orb(gate): any contributor can force-close a rival's PR by citing the same issue number — breaker-exempt, default-on, and it has already closed 2 PRs

[JSONbored]

Problem

Any contributor can force ORB to auto-close a rival's PR by writing the same issue number in their own
PR body. The close is one-shot, and it is exempt from the close-precision circuit breaker.

The duplicate finding is derived entirely from other open PRs' author-written body text
(src/rules/advisory.ts:939-941):

const overlappingPrs = otherOpenPullRequests.filter((otherPr) =>
  otherPr.linkedIssues.some((issueNumber) => pr.linkedIssues.includes(issueNumber)));

pr.linkedIssues is a regex over the PR body. The finding blocks by default
(src/rules/advisory.ts:1110):

if (code === "duplicate_pr_risk") return gateMode(policy.duplicatePrGateMode ?? "block");

and the comment two lines above says so explicitly: "Duplicates still default to blocking." A blocker
→ conclusion: "failure" (advisory.ts:808) → willClose (src/settings/agent-actions.ts:1098) →
one-shot auto-close.

The breaker cannot save it. hasConcreteCloseEvidence (src/settings/agent-actions.ts:252) returns
true on any duplicate link, so downgradeCloseToHold will not downgrade it. The justifying comment
reasons only about staleness:

A duplicate-issue-link, like a base conflict, is still a deterministic, zero-hallucination fact about
the linked-issue graph; it just needs to be re-verified fresh, which it now is.

The fact is deterministic; the graph is contributor-authored. The comment reasons about the value
going stale and never about an adversary choosing it. The actuation-time recheck
(closeRequiresDuplicateStillOpen) only verifies the attacker's PR is still open — which the attacker
controls.

Live confirmation

duplicates: block is explicitly set in this repo's own manifest (.loopover.yml:37), and the live
instance has already acted on it — decision_records on edge-nl-01 (2026-07-26):

duplicate_pr_risk | close | 2

Two PRs have already been auto-closed by this rule. This is a live, exercised path, not a latent one.

Trigger

1. Victim opens PR [codex] Harden public AI summary invariants #200, Closes #7, green CI, ready to merge.
2. Attacker opens any PR whose body contains Fixes #7 — no code required.
3. The next gate pass on [codex] Harden public AI summary invariants #200 sees an overlapping sibling → blocker → failure → auto-closed, one-shot.

Cost to the attacker: one throwaway PR. Cost to the victim: their work, unrecoverable except by opening
a fresh PR (which can be closed the same way).

It also fires accidentally whenever two contributors independently pick the same help wanted issue
— a routine event on a repo that advertises a contributor backlog. Both PRs close.

Impact

Wrong-close, adversarially triggerable, breaker-exempt, on a repo where merges drive upstream rewards.
This is the cheapest available attack on another contributor's earnings and the hardest for them to
diagnose, since the close reason names a PR they have never seen.

Requirements

• Require corroboration beyond body text before a duplicate close: meaningful diff overlap with the
  sibling, or the sibling being a non-trivial real change. Body-text overlap alone may raise an advisory
  finding; it must not close.
• Drop duplicate_pr_risk from hasConcreteCloseEvidence so the precision breaker can downgrade it. The
  existing justification does not survive the adversarial reading and should be replaced with one that
  addresses authorship, not staleness.
• Reconsider duplicatePrGateMode's default for reward-eligible repos — advisory is the safe default
  when the input is contributor-authored.
• When two PRs genuinely claim one issue, prefer holding both for a human over closing either
  automatically; the current design makes ORB pick a loser using data the loser's rival controls.
• Review the two already-closed PRs and reopen them if they were legitimate.

Test Coverage Requirements

99%+ patch coverage, branch-counted. Adversarial regression test: a PR with an overlapping linked issue
but no diff overlap must not produce a close; both arms of the corroboration check covered.

Links & Resources

• src/rules/advisory.ts ~939-955, ~1110, ~806-809; src/settings/agent-actions.ts ~252, ~1098, ~1491-1495;
  .loopover.yml ~37
• orb(anti-abuse): duplicate/copycat reward-farming is off by default and only matches on linked issue #9033 (copycat detection is off by default) is the inverse direction — detection missing. This is the
  duplicate rule used as an offensive close primitive, plus its breaker bypass. Distinct.

Boundaries

The duplicate rule's close authority and breaker eligibility. No change to the duplicate-winner election
flag or to linked-issue parsing.

maintainer-only — close-authority and anti-abuse policy.

[linear-code]

JSO-6304