fix(signals): filter wantedPaths before interpolating focus-area PR guidance

[reyanthony062001-ops]

Summary

deriveContributionLanes in src/signals/focus-manifest.ts gated the "Focus changes on maintainer-wanted areas" PR-guidance line on the public-safety-filtered safeWanted list, but then interpolated the raw manifest.wantedPaths into the string it pushed. Because prEntryGuidance is later collapsed through the all-or-nothing isFocusManifestPublicSafe filter, a single public-unsafe entry anywhere in wantedPaths made the whole joined sentence fail that filter, silently dropping the entire guidance line — including the legitimate safe paths it was meant to surface.

The fix interpolates the already-computed safeWanted list instead, mirroring the sibling buildPolicyEntryGuidance in packages/loopover-engine/src/focus-manifest.ts, which documents and already applies this exact pattern (and matches the #5945 fix at line 692 of this same file). The safeWanted.length > 0 gate is unchanged; only the interpolated content is now filtered.

Closes #5944

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (Closes #5944).

Validation

• git diff --check — clean
• npm run actionlint — no workflow changes
• npm run typecheck — passes (whole project, against the built @loopover/engine)
• npm run test:coverage — the changed line is exercised by the new regression test and existing lane tests; the change is a single interpolation expression (manifest.wantedPaths → safeWanted) inside an already-covered branch and adds no new branch, so codecov/patch on the diff is 100%. The covering suite test/unit/policy-sanitizer.test.ts (67 tests) passes; the new test fails on the pre-fix code (asserts the safe path still surfaces) and passes after.
• npm run test:workers — unaffected (no worker changes)
• npm run build:mcp / test:mcp-pack — unaffected (no MCP changes)
• npm run ui:openapi:check — passes, no drift (pure value change, no schema/route change)
• npm run ui:lint / ui:typecheck / ui:build — unaffected (no UI app code; src/** triggers only the lightweight OpenAPI drift check)
• npm audit --audit-level=moderate — no dependency changes
• New or changed behavior has unit tests — a regression test with a mixed public-safe / public-unsafe wantedPaths list asserts prEntryGuidance still surfaces the safe path and never contains the unsafe one

If any required check was skipped, explain why:

• Backend-only change touching one line of src/signals/focus-manifest.ts plus a regression test in test/unit/policy-sanitizer.test.ts. It introduces no workflow, MCP, UI, OpenAPI, or dependency changes, so those gates are unaffected. I additionally ran npm run engine-parity:drift-check (ok — this file has no engine twin under signals/) and the backend drift checks (manifest, docs, command-reference, selfhost env-reference), all green.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests — N/A (none).
• API/OpenAPI/MCP behavior is updated and tested where needed — N/A (behavior-preserving for the default case; no schema change).
• UI changes use live API data or real empty/error/loading states — N/A (no UI changes).
• Visible UI changes include a UI Evidence section — N/A (no UI/frontend/docs/extension changes).
• Public docs/changelogs are updated where needed — N/A.

Notes

• This strengthens the public-safety guarantee already relied on elsewhere: the resulting guidance line is now built purely from paths that individually pass isFocusManifestPublicSafe, so it can no longer be dropped wholesale by one unrelated unsafe entry, and no unsafe path can leak into the rendered sentence.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-15 05:55:24 UTC}

2 files · 1 AI reviewer · no blockers · readiness 80/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This is a targeted one-line fix that swaps the interpolated `manifest.wantedPaths` for the already-filtered `safeWanted` list when building the 'Focus changes on maintainer-wanted areas' PR guidance string, preventing a single public-unsafe path from causing the entire guidance line to be dropped by the downstream all-or-nothing `isFocusManifestPublicSafe` filter. The `safeWanted.length > 0` gate is correctly left unchanged since only the content, not the condition, was buggy. The accompanying regression test in policy-sanitizer.test.ts correctly asserts the safe path still surfaces and the unsafe path is excluded, mirroring the pattern already used in the sibling `buildPolicyEntryGuidance` function.

Nits — 3 non-blocking

• The new test comment in test/unit/policy-sanitizer.test.ts:280-282 is a bit verbose for a single-line fix verification; a shorter comment referencing the issue/PR would suffice.
• Consider adding a second assertion case where ALL wantedPaths entries are public-unsafe (safeWanted empty) to confirm the guard `safeWanted.length > 0` still correctly suppresses the line entirely, since the diff doesn't show that arm being exercised.
• In test/unit/policy-sanitizer.test.ts, add a case where `safeWanted` ends up empty after filtering to explicitly cover the `if (safeWanted.length > 0)` false branch post-fix.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#5944
Related work	⚠️ 2 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 28 registered-repo PR(s), 16 merged, 1 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	reyanthony062001-ops; Gittensor profile; 28 PR(s), 1 issue(s).
Gate result	✅ Passing	No configured blocker found.
Improvement	✅ Minor	risk: clean · value: minor · LLM: minor

Linked issue satisfaction

Addressed
The diff changes the interpolation in the prEntryGuidance push from the raw manifest.wantedPaths to the filtered safeWanted list, exactly as requested, while leaving the gating condition unchanged, and adds a mixed safe/unsafe regression test verifying the safe path surfaces and the unsafe one is excluded.

Review context

• Author: reyanthony062001-ops
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 28 PR(s), 1 issue(s).
• Related work: Items reference the same linked issue fix(signals): deriveContributionLanes interpolates raw wantedPaths, silently dropping safe PR guidance under the all-or-nothing filter #5944. (issue #5944)
• Related work: Open PR work references issue fix(signals): deriveContributionLanes interpolates raw wantedPaths, silently dropping safe PR guidance under the all-or-nothing filter #5944. (issue #5944)

Contributor next steps

• Start here: Review top overlaps.
• Then work through the remaining 2 steps in the Signals table above.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.