feat(api): add REST mirrors for the finding-taxonomy and enrichment-analyzers MCP resources

[davion-knight]

What & why

buildFindingTaxonomyDocument() and buildEnrichmentAnalyzersTaxonomyDocument() were reachable only as MCP resources (loopover://finding-taxonomy, gittensory://enrichment-analyzers). A caller without MCP access — a plain HTTP client, a dashboard, a non-MCP integration — had no way to fetch either, even though routes.ts otherwise exposes essentially every other piece of review/registry/scoring data over /v1/*.

Changes

• GET /v1/finding-taxonomy and GET /v1/enrichment-analyzers, each delegating to its existing pure, argument-free builder with the same plain-c.json() handler shape as the /v1/scoring/model route they sit beside.
• Additive only — the MCP resource registrations in src/mcp/server.ts are untouched, and the URIs stay MCP-only identifiers.
• Both paths registered in src/openapi/spec.ts with response schemas, and apps/loopover-ui/public/openapi.json regenerated so ui:openapi:check / ui:openapi:settings-parity stay green.

The two schemas are deliberately permissive on member strings: the taxonomies are open-ended (FINDING_CATEGORIES, the committed analyzer-metadata.json), so the shape is the contract — adding a category or analyzer must never break the spec.

One correction worth flagging

The issue describes these as "unauthenticated GET routes consistent with the other public static-data routes (/v1/registry/snapshot, /v1/upstream/ruleset, /v1/scoring/model)". Those siblings aren't actually public — I verified GET /v1/scoring/model returns 401 unauthenticated. So I followed the requirement as written where it counts (no new auth middleware added), and the new routes inherit exactly the same gating as the siblings they mirror. The auth test pins them against /v1/scoring/model's own behavior rather than a hard-coded status, so it stays honest if that shared middleware ever changes — and can never silently open a public hole.

Tests

Each route returns its builder's document byte-identically; neither leaks PR/user/private data; both match the sibling's gating; and openapi.test.ts's path list is extended with both new paths (as the issue requires). Zero uncovered lines and branches across all three changed src/ files, measured against the changed-line set.

Closes #6593

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.65%. Comparing base (c4f31f0) to head (54ee508).
⚠️ Report is 10 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6689      +/-   ##
==========================================
- Coverage   93.65%   93.65%   -0.01%     
==========================================
  Files         682      682              
  Lines       68118    68118              
  Branches    18711    18708       -3     
==========================================
- Hits        63795    63794       -1     
  Misses       3347     3347              
- Partials      976      977       +1     

Flag	Coverage Δ
shard-1	43.90% <100.00%> (+<0.01%)	⬆️
shard-2	36.97% <66.66%> (+<0.01%)	⬆️
shard-3	32.38% <100.00%> (-0.08%)	⬇️
shard-4	34.24% <100.00%> (+<0.01%)	⬆️
shard-5	31.38% <66.66%> (+<0.01%)	⬆️
shard-6	45.75% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/api/routes.ts	94.57% <100.00%> (+<0.01%)	⬆️
src/openapi/schemas.ts	100.00% <100.00%> (ø)
src/openapi/spec.ts	99.44% <100.00%> (ø)

... and 1 file with indirect coverage changes

[loopover-orb]

Warning

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-16 19:41:59 UTC}

6 files · 1 AI reviewer · no blockers · CI green · dirty

⏸️ Suggested Action - Manual Review

Review summary
This PR adds two REST mirrors (`GET /v1/finding-taxonomy`, `GET /v1/enrichment-analyzers`) for existing MCP resources, delegating to pure argument-free builders already used elsewhere, with matching OpenAPI schema/path registrations and a regenerated openapi.json. The implementation is clean and additive — MCP registrations untouched, no new auth middleware, and the auth test pins behavior against the sibling `/v1/scoring/model` route rather than a hard-coded status, which is a defensible and honest way to test shared gating. The PR correctly identifies and documents a discrepancy in the linked issue's description (siblings aren't actually public) rather than silently deviating from the requirement.

Nits — 5 non-blocking

• The long-file flags on `routes.ts` (2071 lines) and `schemas.ts` (1562 lines) are pre-existing file sizes, not something this small diff meaningfully worsens — no action needed here.
• src/openapi/spec.ts: the `200` status literals are just standard OpenAPI response keys matching the existing convention used by every other route in this file (e.g. the `/v1/scoring/model` registration just above); no change needed.
• test/unit/routes-taxonomy-mirrors.test.ts: the 'no PR/user/private data' regex test is a nice defensive addition but is somewhat redundant given the schemas are already tightly typed to only categories/severities/analyzer metadata.
• Consider adding a one-line note in README's API surfaces or docs reference to these two new public discovery routes for external consumers, matching how other `/v1/*` static routes are documented.
• The inline code comments in routes.ts and schemas.ts referencing issue REST mirror for the finding-taxonomy and enrichment-analyzers MCP resources #6593 are helpful for traceability and match the repo's existing comment style near other schema definitions.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#6593
Related work	⚠️ 3 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 168 registered-repo PR(s), 109 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	davion-knight; Gittensor profile; 168 PR(s), 0 issue(s).
Improvement	✅ Minor	risk: clean · value: minor · LLM: moderate

Linked issue satisfaction

Addressed
The PR adds both GET /v1/finding-taxonomy and GET /v1/enrichment-analyzers in routes.ts delegating to the exact pure builders, registers matching OpenAPI paths/schemas in spec.ts, leaves MCP registrations untouched, and adds test coverage for both routes plus the openapi.test.ts path assertions as required.

Review context

• Author: davion-knight
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 168 PR(s), 0 issue(s).
• Related work: Titles/paths share 7 meaningful terms. (issue #6620)
• Related work: Titles/paths share 10 meaningful terms. (issue #6593, issue #6620)
• Related work: Titles/paths share 7 meaningful terms. (issue #6593, issue #6621)

Contributor next steps

• Start here: Review top overlaps.
• Then work through the remaining 3 steps in the Signals table above.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

Visual preview

Route	Viewport	Before (production)	After (this PR's preview)	Diff
/	desktop	before /	after /	—
/	mobile	before / (mobile)	after / (mobile)	—

Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver is closing this pull request on the maintainer's behalf (conflicts with the base branch — resolve and open a fresh PR). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.