feat(miner): add CoC-compliant rejection message templates

[dhgoal]

Summary

Adds CoC-compliant rejection message templates to @jsonbored/gittensory-miner: when one of the miner's PRs is closed/rejected, it can render a single, final, human-readable courtesy note (for a local run summary or CLI output — posting anywhere is a separate write action, out of scope here). Pure content/formatting: static template strings + a deterministic renderer, no GitHub calls, no LLM, no network.

• renderRejectionMessage(reason, context) renders the note for one of the reason buckets in REJECTION_REASONS — gate_close, maintainer_close_no_reason, superseded_by_duplicate — from a structured context (repoFullName = owner/repo, prNumber = positive integer). It throws on an unknown reason, a malformed context, or (defensively) any unresolved placeholder, so a caller can never emit a half-rendered note. Same inputs always render the same message.
• Every template is courteous and non-defensive — it thanks the reviewer and never re-litigates the maintainer's decision.
• containsPrivateLanguage(text) mirrors the redaction set in sanitizePublicComment (src/github/commands.ts); the templates are authored clean and this is asserted in tests. The structured context (a PR number + a validated owner/repo) carries no private scoring/reward/wallet data, so — deliberately — no value-level redaction is applied that would mangle a legitimate repo name.

Closes #2324.

Location note: the issue sketched src/manage/rejection-templates.ts, but this package is authored as plain-JS lib/*.js + hand-written .d.ts (no TS build — its build is node --check), like every other module beside it (deny-hooks, run-state, event-ledger, claim-ledger, …). I followed that established, merged convention rather than introducing a TS toolchain to the package.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue (feat(miner-manage): CoC-compliant rejection message templates #2324).

Validation

• git diff --check
• npm run typecheck
• npm run test:coverage locally — the new test/unit/miner-rejection-templates.test.ts passes (whole miner suite green). This change lives entirely in packages/**, which Codecov does not measure, so it carries no codecov/patch obligation; the logic is nonetheless exercised across every reason bucket rendering cleanly, the courteous/no-private-language assertions, the private-language guard, unknown-reason, and malformed-context rejection.
• node --check lib/rejection-templates.js via npm run --workspace @jsonbored/gittensory-miner build
• npm audit --audit-level=moderate — this PR adds no dependencies, so dependency-review has nothing new to evaluate.
• New behavior has unit tests for new branches and the public-safe invariant.

If any required check was skipped, explain why:

• UI/OpenAPI/migration/workers checks are not applicable: this change is one pure content/formatting module in packages/gittensory-miner/lib plus its test — no src/**, UI, API schema, DB, or Cloudflare-binding surface is touched.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed. Templates are public-safe by construction and asserted free of private-language tokens.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics. The notes are courteous and never re-litigate a maintainer decision.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. — n/a: pure string formatting, no auth/session/network surface.
• API/OpenAPI/MCP behavior is updated and tested where needed. — n/a: no API/OpenAPI/MCP surface changed.
• UI changes use live API data or real states. — n/a: no UI change.
• Visible UI changes include a UI Evidence section. — n/a: no visible UI, frontend, docs, or extension change.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

Additive: two new files (lib/rejection-templates.js + its lib/rejection-templates.d.ts), one line added to the package build (node --check) gate, and one new test file. No existing code is modified.

[superagent-security]

🚨 Contributor flagged. Click here for more info: Superagent Dashboard

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.22%. Comparing base (eb30c1f) to head (f211c4d).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2804   +/-   ##
=======================================
  Coverage   96.22%   96.22%           
=======================================
  Files         255      255           
  Lines       27944    27944           
  Branches    10156    10156           
=======================================
  Hits        26889    26889           
  Misses        433      433           
  Partials      622      622           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-03 21:50:38 UTC}

4 files · 1 AI reviewer · no blockers · readiness 80/100 · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
The change adds a small pure renderer for fixed rejection-message templates, validates the structured context before interpolation, and wires the new module into the miner package build. The core rendering path is deterministic and covered by focused unit tests for valid reasons, malformed context, unresolved placeholders by observation, and private-language detection. I do not see a reachable correctness break in the provided files, but the GitHub full-name validator is slightly looser than its comment and deserves tightening.

Nits — 4 non-blocking

• nit: packages/gittensory-miner/lib/rejection-templates.js:36 says the owner is a GitHub owner name, but the regex allows an owner segment ending in '-' even though GitHub owner names cannot end with a hyphen.
• nit: test/unit/miner-rejection-templates.test.ts:56 should include an owner-ending-hyphen case if the regex is meant to enforce GitHub owner syntax rather than only display safety.
• packages/gittensory-miner/lib/rejection-templates.js:36 can enforce the documented owner shape with a terminal alphanumeric requirement, then add the matching negative test in test/unit/miner-rejection-templates.test.ts:56.
• packages/gittensory-miner/lib/rejection-templates.d.ts:8 could export `REJECTION_REASONS` as the exact readonly tuple to keep TypeScript consumers aligned with the fixed runtime vocabulary.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#2324
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 30 registered-repo PR(s), 15 merged, 1 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	dhgoal; Gittensor profile; 30 PR(s), 1 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: dhgoal
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 30 PR(s), 1 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Await review-lane availability.
• Refresh registry data or choose a registered active repo.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[dhgoal]

Fixed. normalizeRepoFullName now validates the full name against the GitHub owner/repo shape (^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/[A-Za-z0-9._-]{1,100}$), so control characters, whitespace, markup, or an extra slash (e.g. owner/repo\nextra, owner/<repo>) are rejected with invalid_repo_full_name rather than interpolated into the note. Added negative tests for newline/space/markup/extra-slash/leading-hyphen/illegal-char cases plus a positive case with the allowed ._- punctuation.

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.