feat(api): expose self-tune override audit and clear routes (#6168)

[nghetienhiep]

Summary

src/review/auto-apply.ts fully implements and unit-tests listOverrideAudit,
deleteLiveOverride, and sanitizeOverridePayload, but none of them is reachable — no route
in src/api/routes.ts exposes override management, so a self-host operator running the
LOOPOVER_REVIEW_SELFTUNE loop had no way to inspect the override audit trail or clear a live
override short of direct D1 access.

This adds the missing operator-facing read/delete surface:

• GET /v1/repos/:owner/:repo/selftune/overrides/audit → listOverrideAudit (newest-first
  trail; optional ?limit=).
• DELETE /v1/repos/:owner/:repo/selftune/overrides → deleteLiveOverride. An optional JSON
  body is treated as a confirmation of the override being cleared and is validated through
  sanitizeOverridePayload — a malformed payload is rejected 400 rather than silently ignored.
  The live override is a per-project singleton (tunables_overrides is keyed by project), so the
  clear targets the repo directly rather than an invented :id sub-resource.

Both routes are maintainer-scoped via requireRepoMaintainer (the same gate the gate-precision
route uses) and added to the session path allowlist so a browser maintainer reaches the handler,
where per-repo authority is enforced. writeLiveOverride/writeShadowOverride/recordOverrideAudit
and the automatic promote path are untouched.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Validation

• git diff --check
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed — verified every added line and branch in src/api/routes.ts is covered (audit read with/without ?limit, delete with empty/valid/invalid body, and the 401/403 rejection paths).
• npm run ui:openapi:check (these operator routes are intentionally not in the curated public spec, matching gate-precision/maintainer-noise; check stays green)
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• Ran the checks relevant to a backend-only change (typecheck, the affected integration suite under coverage, openapi drift). No UI/MCP/wrangler surface changed.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (401 unauthenticated + 403 non-maintainer session for both routes.)
• API/OpenAPI/MCP behavior is updated and tested where needed.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

• No UI Evidence: this is a backend-only change with no visible UI/frontend/docs/extension surface.

Closes #6168

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.32%. Comparing base (2ff4179) to head (464f727).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6215   +/-   ##
=======================================
  Coverage   95.32%   95.32%           
=======================================
  Files         596      596           
  Lines       47090    47109   +19     
  Branches    15010    15015    +5     
=======================================
+ Hits        44888    44907   +19     
  Misses       1477     1477           
  Partials      725      725           

Flag	Coverage Δ
shard-1	43.96% <15.78%> (-0.07%)	⬇️
shard-2	36.68% <15.78%> (+0.11%)	⬆️
shard-3	32.21% <100.00%> (+0.06%)	⬆️
shard-4	33.95% <15.78%> (-0.15%)	⬇️
shard-5	31.69% <15.78%> (-0.01%)	⬇️
shard-6	45.30% <15.78%> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/api/routes.ts	94.47% <100.00%> (+0.04%)	⬆️

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-15 22:34:50 UTC}

2 files · 1 AI reviewer · no blockers · readiness 80/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This PR adds two maintainer-scoped operator routes (GET audit, DELETE clear) exposing the already-implemented but previously unreachable `listOverrideAudit`/`deleteLiveOverride`/`sanitizeOverridePayload` functions from auto-apply.ts, following the existing gate-precision route pattern for auth and session-path allowlisting. The delete route correctly validates an optional confirmation body through the same sanitizer used by the apply path before clearing, rejecting malformed payloads with 400 without touching the live override, and the accompanying integration test exercises the 401/403/400/200 paths plus the limit and empty-body branches against real DB state. The wiring (route → allowlist regex → handler) is complete and consistent with the described intent.

Nits — 4 non-blocking

• routes.ts: the DELETE handler treats any non-null body that fails sanitization as invalid, but a body of `false`/`0`/`""` (falsy but not null) would also hit `sanitizeOverridePayload`, which is fine per the code shown but worth a one-line comment on why `!== null` (not `!body`) is intentional.
• routes.ts:2707-2708: `Number(c.req.query("limit"))` on a non-numeric or missing query string yields `NaN`, which correctly falls through to `undefined` via `limitRaw > 0`, but a negative or `NaN`-adjacent edge case isn't explicitly tested beyond the absent-param case.
• Consider asserting in the test that a negative or non-numeric `?limit=` value falls back to the unlimited default, to explicitly lock in that branch.
• The route comments are thorough; keeping them at this length is fine but could be trimmed to match the terser style of nearby route comments in the file.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#6168
Related work	⚠️ 2 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 99 registered-repo PR(s), 53 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	nghetienhiep; Gittensor profile; 99 PR(s), 0 issue(s).
Gate result	✅ Passing	No configured blocker found.
Improvement	✅ Minor	risk: clean · value: minor · LLM: moderate

Linked issue satisfaction

Addressed
The PR adds maintainer-gated GET audit and DELETE clear routes backed by listOverrideAudit/deleteLiveOverride/sanitizeOverridePayload, leaves the automatic promote path untouched, and includes tests covering successful audit-list/delete plus unauthorized (401/403) rejection.

Review context

• Author: nghetienhiep
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, Vue, C#, JavaScript, C, C++, Go, Objective-C
• Official Gittensor activity: 99 PR(s), 0 issue(s).
• Related work: Items reference the same linked issue feat(review): expose self-tune override admin operations (sanitizeOverridePayload/deleteLiveOverride/listOverrideAudit) via a real route #6168. (issue #6168)
• Related work: Open PR work references issue feat(review): expose self-tune override admin operations (sanitizeOverridePayload/deleteLiveOverride/listOverrideAudit) via a real route #6168. (issue #6168)

Contributor next steps

• Start here: Review top overlaps.
• Then work through the remaining 2 steps in the Signals table above.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.