Merge branch 'main' into feat/2329-miner-laptop-mode-cli

Author: JSONbored

.env.example

@@ -154,6 +154,23 @@ GITTENSORY_REVIEW_DRAFT=false
 #                                            #   /setup returns 400; with it, /setup needs ?token=<value> (or an
 #                                            #   x-setup-token / Bearer header) so a freshly-booted, not-yet-configured
 #                                            #   instance can't be driven through App creation by a random visitor.
+# ADMIN_GITHUB_LOGINS=your-github-login      # REQUIRED for control-panel ("operator") access. A comma- or
+#                                            #   whitespace-separated allowlist of GitHub logins, case-insensitive.
+#                                            #   FAIL-CLOSED: unset/empty means NOBODY can sign into the dashboard,
+#                                            #   even the person who set up this instance — this is not a bug, add
+#                                            #   your own login here right after first-run setup. Also exempts these
+#                                            #   logins from the agent's own-PR auto-close rules (fleet-operator
+#                                            #   identity) and lets them bypass per-repo MCP scope.
+# MCP_READ_REPO_ALLOWLIST=                   # scopes the shared GITTENSORY_MCP_TOKEN identity's READ-only MCP
+#                                            #   tools (repo context, issue quality, watch subscriptions) to these
+#                                            #   owner/repo entries (comma/whitespace-separated). FAIL-CLOSED:
+#                                            #   unset/empty grants no repo access. `*` or `all` is an explicit
+#                                            #   escape hatch for full unscoped read access, incl. cross-repo
+#                                            #   contributor/operator tools that have no single repo to scope against.
+# MCP_ACTUATION_REPO_ALLOWLIST=              # same fail-closed/wildcard model as MCP_READ_REPO_ALLOWLIST, but for
+#                                            #   WRITE (merge/close/approve) MCP tools — kept separate so read and
+#                                            #   write trust can differ. Unrelated to ADMIN_GITHUB_LOGINS, which
+#                                            #   scopes dashboard sign-in, not the shared MCP token's per-repo reach.
 # PORT=8787
 # DATABASE_PATH=/data/gittensory.sqlite     # SQLite file on the mounted data volume; all migrations auto-apply
 # POSTGRES_PASSWORD=change-this-long-random-value  # used by the --profile postgres / --profile pgbouncer services
@@ -184,8 +201,16 @@ REDIS_URL=redis://redis:6379                # REQUIRED for the self-host review
 # GITHUB_BRANCH_PROTECTION_CACHE_TTL_SECONDS=1200  # TTL for required-status branch protection reads.
 # GITHUB_METADATA_CACHE_TTL_SECONDS=600      # TTL for stable repo/user/installation metadata reads.
 # GITHUB_COMMIT_CACHE_TTL_SECONDS=900        # TTL for bare /commits/{ref} resolves; dedups the two hourly upstream ref→SHA reads.
+# GITHUB_WEBHOOK_MAX_BODY_BYTES=1048576      # max accepted GitHub webhook body size, in bytes (default 1 MiB).
+#                                            #   Larger deliveries are rejected before parsing. Raise only if you
+#                                            #   see legitimate webhooks rejected for size (e.g. a `push` event
+#                                            #   with a large `commits` array from a big force-push or merge);
+#                                            #   most installs never need to touch this.
 # QDRANT_URL=                                # set to http://qdrant:6333 to use Qdrant as the RAG vector store
 #                                            #   (--profile qdrant). Overrides the built-in sqlite-vec / pgvector.
+# BROWSER_WS_ENDPOINT=                       # ws:// URL of a browserless/chrome instance for visual-review
+#                                            #   screenshot capture. Unset = visual review is fully inert (no
+#                                            #   screenshots, no error) — this feature is entirely optional.
 # DISCORD_WEBHOOK_URL=                        # one Discord channel for per-action notifications (merged/closed/
 #                                            #   manual) on ANY repo you review. Unset = no Discord notifications.
 #                                            #   Collection and schema are auto-created at startup. Off when unset.
@@ -324,6 +349,11 @@ REDIS_URL=redis://redis:6379                # REQUIRED for the self-host review
 #                                            #   merged decision. single = one reviewer's verdict (auto when 1).
 # AI_ON_MERGE=either                         # synthesis merge rule: either (block if EITHER reviewer flags) |
 #                                            #   both (block only when both do). Ignored unless AI_COMBINE=synthesis.
+# AI_DAILY_NEURON_BUDGET=10000000            # daily spend cap (Cloudflare Workers AI "neurons") shared by AI
+#                                            #   summaries, the free consensus-defect reviewer pair, and the
+#                                            #   AI-slop scorer. Default 10,000,000/day; clamped to [0, 10000000].
+#                                            #   Only meters FREE Workers-AI calls — BYOK/provider calls above bill
+#                                            #   the maintainer's own account and are not counted against this.
 # Ollama reviewer (AI_PROVIDER=ollama). Defaults: OLLAMA_AI_BASE_URL=http://localhost:11434/v1,
 # OLLAMA_AI_MODEL=llama3.1, no API key. Set the base URL to http://ollama:11434/v1 when using the compose
 # --profile ollama service.

.gittensory.yml.example

@@ -183,6 +183,15 @@ gate:
   # PR, so it is opt-in rather than a new default.
   premergeContentRecheck: false
 
+  # Force-rebase-before-merge window in minutes (#2552, anti-race). When the base branch has advanced within
+  # this many minutes of the actual merge-decision moment, an agent-driven merge forces an update_branch +
+  # fresh CI recheck cycle before merging, instead of trusting a mergeable_state: clean read that may already
+  # be stale relative to a sibling commit that just landed on the base. A bounded retry cap prevents a
+  # fast-moving base from live-locking the PR — after a few forced attempts it falls through to a normal
+  # merge with an audit note. Positive integer (minutes), or omit/null. Default: null (never force).
+  # DB-backed (dashboard-settable too); this overrides the stored value.
+  requireFreshRebaseWindow: 10
+
   # AI maintainer review. Opt-in; the AI capabilities are switched on at the
   # deployment level.
   aiReview:

apps/gittensory-ui/public/openapi.json

@@ -8682,6 +8682,12 @@
           },
           "badgeEnabled": {
             "type": "boolean"
+          },
+          "requireFreshRebaseWindowMinutes": {
+            "type": "integer",
+            "nullable": true,
+            "minimum": 0,
+            "exclusiveMinimum": true
           }
         },
         "required": [