fix(review): preserve invariant guardrails

[JSONbored]

Motivation

• Prevent repo-owned .gittensory.yml from removing built-in hard guardrails for config-as-code, workflows/runtime, and engine decision paths, which could otherwise allow contributor PRs to bypass manual-review holds.
• Ensure the guardrail resolver treats built-in sensitive paths as non-removable invariants and only allows maintainers to add additional repo-specific globs.

Description

• Restore and expose the built-in guardrail lists (CONFIG_AS_CODE_GUARDRAIL_GLOBS, WORKFLOW_AND_RUNTIME_GUARDRAIL_GLOBS, ENGINE_DECISION_GUARDRAIL_GLOBS) and consolidate them into DEFAULT_HARD_GUARDRAIL_GLOBS in src/review/guardrail-config.ts.
• Change resolveHardGuardrailGlobs to return the union of DEFAULT_HARD_GUARDRAIL_GLOBS and any repo-configured settings.hardGuardrailGlobs, deduplicating entries so repo settings can only add globs.
• Mirror the same constants and resolver change in the packaged engine at packages/gittensory-engine/src/review/guardrail-config.ts so predicted-gate and miner flows use the same invariant behavior.
• Update unit tests to assert invariant guardrails are preserved when hardGuardrailGlobs is omitted, null, empty, or provided (tests updated in test/unit/guardrail-config.test.ts and test/unit/predicted-gate.test.ts).

Testing

• Ran git diff --check which passed.
• Ran the scoped unit tests npx vitest run test/unit/guardrail-config.test.ts test/unit/predicted-gate.test.ts --reporter=dot, and those tests passed.
• Ran npm run typecheck and npm run build:miner, both of which completed successfully.
• Attempted full coverage with npm run test:coverage, but the full suite hung in existing test/unit/queue.test.ts with repeated stack-overflow output and was terminated; a scoped coverage run also failed during Vitest coverage remapping with TypeError: jsTokens is not a function (tooling/remapping issue unrelated to the guardrail logic changes).

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	8ebb6e4	Commit Preview URL Branch Preview URL	Jul 07 2026, 12:15 PM

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-07 12:22:46 UTC}

5 files · 2 blockers · readiness 93/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Concerns raised — review before merging

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Signal	Result	Evidence
Code review	❌ 2 blockers	No AI review summary
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 51 registered-repo PR(s), 43 merged, 570 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 51 PR(s), 570 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, JavaScript, Ruby, Go, Kotlin, MDX, Shell
• Official Gittensor activity: 51 PR(s), 570 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.57%. Comparing base (3a74800) to head (8ebb6e4).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3943      +/-   ##
==========================================
- Coverage   93.58%   93.57%   -0.01%     
==========================================
  Files         381      381              
  Lines       35483    35493      +10     
  Branches    13014    13014              
==========================================
+ Hits        33206    33214       +8     
  Misses       1617     1617              
- Partials      660      662       +2     

Files with missing lines	Coverage Δ
...s/gittensory-engine/src/review/guardrail-config.ts	100.00% <100.00%> (ø)
src/review/guardrail-config.ts	100.00% <100.00%> (ø)

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.