feat(agent-actions): add a review-request nagging cooldown (#2463)

[JSONbored]

Summary

• Adds a review-request nagging cooldown: when a PR/issue's own author repeatedly pings @gittensory on the same thread, the (N+1)th ping within a rolling window triggers the repo's configured policy — hold (deterministic cooldown reply, no further action) or close (labels + closes the PR through the same planner/executor gate stack — autonomy/dry-run/kill-switch/write-permission — as blacklist and the newly-landed contributor-cap short-circuit). Issue threads degrade to hold pending a dedicated closeIssue primitive (tracked separately).
• Fully config-as-code: migration + Drizzle schema + RepositorySettings + DB round-trip (getRepositorySettings/upsertRepositorySettings) + .gittensory.yml parsing/precedence + OpenAPI schema + .gittensory.yml.example docs, all in this PR.
• Adds a new shared autoCloseExemptLogins repo setting (a GitHub-login exemption list layered the same way, on top of the standing owner/admin/automation-bot exemption) intended for reuse by the per-contributor open-item cap too.
• Off by default (reviewNagPolicy: "off") — byte-identical behavior for any repo that doesn't opt in.
• Scoped to the thread's OWN author (issue.user.login === commenter) — a third party pinging on someone else's PR/issue is never tracked or throttled.
• Fixes a pre-existing migration-number collision on main (two 0090_*.sql files landed by separately merged PRs) by renumbering the newer one to 0092; this repo's own migration takes 0091.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused (one feature: the review-nag cooldown, plus the pre-existing migration-collision fix required to make db:migrations:check pass at all) and does not mix unrelated backend, UI, MCP, docs, dependency, or deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• Linked to feat(agent-actions): review-request nagging cooldown — throttle or close on repeated review pings #2463.

Validation

• git diff --check
• npm run actionlint (via npm run test:ci)
• npm run typecheck
• npm run test:coverage locally — all new/changed lines and branches in src/** covered (verified via manual coverage/lcov.info BRDA inspection); a handful of genuinely-unreachable defensive fallbacks (the resolver always resolves a concrete default) are v8 ignored, matching existing precedent elsewhere in this file.
• npm run test:workers (via npm run test:ci)
• npm run build:mcp (via npm run test:ci)
• npm run test:mcp-pack (via npm run test:ci)
• npm run ui:openapi:check (via npm run test:ci)
• npm run ui:lint (via npm run test:ci)
• npm run ui:typecheck (via npm run test:ci)
• npm run ui:build (via npm run test:ci)
• npm audit --audit-level=moderate
• New/changed behavior has unit/integration tests: planner short-circuit (test/unit/agent-actions.test.ts), DB round-trip incl. invalid-value fallback (test/unit/data-spine.test.ts), the new count-in-window audit helper (test/unit/db-parsers.test.ts), .gittensory.yml parsing/precedence (test/unit/focus-manifest.test.ts), the new exemption-list module (test/unit/auto-close-exempt.test.ts), and full webhook-level integration tests covering off/under-threshold/hold/close/issue-degrade/exempt/third-party/owner/admin/dry-run/PR-already-closed/empty-autonomy-plan/no-installation scenarios (test/unit/queue.test.ts).

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text (the hold/close comments) stays sanitized, low-noise, and only interpolates public info (the author's own login and their own public ping count).
• No auth/cookie/CORS/GitHub App/Cloudflare/session changes.
• API/OpenAPI updated (src/openapi/schemas.ts + regenerated apps/gittensory-ui/public/openapi.json).
• No UI changes — backend/webhook-only.
• UI Evidence — not applicable (no visible UI change).
• Docs updated (.gittensory.yml.example); no changelog edit.

Notes

• The contributor-cap feature (feat(agent-actions): configurable per-contributor open PR/issue cap with auto-close over the limit #2270) landed on main while this branch was in progress; resolved the rebase conflicts to keep both contributor_cap and review_nag as sibling closeKind short-circuits, and both contributorCapLabel/contributorCapMatch and the new review-nag/autoCloseExemptLogins fields side by side across every config-as-code touchpoint.

[loopover-orb]

Important

🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪

🔍 Gittensory is reviewing…

AI analysis is in progress. This comment will update when the review is complete.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟪 Reviewing}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	eba6b84	Commit Preview URL Branch Preview URL	Jul 02 2026, 08:34 AM

[codecov]

Codecov Report

❌ Patch coverage is 99.04762% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 95.98%. Comparing base (357cf7a) to head (eba6b84).
⚠️ Report is 31 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/queue/processors.ts	97.82%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2530      +/-   ##
==========================================
+ Coverage   95.95%   95.98%   +0.03%     
==========================================
  Files         226      229       +3     
  Lines       25391    25807     +416     
  Branches     9234     9388     +154     
==========================================
+ Hits        24363    24770     +407     
- Misses        417      425       +8     
- Partials      611      612       +1     

Files with missing lines	Coverage Δ
src/db/repositories.ts	96.54% <100.00%> (+0.03%)	⬆️
src/db/schema.ts	69.46% <ø> (ø)
src/openapi/schemas.ts	100.00% <ø> (ø)
src/settings/agent-actions.ts	94.11% <100.00%> (+1.32%)	⬆️
src/settings/auto-close-exempt.ts	100.00% <100.00%> (ø)
src/signals/focus-manifest.ts	99.26% <100.00%> (+0.02%)	⬆️
src/queue/processors.ts	92.09% <97.82%> (+0.33%)	⬆️

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.