Context
packages/loopover-engine/src/focus-manifest/guidance.ts:154-184 interpolates manifest.wantedPaths/matchedWantedPaths/manifest.preferredLabels unfiltered into public-facing findings and publicNextSteps, even though this same function already applies isFocusManifestPublicSafe to testExpectations/publicNotes. Both are freeform maintainer-authored strings with no content restriction at parse time. The identical bug in the sibling host file src/signals/focus-manifest.ts was found and fixed two days ago (commit 4076df12, PR #5967, closing #5945: "filter public-unsafe wantedPaths/preferredLabels from manifest findings") — that fix was never ported to the engine's independent reimplementation. scripts/check-engine-parity.ts's NAMED_TWIN_PAIRS does not register this host/engine pair, so CI's drift tripwire never catches this class of divergence for this file. No test file exists for this module under packages/loopover-engine/test/.
Requirements
- Filter
manifest.wantedPaths through isFocusManifestPublicSafe before interpolating into the manifest_off_focus finding detail (mirror the host's safeWantedPaths fix).
- Filter
matchedWantedPaths through isFocusManifestPublicSafe before interpolating into the manifest_preferred_path finding detail.
- Filter
manifest.preferredLabels through isFocusManifestPublicSafe before interpolating into both the manifest_missing_preferred_label finding detail and the corresponding publicNextSteps entry.
Deliverables
Test Coverage Requirements
99%+ Codecov patch coverage on every changed line and branch, plus a regression test that reproduces the exact failure mode described above and asserts it's fixed.
Expected Outcome
The engine's manifest-guidance builder can never leak a maintainer-private term into a public-facing finding, matching the already-fixed host behavior.
Links & Resources
packages/loopover-engine/src/focus-manifest/guidance.ts:109-112,154-184,207,230, host fix: src/signals/focus-manifest.ts (commit 4076df12, PR #5967, #5945).
Context
packages/loopover-engine/src/focus-manifest/guidance.ts:154-184interpolatesmanifest.wantedPaths/matchedWantedPaths/manifest.preferredLabelsunfiltered into public-facing findings andpublicNextSteps, even though this same function already appliesisFocusManifestPublicSafetotestExpectations/publicNotes. Both are freeform maintainer-authored strings with no content restriction at parse time. The identical bug in the sibling host filesrc/signals/focus-manifest.tswas found and fixed two days ago (commit4076df12, PR #5967, closing #5945: "filter public-unsafe wantedPaths/preferredLabels from manifest findings") — that fix was never ported to the engine's independent reimplementation.scripts/check-engine-parity.ts'sNAMED_TWIN_PAIRSdoes not register this host/engine pair, so CI's drift tripwire never catches this class of divergence for this file. No test file exists for this module underpackages/loopover-engine/test/.Requirements
manifest.wantedPathsthroughisFocusManifestPublicSafebefore interpolating into themanifest_off_focusfinding detail (mirror the host'ssafeWantedPathsfix).matchedWantedPathsthroughisFocusManifestPublicSafebefore interpolating into themanifest_preferred_pathfinding detail.manifest.preferredLabelsthroughisFocusManifestPublicSafebefore interpolating into both themanifest_missing_preferred_labelfinding detail and the correspondingpublicNextStepsentry.Deliverables
wantedPaths/preferredLabelsinguidance.tspublicNextSteps/summaryTest Coverage Requirements
99%+ Codecov patch coverage on every changed line and branch, plus a regression test that reproduces the exact failure mode described above and asserts it's fixed.
Expected Outcome
The engine's manifest-guidance builder can never leak a maintainer-private term into a public-facing finding, matching the already-fixed host behavior.
Links & Resources
packages/loopover-engine/src/focus-manifest/guidance.ts:109-112,154-184,207,230, host fix:src/signals/focus-manifest.ts(commit4076df12, PR #5967, #5945).