fix(openapi): add 11 missing RepositorySettings fields + a structural-drift CI check

[JSONbored]

Summary

• RepositorySettingsSchema/RepoSettingsPreviewSchema (hand-authored Zod schemas in src/openapi/schemas.ts) were missing 11 real fields the runtime RepositorySettings TS type has and GET /v1/repos/:owner/:repo/settings actually serializes: sizeGateMode, gateDryRun, premergeContentRecheck, aiReviewMode, aiReviewByok, aiReviewProvider, aiReviewModel, aiReviewAllAuthors, aiReviewCloseConfidence, closeOwnerAuthors, badgeEnabled.
• ui:openapi:check only verifies the generated openapi.json matches the Zod schema — it never verifies the Zod schema matches the actual TS interface, so this silently breaks generated API clients (including @jsonbored/gittensory-mcp) with no CI signal.

Scope

• src/openapi/schemas.ts — added all 11 fields to RepositorySettingsSchema, plus the 6 fields (badgeEnabled + 5 aiReview*) that the separate RepoSettingsPreview.settings sub-type carries to RepoSettingsPreviewSchema.
• scripts/check-openapi-settings-parity.mjs (+ .d.mts) — parses the top-level field names out of the RepositorySettings type block in src/types.ts and diffs them against RepositorySettingsSchema.shape's keys, failing with the exact field names on any asymmetric difference. Pure functions (extractRepositorySettingsFieldNames, diffFieldSets) are exported and directly unit-tested.
• package.json — new ui:openapi:settings-parity script, wired into test:ci right after ui:openapi:check.
• .github/workflows/ci.yml — new "OpenAPI settings-parity check" step, gated identically to "OpenAPI drift check".
• .claude/skills/contributing-to-gittensory/reference.md — documented the new check.
• apps/gittensory-ui/public/openapi.json — regenerated.
• test/unit/ci-openapi-settings-parity.test.ts — new tests for the extraction/diff logic plus a regression test asserting the real type and schema are in parity.

Validation

• npx vitest run test/unit/ci-openapi-settings-parity.test.ts test/unit/openapi.test.ts — 7/7 passing, 100% line/branch coverage on the changed src/openapi/schemas.ts
• npm run typecheck — clean
• npm run actionlint — clean
• npm run test:ci — full local gate green
• npm audit --audit-level=moderate — 0 vulnerabilities

Safety

• Additive schema fields only — every field is .optional()/.nullable() matching the TS type's own optionality, so no existing consumer's parsing behavior changes.
• The new CI check only runs when ui/uiContract paths change (same gate as the existing OpenAPI drift check) — zero added cost for unrelated PRs.
• Touches .github/workflows/**, a guarded path — expect this to be held for manual owner merge rather than auto-merged.

Closes #2556

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-02 12:42:14 UTC}

8 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review

Review summary
This change fills the visible RepositorySettings and RepoSettingsPreview OpenAPI gaps and regenerates the committed spec consistently with the new Zod fields. The added CI script correctly catches asymmetric top-level key drift between the RepositorySettings type and RepositorySettingsSchema for the current simple type shape, and the package/workflow wiring is coherent. The main limitation is that the new guard is structural only: it protects field presence, not requiredness or field type parity.

Nits — 7 non-blocking

• nit: scripts/check-openapi-settings-parity.mjs:14-24 uses a hand-rolled text marker plus a two-space field regex, so future formatting, comments, quoted keys, or inline object fields could make the parity guard miss real drift.
• nit: scripts/check-openapi-settings-parity.mjs:34-51 only guards RepositorySettingsSchema, while RepoSettingsPreviewSchema remains another hand-authored schema touched by this PR and can still drift unless you add a preview-specific parity check or document why it has no stable source type.
• nit: src/openapi/schemas.ts:689 keeps RepoSettingsPreviewSchema.aiReviewProvider as plain nullable string while RepositorySettingsSchema.aiReviewProvider is constrained to the known provider enum; use the same enum unless the preview endpoint intentionally permits a wider value.
• scripts/check-openapi-settings-parity.mjs:18 should use the TypeScript compiler API or a small AST parser for RepositorySettings fields so the CI guard survives harmless formatting/type-shape changes.
• scripts/check-openapi-settings-parity.mjs:34 should either add a second diff for RepoSettingsPreviewSchema.settings or leave an explicit comment naming the source that makes preview parity impractical.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#2556
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (size label size:M; 1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 65 registered-repo PR(s), 55 merged, 536 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 65 PR(s), 536 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 65 PR(s), 536 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• No action.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	77abcd5	Commit Preview URL Branch Preview URL	Jul 02 2026, 12:35 PM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.02%. Comparing base (dd2c824) to head (77abcd5).
⚠️ Report is 6 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2601      +/-   ##
==========================================
+ Coverage   96.01%   96.02%   +0.01%     
==========================================
  Files         231      233       +2     
  Lines       25987    26077      +90     
  Branches     9446     9474      +28     
==========================================
+ Hits        24951    25041      +90     
  Misses        425      425              
  Partials      611      611              

Files with missing lines	Coverage Δ
src/openapi/schemas.ts	100.00% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.