Epic: review-stack architecture audit — eliminate duplication, hardcoding, config sprawl, and dead code

[JSONbored]

Context

This is the output of an extensive, codebase-only audit of the gittensory review engine
(src/**, packages/gittensory-engine/src/**, review-enrichment/src/**) requested to answer: where
is there hardcoded/legacy behavior specific to JSONbored's own 3 repos that should instead be generic and
self-hoster-configurable; where has duplication drifted into real bugs; where does the config surface
overlap or contradict itself; and where is dead code adding navigation cost. The audit is explicitly
framed around a future hosted/multi-tenant version — the goal is to reuse the existing review-engine
stack as much as possible for that eventuality, which means the config-resolution and per-feature
activation mechanisms need to be genuinely single-sourced, not just "mostly consistent."

This issue and its sub-issues are the deliverable of an audit-only pass — no code was changed while
producing them. Five agents independently swept: duplication, hardcoding, decision-path/layering
(including a security-relevant bypass-path check), silent-drift (stale comments vs. actual behavior),
and dead code, plus a sixth pass specifically on config-schema sprawl. All findings below were verified
against the live codebase (grep, git-blame, cross-reference — not speculative) before being filed.

What the audit found, in one paragraph

The core review-decision path (planAgentMaintenanceActions) is genuinely well-unified — that's the
good news. But 5 hand-written "deterministic close" paths bypass it by design and have already drifted
into a live authorization gap (#4602). A confidence-floor config field has been silently inert since a
late-June refactor, with 5 stale comments still promising the old behavior (#4603). The secret-detection
logic has 3 duplicated copies that have drifted twice already, once causing false-positive auto-closes
(#4604, #4608 — this is the root cause class behind the false positives reported this week, now
independently reconfirmed by a fresh audit pass). processors.ts is 15,241 lines with a single
2,631-line function (#4607). At least 9 genuinely hardcoded, JSONbored-specific values wall off or
mis-brand a self-hoster's own deployment (#4612-#4615). Per-feature activation for ~16 advisory review
capabilities is implemented 4 different ways with 4 different config-precedence rules, which has already
caused one real production incident (#4616 — the single highest-impact finding in this audit).
RepositorySettings has grown to 102 fields with real redundancy (#4618). And 14+ exports plus 2 entire
orphaned DB tables are dead weight left over from features that were removed or superseded but not fully
cleaned up (#4619-#4621).

How to use this issue

Sub-issues are grouped by priority. P0 items are live correctness/security bugs discovered incidentally
during the audit — they should generally be picked up before the broader architectural cleanup, since
they're real bugs regardless of the audit's original architecture-improvement framing. P1 items are the
core "simplify, consolidate, eliminate duplication/hardcoding/config-sprawl" work the audit was
requested to find. P2 is dead-code removal — safe, mechanical, do whenever convenient.

Every sub-issue is self-contained (file:line evidence, impact, fix shape, acceptance criteria) and can be
picked up independently. Several are natural batches (e.g. the hardcoding items) but were kept in
reasonably-scoped sub-issues rather than one giant catch-all PR, per this repo's own small-PR convention.

Safety note carried over from the audit instructions: none of this touches the live server or ORB
deployment directly — every sub-issue is a codebase-only change. Deploying any given fix still follows
the normal beta-image → edge-nl-01 rollout process, one fix at a time, same as always.

Sub-issues

P0 — live correctness/security bugs found during the audit

• Fix close-enforcement authorization gap; extract shared helper #4602 — Fix close-enforcement authorization gap; extract shared helper (live authorization
  bypass — a repo with close autonomy unconfigured can still be auto-closed via 2 of 5
  duplicated close paths)
• Resolve dead aiReviewCloseConfidence floor (decision + fix) #4603 — Resolve dead aiReviewCloseConfidence floor (decision + fix) — needs a maintainer call on
  intended behavior before code changes
• Port missing secret-scan fixes to content-lane/security-scan.ts #4604 — Port missing secret-scan fixes to content-lane/security-scan.ts (live false-positive
  auto-close risk + a silent detection gap for 2 secret kinds)
• Fix engine-parity diffFilePriority typo; make drift-check recursive/function-aware #4605 — Fix engine-parity diffFilePriority typo (Carthage lockfile regex bug in the published
  engine package); make the drift-check recursive/function-aware
• Fix divergent linked-issue-required check in buildPublicCommentSignalBundle #4606 — Fix divergent linked-issue-required check in buildPublicCommentSignalBundle

P1 — duplication / architecture consolidation

• Break up processors.ts mega-functions #4607 — Break up processors.ts mega-functions (15,241 lines; one function is 2,631 lines / 17%
  of the file)
• Extract shared secret-detection module across secrets-scan.ts and content-lane/security-scan.ts #4608 — Extract shared secret-detection module across secrets-scan.ts and
  content-lane/security-scan.ts (follows Port missing secret-scan fixes to content-lane/security-scan.ts #4604)
• Consolidate review-enrichment's 17-file githubHeaders() duplication #4609 — Consolidate review-enrichment's 17-file githubHeaders() duplication (flagged as the
  single highest-value/lowest-risk fix in the whole audit)
• Consolidate second githubHeaders cluster + CI-cache positional params #4610 — Consolidate the second githubHeaders cluster + CI-cache positional-param cleanup
• Lower-priority duplicate cleanup batch #4611 — Lower-priority duplicate cleanup batch (isCommentLine, authoritativeContributorRepoStats,
  hasUnsafeWildcardCount)

P1 — hardcoding / self-host genericity

• Fix public repo-stats endpoint hardcoded to jsonbored/gittensory only #4612 — Fix public repo-stats endpoint hardcoded to jsonbored/gittensory only
• Self-hoster branding: gittensoryFooter + repo-doc-render honor PUBLIC_SITE_ORIGIN #4613 — Self-hoster branding: gittensoryFooter + repo-doc-render honor PUBLIC_SITE_ORIGIN
  (every reviewed PR currently attributes itself to JSONbored's product regardless of deployment)
• Make trusted-scanner-bot allowlist configurable #4614 — Make the trusted-scanner-bot allowlist configurable (currently only 4 JSONbored-chosen bots
  can ever create gate blockers via review threads)
• Minor hardcoding cleanup batch #4615 — Minor hardcoding cleanup batch (5 small items)

P1 — config sprawl (the biggest lever for hosted-version reuse)

• Unify per-feature *-wire.ts activation behind one shared resolver #4616 — Unify per-feature *-wire.ts activation behind one shared resolver — the single
  highest-impact config finding; already caused a real production incident; this is the flagship
  reuse target for a future hosted/multi-tenant version
• Widen check-docs-drift.mjs to cover the full config surface #4617 — Widen check-docs-drift.mjs to cover the full config surface (currently only 13
  hand-picked fields have any automated documentation guarantee, out of 140+)
• Reduce redundant config surface: linked-issue knob, gateCheckMode, label fields #4618 — Reduce redundant config surface: 3-way linked-issue knob, gateCheckMode vs
  reviewCheckMode, 13 near-identical label fields

P1 — hardcoding follow-up

• Thread PUBLIC_SITE_ORIGIN into commands.ts help-text URL #4670 — Thread PUBLIC_SITE_ORIGIN into commands.ts help-text URL (found during Self-hoster branding: gittensoryFooter + repo-doc-render honor PUBLIC_SITE_ORIGIN #4613's fix, deliberately kept out of that PR's scope)

P2 — dead code cleanup (safe, mechanical)

• Remove verified-dead exports and orphaned DB tables #4619 — Remove verified-dead exports and 2 orphaned DB tables (14+ items) — fully complete: chore(cleanup): remove 12 confirmed-dead exports (#4619) #4666 (12 exports) + fix(db): drop the 2 orphaned scoring-intelligence tables from #4619 #4676 (2 DB tables, confirmed zero production rows before dropping)
• Resolve dead config branches (wire or remove) #4620 — Resolve dead config branches (AutonomyLevel.suggest/.propose,
  checkRunDetailLevel.deep + a batch of already-self-documented inert fields) — needs a wire-or-
  remove decision per item
• Remove unused npm dependencies #4621 — Remove 3 unused npm dependencies

Non-goals / explicitly out of scope for this epic

• No server/ORB/deployment changes — this epic is entirely src/**, packages/**,
  review-enrichment/** codebase work.
• Not attempting a rewrite of any subsystem — every sub-issue is scoped as an incremental,
  independently-shippable, no-net-behavior-change (or narrowly-scoped behavior-fix) PR, consistent with
  this repo's one-shot contributor-gate model and small-PR preference.
• The @gittensory chat/mention-reply work (tracked separately: Epic: scoped @gittensory Q&A reply capability (local-Ollama chat + intent-routing) #4594, feat(commands): add @gittensory chat <question> — grounded LLM Q&A via local Ollama #4595, feat(commands): intent-classification router for unrecognized @gittensory mentions #4596) is unrelated to
  this audit and not folded in here.

[linear-code]

JSO-3399

[JSONbored]

P0 batch complete — all 5 live bugs found during the audit are fixed and merged:

• Fix close-enforcement authorization gap; extract shared helper #4602: #4637 (permission fix) + #4643 (shared-helper extraction)
• Resolve dead aiReviewCloseConfidence floor (decision + fix) #4603: #4656
• Port missing secret-scan fixes to content-lane/security-scan.ts #4604: #4628
• Fix engine-parity diffFilePriority typo; make drift-check recursive/function-aware #4605: #4638 + #4654
• Fix divergent linked-issue-required check in buildPublicCommentSignalBundle #4606: #4631

Two independent-review catches worth noting for anyone reading this later: #4605's first PR auto-merged and closed the issue with 1 of 3 acceptance criteria unaddressed (caught + fixed in a follow-up), and #4603's PR had an undisclosed, out-of-scope deletion of a live public feature bundled in alongside the real fix (caught + reverted before merge). Both are exactly the kind of silent-drift failure mode this audit exists to catch — including, apparently, in its own remediation PRs.

Moving to the P1 batch next (duplication, hardcoding, config-sprawl).