docs: repo-agnostic capability audit for the review/signals/rules stack

[davion-knight]

Closes #5744.

Audits `src/review/`, `src/signals/`, and `src/rules/` for hardcoded gittensory-specific assumptions that would need to become per-tenant configuration before the review/merge authority model can be handed to an arbitrary rented repo — mirroring the shape of the miner-side packages/gittensory-miner/docs/repo-agnostic-capability-audit.md (the #4780 audit that #4784 resolved).

Audit-and-document only — no code changes (matching #4780's scope split from #4784).

Deliverable

A new audit doc at src/review/repo-agnostic-capability-audit.md following #4780's exact format: Summary (3 assumption buckets) → findings-by-file tables (every finding with a file:line reference and a Should become column) → an "Already parameterized — no follow-up needed" section → a prioritized checklist for the follow-up implementation issue.

Findings in brief

• GitHub as the only forge (biggest gap): api.github.com / 2022-11-28 / vnd.github+json / repo-tree + contents path templates hardcoded across rag-index.ts, grounding-wire.ts, the visual/ capture+preview sub-system, and the github.com web-URL builders (alerts.ts, changed-files-diff-link.ts, signals/engine.ts).
• Engine-delegated gittensory default: the DEFAULT_TYPE_LABELS (gittensor:*) taxonomy fallback at focus-manifest.ts:550 — overridable per repo, gittensory-by-default. This is the review-path item De-hardcode discovery from gittensory's own conventions #4784 explicitly deferred; the acceptance criteria call for it and it is covered here.
• Branding/namespace constants: check-run names, R2 namespace, User-Agent, parity shadow-writer, maintainer-recap actor, comment brand.
• Already parameterized (no follow-up): the src/rules/ gate logic (engine-delegated), label-propagation matching (config-driven; gittensor:* appears only in comments), the type-label sparse-merge mechanism, and the signals role vocabulary.

Every file:line reference was verified against the current main.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.07%. Comparing base (12958f4) to head (86da27e).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5754   +/-   ##
=======================================
  Coverage   95.07%   95.07%           
=======================================
  Files         581      581           
  Lines       46181    46181           
  Branches    14811    14811           
=======================================
  Hits        43905    43905           
  Misses       1516     1516           
  Partials      760      760           

Flag	Coverage Δ
shard-1	43.42% <ø> (-0.54%)	⬇️
shard-2	35.96% <ø> (+0.25%)	⬆️
shard-3	32.15% <ø> (-0.13%)	⬇️
shard-4	32.93% <ø> (-0.63%)	⬇️
shard-5	31.33% <ø> (+0.14%)	⬆️
shard-6	45.01% <ø> (+0.37%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-14 11:41:55 UTC}

1 file · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This is a docs-only audit deliverable that closes #5744, mirroring the format and structure of the prior miner-side audit (#4780) referenced in the PR. The doc is well-organized, gives concrete file:line findings with a 'Should become' column, distinguishes already-parameterized code from real gaps, and produces a prioritized follow-up checklist — consistent with the stated audit-and-document-only scope. I cannot independently verify every cited line number against the actual source files since only the audit doc's full content was provided, not the underlying src/review, src/signals, src/rules files.

Nits — 5 non-blocking

• Several file:line citations (e.g. rag-index.ts:97/111/113/182, engine.ts:5297, focus-manifest.ts:82/550) cannot be verified against the actual source in this review context — worth a spot-check pass before treating the line numbers as durable references, since docs like this tend to drift as the referenced files change.
• The 'content-registry lane' section (content-repo-spec.ts) explicitly punts a scope question to the follow-up issue rather than resolving it here — reasonable for an audit doc, but flag that the prioritized checklist's last item is a decision item, not an actionable line-level fix.
• Confirm the follow-up implementation issue (referenced throughout as future work) actually gets filed and linked from this doc or from Repo-agnostic capability audit — review/signals stack (Wave 5 prerequisite) #5744, since audits without a linked execution issue tend to go stale (as nearly happened between Repo-agnostic capability audit #4780 and De-hardcode discovery from gittensory's own conventions #4784).
• Consider adding a last-verified date or commit SHA to the audit doc header so future readers know how fresh the file:line references are, since source drift will make individual line numbers wrong over time even though the categorical findings remain valid.
• Diff looks like trivial or whitespace-only churn — Reduce whitespace-only or formatting-only churn and keep the diff focused on substantive changes.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#5744
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 119 registered-repo PR(s), 83 merged, 1 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	davion-knight; Gittensor profile; 119 PR(s), 1 issue(s).
Gate result	✅ Passing	No configured blocker found.
Improvement	⚠️ ℹ️ Insufficient signal	risk: low · value: insufficient-signal — Nothing measurable for the structural-improvement analyzers on this PR (e.g. no code files changed).

Review context

• Author: davion-knight
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Rust
• Official Gittensor activity: 119 PR(s), 1 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

[BETA] Chat with Gittensory

Ask Gittensory a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @gittensory ask <question> answers contribution-quality Q&A with source citations and freshness.
• @gittensory chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @gittensory mention with a real question is routed to the closest matching read-only command automatically -- no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/gittensory-commands

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review