feat(mcp): mirror selftune override audit to remote/stdio tools and cli (#7798)

[andriypolanski]

Summary

• GET /v1/repos/:owner/:repo/selftune/overrides/audit (listOverrideAudit) exposed the self-tune override audit trail over REST only — no remote MCP tool, no local stdio MCP tool, and no CLI verb, unlike its gate-precision sibling which has all three.
• This adds the three missing mirror surfaces for loopover_get_selftune_override_audit, following loopover_get_gate_precision's exact shape. listOverrideAudit, the REST route, and its requireRepoMaintainer gate are unchanged.

Closes #7798

Change

• Remote MCP tool (src/mcp/server.ts): registered loopover_get_selftune_override_audit (owner/repo + optional limit, output { repoFullName, audit }), added it to MCP_TOOL_CATEGORIES as "maintainer", and added the getSelftuneOverrideAudit method — same per-repo requireRepoAccess gate as getGatePrecision, calling the existing listOverrideAudit.
• Local stdio MCP tool (packages/loopover-mcp/bin/loopover-mcp.ts): registered the same tool, calling GET ${repoBase}/selftune/overrides/audit via apiGet, with a matching STDIO_TOOL_DESCRIPTORS entry.
• CLI verb: added maintain selftune-audit --repo owner/repo [--limit N], mirroring the precision subcommand's emit/--json structure, plus printMaintainHelp, CLI_COMMAND_SPEC (shell completions), the usage string, and the unknown-subcommand error.

Tests

• New test/unit/mcp-selftune-override-audit.test.ts: remote tool — happy path (newest-first mapping), limit passthrough, empty trail, and forbidden-identity denial.
• test/unit/mcp-cli-maintain.test.ts: maintain selftune-audit plain + --json, null-detail filtering, and --limit passthrough.
• test/unit/mcp-cli-maintain-tools.test.ts: the stdio tool proxies to the audit endpoint, forwards limit, and surfaces an API failure as a tool error.
• test/unit/support/mcp-cli-harness.ts: fixture handler for the audit endpoint.
• Updated invariants the new tool shifted: stdio tool count 79 → 80 (mcp-tool-rename-aliases), the PowerShell completer's maintain list (mcp-cli-basics), and the output-schema roster (mcp-output-schemas).

Validation

• git diff --check clean.
• npm run typecheck, targeted vitest suites, and command-reference:check / cf-typegen:check pass.
• npm run test:coverage — every changed line and branch in src/mcp/server.ts is 100% covered (the new method has no untested branches). packages/** / test/** are outside Codecov's src/** scope.
• No artifact regeneration needed (no REST/OpenAPI/schema/binding/migration changes).

UI Evidence

N/A — backend MCP tool + CLI only; no apps/loopover-ui/** or other visible surface changed.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

❌ 2 Tests Failed:

Tests completed	Failed	Passed	Skipped
499	2	497	0

View the top 2 failed test(s) by shortest run time

test/unit/mcp-tool-rename-aliases.test.ts > MCP legacy alias retirement (#4777) — discovery invariants > lists exactly 80 loopover_ tools and zero gittensory_-prefixed aliases

Stack Traces | 1.5s run time

AssertionError: expected 81 to be 80 // Object.is equality

- Expected
+ Received

- 80
+ 81

 ❯ test/unit/mcp-tool-rename-aliases.test.ts:78:28

test/unit/mcp-tool-rename-aliases.test.ts > MCP legacy alias retirement (#4777) — discovery invariants > `loopover-mcp tools --json` reports the same 80-tool count the live server registers

Stack Traces | 3.06s run time

AssertionError: expected 81 to be 80 // Object.is equality

- Expected
+ Received

- 80
+ 81

 ❯ test/unit/mcp-tool-rename-aliases.test.ts:99:27

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[loopover-orb]

Caution

🛑 LoopOver review result - fixes required

_{Review updated: 2026-07-21 16:31:41 UTC}

9 files · 1 AI reviewer · no blockers · CI failing · blocked

🛑 Suggested Action - Fix Blockers

Review summary
This adds the missing MCP tool (remote + stdio) and CLI verb for the self-tune override audit trail, mirroring the existing gate-precision pattern exactly, and closes the linked issue #7798. The wiring is consistent across all three surfaces (registration, category, output schema, help text, shell completions), the auth gate (requireRepoAccess/requireRepoMaintainer) is unchanged and correctly reused, and the accompanying tests exercise the real proxy paths including limit forwarding, empty trails, and forbidden-identity denial rather than fabricated scenarios.

Nits — 5 non-blocking

• packages/loopover-mcp/bin/loopover-mcp.ts:2646 and :3399 use `any` for the tool/CLI handler params, matching the existing pattern in this file but still worth tightening to the schema-inferred type over time.
• The long-file size flags on loopover-mcp.ts and server.ts are pre-existing conditions this PR adds to rather than causes; not actionable for this diff specifically.
• test/unit/mcp-cli-maintain-tools.test.ts adds the two new cases outside the shared MAINTAIN_TOOLS loop per its own comment — fine for now, but if more mirror tools get added this way the loop's value erodes.
• Consider eventually refactoring the shared MAINTAIN_TOOLS test loop in mcp-cli-maintain-tools.test.ts to cover simple proxy-mirror tools like this one, reducing copy-pasted boilerplate as more get added.
• The FAILED validate and validate-tests (2) checks are unlabeled and this branch is 1 commit behind default — worth rebasing before merge to rule out drift as the cause.

CI checks failing

• validate
• validate-tests (2)

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#7798
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 177 registered-repo PR(s), 115 merged, 22 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	andriypolanski; Gittensor profile; 177 PR(s), 22 issue(s).
Improvement	✅ Minor	risk: clean · value: minor · LLM: moderate

Linked issue satisfaction

Addressed
The PR registers loopover_get_selftune_override_audit as a remote MCP tool (maintainer category) and a local stdio tool, and adds the maintain selftune-audit CLI verb mirroring the precision subcommand's emit/--json structure, matching all three required surfaces without altering listOverrideAudit or the REST route's gate.

Review context

• Author: andriypolanski
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, JavaScript, Rust, Cuda, Kotlin, MDX, Scala
• Official Gittensor activity: 177 PR(s), 22 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver is closing this pull request on the maintainer's behalf (CI is failing (validate, validate-tests (2))). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.