docs: audit AMS global-singleton state for tenant-leak risk

[davion-knight]

Closes #5218.

Enumerates every module in packages/loopover-miner/lib and packages/loopover-engine/src/miner that holds process-wide or file-scoped singleton state, and rates the risk each would pose if AMS ran as a shared hosted service across tenants — the AMS counterpart to ORB's #4885–#4893 sweep.

Audit and documentation only — no fixes (each confirmed leak gets its own follow-up issue, per the issue boundary).

Paths are the post-rebrand loopover-* names for what the issue calls gittensory-*.

Deliverable

A findings doc at packages/loopover-miner/docs/global-singleton-tenant-audit.md with the requested risk rating per item (leaks across tenants / needs redesign / safe as-is) and file:line references throughout.

Findings in brief

• Leaks across tenants — ~13 default* store singletons (portfolio-queue, claim-ledger, event-ledger, governor-state/-ledger, run-state, ranked-candidates, attempt-log, plan-store, prediction-ledger, replay-snapshot, policy-*-cache, worktree-allocator). Each keeps a module-scoped let default* = null reused process-wide via getDefault*()/closeDefault*(), backed by one SQLite file whose path (resolveLocalStoreDbPath, local-store.js:16) has no tenant key — so two tenants in one process share the handle and file.
• Needs redesign — the LOOPOVER_MINER_KILL_SWITCH global boolean (the seed example; engine governor/kill-switch.ts:19,31): no per-tenant dimension. Flagged maintainer-owned trust/safety, like ORB Redesign the global agent-controls table for per-tenant scoping #4885.
• Safe as-is — processLogger, the process-lifecycle cleanup registry, tree-sitter/module-resolution caches, and the immutable validation Sets (no tenant data).
• Governor rate-limit/chokepoint/throttle hold no in-memory counters (pure fns over the persisted stores), so they add no separate leak surface.

Every file:line reference was verified against the current main. Follow-up seeds that touch the tenancy boundary are explicitly marked maintainer-review-required.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-14 12:02:45 UTC}

1 file · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This is a docs-only audit deliverable closing #5218, cataloging singleton state across the miner/engine packages with risk ratings (leaks-across-tenants / needs-redesign / safe-as-is) and file:line references. It matches the ORB #4885–#4893 sweep pattern cited as precedent, contains no code changes, and is internally consistent with its stated scope (audit only, no fixes).

Nits — 6 non-blocking

• Several file:line references (e.g. `local-store.js:16`, `claim-ledger.js:268/299`, `kill-switch.ts:19,31`) cannot be verified against the actual source since only the doc file is shown in the diff — worth a spot-check that these line numbers are current, since docs like this rot fast as the source shifts.
• The table row for `policy-doc-cache.js` and `policy-verdict-cache.js` omits a specific line number for the singleton declaration unlike every other row — minor inconsistency in an otherwise line-precise table.
• The doc references `Audit: privacy pass on AMS telemetry/export surfaces for cross-tenant leakage #5219` and `Redesign the global agent-controls table for per-tenant scoping #4885`/`Redesign the global agent-controls table for per-tenant scoping #4885–Run a privacy pass on fleet-analytics ingestion #4893` as cross-context issues without confirming they exist/are still open — worth double-checking those numbers are accurate before merge.
• Consider adding a one-line note on how these file:line references were verified (e.g. commit SHA pinned) so future readers know how stale the doc might be.
• If `worktree-allocator.js`'s singleton line number is known, add it to the table for consistency with the other 13 rows.
• Diff looks like trivial or whitespace-only churn — Reduce whitespace-only or formatting-only churn and keep the diff focused on substantive changes.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#5218
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 119 registered-repo PR(s), 83 merged, 1 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	davion-knight; Gittensor profile; 119 PR(s), 1 issue(s).
Gate result	✅ Passing	No configured blocker found.
Improvement	⚠️ ℹ️ Insufficient signal	risk: low · value: insufficient-signal — Nothing measurable for the structural-improvement analyzers on this PR (e.g. no code files changed). LLM value judgment: moderate — The doc is well-scoped, closes the linked issue, and produces an actionable, prioritized set of follow-up seeds without overreaching into fixes, matching the audit-only boundary set by the issue and prior ORB sweep.

Linked issue satisfaction

Addressed
The PR delivers exactly the requested findings document enumerating global-singleton modules across the specified miner packages with file:line references and a three-tier risk rating, explicitly matching ORB's #4885-#4893 template and covering the seed kill-switch example plus ~13 additional store singletons.

Review context

• Author: davion-knight
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 119 PR(s), 1 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

[BETA] Chat with Gittensory

Ask Gittensory a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @gittensory ask <question> answers contribution-quality Q&A with source citations and freshness.
• @gittensory chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @gittensory mention with a real question is routed to the closest matching read-only command automatically -- no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/gittensory-commands

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.