feat(enrichment): flag review/approval integrity signals

[jaso0n0818]

What

A new local REES analyzer, approvalIntegrity, that flags review/approval integrity signals a PR's own page
doesn't always surface without branch protection's "dismiss stale reviews" setting enabled.

Detections (structured PR-reviews API fields only — a bounded, documented schema)

• stale-approval — the reviewer's latest APPROVED review predates the PR's current head commit (new commits
  landed after the approval).
• self-approval — the PR author approved their own PR.
• outstanding-changes-requested — a reviewer's CURRENT (most recent) review is still CHANGES_REQUESTED, not yet
  superseded by a later review from the same person.

Each reviewer is reduced to their single latest-submitted review before these checks run — the same semantics
GitHub itself uses to decide whether a reviewer's vote is still outstanding. A dismissed review is reported back
by the API with state: "DISMISSED", so a dismissed CHANGES_REQUESTED naturally stops counting as outstanding
without any extra handling.

Why it is bounded / merge-safe

It reads only documented fields from the GitHub PR-reviews API (state, commit_id, user.login,
submitted_at) and compares them — never diff, file, or review-body text. There is no text/YAML/code parsing of
any kind, so there are no ambiguous-syntax edge cases to find. Fail-safe throughout: a missing token, missing head
SHA, malformed repo slug, or fetch error all yield no finding rather than an error. Bounded to one page of reviews
(100), which covers the overwhelming majority of PRs. Mirrors the existing blame-link analyzer's structure
(same header/fetch helper shape, same ScanOptions/fail-safe conventions).

Value

Reviewers and auto-merge tooling can miss that an "Approved" PR was actually approved before the last few pushes,
that the author approved their own change, or that a CHANGES_REQUESTED review was never actually resolved (just
silently outpaced by new commits). Surfacing these in the review brief closes that gap without requiring the repo
to turn on GitHub's own stale-review-dismissal branch protection.

Tests

review-enrichment/test/approval-integrity.test.ts covers: the latest-per-reviewer reduction (including a
PENDING draft exclusion and case-insensitive login grouping), each of the 3 finding kinds, a fresh (non-stale)
approval, a stale+self approval on the same review, no self-approval when the author is unknown, a later APPROVED
superseding an earlier CHANGES_REQUESTED, a dismissed review no longer counting as outstanding, a COMMENTED review
producing no finding, and fail-safe paths (no token, no head SHA, malformed repo slug, fetch failure, empty
reviews, the exact bounded request URL). Analyzer metadata is regenerated and committed.

No linked issue

No linked issue because this is a net-new analyzer; there is no tracking issue to link.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-03 07:01:05 UTC}

9 files · 1 AI reviewer · no blockers · readiness 80/100 · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
The diff adds a bounded GitHub PR-review analyzer and wires it through the runtime registry, render path, generated metadata, UI docs, and tests. The core pagination and latest-review reduction are coherent for the stated structured-field approach, and the tests cover the important stale/self/outstanding and pagination-fail-closed paths. I do not see a reachable correctness break in the provided diff, but there are a couple of maintainability/test-fixture cleanup points worth tightening.

Nits — 4 non-blocking

• nit: `review-enrichment/test/approval-integrity.test.ts:17` uses a realistic-looking `ghp_` token fixture; change it to a non-token-shaped value like `test-token` so future scanners and readers do not have to special-case it.
• nit: `review-enrichment/test/approval-integrity.test.ts:255` packs the `fullPage` callback onto a very long line, which makes the pagination test harder to review than the rest of the file.
• In `review-enrichment/test/approval-integrity.test.ts:17`, use `githubToken: "test-token"` or similar because the analyzer only checks presence, not token format.
• In `review-enrichment/test/approval-integrity.test.ts:255`, split the `Array.from` ternary across lines to match the surrounding test style.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ No-issue rationale	PR body explains why no issue is linked.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 423 registered-repo PR(s), 272 merged, 6 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	jaso0n0818; Gittensor profile; 423 PR(s), 6 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: jaso0n0818
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 423 PR(s), 6 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Await review-lane availability.
• Refresh registry data or choose a registered active repo.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review