feat(agent-actions): generalize the review-nag cooldown into a per-command rate limit

[JSONbored]

Summary

• The only throttle on the @gittensory mention-command surface was maybeThrottleReviewNagPing, deliberately narrow: it only fires for the thread's OWN author, and only when reviewNagPolicy is hold/close. Every other command — the public commands (help, ask, preflight, blockers, duplicate-check, miner-context, next-action, reviewability, repo-fit, packet) and the maintainer-only queue-digest commands — had no cooldown at all, and most dispatch to real, AI-cost-bearing orchestrator calls a careless or malicious actor could spam dozens of times on the same thread.
• Adds maybeThrottleGittensoryCommand, generalizing review-nag's audit-ledger counting pattern (countRecentAuditEventsForActorAndTarget) to any command — keyed by (actor, command, targetKey) (the command name folded into targetKey) so each command gets its own independent counter; pinging help repeatedly never counts against ask's own limit.
• Config-driven per repo (commandRateLimitPolicy: off/hold), off by default so existing repos see no behavior change until they opt in. AI-cost-bearing commands (ask/blockers/preflight/reviewability/packet/duplicate-check/next-action/repo-fit, i.e. everything that reaches planNextWork/explainBlockersWithAgent/preflightBranchWithAgent/preparePrPacketWithAgent) get a tighter default limit (5/24h) than cheap, cache-only commands (20/24h) — help, miner-context, and the maintainer queue-digest commands never touch the AI orchestrator at all.
• A rate-limited invocation gets a clear, public cooldown reply (reusing review-nag's own hold-notice pattern), never silence.
• Independent of, and complementary to, review-nag's own narrower thread-author-only, close-capable cooldown — this generalizes the pattern without replacing it.
• Full config-as-code chain wired in one PR (migration + Drizzle schema + RepositorySettings type + db/repositories.ts resolver + .gittensory.yml parsing + OpenAPI schema + .gittensory.yml.example docs), matching the existing settings-wiring pattern review-nag itself established.

Closes #2560.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint (via npm run test:ci)
• npm run db:migrations:check — migration 0094, contiguous, no new duplicates
• npm run typecheck
• npm run test:coverage locally — 6 new tests covering off-by-default (25 invocations, zero tracked), under-threshold (normal dispatch continues), a cheap command crossing its threshold (cooldown reply, short-circuited), an AI-cost-bearing command using the tighter default, independent per-command counters (invoking one command never throttles a different one), and dry-run (held but no live comment). All mutation-tested (temporarily reverted the off-check and the AI/cheap tier-selection logic, confirmed the relevant tests fail, restored).
• npm run test:workers (via npm run test:ci)
• npm run build:mcp (via npm run test:ci)
• npm run test:mcp-pack (via npm run test:ci)
• npm run ui:openapi:check — regenerated apps/gittensory-ui/public/openapi.json via npm run ui:openapi and committed it
• npm run ui:lint (via npm run test:ci)
• npm run ui:typecheck (via npm run test:ci)
• npm run ui:build (via npm run test:ci)
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. — N/A, no auth/session/CORS surface touched.
• API/OpenAPI/MCP behavior is updated and tested where needed. — RepositorySettings's new fields added to the OpenAPI schema and regenerated.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. — N/A, no UI change.
• Visible UI changes include a UI Evidence section below with screenshots. — N/A, no UI change.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. — .gittensory.yml.example documents the new settings.

Notes

• Third of a batch of independent maintainer-only roadmap items being worked one PR at a time (see feat(review): surface the test-evidence classifier in the AI review prompt #2635/feat(review): surface the deterministic test-evidence classifier in the AI review prompt #2558, feat(review): add a performance-regression instruction to the AI review system prompt #2636/feat(review): add a performance-regression instruction to the AI review system prompt #2559).
• 11 files touched, slightly above the usual small-PR target — inherent to the established config-as-code settings-wiring pattern (migration/schema/type/resolver/yml-parser/openapi/docs), same shape review-nag's own PR used.

[loopover-orb]

Important

🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪

🔍 Gittensory is reviewing…

AI analysis is in progress. This comment will update when the review is complete.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟪 Reviewing}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.10%. Comparing base (dfba160) to head (0f26200).
⚠️ Report is 4 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2637   +/-   ##
=======================================
  Coverage   96.09%   96.10%           
=======================================
  Files         237      237           
  Lines       26482    26517   +35     
  Branches     9606     9617   +11     
=======================================
+ Hits        25449    25484   +35     
  Misses        424      424           
  Partials      609      609           

Files with missing lines	Coverage Δ
src/db/repositories.ts	96.58% <100.00%> (+<0.01%)	⬆️
src/db/schema.ts	69.46% <ø> (ø)
src/github/commands.ts	97.67% <100.00%> (+<0.01%)	⬆️
src/openapi/schemas.ts	100.00% <ø> (ø)
src/queue/processors.ts	92.53% <100.00%> (+0.07%)	⬆️
src/signals/focus-manifest.ts	99.28% <100.00%> (+<0.01%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	0f26200	Commit Preview URL Branch Preview URL	Jul 03 2026, 01:18 AM