feat(metrics): expose Redis token cache counters

[oktofeesh1]

Summary

• Add Prometheus hit/miss counters for the Redis-backed GitHub installation-token cache so self-host operators can see whether warm tokens are being reused or falling back to cold minting. Closes feat(metrics): emit hit/miss counters for the Redis installation-token cache #2074.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• None. Also ran npx vitest run test/unit/selfhost-redis-token-cache.test.ts --coverage.enabled true --coverage.include src/selfhost/redis-token-cache.ts with 100% statements, branches, functions, and lines for the touched source file. npm run test:ci passed end to end, including REES tests and UI checks.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

No visible UI, frontend, docs, or extension changes.

Notes

• The metric uses only the fixed result label (hit or miss); token values and installation identifiers are not emitted as metric labels.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-01 19:31:47 UTC}

2 files · 1 AI reviewer · no blockers · readiness 55/100 · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
The change adds a bounded hit/miss Prometheus counter around the Redis installation-token cache read path and keeps the stored token value out of metrics output. The implementation records misses for absent, malformed, and wrong-shaped Redis entries and records hits only after both cached fields validate, which matches the new tests and keeps the existing cache behavior intact. No blocking defects are visible in the provided diff and full changed files.

Nits — 5 non-blocking

• nit: test/unit/selfhost-redis-token-cache.test.ts:25 resets metrics only in afterEach, so this file still depends on no prior test in the same worker leaving the same metric populated before the first assertion.
• nit: src/selfhost/redis-token-cache.ts:12 hard-codes the metric name locally; if other self-host metrics expose constants from src/selfhost/metrics.ts, keeping this name there would reduce drift.
• test/unit/selfhost-redis-token-cache.test.ts:25 should use beforeEach or both beforeEach and afterEach for resetMetrics() so the metric assertions are independent of test ordering and worker reuse.
• src/selfhost/redis-token-cache.ts:12 could export or colocate the metric-name constant with the metrics module if that is the repo convention for self-host metric names.
• Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#2074
Related work	⚠️ 2 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (size label size:S; 1 linked issue).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 68 registered-repo PR(s), 56 merged, 4 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	oktofeesh1; Gittensor profile; 68 PR(s), 4 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: oktofeesh1
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 68 PR(s), 4 issue(s).
• Related work: Items reference the same linked issue feat(metrics): emit hit/miss counters for the Redis installation-token cache #2074. (issue #2074)
• Related work: Open PR work references issue feat(metrics): emit hit/miss counters for the Redis installation-token cache #2074. (issue #2074)

Contributor next steps

• Review top overlaps.
• Add a concise scope and risk note.
• Await review-lane availability.
• Triage stale or unlinked PRs.
• Refresh registry data or choose a registered active repo.
• Check active issues and PRs before submitting.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.00%. Comparing base (836e8e9) to head (bd714d7).
⚠️ Report is 18 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #2123       +/-   ##
==========================================
- Coverage   95.71%       0   -95.72%     
==========================================
  Files         222       0      -222     
  Lines       24653       0    -24653     
  Branches     8945       0     -8945     
==========================================
- Hits        23597       0    -23597     
+ Misses        433       0      -433     
+ Partials      623       0      -623     

see 222 files with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.