feat(miner-discovery): add tolerant MinerGoalSpec parser

[9876543210-tc-0123456789]

Summary

• add parseMinerGoalSpec and parseMinerGoalSpecContent with tolerant JSON/YAML parsing, safe-default normalization, and explicit warnings for dropped or invalid fields
• export and document the parser API from @jsonbored/gittensory-engine
• add package-level and repo-level tests for the new parser branches, and raise the unsafe packet CLI test timeout so the full coverage gate stays deterministic

Closes #2301.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• None. I also ran npm run test:ci, which includes the full repo gate plus npm run build:miner, npm run rees:test, npm run ui:test, and the remaining CI checks.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

Not applicable; this PR does not change visible UI, docs pages, or extension surfaces.

Notes

• The test/unit/mcp-cli-packets.test.ts timeout increase is a test-only stabilization change. The existing assertion already passed in isolation, but the full npm run test:coverage gate intermittently hit an AbortError at the default 1s API timeout under full-suite load.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-03 02:44:25 UTC}

8 files · 1 AI reviewer · no blockers · readiness 80/100 · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
The change adds a tolerant `.gittensory-miner.yml` parser, exports it from the engine barrel, documents it, and covers the main JSON/YAML/default/fallback paths in both root and package tests. The implementation is side-effect-free, bounds file size and list sizes, clones defaults for parser results, and degrades malformed input to warnings as intended. I do not see a reachable correctness break in the changed code.

Nits — 5 non-blocking

• packages/gittensory-engine/src/miner-goal-spec.ts:100 truncates strings by UTF-16 code units, so a non-BMP character at the boundary can be split into a replacement character downstream; consider truncating by code points if user-facing globs or labels may contain emoji or other astral characters.
• packages/gittensory-engine/src/miner-goal-spec.ts:204 silently accepts YAML documents that parse to `undefined`, such as a comment-only file, as absent with no warning; confirm that is the intended behavior rather than treating it like an empty file explicitly.
• packages/gittensory-engine/test/miner-goal-spec-parser.test.ts:46 covers the exact 100-entry boundary but not the over-cap branch that the root Vitest suite covers, so the package-level public API tests are slightly less complete for the new cap behavior.
• In `packages/gittensory-engine/src/miner-goal-spec.ts:100`, replace `normalized.slice(0, MAX_ITEM_LENGTH)` with a code-point-aware truncation helper if the max is meant to be user-visible characters rather than UTF-16 units.
• In `packages/gittensory-engine/test/miner-goal-spec-parser.test.ts`, add the 101-entry cap case already present in `test/unit/miner-goal-spec-parser.test.ts` so the packaged dist tests exercise that warning path too.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#2301
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (size label size:L; 1 linked issue).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 38 registered-repo PR(s), 18 merged, 3 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	DragunovX16; Gittensor profile; 38 PR(s), 3 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: DragunovX16
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 38 PR(s), 3 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Await review-lane availability.
• Refresh registry data or choose a registered active repo.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.10%. Comparing base (354d98b) to head (661e49a).
⚠️ Report is 36 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2658      +/-   ##
==========================================
+ Coverage   96.09%   96.10%   +0.01%     
==========================================
  Files         237      237              
  Lines       26446    26521      +75     
  Branches     9588     9614      +26     
==========================================
+ Hits        25414    25489      +75     
  Misses        425      425              
  Partials      607      607              

Files with missing lines	Coverage Δ
packages/gittensory-engine/src/miner-goal-spec.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.