fix(route): derive PR author at admission to unjam merge queue

[andrei-hasna]

Problem

The PR-review admission gate prReviewRoutingDecision (src/lib/route/pr-review.ts, invoked for every todos-task drain at route-event.ts:428) marks every "Review and safely merge <repo>#N" queue task required=true but derives the PR author only from task metadata fields or an inline "author is X" regex. It never queries GitHub.

The pr-queue producer (repos ops pr-queue --upsert-tasks) writes queue tasks with empty metadata and a description carrying the PR URL + github-pr:owner/repo#N fingerprint but no author line. So ~330 repo-pr-merge-queue tasks were skipped every drain cycle:

considered: 9  created: 0  skipped: 8
skip reason (x8): "PR approval/merge route requires PR author evidence
                   before selecting a non-author GitHub reviewer"

created=0 means no worker is ever dispatched, no merge lands, and the fleet PR backlog stays flat (145+ PRs stuck). This is the linchpin.

Fix

When the gate is required, the author is absent, and the task carries a resolvable repo+number reference (PR URL or github-pr fingerprint already present in the task text), derive the author at admission via a single gh pr view <n> --repo <owner/repo> --json author -q .author.login lookup (one per candidate), then continue non-author reviewer selection from the pool.

• Self-review protection unchanged — a derived author that is the sole reviewer candidate is still blocked (self-review is not routable).
• Fails closed only when the author genuinely can't be resolved: no reference, or an unreachable/empty lookup (non-zero exit, spawn error, blank stdout).
• Hermetic tests — the lookup is injectable via PrReviewRoutingDeps.lookupPrAuthor; the gh binary is overridable via OPENLOOPS_PR_REVIEW_GH_BIN.
• Adds authorSource ("evidence" | "github-api") and pr-reference-detected / author-derived-github-api / author-lookup-unresolved signals for observability.

Tests (src/lib/route/pr-review.test.ts, 9 new)

• author derived from the github-pr fingerprint reference → route admitted, one lookup, correct non-author reviewer selected
• evidence author preferred → no lookup performed
• derived author == sole reviewer → blocked (self-review protection)
• lookup unreachable (returns undefined) → fails closed
• no resolvable reference → fails closed without a lookup
• non-required PR mention (no approval/merge/review intent) → no lookup

Verification

• bun test src/lib/route/ → 13 pass / 0 fail
• bun run typecheck (tsc --noEmit) → clean
• bun run build → clean
• gitleaks protect --staged → no leaks

Refs chief task 49f5670c. Do NOT self-merge — needs an independent reviewer + separate merger per the delivery contract; this fix unblocks the merge path itself so it needs a clean landing.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[andrei-hasna]

OpenLoops worker review for task 18d18dae-4fa1-4600-bea5-940012b08897: merge is blocked; I did not merge this PR.

Current GitHub state:

• PR is open, not draft; author is andrei-hasna; base main; head fix/pr-review-derive-author at 18249637f8d4f061890c4fb4883cb444a88b435c.
• CI checks are green: bun (ubuntu-latest) and bun (macos-latest) succeeded.
• latestReviews is empty and reviewDecision is blank.
• GitHub reports mergeable=CONFLICTING, mergeStateStatus=DIRTY.

Local conflict/semantic evidence:

• git merge-tree $(git merge-base origin/main origin/pr-20) origin/main origin/pr-20 reports conflicts in src/lib/route/pr-review.ts and src/lib/route/pr-review.test.ts; src/lib/route/index.ts merges cleanly.
• origin/main at 0e2a90d83751abf5af791b97dc87dafeba96820d already contains the core PR-author derivation fix in src/lib/route/pr-review.ts and route tests in src/lib/route/pr-review.test.ts.
• PR fix(route): derive PR author at admission to unjam merge queue #20's remaining differences are incompatible optional API/telemetry changes (prReferenceFromText, deps-object lookup, authorSource, alternate signal names, OPENLOOPS_PR_REVIEW_GH_BIN) rather than the required unjam fix itself.

Validation on current origin/main in the isolated worktree:

• bun install with sanitized env/cache: succeeded, no lockfile changes.
• bun test src/lib/route/pr-review.test.ts: 9 pass, 0 fail.
• bun test: 555 pass, 0 fail.
• bun run typecheck: passed.
• bun run build: passed.
• bun run test:boundary: passed.
• git diff --check origin/main...origin/pr-20: passed.

Blockers before merge:

1. Rebase/repair the PR head against current main and explicitly choose whether to keep any optional API/telemetry additions beyond the behavior already on main.
2. Obtain a valid non-author review/approval path. The routed reviewer evidence for this task selected kriptoburak from pool andrei-hasna, kriptoburak.