Severity: MEDIUM
Location: packages/loopover-engine/src/signals/engine.ts:848
Found via a full-system adversarial audit of the ORB review/scoring engine (2026-07-15) — 2 independent skeptic passes, both had to vote "confirmed" for this to survive.
Failure scenario
In buildCollisionReport's issue-cluster loop (packages/loopover-engine/src/signals/engine.ts:842-852), risk: linkedPrs.length > 1 || issue.linkedPrs.length > 1 ? "high" : "medium" ORs in the raw, unverified issue.linkedPrs field (see finding above) alongside the genuinely-scoped linkedPrs (real open PRs whose body closes this issue). Concretely: issue #40 has exactly ONE real open PR (#12) closing it via 'Fixes #40' (so linkedPrs.length === 1), but issue #40's own body separately mentions 'see PR #8 and PR #9 for earlier discussion' (real or fabricated PR numbers, doesn't matter here since this branch does no existence check at all) -> issue.linkedPrs.length === 2 > 1 -> the cluster's risk is forced to 'high' even though there is no actual competing PR. collisionClustersForPull (src/rules/advisory.ts:375-379) picks up this cluster for PR #12 and rules/advisory.ts:461 turns the check-run annotation level from 'notice' to 'warning' ('Possible duplicate overlap') on every changed file of PR #12, and the inflated cluster also counts toward summary.highRiskCount (engine.ts:915) and highRiskDuplicateClusters (src/github/commands.ts:1609) shown to maintainers.
Impact
A PR with zero real competing work gets a 'warning'-level public duplicate-overlap annotation and inflates the repo's reported high-risk-collision count, based purely on how many times the linked issue's body text happens to say 'PR #N' -- a false-positive duplicate signal shown to both the contributor and the maintainer.
Severity: MEDIUM
Location:
packages/loopover-engine/src/signals/engine.ts:848Found via a full-system adversarial audit of the ORB review/scoring engine (2026-07-15) — 2 independent skeptic passes, both had to vote "confirmed" for this to survive.
Failure scenario
In buildCollisionReport's issue-cluster loop (packages/loopover-engine/src/signals/engine.ts:842-852),
risk: linkedPrs.length > 1 || issue.linkedPrs.length > 1 ? "high" : "medium"ORs in the raw, unverifiedissue.linkedPrsfield (see finding above) alongside the genuinely-scopedlinkedPrs(real open PRs whose body closes this issue). Concretely: issue #40 has exactly ONE real open PR (#12) closing it via 'Fixes #40' (solinkedPrs.length === 1), but issue #40's own body separately mentions 'see PR #8 and PR #9 for earlier discussion' (real or fabricated PR numbers, doesn't matter here since this branch does no existence check at all) ->issue.linkedPrs.length === 2 > 1-> the cluster's risk is forced to 'high' even though there is no actual competing PR. collisionClustersForPull (src/rules/advisory.ts:375-379) picks up this cluster for PR #12 and rules/advisory.ts:461 turns the check-run annotation level from 'notice' to 'warning' ('Possible duplicate overlap') on every changed file of PR #12, and the inflated cluster also counts towardsummary.highRiskCount(engine.ts:915) andhighRiskDuplicateClusters(src/github/commands.ts:1609) shown to maintainers.Impact
A PR with zero real competing work gets a 'warning'-level public duplicate-overlap annotation and inflates the repo's reported high-risk-collision count, based purely on how many times the linked issue's body text happens to say 'PR #N' -- a false-positive duplicate signal shown to both the contributor and the maintainer.