fix(config): restore main's typecheck and clear an injection-detector false positive

[JSONbored]

Summary

• main is currently broken: docs(config): make .gittensory.yml.example genuinely exhaustive, add a drift check #3635 (merged 2026-07-05T21:18Z) added a compile-time exhaustiveness map in test/unit/focus-manifest.test.ts (REVIEW_FIELD_TOKENS satisfies Record<Exclude<keyof FocusManifestReviewConfig, "present">, string>) that predates Finding category taxonomy on AI review findings #1958's review.finding_categories field, which merged separately around the same time. The map is missing the findingCategories key the satisfies check now requires, so npm run typecheck currently fails on main. Fixed by documenting review.finding_categories in .gittensory.yml.example (mirroring the review.changed_files_summary entry immediately above it) and adding the corresponding map entry.
• Injection-detector false positive: also flagged by gittensory's own review on docs(config): make .gittensory.yml.example genuinely exhaustive, add a drift check #3635 before it merged (the PR merged without addressing it). .gittensory.yml.example's new gate.aiReview.onMerge comment says "Per-repo override of the synthesis merge rule" — this matches gittensory's own INJECTION_SOURCE pattern for "override ... the ... rule" (a prompt-manipulation heuristic in src/review/prompt-injection.ts), so the review pipeline redacted it to [external-instruction-redacted] before the AI reviewer ever saw it. Confirmed via a direct regex test that this is a genuine false positive (the text is ordinary config documentation, nothing resembling an actual instruction) and that no other phrase in the file matches. Reworded "rule" to "mode", preserving the exact meaning.

No linked issue — this is a direct fix restoring main to a working state plus a follow-up correction on an already-merged PR; both are evidenced above rather than tracked separately.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused: two small, independently-evidenced doc/test fixes in the same two files docs(config): make .gittensory.yml.example genuinely exhaustive, add a drift check #3635 touched.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• No issue link — see Summary for the concrete evidence (a failing npm run typecheck and a reproduced regex match) in place of a tracked issue.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck — confirmed FAILING on main before this change (missing findingCategories key), PASSING after.
• npm run test:coverage — N/A, zero src/** lines changed (only .gittensory.yml.example, a doc/test file); confirmed no coverage obligation.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has tests: the exhaustiveness test itself (test/unit/focus-manifest.test.ts) now correctly asserts review.finding_categories is documented; ran the full affected suite (test/unit/focus-manifest.test.ts, 426 tests) plus npm run test:changed locally, all green.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (N/A — doc/test-only.)
• UI changes use live API data or real empty/error/loading states. (N/A.)
• Visible UI changes include a UI Evidence section. (N/A — no apps/gittensory-ui changes.)
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. (This PR IS the doc fix; no changelog touched.)

Notes

Verified the false-positive claim directly rather than assuming it:

node -e '... same INJECTION_SOURCE regex from src/review/prompt-injection.ts ...'
// -> "override of the synthesis merge rule" (1 match, now 0 after the reword)

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-05 21:31:22 UTC}

2 files · 1 AI reviewer · 2 blockers · readiness 100/100 · CI pending · blocked

⏸️ Suggested Action - Manual Review

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Review summary
This is a small, well-scoped fix: it restores `npm run typecheck` on `main` by adding the missing `findingCategories: "finding_categories:"` entry to the exhaustiveness map in test/unit/focus-manifest.test.ts and documenting `review.finding_categories` in .gittensory.yml.example (mirroring the adjacent changed_files_summary entry), and it separately rewords a comment that was tripping the repo's own prompt-injection heuristic on `gate.aiReview.onMerge`. Both fixes are narrowly targeted, the rewording preserves the original meaning (per-repo override capability of the merge-combine mode), and the new doc entry follows the existing comment style/format used for sibling config keys. No correctness issues are visible in the diff.

Nits — 4 non-blocking

• Consider adding a lightweight regression test (or comment note) asserting the reworded gate.aiReview.onMerge comment doesn't re-trigger the INJECTION_SOURCE pattern in src/review/prompt-injection.ts, so a future edit doesn't silently reintroduce this false positive.
• The PR bundles two logically distinct fixes (typecheck restoration + injection-detector wording) in one diff; both are small and justified in the description, but a maintainer scanning history later may find it easier to trace if they'd been separate commits/PRs.
• Verify FocusManifestReviewConfig (not shown in this diff) actually declares a `findingCategories` key with this exact casing so the `satisfies Record<...>` check in focus-manifest.test.ts compiles cleanly.
• Double-check no other doc comment in .gittensory.yml.example still contains the same 'override ... the ... rule' phrasing pattern that could trip the same injection heuristic elsewhere in the file.

Concerns raised — review before merging

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Signal	Result	Evidence
Code review	❌ 2 blockers	1 reviewer
Linked issue	✅ No-issue rationale	PR body explains why no issue is linked.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 55 registered-repo PR(s), 46 merged, 480 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 55 PR(s), 480 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: Python, TypeScript, JavaScript, Ruby, Go, Kotlin, MDX, Shell
• Official Gittensor activity: 55 PR(s), 480 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• No action.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@6443501). Learn more about missing BASE report.
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3641   +/-   ##
=======================================
  Coverage        ?   93.13%           
=======================================
  Files           ?      314           
  Lines           ?    32002           
  Branches        ?    11723           
=======================================
  Hits            ?    29804           
  Misses          ?     1552           
  Partials        ?      646           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.