fix(services): gate onboarding-pack preview by isInstalled, not isRegistered

[JSONbored]

Summary

• buildRepoOnboardingPackPreviewForRepo required a repo to be subnet-registered (isRegistered) before serving its onboarding-pack preview (contribution lanes, label policy, validation/maintainer expectations — all derived from the repo's own focus manifest/policy compiler, zero gittensor-subnet economics fields).
• Sibling advisory tools at the same access tier (getMaintainerLane, getLabelAudit, getBurdenForecast) already gate on isInstalled with no isRegistered check, so this was an inconsistent, unnecessarily-restrictive gate: an installed-but-unregistered repo was wrongly denied a preview it should get.
• Found via the epic Untangle gittensor-subnet integration from core self-host review features #5016 isRegistered/isInstalled exhaustive audit, not one of the originally-tracked sub-issues.

Test plan

• Renamed/rewrote 2 existing tests to reflect the isInstalled gate
• Added #onboarding-pack-isinstalled: returns a real preview for an installed-but-not-subnet-registered repo (positive regression)
• Added #onboarding-pack-isinstalled: rejects a subnet-registered-but-not-installed repo (negative regression)
• Fixed a pre-existing test/unit/mcp-output-schemas.test.ts fixture that relied on isRegistered without isInstalled (now installs via upsertRepositoryFromGitHub(..., 501))
• test/unit/onboarding-pack.test.ts + test/unit/mcp-output-schemas.test.ts — 47/47 passed
• Full local gate (npm run test:ci + npm audit --audit-level=moderate) green: 16032 passed, 0 failed

Advances #5016

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.02%. Comparing base (21d13b2) to head (1ab9c72).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5699   +/-   ##
=======================================
  Coverage   95.02%   95.02%           
=======================================
  Files         577      577           
  Lines       45978    45978           
  Branches    14724    14724           
=======================================
  Hits        43689    43689           
  Misses       1530     1530           
  Partials      759      759           

Flag	Coverage Δ
shard-1	43.63% <0.00%> (-0.43%)	⬇️
shard-2	35.84% <0.00%> (+0.06%)	⬆️
shard-3	32.33% <0.00%> (-0.09%)	⬇️
shard-4	33.04% <100.00%> (-0.02%)	⬇️
shard-5	31.51% <0.00%> (-0.26%)	⬇️
shard-6	44.62% <100.00%> (+0.20%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/services/repo-onboarding-pack.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-14 05:35:22 UTC}

3 files · 1 AI reviewer · 2 blockers · readiness 93/100 · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
This narrows the onboarding-pack preview gate from isRegistered to isInstalled in src/services/repo-onboarding-pack.ts, matching the sibling advisory tools' access tier and removing an inconsistent, overly-restrictive check on data that carries no subnet-economics fields. The change is a single-line logic swap with a clear doc comment explaining why, and the test suite was updated/expanded with a positive (installed-not-registered) and negative (registered-not-installed) regression pair that directly exercises the new gate. The fixture fix in mcp-output-schemas.test.ts (adding an installationId so the repo is actually installed) is a legitimate corrective, since that test previously only satisfied isRegistered and would have started failing under the new gate.

Nits — 4 non-blocking

• test/unit/mcp-output-schemas.test.ts and onboarding-pack.test.ts still call `UPDATE repositories SET is_registered = 1` in the new isInstalled-scoped tests even though the gate no longer checks isRegistered — harmless but dead setup that could confuse a future reader into thinking registration still matters here.
• The `#onboarding-pack-isinstalled:` test-name prefix convention is unusual versus the plain-English `it(...)` descriptions used elsewhere in the same file — verify this matches an established repo convention rather than being one-off.
• Consider dropping the now-irrelevant `is_registered = 1` SQL update in the new/updated tests to keep each test's setup minimal and clearly scoped to the isInstalled condition it's asserting.
• If other call sites still branch on isRegistered for similarly subnet-economics-free advisory data, it may be worth linking them to the epic Untangle gittensor-subnet integration from core self-host review features #5016 audit as follow-up candidates.

Concerns raised — review before merging

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

📋 Copy for AI agents — paste into your coding agent

Fix the following blocker(s) from this PR review:

1. No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.

2. Maintainer requires a linked issue — Link the relevant issue (for example `Closes #123`) before opening the PR.

Signal	Result	Evidence
Code review	❌ 2 blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 45 registered-repo PR(s), 37 merged, 320 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 45 PR(s), 320 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.
Improvement	✅ Minor	risk: clean · value: minor — Code changes are accompanied by test evidence.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, Ruby, Go, JavaScript, MDX, Shell, Solidity
• Official Gittensor activity: 45 PR(s), 320 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

[BETA] Chat with Gittensory

Ask Gittensory a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @gittensory ask <question> answers contribution-quality Q&A with source citations and freshness.
• @gittensory chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @gittensory mention with a real question is routed to the closest matching read-only command automatically -- no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/gittensory-commands

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review