settings.linkedIssueLabelPropagation.mappings[${index}].trustMaintainerAuthoredIssueForReward must be a boolean; ignoring it.`);
+        }
+    }
+    return { issueLabel, prLabel, removeOtherTypeLabels: record.removeOtherTypeLabels === true, trustMaintainerAuthoredIssue, trustMaintainerAuthoredIssueForReward };
+}
+/** Defaults-fill a per-repo `linkedIssueLabelPropagation` override into an always-complete, safe config —
+ *  mirrors `normalizeCommandAuthorizationPolicy`'s defaults-fill pattern
+ *  (`src/settings/command-authorization.ts`). Malformed mapping entries are dropped with a warning; valid
+ *  entries in the same array are kept (matches `commandAuthorization`'s per-entry `commands` validation). */
+export function normalizeLinkedIssueLabelPropagationConfig(input, warnings) {
+    if (input === undefined)
+        return { ...DEFAULT_LINKED_ISSUE_LABEL_PROPAGATION, mappings: [] };
+    if (typeof input !== "object" || input === null || Array.isArray(input)) {
+        warnings.push("settings.linkedIssueLabelPropagation must be an object; propagation stays disabled.");
+        return { ...DEFAULT_LINKED_ISSUE_LABEL_PROPAGATION, mappings: [] };
+    }
+    const record = input;
+    let enabled = DEFAULT_LINKED_ISSUE_LABEL_PROPAGATION.enabled;
+    if (record.enabled !== undefined) {
+        if (typeof record.enabled === "boolean") {
+            enabled = record.enabled;
+        }
+        else {
+            warnings.push(`settings.linkedIssueLabelPropagation.enabled must be a boolean; using the default "${DEFAULT_LINKED_ISSUE_LABEL_PROPAGATION.enabled}".`);
+        }
+    }
+    let mode = DEFAULT_LINKED_ISSUE_LABEL_PROPAGATION.mode;
+    if (record.mode !== undefined) {
+        if (typeof record.mode === "string" && VALID_LINKED_ISSUE_LABEL_PROPAGATION_MODES.includes(record.mode)) {
+            mode = record.mode;
+        }
+        else {
+            warnings.push(`settings.linkedIssueLabelPropagation.mode must be one of ${VALID_LINKED_ISSUE_LABEL_PROPAGATION_MODES.join(", ")}; using the default "${DEFAULT_LINKED_ISSUE_LABEL_PROPAGATION.mode}".`);
+        }
+    }
+    let mappings = [];
+    if (record.mappings !== undefined) {
+        if (Array.isArray(record.mappings)) {
+            mappings = record.mappings.flatMap((entry, index) => {
+                const normalized = normalizeMapping(entry, index, warnings);
+                return normalized ? [normalized] : [];
+            });
+        }
+        else {
+            warnings.push("settings.linkedIssueLabelPropagation.mappings must be an array; using no mappings.");
+        }
+    }
+    return { enabled, mode, mappings };
+}

package/dist/review/pre-merge-checks.d.ts

@@ -0,0 +1,28 @@
+import { type PreMergeCheck } from "../focus-manifest/guidance.js";
+import type { AdvisoryFinding } from "../types/predicted-gate-types.js";
+/** Finding code for a FAILED advisory (default) pre-merge check — surfaced but NEVER blocks. */
+export declare const PRE_MERGE_CHECK_ADVISORY_CODE = "pre_merge_check_failed";
+/** Finding code for a FAILED pre-merge check the maintainer marked `enforce: true` — a hard gate blocker
+ *  (isConfiguredGateBlocker treats this code as blocking, like secret_leak). */
+export declare const PRE_MERGE_CHECK_BLOCKING_CODE = "pre_merge_check_required";
+/** Finding code emitted when an ENFORCED `whenPaths`-gated check cannot be evaluated because the PR's changed-file
+ *  set could not be resolved. isEvaluationBlocker (advisory.ts) treats this as a NEUTRAL gate (HELD, re-evaluates
+ *  automatically) — never silently skipping a hard requirement (auto-merge bypass) and never hard-closing the
+ *  contributor on a transient resolution miss. (#review-audit) */
+export declare const PRE_MERGE_CHECK_UNRESOLVED_CODE = "pre_merge_check_unresolved";
+/**
+ * Evaluate the maintainer's `.gittensory.yml review.pre_merge_checks` against a PR — DETERMINISTICALLY, with no AI
+ * judgment. A check with `whenPaths` applies only when a changed path matches; it PASSES only when EVERY configured
+ * assertion holds (the title contains `titleContains`, the body contains `descriptionContains`, and the
+ * `requireLabel` label is present — all case-insensitive). Each FAILED check yields ONE finding:
+ * `pre_merge_check_required` (severity critical → the gate blocks under enforce) or `pre_merge_check_failed`
+ * (severity warning → advisory). Pure + side-effect-free; the caller pushes the findings into the advisory before
+ * the gate evaluates. Empty `checks` ⇒ no findings (byte-identical).
+ */
+export declare function evaluatePreMergeChecks(checks: PreMergeCheck[], ctx: {
+    title?: string | null | undefined;
+    body?: string | null | undefined;
+    labels?: string[] | null | undefined;
+    changedPaths: string[];
+    filesResolved?: boolean | undefined;
+}): AdvisoryFinding[];

package/dist/review/pre-merge-checks.js

@@ -0,0 +1,66 @@
+import { matchesManifestPath } from "../focus-manifest/guidance.js";
+/** Finding code for a FAILED advisory (default) pre-merge check — surfaced but NEVER blocks. */
+export const PRE_MERGE_CHECK_ADVISORY_CODE = "pre_merge_check_failed";
+/** Finding code for a FAILED pre-merge check the maintainer marked `enforce: true` — a hard gate blocker
+ *  (isConfiguredGateBlocker treats this code as blocking, like secret_leak). */
+export const PRE_MERGE_CHECK_BLOCKING_CODE = "pre_merge_check_required";
+/** Finding code emitted when an ENFORCED `whenPaths`-gated check cannot be evaluated because the PR's changed-file
+ *  set could not be resolved. isEvaluationBlocker (advisory.ts) treats this as a NEUTRAL gate (HELD, re-evaluates
+ *  automatically) — never silently skipping a hard requirement (auto-merge bypass) and never hard-closing the
+ *  contributor on a transient resolution miss. (#review-audit) */
+export const PRE_MERGE_CHECK_UNRESOLVED_CODE = "pre_merge_check_unresolved";
+/**
+ * Evaluate the maintainer's `.gittensory.yml review.pre_merge_checks` against a PR — DETERMINISTICALLY, with no AI
+ * judgment. A check with `whenPaths` applies only when a changed path matches; it PASSES only when EVERY configured
+ * assertion holds (the title contains `titleContains`, the body contains `descriptionContains`, and the
+ * `requireLabel` label is present — all case-insensitive). Each FAILED check yields ONE finding:
+ * `pre_merge_check_required` (severity critical → the gate blocks under enforce) or `pre_merge_check_failed`
+ * (severity warning → advisory). Pure + side-effect-free; the caller pushes the findings into the advisory before
+ * the gate evaluates. Empty `checks` ⇒ no findings (byte-identical).
+ */
+export function evaluatePreMergeChecks(checks, ctx) {
+    const title = (ctx.title ?? "").toLowerCase();
+    const body = (ctx.body ?? "").toLowerCase();
+    const labels = (ctx.labels ?? []).map((label) => label.toLowerCase());
+    const filesResolved = ctx.filesResolved ?? true; // absent ⇒ caller asserts a trustworthy changedPaths set
+    const findings = [];
+    for (const check of checks) {
+        // when_paths gate: a check with whenPaths applies ONLY to PRs that touch a matching path; an unmatched check
+        // is N/A (no finding). Empty whenPaths ⇒ the check always applies (title/description/label only).
+        if (check.whenPaths.length > 0) {
+            if (!filesResolved) {
+                // The changed-file set could not be resolved, so we cannot evaluate this path gate. HOLD the gate for an
+                // ENFORCED check (re-evaluates when files resolve) instead of silently skipping a hard requirement (which
+                // would let a guarded PR auto-merge). An advisory check is just dropped (no noise on a transient miss).
+                if (check.enforce)
+                    findings.push({
+                        code: PRE_MERGE_CHECK_UNRESOLVED_CODE,
+                        severity: "warning",
+                        title: `Pre-merge check held — changed files not resolved: ${check.name}`,
+                        detail: `Gittensory could not resolve this PR's changed files to evaluate the path-gated check "${check.name}"; the gate is held and re-evaluates automatically.`,
+                        action: "No action needed — the gate re-evaluates once the PR's files are available.",
+                    });
+                continue;
+            }
+            if (!ctx.changedPaths.some((path) => check.whenPaths.some((glob) => matchesManifestPath(path, glob))))
+                continue;
+        }
+        const unmet = [];
+        if (check.titleContains !== null && !title.includes(check.titleContains.toLowerCase()))
+            unmet.push(`the title must contain "${check.titleContains}"`);
+        if (check.descriptionContains !== null && !body.includes(check.descriptionContains.toLowerCase()))
+            unmet.push(`the description must contain "${check.descriptionContains}"`);
+        if (check.requireLabel !== null && !labels.includes(check.requireLabel.toLowerCase()))
+            unmet.push(`the "${check.requireLabel}" label must be applied`);
+        if (unmet.length === 0)
+            continue; // every configured assertion held → the check passed
+        findings.push({
+            code: check.enforce ? PRE_MERGE_CHECK_BLOCKING_CODE : PRE_MERGE_CHECK_ADVISORY_CODE,
+            severity: check.enforce ? "critical" : "warning",
+            title: `Pre-merge check not satisfied: ${check.name}`,
+            detail: `This PR does not satisfy the maintainer pre-merge check "${check.name}": ${unmet.join("; ")}.`,
+            action: "Update the PR to satisfy the check, then re-run the gate.",
+        });
+    }
+    return findings;
+}