feat(ai-review): dual-AI maintainer review + BYOK (Phase C)

[JSONbored]

Phase C — AI agent review (Workers AI default + BYOK)

Adds a gittensor-aware AI maintainer review to the public PR path. It is opt-in and dormant by default — gated by per-repo aiReviewMode (default off) AND the existing AI_SUMMARIES_ENABLED / AI_PUBLIC_COMMENTS_ENABLED flags (both default false). Nothing changes in production until a maintainer enables it.

What it does

Two layers, both fail-safe (no AI / error / over-budget / unsafe output → no public text and no gate finding — gittensory never blocks because a model spoke):

• Advisory notes — a concise maintainer-style write-up (assessment / suggestions / risks) rendered as an advisory Gittensory AI review section in the PR panel. Free Cloudflare Workers AI by default; the maintainer's frontier model when BYOK is configured.
• Consensus defect (opt-in blocker) — a defect becomes a gate blocker only when aiReview: block is set and the two free Workers-AI models (gpt-oss-120b + nemotron, adapted from reviewbot's proven pair) independently agree on a high-confidence (≥0.9) critical defect. Still confirmed-contributor gated — only confirmed Gittensor contributors can ever be hard-blocked. BYOK never drives this path, so it never changes who can be blocked.

Config-as-code

Everything is controllable from .gittensory.yml (precedence yml > DB > defaults):

gate:
  aiReview:
    mode: advisory   # off | advisory | block
    byok: false

Also settable via the dashboard settings route and the generic settings: override.

BYOK (encrypted at rest)

• New encryptSecret/decryptSecret (AES-256-GCM, PBKDF2-derived key, random per-write IV) — gittensory's first reversible-encryption primitive — keyed by a new TOKEN_ENCRYPTION_SECRET worker secret.
• Isolated repository_ai_keys table (migration 0027) so ciphertext is never serialized by the settings surface. Stores ciphertext + iv + key_version + a display-only last4; the plaintext key is never persisted.
• Write-only internal routes POST/GET/DELETE /v1/internal/repos/:owner/:repo/ai-key — GET returns only { configured, provider, last4, model }, never the key. The key is never logged and never reaches a public surface.

Privacy

Every public string (notes + defect title/detail) is forced through sanitizePublicComment; anything that trips the public/private boundary is dropped, not published. Every model call is metered against the shared daily neuron budget and audited (never with key material).

Operator setup (when enabling)

1. wrangler secret put TOKEN_ENCRYPTION_SECRET (≥32 bytes) for BYOK.
2. Flip AI_SUMMARIES_ENABLED + AI_PUBLIC_COMMENTS_ENABLED to true.
3. Per repo: set aiReview.mode (and optionally a BYOK key via the dashboard/API).

Tests

• Engine: gating, budget, advisory/consensus, dual-model fallback, parse/sanitize, BYOK provider dispatch.
• Gate: ai_consensus_defect blocks only in block mode, only for confirmed contributors.
• End-to-end: a confirmed contributor is blocked by a consensus defect through the real webhook path.
• BYOK: AES round-trip, secret-free status surface, decrypt-at-call-time, write-only routes.
• Full suite green; coverage holds above the 97% gate.

Notes

• The operator-facing website docs (the docs.github-app.tsx config-as-code page) are intentionally not touched here to avoid conflicting with the open onboarding-docs PR feat(ui): maintainer onboarding — hero install button + config-as-code docs #648; an AI-review docs subsection can follow once that lands.

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#652 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[ghost]

gittensory · advisory review

Reviewed 30 changed file(s) — two independent AI reviewers.

Suggested action: 🛠️ Request changes. (reviewers split: request changes / merge) Address the suggestions below before merging.

Reviewer A · gpt-oss-120b — recommends 🛠️ request changes
The PR adds a full AI maintainer‑review feature with optional BYOK keys, new DB tables, API endpoints, settings integration, UI rendering, and extensive tests. The implementation is largely clean and respects the public‑private sanitizer, but it introduces a privacy risk by sending PR diffs to AI models without confirming the repository is public, and the neuron‑budget estimation may under‑count actual model calls.

Suggestions

• Add a guard before invoking any AI review (runAiReviewForAdvisory / runGittensoryAiReview) to ensure the repository is public (e.g. check a repo.private flag) or explicitly document that AI review is only safe for public repos.
• Adjust the neuron‑budget estimation in runGittensoryAiReview to account for the possible fallback model calls and retries, or add a safety margin to avoid exceeding the daily budget after the calls have been made.
• Consider adding a unit test that verifies AI review is skipped for a private repository (or when the new guard is in place).

Worth double-checking

• Potential leakage of private code to external AI providers if AI review is enabled on private repositories.
• Under‑estimated neuron usage could cause the service to exceed its configured daily budget.

Reviewer B · nemotron-3-120b-a12b — recommends ✅ merge
This PR implements Phase C of the AI review feature: dual-AI maintainer review with BYOK support. It adds database schema for AI review settings and encrypted API keys, new API routes for BYOK key management, AI review service with dual-model consensus checking, and integrates AI findings into the PR review process. The changes are extensive but well-structured, with proper encryption for BYOK keys, fail-safes for AI calls, and adherence to the public/private boundary via sanitization. Tests cover the new functionality.

Suggestions

• Consider adding a comment in the migrations explaining why ai_review_byok is stored as INTEGER (0/1) rather than using SQLite's native BOOLEAN affinity for clarity.
• In buildAiReviewDiff, the truncation message could include the exact character limit for better transparency (e.g., '… diff truncated at 60,000 chars').
• The aiReviewGateMode in GateCheckPolicy defaults to 'advisory' - confirm this aligns with the intended behavior where AI never blocks by default (as stated in comments).
• In runAiReviewForAdvisory, the AI call is wrapped in a try/catch that logs and returns undefined on error - ensure this doesn't silently hide configuration issues during debugging (maybe add a debug-level log).
• The BYOK API routes return 503 when encryption secret is missing - verify this matches the project's error handling patterns for misconfiguration.

Worth double-checking

• Ensure the encryption/decryption functions handle edge cases like ultra-long keys (though input is limited to 400 chars).
• Verify the daily neuron budget calculation doesn't inadvertently allow bypass via many small PRs (the sumAiEstimatedNeuronsSince uses UTC day start).
• Confirm that the AI review's public-safe sanitization doesn't inadvertently allow safe-looking strings that could still contain private terms via obfuscation (relies on sanitizePublicComment).

[superagent-security]

Superagent found 2 security concern(s).

[superagent-security]

P2: Fixed salt used in PBKDF2 key derivation for BYOK secrets

Reusing a hardcoded salt weakens key derivation resistance to precomputation.

Derive salt randomly per encryption and persist it alongside the ciphertext.

AI prompt

Check if this security scanner issue is valid. If so, understand the root cause and fix it. If appropriate, update or add tests. Keep the change focused and preserve intended behavior.

<file name="src/utils/crypto.ts">
<violation number="1" location="src/utils/crypto.ts:49">
<priority>P2</priority>
<title>Fixed salt used in PBKDF2 key derivation for BYOK secrets</title>
<evidence>src/utils/crypto.ts defines SECRET_KDF_SALT as a constant string (&quot;gittensory-secret-encryption-v1&quot;) and passes it to crypto.subtle.deriveKey with PBKDF2. A fixed salt means the derived AES key is deterministic for the same master secret, weakening resistance to precomputation and rainbow-table attacks if the master secret is ever exposed or low-entropy.</evidence>
<recommendation>Replace the fixed salt with a cryptographically random salt (e.g., 16 bytes from crypto.getRandomValues) generated per call to encryptSecret. Store the salt alongside the IV and ciphertext so decryptSecret can reconstruct the key. Update the database schema or ciphertext format to include the salt if needed.</recommendation>
</violation>
</file>

[superagent-security]

P2: PR diff sent to external AI models without redacting secrets

The unified diff containing raw PR changes is forwarded to third-party AI providers without stripping API keys, tokens, or other secrets.

Strip or mask high-entropy strings and known secret patterns from diffs before building the AI prompt.

AI prompt

Check if this security scanner issue is valid. If so, understand the root cause and fix it. If appropriate, update or add tests. Keep the change focused and preserve intended behavior.

<file name="src/services/ai-review.ts">
<violation number="1" location="src/services/ai-review.ts:181">
<priority>P2</priority>
<title>PR diff sent to external AI models without redacting secrets</title>
<evidence>buildUserPrompt in src/services/ai-review.ts concatenates input.diff.slice(0, 60000) directly into the prompt sent to Anthropic, OpenAI, or Cloudflare Workers AI. The diff may contain committed secrets (e.g., API keys, database URLs, tokens). Without redaction or masking, these could be exfiltrated to external model providers or retained in model logs.</evidence>
<recommendation>Before including the diff in the AI prompt, run a redaction pass that masks high-entropy strings, known secret patterns (sk-..., ghp_..., etc.), and any values adjacent to keys like password, token, or secret. Alternatively, use a git-secrets style scanner or regex to replace matches with [REDACTED].</recommendation>
</violation>
</file>