fix(review): persist merge train settings paths

[JSONbored]

Motivation

• The mergeTrainMode setting was normalized in-memory but was not accepted by the maintainer settings API, not parsed from .gittensory.yml, and not present in the engine settings type, so persisted rows kept the SQL default off and the merge-train gate could not be enabled.

Description

• Add mergeTrainMode to the maintainer settings schema so the authenticated PUT /v1/repos/:owner/:repo/settings endpoint accepts "off" | "audit" | "enforce" (src/api/routes.ts).
• Parse and normalize settings.mergeTrainMode from focus-manifest overrides and include it in the focus-manifest allowlist so .gittensory.yml can override this setting (packages/gittensory-engine/src/focus-manifest.ts).
• Keep the engine-facing settings type in sync by adding mergeTrainMode to the manifest dependency types (packages/gittensory-engine/src/types/manifest-deps-types.ts).
• Update tests and examples to cover the end-to-end save/parse/round-trip behaviour and the maintainer API surface (test/integration/api.test.ts, test/unit/focus-manifest.test.ts).

Testing

• Built the miner with npm run build:miner and the build succeeded.
• Ran unit and integration tests with npx vitest run test/unit/repository-settings-merge-train-mode.test.ts test/unit/focus-manifest.test.ts test/integration/api.test.ts and all tests passed (3 test files, 572 tests total passed).
• Ran npm run typecheck and git diff --check which both succeeded locally.
• Attempted npm audit --audit-level=moderate but the registry audit endpoint returned 403 Forbidden in this environment so the audit could not complete.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	2ab91d3	Commit Preview URL Branch Preview URL	Jul 08 2026, 06:06 AM

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.64%. Comparing base (ef3257a) to head (2ab91d3).
⚠️ Report is 22 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4130   +/-   ##
=======================================
  Coverage   93.64%   93.64%           
=======================================
  Files         384      384           
  Lines       35853    35855    +2     
  Branches    13157    13158    +1     
=======================================
+ Hits        33574    33576    +2     
  Misses       1618     1618           
  Partials      661      661           

Files with missing lines	Coverage Δ
packages/gittensory-engine/src/focus-manifest.ts	99.15% <100.00%> (+<0.01%)	⬆️
src/api/routes.ts	93.98% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-08 06:58:40 UTC}

5 files · 1 AI reviewer · 2 blockers · readiness 93/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Review summary
This PR completes the wiring for the `mergeTrainMode` setting (off/audit/enforce) that was already normalized in-memory but silently dropped: it adds the enum to the maintainer settings PUT schema (`src/api/routes.ts`), to the `.gittensory.yml` focus-manifest allowlist + parser (`focus-manifest.ts`), and to the engine-facing `RepositorySettings` type (`manifest-deps-types.ts`), using the exact same enum values (`"off"|"audit"|"enforce"`) in all three places. The change follows the established pattern used for sibling gate-mode settings (e.g. `reviewEvasionComment`, `linkedIssueSatisfactionGateMode`) line-for-line, and is backed by round-trip, invalid-value, field-exhaustiveness, and maintainer-API integration tests that all pass in CI. No schema/migration change appears necessary here since the description indicates the DB column and default already existed from a prior PR — this PR only closes the API/config/type wiring gap.

Nits — 5 non-blocking

• The PR description doesn't cite a specific open issue number for this fix (only a narrative motivation) — other settings wired in these same files reference concrete issues in comments (`fix(review): gate.readiness.mode "block" is accepted and documented but the quality gate can never hard-block #2267`, `feat(agent): action audit log + kill-switch + dry-run/shadow mode #776`, `Config-driven gate rule: auto-close visual/frontend PRs missing a before/after screenshot table #2006`), and repo convention expects a linked issue for contributor PRs.
• The new JSDoc in `manifest-deps-types.ts` tags this as `(#selfhost-merge-train)` rather than a numeric issue like its neighbors (`Generic per-repo preview-URL provider config (Cloudflare/Vercel/Netlify/manual template) #3609`, `fix(review): verify + fix theme-forcing and viewport matrix in visual capture #4109`) — worth confirming that's intentional and not a stray placeholder.
• The visible `config/examples/gittensory.full.yml` reference excerpt doesn't show a documented `mergeTrainMode` example entry alongside the other settings knobs; worth confirming the exhaustiveness test is actually checking that file (and not just an internal test map) so users can discover this override via the example file.
• Add/confirm a `mergeTrainMode` entry with inline documentation in the `.gittensory.yml` example file for discoverability, matching the treatment given to other settings like `reviewEvasionComment`.
• Reference the concrete issue number this fix closes in the PR description per repo convention.

Concerns raised — review before merging

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Signal	Result	Evidence
Code review	❌ 2 blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 52 registered-repo PR(s), 43 merged, 496 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 52 PR(s), 496 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, JavaScript, Ruby, Go, Kotlin, MDX, Shell
• Official Gittensor activity: 52 PR(s), 496 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review