feat(config): add Gittensory repo focus manifest

[kiannidev]

Fixes #118

Summary

• Adds a machine-readable Gittensory repo focus manifest at .gittensory.yml (wanted backend/MCP paths, blocked website/lovable areas, test expectations, public vs private notes).
• Extends focus-manifest parsing to support YAML (.gittensory.yml first, then JSON candidates) with safe malformed-manifest warnings.
• Bundles a self-repo fallback (src/config/gittensory-repo-focus-manifest.ts) so decision packs, preflight, and maintainer APIs work before the file is on main.
• Exposes maintainer-only GET / PUT /v1/repos/{owner}/{repo}/focus-manifest returning manifest + compiled policy.

Scope

• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; global coverage stays at or above 97% for lines, statements, functions, and branches (aim for 98%+ branch coverage locally so CI variance does not fail near the threshold)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

New / updated tests: test/unit/gittensory-focus-manifest.test.ts, test/unit/focus-manifest.test.ts, test/unit/focus-manifest-loader.test.ts.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include screenshots or a short recording.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

• Parent roadmap: roadmap: beta-grade Gittensory base agent v2 #82.
• Self-dogfood uses GITTENSORY_DRIFT_ISSUE_REPO when set; otherwise JSONbored/gittensory.
• GITTENSORY_REPO_FOCUS_MANIFEST_YAML must stay in sync with .gittensory.yml (enforced by unit test).

[JSONbored]

@kiannidev the manifest/parser/API shape is useful, but I cannot merge this policy as written.

A few notes:

• The main blocker is .gittensory.yml treating apps/gittensory-ui/ as a blocked path.
• That would classify legitimate focused control-panel work as blocked, which conflicts with how this repo currently accepts UI work tied to operator analytics, safety, and release workflows.
• The API/OpenAPI direction is fine, but the policy semantics need to match the repo.

Required changes:

• Rework the focus manifest so UI work is discouraged/conditional where appropriate, not categorically blocked.
• Update tests to cover allowed focused UI changes and genuinely blocked surfaces separately.
• Keep the manifest language aligned with CONTRIBUTING instead of creating a stricter hidden policy.

Validation expected:

• Rerun the focused manifest/parser/API tests and any OpenAPI check touched by this PR.

[gittensory]

Important

Gittensory found maintainer review notes

Scoped related-work signals were found for this PR. They are advisory unless the gate reports a blocker.

Readiness score: 75/100

Signal	Result	Evidence	Action
Linked issue	✅ Linked	#118	No action.
Related work	⚠️ 3 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.	Review top overlaps.
Review load	❌ 8/20	Readiness component derived from cached public PR metadata and labels; size label size:L.	Add scope summary.
Validation evidence	✅ 25/25	PR body includes validation/test evidence.	No action.
Open PR queue	❌ 3/10	17 open PR(s), 15 likely reviewable.	Expect slower review.
Contributor context	✅ Confirmed Gittensor contributor	kiannidev; Gittensor profile; 119 PR(s), 32 issue(s).	No action.
Gate result	✅ Passing	No configured blocker found.	No action.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Review load = cached public PR metadata such as size labels, changed paths, and preflight status.
• Open PR queue = repo-wide review pressure; it is not a PR quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

Review context

• Author: kiannidev
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 119 PR(s), 32 issue(s).
• Related work: Items reference the same linked issue feat(config): add Gittensory repo focus manifest #118. (issue #118)
• Related work: Open PR work references issue feat(config): add Gittensory repo focus manifest #118. (issue #118)
• Related work: Titles/paths share 6 meaningful terms. (PR #335)
• Additional title-only matches omitted; title-only overlap does not block.

Maintainer notes

• Possible duplicate or overlapping work: 83 related open work cluster(s) were detected.

Contributor next steps

• Review top overlaps.
• Add scope summary.
• Expect slower review.
• Check active issues and PRs before submitting.

• Re-run Gittensory review

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers. Learn more about Gittensor contribution workflows.

[kiannidev]

@JSONbored Thanks for the review — reworked the manifest policy and merged latest main.

Policy changes

• Removed apps/gittensory-ui/ from blockedPaths; added it to wantedPaths so focused control-panel UI work (operator analytics, safety, release workflows) is in scope per CONTRIBUTING.
• Kept genuinely blocked surfaces only: site/, CNAME, and **/lovable/**.
• Updated publicNotes / maintainerNotes to discourage cosmetic UI-only polish without API wiring, not all UI work.

Tests

• Focused UI paths (apps/gittensory-ui/src/routes/app.operator.tsx) → manifest_preferred_path.
• Retired surfaces (site/, CNAME, lovable) → manifest_blocked_path.
• Added test/unit/routes-focus-manifest.test.ts for GET/PUT route auth and persistence.

Merge

• Resolved conflicts with main; kept focus-manifest routes and onboarding-pack preview.
• npm run ui:openapi:check and npm run test:coverage pass locally (97% branch coverage).

Ready for another look.