[Bug/privacy]: focus-manifest public-safety redaction may be applied inconsistently

[JSONbored]

Net-new from wiring audit (verify-first, privacy-sensitive). isFocusManifestPublicSafe (src/signals/focus-manifest.ts:183) defines the filter; confirm it is applied on every public surface that can echo manifest content (PR comments, badges, check details) so private maintainer notes can't leak.

Deliverables

• Audit all public surfaces that render manifest-derived text
• Ensure redaction applied everywhere; test

Context

src/signals/focus-manifest.ts:183, src/api/routes.ts, src/github/comments.ts.

[dosubot]

I audited the public surfaces that can echo focus-manifest content. Based on what I found in the codebase:

isFocusManifestPublicSafe (src/signals/focus-manifest.ts:183-185) is a regex-based filter that blocks financial terms (reward, payout, farming), credentials (wallet, hotkey, coldkey, seed phrase), scoring metrics (trust score, reviewability, scoreability), and filesystem paths. It's case-insensitive with word boundaries [1].

Coverage across public surfaces:

Surface	Filter Applied	Status
PR comments (engine.ts → comments.ts)	isFocusManifestPublicSafe + containsPrivatePublicTerm + sanitizePublicComment	✅ [2]
Check runs (app.ts)	CHECK_RUN_FORBIDDEN_TERMS + sanitizeForCheckRun; only findings with explicit publicText included	✅ [3]
API routes (manifest endpoints)	All 3 routes (GET, POST /refresh, PUT) require auth + maintainer/owner/operator role	✅ [4]
MCP tools	Operate on public .gittensory.yml only; private dashboard settings not exposed	✅ [5]
Extension panels	Explicit "private" vs "public-safe" labeling; HTML-escaped	✅ [6]
Badges/notifications	sanitizePublicComment applied; scoped to authenticated user	✅ [7]

maintainerNotes specifically: The field is stored as authenticated.maintainerContext [8], accessible only via the authenticated /v1/repos/{owner}/{repo}/pulls/{number}/maintainer-packet endpoint [9]. Only the count (privateNoteCount) is exposed in readiness signals, never the content [10]. The "Maintainer notes" section in the PR comment is misleadingly named—it contains public-safe filtered advisory findings, not actual maintainerNotes content [11].

The pattern is defense-in-depth: filtering at parse time (rejecting unsafe text), output time (filtering collections via isFocusManifestPublicSafe), and render time (fail-closed sanitizePublicComment that throws rather than strips). The function is invoked at 30+ call sites across 8+ files including decision-pack.ts, contributor-issue-draft.ts, repo-policy-compiler.ts, repo-policy-readiness.ts, onboarding-pack.ts, and the UI registration workspace .

Centralized test coverage exists in test/unit/policy-sanitizer.test.ts (55 cases covering comments, checks, manifests, settings preview, MCP output, and control-panel roles) [12].

No gaps found — redaction appears consistently applied across all identified public surfaces. The main edge cases to consider for your audit would be Unicode homoglyph bypasses of the forbidden-terms regex and any future surfaces that don't opt into the shared test helper.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[JSONbored]

Verified applied (2026-06-17). isFocusManifestPublicSafe is enforced at every point manifest-derived text becomes public — readiness warnings (repo-policy-readiness.ts:210), onboarding pack (onboarding-pack.ts:232/355/374), policy compiler (repo-policy-compiler.ts:33), and public slop text (slop.ts:329). The architecture filters at the signal-production source; the public surfaces (github/commands.ts, api/routes.ts) consume already-filtered signals rather than raw manifest text. No inconsistency found. Closing — reopen if a deeper formal privacy trace is wanted.