gittensory-orb orb-v0.3.0

Gittensory Orb container image:

docker pull ghcr.io/jsonbored/gittensory-selfhost:orb-v0.3.0

Multi-arch (linux/amd64 + linux/arm64). See https://gittensory.aethereal.dev/docs/maintainer-self-hosting for setup.
Includes the Claude Code / Codex subscription CLIs by default; credentials stay runtime-only.
Sentry release id baked into the image: gittensory-orb@0.3.0.

What's Changed

🚀 Features

• feat(engine): add bestRankedOpportunityAtOrAboveScore by @kiannidev in #3377
• feat(engine): add bestMetadataOpportunityAtOrAboveScore by @kiannidev in #3381
• feat(engine): add countPlanStepsByStatus by @kiannidev in #3386
• feat(engine): add isPlanFullyCompleted by @kiannidev in #3390
• feat(engine): add hasPlanFailedSteps by @kiannidev in #3408
• feat(engine): add hasPlanPendingSteps by @kiannidev in #3413
• feat(miner): add structured reviewer-consensus calibration signal by @galuis116 in #3406
• feat(engine): add hasPlanRunningSteps by @kiannidev in #3435
• feat(engine): add countPlanSteps by @kiannidev in #3439
• feat(engine): add isPlanEmpty by @kiannidev in #3447
• feat(review): add review-evasion protection by @JSONbored in #3414
• feat(engine): add hasPlanSkippedSteps and document plan DAG helpers by @kiannidev in #3470
• feat(engine): add ENGINE_VERSION semver pin by @kiannidev in #3475
• feat(review): add review.path_filters include/negation globs (#2043) by @RealDiligent in #3494
• feat(review): add review.auto_review eligibility filters (#1954) by @RealDiligent in #3499
• feat(enrichment): dependency-diff (added/removed deps) surface analyzer by @bohdansolovie in #3500
• feat(review): add auto_pause_after_reviewed_commits knob (#2042) by @RealDiligent in #3503
• feat(review): add review.tone public-safe voice brief knob (#2044) by @RealDiligent in #3507
• feat(config): add review.labeling_rules deterministic label suggestions (#2045) by @nickmopen in #3534
• feat(engine): add hasPlanCompletedSteps and document packages by @kiannidev in #3540
• feat(engine): add isPlanBlocked plan DAG helper by @kiannidev in #3559
• feat(engine): add isPlanProgressComplete plan DAG helper by @kiannidev in #3562
• feat(enrichment): add unsafe-any TS counter analyzer (#2017) by @jony376 in #3563
• feat(engine): add resolvePlanOverallStatus plan DAG helper by @kiannidev in #3567
• feat(selfhost): add per-repo review.ai_model overrides for claude-code/codex by @JSONbored in #3570
• feat(engine): add hasPlanReadySteps plan DAG helper by @kiannidev in #3578
• feat(engine): add isPlanTerminated plan DAG helper by @kiannidev in #3587
• feat(enrichment): add exported-API breaking-change analyzer by @e11734937-beep in #3619
• feat(selfhost): add optional browserless/chromium service for visual review by @JSONbored in #3633
• feat(miner-packaging): add laptop-mode init command by @kiannidev in #3622
• feat(enrichment): add deprecated / unmaintained dependency analyzer by @e11734937-beep in #3637
• feat(miner): add claimIssue and listActiveClaims ledger aliases by @kiannidev in #3640
• feat(enrichment): add revert-recurrence detector by @e11734937-beep in #3647
• feat(review): add per-repo review.visual capture config by @JSONbored in #3644
• feat(review): wire up pixel-diff into a Diff column (self-host) by @JSONbored in #3677
• feat(review): add deterministic review-effort chip and wire real per-PR minutes by @JSONbored in #3666
• feat(selfhost): add shared-base config layer for multi-repo operators (#1959) by @JSONbored in #3660
• feat(review): add review.visual.themes config for dark-mode capture by @JSONbored in #3680
• feat(review): add scroll-through GIF evidence capture by @JSONbored in #3688
• feat(review): add review.min_finding_severity display floor for inline findings by @luciferlive112116 in #3718
• feat(review): add review.max_findings display caps for blockers/nits (#2049) by @Lang-bt in #3783
• feat(ui): add maintainer activation preview card by @JSONbored in #3790
• feat(review): add maintainer review recap digest builder + Discord delivery by @JSONbored in #3801
• feat(review): add review.comment_verbosity output-detail knob by @philluiz2323 in #3804
• feat(review): add cached repo quality-culture profile as AI-review grounding by @JSONbored in #3802
• feat(mcp): add follow-up issue local-write action spec (#2177) by @kiannidev in #3836
• feat(review): add suppression-signal data model + memory matcher by @JSONbored in #3841
• feat(review): add linked-issue satisfaction advisory + unified-comment section by @JSONbored in #3833
• feat(site): add public per-repo review-quality leaderboard (#2568) by @jimcody1995 in #3846
• feat(config): add review.auto_merge_summary read-only knobs surface (#2051) by @nickmopen in #3855
• feat(review): add a category-tally line to the unified review comment (#2150) by @nickmopen in #3865
• feat(miner-foundation): extract scoring preview/model into gittensory-engine (#2282) by @jimcody1995 in #3849
• feat(regate-sweep): add opt-in oldest-first ordering mode to selectRegateCandidates by @JSONbored in #3867
• feat(review): add hourly sweep-liveness watchdog with self-heal re-enqueue by @JSONbored in #3835
• feat(review): add config-driven before/after screenshot-table gate by @JSONbored in #3877

🐛 Fixes

• fix(signals): classify scss and less source maps as generated by @jimcody1995 in #3376
• test(enrichment): cover extractDependencyChanges edge cases in dependency-scan by @dhgoal in #3378
• feat(ai): track real usage for BYOK provider calls by @JSONbored in #3382
• test(enrichment): cover churn-hotspot empty-list and threshold boundaries by @dhgoal in #3385
• feat(enrichment): flag insecure HTTP security-header settings in iac-misconfig by @luciferlive112116 in #3387
• test(enrichment): cover redos {n,} quantifier and escape branches by @dhgoal in #3389
• feat(enrichment): analyze .mts/.cts files for doc-comment drift by @jeffrey701 in #3393
• fix(settings): close assign and manual-review coverage gaps in agent-actions by @JSONbored in #3384
• feat(enrichment): scan Terraform .tfvars and HCL files for IaC misconfig by @jeffrey701 in #3400
• feat(enrichment): flag EOL Postgres/MySQL/Redis/MariaDB/Mongo base images by @jeffrey701 in #3401
• feat(enrichment): detect webhook-URL and more API-token credential formats in secret-scan by @luciferlive112116 in #3402
• feat(review): treat Azure App Service + Fly.io as multi-tenant suffixes by @jeffrey701 in #3403
• fix(review): skip additional binary extensions in full-file grounding by @jimcody1995 in #3404
• test(enrichment): cover extractFunctionParams multi-line and TS param shapes by @dhgoal in #3407
• test(enrichment): cover requirementTokens dedup, stopword, and alnum branches by @dhgoal in #3409
• fix(signals): classify Dart protobuf stubs as generated by @jimcody1995 in #3412
• test(enrichment): cover codeOnly escape and nested-interpolation branches by @dhgoal in #3420
• fix(integrations): reject blank project IDs before GitHub calls by @jony376 in #3419
• docs(ai): document BYOK pricing table provenance and cross-file dependency by @JSONbored in #3421
• docs(selfhost): redact restore drill metadata by @JSONbored in #3427
• test(enrichment): cover reconstructOldContent multi-hunk and out-of-range paths by @dhgoal in #3430
• fix(selfhost): use own-property check for retired config-lint fields by @galuis116 in #3379
• fix(signals): classify Kotlin protobuf stubs as generated by @jimcody1995 in #3424
• fix(agent): restrict tracker suggestions to PR lifecycle actions by @JSONbored in #3426
• test(signals): extend repo-policy-compiler branch coverage by @bohdansolovie in #3432
• test(config): harden gate.readiness.minScore round-trip coverage by @bohdansolovie in #3436
• fix(signals): classify C# protobuf stubs as generated by @jimcody1995 in #3437
• fix(review): prioritize manifest/config files in RAG indexing before the chunk cap by @JSONbored in #3438
• fix(rees): coerce non-string values in safeCodeSpan/promptText by @JSONbored in #3441
• feat(enrichment): flag deployment-trigger and webhook URLs in secret-scan by @luciferlive112116 in #3442
• fix(queue): retry PR public-surface publish on a transient GitHub failure by @JSONbored in #3440
• fix(agent): preserve staged assign assignees by @JSONbored in #3448
• fix(rees): gate the expected-commit check on SENTRY_REQUIRE_COMMITS by @JSONbored in #3431
• fix(signals): classify MDX source maps as generated by @jimcody1995 in #3446
• test(enrichment): complete provenance classifier coverage for minified and manifest paths by @bohdansolovie in #3450
• feat(release): include a categorized PR changelog in orb-v release notes by @JSONbored in #3429
• fix(signals): classify Sass source maps as generated by @jimcody1995 in #3453
• fix(agent-actions): apply account-age throttle on issue contributor-cap path by @RealDiligent in #3455
• fix(selfhost): fast-fail codex on a stdin-read hang before the full timeout by @JSONbored in #3443
• fix(review): stop same-head AI re-review churn and add a maintainer-gated freeze by @JSONbored in #3461
• fix(orb): fail safe on a stream read error in readOrbRelayRegisterBody by @JSONbored in #3456
• fix(signals): classify HTML and SVG source maps as generated by @jimcody1995 in #3463
• feat(health): expose SQLite backup acknowledgment as a Prometheus gauge by @bohdansolovie in #3462
• fix(db): batch signal snapshot target lookups by @JSONbored in #3465
• fix(engine): reject malformed historical replay calibration scores by @JSONbored in #3466
• fix(signals): classify Objective-C protobuf stubs as generated by @jimcody1995 in #3469
• feat(enrichment): leftover console.log / debugger analyzer by @bohdansolovie in #3472
• feat(enrichment): hardcoded-URL / raw-endpoint heuristic analyzer by @bohdansolovie in #3474
• test(review): cover the markAiReviewPublished write-failure fail-open path by @JSONbored in #3477
• fix(agent): deny approve/merge when a live manual-review hold exists by @JSONbored in #3483
• test(review): document the last unreachable review-evasion coverage branch by @JSONbored in #3476
• fix(review): exempt the owner/admin/automation-bot from the manual-review freeze by @JSONbored in #3490
• fix(review): scan patch-less PR files for leaked secrets (#audit-3.4) by @RealDiligent in #3493
• fix(signals): classify Ruby and Rust protobuf stubs as generated by @jimcody1995 in #3504
• fix(signals): classify PHP protobuf stubs as generated by @jimcody1995 in #3505
• feat(review): skip ignored auto-review authors by @joaovictor91123 in #3508
• fix(signals): classify Elixir and Swift gRPC protobuf stubs as generated by @jimcody1995 in #3509
• fix(signals): classify Erlang gpb protobuf stubs as generated by @jimcody1995 in #3510
• fix(selfhost): give verdict the same state/merged_at precedence status has by @JSONbored in #3512
• feat(enrichment): long-file / big-function heuristic analyzer by @bohdansolovie in #3515
• fix(signals): classify Crystal protobuf stubs as generated by @jimcody1995 in #3518
• fix(signals): classify WASM source maps as generated by @jimcody1995 in #3523
• feat(enrichment): floating-promise / unhandled-rejection analyzer by @bohdansolovie in #3527
• fix(signals): classify Haskell protobuf stubs as generated by @jimcody1995 in #3529
• fix(signals): classify Nim protobuf stubs as generated by @jimcody1995 in #3533
• feat(metrics): add Redis response-cache hit-ratio gauge (#2090) by @jony376 in #3528
• chore(miner): add test:miner-pack publish-shape checker by @kiannidev in #3530
• feat(enrichment): deep-nesting / arrow-anti-pattern heuristic analyzer by @bohdansolovie in #3536
• fix(signals): classify Lua protobuf stubs as generated by @jimcody1995 in #3537
• fix(selfhost): source an open PR's Grafana verdict from review_audit, not dead advisories by @JSONbored in #3535
• feat(enrichment): empty-catch / error-swallow analyzer by @bohdansolovie in #3541
• fix(signals): classify Kotlin gRPC coroutine stubs as generated by @jimcody1995 in #3542
• feat(metrics): count Redis webhook dedup hits (#2075) by @jony376 in #3544
• feat(enrichment): flag COOP/COEP unsafe-none in iac-misconfig by @luciferlive112116 in #3545
• fix(selfhost): recognize review_audit in the exporter's no-source-tables guard by @JSONbored in #3546
• feat(enrichment): i18n hardcoded-string regression analyzer by @bohdansolovie in #3548
• test(review): add adversarial prompt-injection regression fixtures by @JSONbored in #3565
• fix(selfhost): ignore timestamped config/deploy backup directories by @JSONbored in #3568
• feat(review): hold PRs that solve an unlinked open issue by @JSONbored in #3513
• feat(review): deterministic changed-file classifier (#2143) by @nickmopen in #3547
• feat(enrichment): add accessibility regression analyzer (#2026) by @jony376 in #3574
• fix(review): cap patch-less secret scan fetches by @JSONbored in #3571
• docs(contributing): document every test:ci check, not just three by @JSONbored in #3579
• fix(signals): classify grpc-node JS/TS protobuf stubs as generated by @jimcody1995 in #3581
• fix(review): clear stale disposition labels once the underlying hold resolves by @JSONbored in #3575
• fix(review): order-swapped dual-AI tie-break stability by @RealDiligent in #3569
• fix(labels): bound custom type label cleanup by @JSONbored in #3552
• fix(review): enforce same-head self-close evasion by @JSONbored in #3583
• feat(review): render AI-suggested fixes as GitHub suggested-change blocks by @JSONbored in #3577
• feat(enrichment): unused-export / dead-on-arrival detector analyzer by @bohdansolovie in #3582
• feat(enrichment): enum / literal-union exhaustiveness-drift analyzer by @bohdansolovie in #3594
• fix(signals): classify Java gRPC service stubs as generated by @jimcody1995 in #3598
• feat(enrichment): flaky-test history annotator analyzer by @bohdansolovie in #3600
• docs(review): document review.auto_review eligibility knobs (#2072) by @jony376 in #3603
• chore(ci): wire gittensory-engine and gittensory-miner path filters by @kiannidev in #3599
• feat(review): render a deterministic changed-files summary in the unified comment by @JSONbored in #3604
• docs(miner-discovery): author MinerGoalSpec schema doc (#2300) by @kiannidev in #3618
• fix(review): address non-blocking review nits across the credibility-gate-farming series by @JSONbored in #3615
• test(miner-discovery): AI-policy-map fixture corpus + hard-skip integration test by @dhgoal in #3602
• fix(selfhost): canonicalize repo-doc refresh repos by @JSONbored in #3605
• docs(miner-deployment): add laptop vs fleet deployment guide by @kiannidev in #3621
• docs(config): add minimal starter .gittensory.minimal.yml template (#2054) by @jony376 in #3606
• fix(webhook): omit repo names from enqueue error logs by @JSONbored in #3614
• feat(review): tag AI review findings with a category taxonomy by @JSONbored in #3634
• fix(queue): regate all PRs linked to an issue on issue-side signals by @JSONbored in #3624
• fix(db): preserve linked-issue claim on a sparse PR sync payload by @JSONbored in #3636
• fix(review): require linked issue ownership for label propagation by @JSONbored in #3626
• fix(miner): sanitize reviewer consensus ingestion by @JSONbored in #3627
• docs(selfhost): redact Cloudflare inventory details by @JSONbored in #3628
• fix(review): forward REES file line counts by @JSONbored in #3629
• fix(review-enrichment): schedule model weight assets by @JSONbored in #3630
• fix(repo-docs): protect hand-maintained CLAUDE.md from overwrite by @JSONbored in #3631
• docs(miner): clarify claim ledger is local bookkeeping only by @kiannidev in #3638
• docs(config): make .gittensory.yml.example genuinely exhaustive, add a drift check by @JSONbored in #3635
• fix(review): keep generated skill frontmatter first by @JSONbored in #3632
• fix(config): restore main's typecheck and clear an injection-detector false positive by @JSONbored in #3641
• docs(selfhost): accurate onboarding paths and simplification proposal by @andriypolanski in #3649
• test(miner): verify miner_claims schema via PRAGMA by @kiannidev in #3648
• docs(miner): document claim ledger in README (#2291) by @kiannidev in #3650
• docs(config): add self-host review config templates in config/examples by @andriypolanski in #3651
• test(miner): verify package skeleton wiring (#2287) by @kiannidev in #3653
• fix(test): decouple miner workspace-discoverability check from npm ls exit code by @JSONbored in #3664
• feat(config): add review.linkedIssueSatisfaction knob (off/advisory/block, default off) (#2173) by @nickmopen in #3665
• fix(review): tighten injection-detection patterns to cut false positives by @JSONbored in #3658
• fix(review): approval-gate manual review labels by @JSONbored in #3623
• fix(selfhost): preserve legacy dual-review behavior for multi-provider AI_PROVIDER by @JSONbored in #3625
• feat(review): capture full-page screenshots for before/after evidence by @JSONbored in #3669
• fix(selfhost): stop embedding line numbers in the generated env-reference doc by @JSONbored in #3676
• fix(review): preserve manual review holds during cleanup by @JSONbored in #3668
• fix(enrichment): avoid i18n JSX text ReDoS by @JSONbored in #3670
• fix(review): require distinct PR for unlinked repeat close by @JSONbored in #3672
• fix(review): tighten hyphenated secret placeholder scan by @JSONbored in #3673
• test(review): auto_review round-trip and precedence matrix by @luciferlive112116 in #3683
• feat(review): skip auto-review when a configured label is present via review.auto_review.skip_labels by @bohdansolovie in #3686
• test(review): lock advisory==live disposition parity by @luciferlive112116 in #3689
• feat(review): skip auto-review of docs-only PRs via review.auto_review.skip_docs_only by @bohdansolovie in #3690
• fix(review): meter tie-break judge budget by @JSONbored in #3671
• feat(review): size-cap eligibility guard for auto-review via review.auto_review.max_added_lines / max_files by @bohdansolovie in #3693
• test(engine): add predicted-gate golden parity runner (#2286) by @kiannidev in #3687
• feat(review): post a quiet "review skipped (reason)" status when auto-review eligibility fails by @bohdansolovie in #3694
• fix(enrichment): bound coverage artifact zip parsing by @JSONbored in #3695
• fix(review): handle terminal basename punctuation by @JSONbored in #3696
• fix(review): clamp visual route capture limit by @JSONbored in #3697
• fix(miner): avoid PATH helper in docker doctor by @JSONbored in #3700
• fix(review): preserve repo manifest for AI-skipped reviews so changed-files summary still renders by @JSONbored in #3701
• fix(queue): cap linked issue regate fanout by @JSONbored in #3699
• docs(config): document shipped review.auto_review knobs in gittensory.full.yml by @luciferlive112116 in #3703
• fix(selfhost): pass OTEL usage-telemetry env vars into the Claude Code subprocess by @JSONbored in #3706
• fix(enrichment): bound caller-impact import parsing by @JSONbored in #3707
• fix(signals): move isTestFile/isCodeFile out of local-branch.ts to unbreak ui:typecheck by @JSONbored in #3709
• fix(ui): resolve backend-workspace typecheck break in apps/gittensory-ui by @JSONbored in #3710
• test(review): extend auto_review matrix with skip_labels and max_files coverage by @luciferlive112116 in #3711
• docs(selfhost): define safe update and rollback flow by @andriypolanski in #3713
• docs(config): document shipped review.effort_score and changed_files_summary toggles by @luciferlive112116 in #3714
• fix(signals): classify Perl and Scala protobuf stubs as generated by @jimcody1995 in #3715
• fix(review): exclude current head from auto-pause count by @JSONbored in #3719
• fix(db): preserve sparse PR body evidence by @JSONbored in #3720
• fix(miner): sanitize severity calibration ingestion by @JSONbored in #3722
• fix(observability): export all ai_usage_events into Grafana reporting DB by @JSONbored in #3723
• fix(queue): force a fresh AI review on manual panel retrigger by @JSONbored in #3729
• docs(config): document shipped inline-comment review toggles in gittensory.full.yml by @luciferlive112116 in #3731
• fix(install-scripts): reduce npm version metadata max size to prevent timeouts by @sentry[bot] in #3733
• fix(terminology): guard TERMS lookup against prototype pollution by @sentry[bot] in #3736
• fix(signals): classify C# and Dart gRPC service stubs as generated by @jimcody1995 in #3735
• test(config): lock in review.changed_files_summary plumbing (#2146) by @luciferlive112116 in #3737
• test(config): lock in review.effort_score plumbing (#2152) by @luciferlive112116 in #3740
• fix(enrichment): bound malformed switch scans by @JSONbored in #3742
• fix(enrichment): bound deep nesting brace classification by @JSONbored in #3744
• fix(review): stop the medium-effort retry storm burning tokens on zero output by @JSONbored in #3747
• fix(signals): classify Java protobuf message stubs as generated by @jimcody1995 in #3746
• docs(miner): document append-only event ledger in README (#2322) by @kiannidev in #3702
• test(review): lock in changed-files summary collapsible render (#2145) by @luciferlive112116 in #3748
• fix(signals): hold PR readiness only after the registry has actually synced by @JSONbored in #3751
• chore(miner): scaffold calibration module types (#2332) by @Lang-bt in #3704
• fix(signals): classify PHP gRPC service stubs as generated by @jimcody1995 in #3754
• feat(observability): expand self-host Sentry context and monitors by @andriypolanski in #3752
• test(miner-discovery): end-to-end Phase 1 pipeline fixture (#2311) by @kiannidev in #3756
• fix(review): tighten the regate-repair attempt cap to 2 and surface it to Sentry by @JSONbored in #3760
• fix(review): hold required automated-review skips from PR metadata by @JSONbored in #3721
• fix(review): keep gate evaluation for ignored authors by @JSONbored in #3698
• fix(selfhost): surface failed orb relay drains by @JSONbored in #3785
• fix(signals): exclude generated Dart part files from code scoring by @JSONbored in #3724
• fix(review): stop re-reviewing a PR whose CI is permanently stuck by @JSONbored in #3755
• fix(queue): re-gate every PR linked to changed issue by @JSONbored in #3787
• fix(review): bound visual screenshot rendering by @JSONbored in #3712
• feat(mcp): compose preflight, slop-risk, and pr-text-lint into review-pr by @JSONbored in #3791
• fix(review): count additions for auto-review size caps by @JSONbored in #3792
• feat(review): add boundary-safe test-generation advisory (#1972) by @JSONbored in #3794
• fix(selfhost): increase Claude Code CLI medium effort timeout by @sentry[bot] in #3789
• fix(review): prevent npm analyzer timeouts due to registry latency (#17) by @sentry[bot] in #3800
• fix(review): skip open-PR refresh for uninstalled registry repos in the regate sweep by @JSONbored in #3797
• test(review): add multi-file band-5 case for estimateReviewEffort (#2151) by @luciferlive112116 in #3784
• fix(selfhost): increase orb relay register timeout by @sentry[bot] in #3799
• fix(signals): classify Rust prost/tonic underscore protobuf stubs as generated by @jimcody1995 in #3782
• feat(review): boundary-safe test-generation spec + framework detector by @JSONbored in #3795
• feat(review): deterministic impact map (#2182-#2186) by @JSONbored in #3796
• fix(selfhost): reserve shared config folder by @JSONbored in #3818
• fix(review): elect duplicate-cluster winner by true PR creation time by @JSONbored in #3819
• feat(config): add review.fixHandoff toggle (default off) for fix-handoff blocks (#2176) by @nickmopen in #3824
• fix(queue): isolate per-repo failures in the scheduled regate sweep fan-out by @JSONbored in #3827
• fix(github): scope rate-limit admission checks to the caller's own bucket by @JSONbored in #3825
• feat(commands): register PR control-surface action verbs in the @gittensory parser by @JSONbored in #3826
• feat(review): add fix-handoff block renderer + follow-up-issue MCP spec by @JSONbored in #3834
• test(config): lock in review.test_generation manifest plumbing by @davion-knight in #3848
• feat(commands): did-you-mean hint for unknown @gittensory verbs (#2170) by @rust-toml in #3854
• feat(commands): document PR action verbs in the help card (#2167) by @rust-toml in #3856
• feat(review): merge identical inline findings across dual reviewers (#2158) by @nickmopen in #3858
• feat(config): validate .gittensory.yml against schema (fail clearly pre-review) by @philluiz2323 in #3823
• fix(observability): close two zero-trace webhook/relay loss points by @JSONbored in #3838
• fix(selfhost): isolate per-event enqueue failures in the Orb relay drain loop by @JSONbored in #3842
• fix(db): dedupe signal_snapshots to bounded latest-per-key retention by @JSONbored in #3857
• obs(selfhost): detect and alert on GitHub App JWT clock skew by @JSONbored in #3861
• fix(review): dedupe public stats effort average by @JSONbored in #3864
• fix(review): tighten mock placeholder carve-out to avoid secret-scan false negatives by @JSONbored in #3866
• fix(github): stop unattributed rate-limit observations from starving the shared public-token bucket by @JSONbored in #3869
• fix(queue): mark superseded webhook_events rows instead of leaving them stuck at 'queued' forever by @JSONbored in #3843
• feat(miner-foundation): extract duplicate-winner adjudication into gittensory-engine (#2278) by @philluiz2323 in #3870
• docs(commands): add @gittensory command reference page (#2171) by @rust-toml in #3872
• feat(miner-foundation): extract predicted-gate types into gittensory-engine (#2276) by @e11734937-beep in #3873
• docs(selfhost): document a git-pull-safe path to enabling Alertmanager notifications by @JSONbored in #3875
• docs(config): dedupe review.test_generation example documentation by @JSONbored in #3879
• feat(review): bypass the AI-review cache when impact-map is active by @JSONbored in #3878

🧹 Other Changes

• feat(enrichment): add changed-line coverage-delta analyzer by @e11734937-beep in #3652
• feat(enrichment): add caller-impact analyzer for removed exports with live callers by @e11734937-beep in #3656
• fix(review): redact direct reviewer manipulation phrases by @JSONbored in #3743
• fix(review): preserve safe enrichment lines when sanitizer finds forbidden terms by @JSONbored in #3753
• feat(selfhost): add optional REES self-hosting via docker-compose profile by @JSONbored in #3776
• fix(miner): flatten calibration module to match the flat lib/ convention by @JSONbored in #3772
• fix(miner): accept lib/ subdirectory modules in the package checker by @JSONbored in #3778
• ci(workflows): skip miner-package tests when the miner package is untouched by @JSONbored in #3775
• fix(miner): restore the strict flat-only pack-safety allowlist by @JSONbored in #3781
• fix(observability): forward ops-alerts anomalies to Sentry, add a review-burst rule by @JSONbored in #3766
• fix(review): bound scroll GIF page operations by @JSONbored in #3771
• Fix: MCP endpoint authentication bypass via extension-scoped session token by @superagent-security[bot] in #3786

New Contributors

• @e11734937-beep made their first contribution in #3619
• @Lang-bt made their first contribution in #3704
• @superagent-security[bot] made their first contribution in #3786
• @rust-toml made their first contribution in #3854

Full Changelog: orb-v0.2.0...orb-v0.3.0