feat(enrichment): add changed-line coverage-delta analyzer

[e11734937-beep]

Summary

Adds a coverageDelta REES analyzer (#1516) that flags the lines a PR adds which the project's own latest successful CI coverage report records as executed zero times — real measured test gaps on exactly the touched lines, not a heuristic about whether tests "look" present. This is heavy/external analysis the no-checkout in-prompt reviewer cannot run; the service returns it as an additive, fail-safe brief block the engine splices into the review.

How it works

• Indexes the PR's added new-file line numbers from the patch hunks (no network round-trip if the PR adds no lines).
• Fetches the head commit's most recent successful GitHub Actions run, finds a coverage-named artifact under a size cap, and downloads the artifact zip (bounded by declared + actual byte caps).
• Reads the zip via the central directory (stored + deflate, using node:zlib), parses the first recognized report — lcov lcov.info, Istanbul coverage-final.json, or Cobertura XML — into per-file zero-hit lines, and intersects with the PR's added lines.
• Reports only { file, uncoveredLines } — never file contents.

Safety / bounds

• Fully fail-safe: a missing token/head-sha, absent artifact, unparseable report, oversize download, fetch error, or aborted signal all yield no finding rather than a false one — a fetch failure can never manufacture a false "untested" result.
• Bounded: at most 5 runs probed, an 8 MB artifact / 4 MB per-entry cap, and at most 15 files x 20 lines reported.
• Self-contained in review-enrichment/ (outside the engine tsc/vitest/codecov scope); zero engine conflict.

Tests

• 20 focused node:test units covering the patch parser, all three coverage-format parsers, the zip reader (deflated + stored + non-zip), path matching, the full scan (lcov + Istanbul happy paths, fully-covered negative, token/head-sha/slug guards, no-run/no-artifact/oversize/wrong-file, runs-fetch and zip-download failure, aborted signal), and both render branches. A real deflated zip is built in-test from node:zlib.

Closes #1516

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-05 23:21:13 UTC}

10 files · 1 AI reviewer · no blockers · readiness 62/100 · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
Adds a self-contained, fail-safe `coverageDelta` REES analyzer that intersects a PR's added line numbers with zero-hit lines pulled from the project's own latest successful CI coverage artifact (lcov/Istanbul/Cobertura), wired through the registry, docs, render, and env-var lists consistently across all four generated-list locations. The implementation is careful: bounded fetch/artifact/entry sizes, a from-scratch bounds-checked ZIP central-directory reader, no-network-when-no-added-lines short-circuit, and 20 focused unit tests covering every parser, the zip reader, path matching, and failure/abort paths — all fail closed to `[]` rather than fabricating a finding. Linked to issue #1516 (part of #1499) per the description, satisfying the issue-link requirement.

Nits — 6 non-blocking

• review-enrichment/src/analyzers/coverage-delta.ts: when multiple coverage-named artifacts exist for a run, the code sorts ascending by `size_in_bytes` and takes the smallest (`.sort((a,b)=>a.size_in_bytes-b.size_in_bytes)[0]`) — worth a one-line comment on why smallest-first is preferred (e.g. avoiding merged/duplicate report bloat), since picking the smallest report could also mean picking a partial one.
• review-enrichment/src/analyzers/coverage-delta.ts:170-200 (readZipEntries): the ZIP central-directory offsets (12, 16, 20, 28, 30, 42, 46, etc.) are raw magic numbers with no named constants — consider a small offsets object/enum for readability given how easy it is to transpose one of these during a future edit.
• review-enrichment/src/analyzers/coverage-delta.ts:~108 (parseIstanbulJson): control-flow nesting is 5 deep per the size/nesting scan; consider extracting the per-statement zero-hit check into a small helper to flatten it.
• apps/gittensory-ui/src/lib/rees-analyzers.ts, review-enrichment/analyzer-metadata.json, review-enrichment/src/analyzers/registry.ts continue growing as large generated/registry files (1300–1540+ lines); not introduced by this diff, but worth eventually splitting per-analyzer metadata out of one monolithic array if the pattern keeps scaling.
• review-enrichment/src/analyzers/coverage-delta.ts: `fetchArtifactZip`'s declared-size check treats a missing/unparsable `content-length` header as `NaN`, which correctly falls through to the post-download byte check — fine as written, but a short comment noting that fallback would help a future reader confirm it's intentional.
• Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#1516
Related work	⚠️ 2 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (1 linked issue).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 45 registered-repo PR(s), 22 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	e11734937-beep; Gittensor profile; 45 PR(s), 0 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: e11734937-beep
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 45 PR(s), 0 issue(s).
• Related work: Items reference the same linked issue feat(enrichment): Changed-line coverage-delta #1516. (issue #1516)
• Related work: Open PR work references issue feat(enrichment): Changed-line coverage-delta #1516. (issue #1516)

Contributor next steps

• Review top overlaps.
• Add a concise scope and risk note.
• Await review-lane availability.
• Refresh registry data or choose a registered active repo.
• Check active issues and PRs before submitting.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.28%. Comparing base (a151d8a) to head (f034f00).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3652   +/-   ##
=======================================
  Coverage   93.28%   93.28%           
=======================================
  Files         314      314           
  Lines       32054    32054           
  Branches    11747    11747           
=======================================
  Hits        29903    29903           
  Misses       1517     1517           
  Partials      634      634           

Files with missing lines	Coverage Δ
src/review/enrichment-analyzer-names.ts	100.00% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.