feat(review): backtest-gated autonomous loosening of the satisfaction confidence floor

[JSONbored]

Summary

• Ships Epic: validated auto-loosening for auto-tune.ts's tuning advisor, gated on a clean backtest #8121's explicitly-approved narrow start: the first backtest-gated autonomous loosening in the system, scoped to the epic's own named first candidate — LINKED_ISSUE_SATISFACTION_CONFIDENCE_FLOOR, a single scalar with real calibration: wire linked_issue_scope_mismatch into the shared signal-tracking module (fired + reversal) #8101 ground truth. auto-tune.ts's standing rule ("a loosening recommendation never carries a payload — autonomous loosening is the regression risk the loop exists to avoid") stays intact for everything else; this loop is the measured exception the Epic: verifiable pre-merge backtest for ORB/AMS deterministic rules #8082 backtest primitives exist to make safe.
• The gate: evaluateSatisfactionFloorLoosening (pure, 100% branch-covered) proposes the smallest candidate step below the current floor that scores strictly improved on the visible split and non-regressed on the deterministic held-out split (calibration: deterministic seeded held-out/visible split of the backtest corpus #8087, fixed seed — repeated runs can never fish for a lucky partition), requires a real sample (≥20 visible / ≥5 held-out decided cases), and never proposes below a hard 0.3 safety minimum.
• The apply path (runSatisfactionFloorLoosening): writes a system_flags override (the same operational-flag table the circuit breakers already use — no new storage) plus a calibration.satisfaction_floor_loosened audit event carrying both split comparisons, with independent direction/bound re-checks at the write path (a bogus proposal object cannot tighten or pass the minimum, tested via a mocked evaluator). One candidate step per run; re-runs evaluate from the current (possibly already-loosened) floor and can never oscillate upward.
• Consumption: runLoopOverLinkedIssueSatisfaction resolves the live floor in one place; the pure parse takes it as a defaulted parameter — byte-identical behavior when absent. Everything (override read, apply path, and the manual trigger POST /v1/internal/calibration/loosen-satisfaction-floor) is gated on the new SATISFACTION_FLOOR_AUTOTUNE_ENABLED wrangler var, false by default: the deploy is behavior-identical, and flipping the flag off instantly restores the shipped floor.
• The rest of the epic is now decomposed per its own "decompose once approved" instruction: calibration: schedule the satisfaction-floor loosening evaluation on the cron tick, with an apply alert #8158 (cron scheduling + apply alert), calibration: generalize backtest-gated loosening into a bounded knob registry beyond the satisfaction floor #8159 (bounded knob registry), calibration: surface backtest-cleared loosening proposals in the tuning advisor with evidence payloads #8160 (tuning-advisor surfacing), calibration: operator visibility for applied loosenings — live floor + history on the internal calibration surface #8161 (operator visibility) — all sub-issues of Epic: validated auto-loosening for auto-tune.ts's tuning advisor, gated on a clean backtest #8121.

Advances #8121 (the epic stays open for the decomposed remainder).

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:test
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• Full npm run test:ci ran green end-to-end (1110 test files) on the pre-rebase head; the rebase onto feat(api): weekly rule-calibration trend endpoint over fired/override history and backtest runs #8156's merge resolved one textual conflict in src/api/routes.ts (both branches append internal routes at the same anchor — both kept), re-verified with a clean tsc --noEmit plus both internal-route suites (14 tests). New-module coverage: 100% line AND branch on both satisfaction-floor-loosening.ts (6 tests) and satisfaction-floor-loosening-run.ts (12 tests, incl. the mocked-evaluator defense-in-depth case and the best-effort audit failure path); floor threading covered in both the pure suite (3 new tests) and the run suite (3 new tests); route auth/flag-gate/response pinned in its own suite. cf-typegen regenerated and committed for the new var.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

This is trust-critical by nature; the containment is layered: env flag off by default → evaluator's own gates → write-path direction/bound re-checks → validated read (a corrupted override row can never tighten the floor or pass the minimum, and reads fail safe to the shipped default) → every apply audited with full evidence. A stored-override read failure degrades to the shipped constant, never blocks the review pass. Negative paths tested: 401 without token, 404 with flag off, DB-error fail-safe.

UI Evidence

Not applicable — no UI change.

Notes

• The internal route (not OpenAPI-listed, matching the /v1/internal/decision/calibration precedent) is the manual trigger; calibration: schedule the satisfaction-floor loosening evaluation on the cron tick, with an apply alert #8158 schedules it.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.