Context
packages/loopover-engine/src/track-record-summary.ts:115-126 defines PUBLIC_FIELD_BLOCKLIST as bare word-boundary regexes (/\bwallet\b/iu, /\bhotkey\b/iu, /\bcoldkey\b/iu, /\breward\b/iu, /\bpayout\b/iu, /\branking\b/iu). renderTrackRecordSummaryMarkdown:424-448 unconditionally renders GitHub login: ${markdownSafe(summary.login)} into the same text block that assertPublicSummaryText scans, which throws if any blocklist pattern matches anywhere in the full text — with no exemption for the identity field. A GitHub login containing one of these words as a whole word bounded by a hyphen (a legal username character) — e.g. my-wallet, payout-bot, coldkey-labs — makes rendering that contributor's own summary throw, even though PUBLIC_FIELD_BLOCKLIST is designed to catch computed/leakable content, not to double as an identity-field validator.
Requirements
renderTrackRecordSummaryMarkdown must not throw solely because a genuine GitHub login contains a blocklisted word — exclude the login line from the blocklist scan (or scan it separately with a narrower check).- Preserve existing fail-closed behavior for a genuinely-injected blocked term in a computed field.
Deliverables
Test Coverage Requirements
99%+ Codecov patch coverage on every changed line and branch, plus a regression test that reproduces the exact failure mode described above and asserts it's fixed.
Expected Outcome
A contributor whose real GitHub login happens to contain a blocklisted word can still have their track-record summary rendered.
Links & Resources
packages/loopover-engine/src/track-record-summary.ts:115-126,236-242,424-448.
Context
packages/loopover-engine/src/track-record-summary.ts:115-126definesPUBLIC_FIELD_BLOCKLISTas bare word-boundary regexes (/\bwallet\b/iu,/\bhotkey\b/iu,/\bcoldkey\b/iu,/\breward\b/iu,/\bpayout\b/iu,/\branking\b/iu).renderTrackRecordSummaryMarkdown:424-448unconditionally rendersGitHub login: ${markdownSafe(summary.login)}into the same text block thatassertPublicSummaryTextscans, which throws if any blocklist pattern matches anywhere in the full text — with no exemption for the identity field. A GitHub login containing one of these words as a whole word bounded by a hyphen (a legal username character) — e.g.my-wallet,payout-bot,coldkey-labs— makes rendering that contributor's own summary throw, even thoughPUBLIC_FIELD_BLOCKLISTis designed to catch computed/leakable content, not to double as an identity-field validator.Requirements
renderTrackRecordSummaryMarkdownmust not throw solely because a genuine GitHub login contains a blocklisted word — exclude the login line from the blocklist scan (or scan it separately with a narrower check).Deliverables
login: "team-wallet"(or similar) asserting successful rendering instead of a throwTest Coverage Requirements
99%+ Codecov patch coverage on every changed line and branch, plus a regression test that reproduces the exact failure mode described above and asserts it's fixed.
Expected Outcome
A contributor whose real GitHub login happens to contain a blocklisted word can still have their track-record summary rendered.
Links & Resources
packages/loopover-engine/src/track-record-summary.ts:115-126,236-242,424-448.