feat(miner-governor): wire the gated-submission trigger into the driving loop's handoff signal (#2337)

[JSONbored]

Summary

Advances #2337.

Adds evaluateHarnessSubmissionTrigger (packages/gittensory-engine/src/miner/harness-submission-trigger.ts) + evaluateAndRecordHarnessSubmissionTrigger (packages/gittensory-miner/lib/harness-submission-trigger.js): connects shouldSubmit (#2336) to the actual driving loop's own handoff signal -- iterate-loop.ts's (#2333) HandoffPacket, produced the moment a real run's self-review reaches a clean predicted-gate pass.

Why "Advances" not "Closes": this issue's own text asks for a real run to, "end to end, decide to submit and invoke the local-write spec." This PR delivers the decision-wiring half genuinely, but does not build or invoke buildOpenPrSpec (src/mcp/local-write-tools.ts) -- that lives in the private root src/ tree, unreachable from this portable package for the same cross-package-boundary reason self-review-adapter.ts's slop injection exists (#2334). A real call site (root-side server/CLI integration, wired in a later issue) would consult this function's allow: true before it builds that spec itself. Flagging this explicitly rather than claiming full closure.

The session-level circuit breaker this issue's own deliverable calls for, distinct from shouldSubmit's per-candidate signal checks: N consecutive allow:false decisions in one session pauses the run entirely pending human review. Checked FIRST, before ever consulting shouldSubmit -- once tripped, only a human clearing the session's own tally can un-trip it, unlike a per-candidate block a later, different candidate can clear on its own merits. Session-scoped (not per-repo), matching "pauses the run entirely" -- deliberately distinct from #2338's loop-reentry circuit breaker, which is per-repo (a rejection streak on one repo must not pause unrelated repos).

Every decision (allow or block) is appended to the local event ledger with full reasons, whether or not the circuit breaker was involved -- per this issue's own audit deliverable.

On the referenced "harness driving loop": the issue's references section cites both the old M4-era gittensory-mcp harness adapter (#781, a different package, closed a while back under a different epic) and this session's own submission-gate.ts. Wired to iterate-loop.ts's HandoffPacket instead of #781's system, since that's the actual, current, same-wave (#2333) driving loop #2336 was explicitly built to compose with -- reaching into the older gittensory-mcp package would be a much larger, differently-scoped undertaking than this maintainer-only issue's batch suggests.

Validation

Measured, not assumed -- across both the engine's own node:test suite AND the actual codecov-visible root vitest path:

# engine package
npx tsc -p tsconfig.json --incremental false && npx tsc -p tsconfig.test.json --incremental false && node --experimental-test-coverage --test "dist-test/**/*.test.js"
# root, the actual codecov-visible path
npx vitest run test/unit/miner-harness-submission-trigger.test.ts --coverage --coverage.include="packages/gittensory-miner/lib/harness-submission-trigger.js"
npx vitest run test/unit/miner-harness-submission-trigger.test.ts --coverage --coverage.include="packages/gittensory-engine/src/miner/harness-submission-trigger.ts"

• Engine: 447/447 tests pass; harness-submission-trigger.js (compiled from the .ts source) 100.00% lines/branch/funcs.
• Root vitest (codecov's real measurement path): 5/5 tests pass; both the miner-lib wrapper and the engine policy independently confirmed at 100.00% stmts/branch/funcs/lines.
• packages/gittensory-miner's node --check build script passes cleanly with the new file registered.

Test plan

Per the issue's own explicit deliverable:

• "Integration test simulating a full candidate -> gate-check -> submit (or correctly-blocked) cycle" -- both scenarios, named verbatim in the test file.
• Circuit breaker: N consecutive blocks pauses even an otherwise-clean handoff; a single allow resets the streak.
• Defense in depth: a handoff whose own verdict fails predicted-gate or exceeds the slop threshold is still blocked by shouldSubmit's own re-check, not blindly trusted just because a handoff happened.
• Observe mode forces allow: false regardless of the underlying signals.
• Fails closed on every malformed-input/missing-dependency path.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	b054955	Commit Preview URL Branch Preview URL	Jul 11 2026, 12:56 PM

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.18%. Comparing base (ad44723) to head (b054955).
⚠️ Report is 3 commits behind head on feat/miner-killswitch-manage-loop-2339.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@                            Coverage Diff                             @@
##           feat/miner-killswitch-manage-loop-2339    #5054      +/-   ##
==========================================================================
+ Coverage                                   94.14%   94.18%   +0.04%     
==========================================================================
  Files                                         467      468       +1     
  Lines                                       39609    39619      +10     
  Branches                                    14446    14450       +4     
==========================================================================
+ Hits                                        37289    37317      +28     
+ Misses                                       1664     1646      -18     
  Partials                                      656      656              

Flag	Coverage Δ
shard-1	46.49% <10.00%> (-0.01%)	⬇️
shard-2	33.83% <10.00%> (-0.01%)	⬇️
shard-3	32.26% <10.00%> (+0.11%)	⬆️
shard-4	31.83% <10.00%> (+0.12%)	⬆️
shard-5	33.29% <30.00%> (+<0.01%)	⬆️
shard-6	44.95% <80.00%> (+0.04%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...ory-engine/src/miner/harness-submission-trigger.ts	100.00% <100.00%> (ø)
...gittensory-engine/src/miner/loop-reentry-policy.ts	100.00% <100.00%> (ø)
...ges/gittensory-engine/src/miner/submission-gate.ts	100.00% <100.00%> (+90.00%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[gittensory-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-11 13:02:24 UTC}

15 files · 1 AI reviewer · 2 blockers · readiness 93/100 · CI green · unstable

⏸️ Suggested Action - Manual Review

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Review summary
AI review could not be completed for this PR head. Gittensory is holding this PR for manual review instead of relying on deterministic signals alone.

Concerns raised — review before merging

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Signal	Result	Evidence
Code review	❌ 2 blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 47 registered-repo PR(s), 39 merged, 423 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 47 PR(s), 423 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.
Improvement	✅ Minor	risk: clean · value: minor — Code changes are accompanied by test evidence.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 47 PR(s), 423 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[JSONbored]

Pushed a coupling fixup (0eb3704) + rebased onto #5057 (#2339, kill-switch propagation): #2339 makes `SubmissionGateCandidate.killSwitchScope` required on `shouldSubmit`, which this PR's own `evaluateHarnessSubmissionTrigger` constructs internally -- threaded `killSwitchScope` through from this function's own candidate rather than duplicating the kill-switch check itself (`shouldSubmit`'s own guard covers it whenever the session circuit breaker hasn't already short-circuited first). Base retargeted to `feat/miner-killswitch-manage-loop-2339` so this PR's diff stays scoped to its own changes.

Also closed a real, pre-existing codecov gap discovered while verifying the fixup: `submission-gate.ts` had zero root-vitest scenarios for its null-predictedGateVerdict, null-slopAssessment, slop-exceeds-threshold, and observe-mode-would-have-blocked/would-have-allowed paths -- it's only reachable from the root vitest suite through this file's own integration test (`test/unit/miner-harness-submission-trigger.test.ts`), and that test never exercised them. Added all five scenarios; `submission-gate.ts` now measures 100% branch coverage via the actual codecov-visible path.

409 -> now includes 12/12 tests in the root integration test file, all three touched files (harness-submission-trigger.js, harness-submission-trigger.ts, submission-gate.ts) independently confirmed at 100% stmts/branch/funcs/lines.