feat(review): personalize predicted-gate readiness by contributor calibration history (#2349)

[JSONbored]

Summary

• Extends buildPredictedGateVerdict with an optional contributorCalibration input that nudges the returned readinessScore based on a login's own historical predict-vs-real agreement (predicted_gate_calibration_ledger, written since feat(review): persist a login-keyed predict-gate-vs-live-gate disagreement ledger as the review stack's own calibration ground truth #4517) — a strong track record tightens confidence (score up), a weak one is more conservative (score down), clamped to MAX_READINESS_ADJUSTMENT (10 points) either direction.
• Adds computeContributorCalibration (src/review/predicted-gate-calibration-ledger.ts) to aggregate one login's full ledger history into {sampleSize, agreementRate} — read-side counterpart to the existing writer, completing that module's own documented future work. Not flag-gated (unlike the writer): it just reads whatever rows already exist.
• Wires it into both real call sites: MCP predict_gate/explain_gate_disposition (src/mcp/server.ts) and POST /v1/local/branch-analysis (src/api/routes.ts).
• Cold start (never-seen login, or fewer than MIN_CALIBRATION_SAMPLES = 5 pairings) is byte-identical to today — no penalty, no bonus.

Safety boundary

Personalization is applied in buildPredictedGateVerdict strictly after evaluateGateCheck has already finalized conclusion/blockers/warnings — the calibration adjustment function receives and returns only the numeric readinessScore, so it is structurally incapable of flipping a hard blocker off or suppressing a finding, not just clamped by convention. Verified directly: a test seeds the strongest possible personalization signal (10,000 samples, 100% agreement) against a PR with a real missing-linked-issue blocker and asserts the blocker and failure conclusion are untouched.

The raw calibration numbers (sampleSize, agreementRate) are never echoed back in the verdict — only their clamped, already-public downstream effect on readinessScore is. Verified with explicit "never echoed back" tests at the pure-verdict level and at both real wire call sites, per the issue's own design-note deliverable (mirrors src/signals/redaction.ts's "no raw per-actor trust signal, ever public" precedent).

Deliverables (from #2349)

• Per-actor calibration lookup feeding an adjustment factor into the readiness/confidence output
• Explicit floor/ceiling clamps so personalization can only narrow/widen the advisory band, never flip a hard blocker off
• Cold-start behavior for a never-seen actor (unweighted baseline, no penalty/bonus)
• Regression coverage: cold-start, strong-track-record, weak-track-record, clamp-boundary (including malformed-input clamping), hard-blocker-cannot-be-bypassed
• Design note + tests on where this may not be exposed publicly

No schema changes — predicted_gate_calibration_ledger (migration 0138) already has everything needed; this PR is purely a reader + a pure adjustment function + wiring.

Test plan

• packages/gittensory-engine builds clean (tsc --incremental false) and its full node:test suite passes
• Root npm run typecheck clean
• test/unit/predicted-gate.test.ts — 22 new tests: pure applyContributorCalibration unit tests (cold-start x3, strong/weak, clamp boundaries incl. malformed input, null-baseline) + buildPredictedGateVerdict integration tests (byte-identical when omitted, score shifts, blockers/conclusion/warnings untouched, hard-blocker safety, no raw-number leak)
• test/unit/predicted-gate-calibration-ledger.test.ts — 7 new tests for computeContributorCalibration (cold start, aggregation, per-login scoping, cross-repo aggregation, missing login, unflagged read, fail-safe)
• test/unit/mcp-predict-gate.test.ts + test/unit/routes-remediation-plan.test.ts — end-to-end wiring tests through both real call sites
• Measured coverage (scoped --coverage.include, not whole-file): contributor-calibration.ts 100/100/100/100, predicted-gate-calibration-ledger.ts 100/100/100/100, predicted-gate.ts's two remaining branch partials are pre-existing/unrelated to this diff (confirmed via git diff hunk boundaries), new lines in server.ts/routes.ts confirmed hit via raw coverage JSON

Closes #2349

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.13%. Comparing base (3213313) to head (0bdf5f2).
⚠️ Report is 4 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5069   +/-   ##
=======================================
  Coverage   94.13%   94.13%           
=======================================
  Files         465      466    +1     
  Lines       39554    39572   +18     
  Branches    14433    14436    +3     
=======================================
+ Hits        37235    37253   +18     
  Misses       1664     1664           
  Partials      655      655           

Flag	Coverage Δ
shard-1	46.52% <77.77%> (+0.01%)	⬆️
shard-2	33.55% <16.66%> (-0.01%)	⬇️
shard-3	32.46% <77.77%> (+1.13%)	⬆️
shard-4	31.72% <50.00%> (-0.96%)	⬇️
shard-5	33.34% <16.66%> (-0.09%)	⬇️
shard-6	44.93% <44.44%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
packages/gittensory-engine/src/predicted-gate.ts	100.00% <ø> (ø)
...sory-engine/src/signals/contributor-calibration.ts	100.00% <100.00%> (ø)
src/api/routes.ts	94.29% <100.00%> (+<0.01%)	⬆️
src/mcp/server.ts	95.62% <100.00%> (+<0.01%)	⬆️
src/review/predicted-gate-calibration-ledger.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.