fix(review): hash a JSON payload for the impact-map query cache key to prevent collisions

[jeffrey701]

Problem

impactMapQueryFingerprint (src/review/impact-map.ts) built the impact-map query cache key by joining its fields with "|" and the excludePaths with ",", then hashing the string:

const payload = [input.queryText, [...input.excludePaths].sort().join(","), String(input.topK), String(input.minScore), input.reranker].join("|");

queryText is free-form text and an excludePath is a file path — either can legitimately contain the "|" or "," delimiter, which shifts a field boundary and lets two genuinely different inputs serialize to the same string, colliding on one fingerprint. Concretely, both of these produce "a|b|c|5|0.4|bm25":

• { queryText: "a|b", excludePaths: ["c"], … }
• { queryText: "a", excludePaths: ["b|c"], … }

A collision returns one query's cached impact-map result for a genuinely different query (getCachedImpactMapQuery looks the row up purely by this fingerprint).

Fix

Hash a JSON.stringify payload instead of a delimiter-joined string, so every field is escaped and distinct inputs always produce distinct fingerprints. This mirrors the exact discipline of the sibling cache-key builders linked-issue-satisfaction-cache-input.ts (#5976) and ai-slop-cache-input.ts. excludePaths stays sorted so argument order never causes a spurious cache miss. The function is exported so the fingerprint can be unit-tested directly (same as the sibling).

Tests

test/unit/impact-map.test.ts adds coverage that:

• two distinct inputs no longer collide across the "|"/"," delimiters (fails before the fix),
• the fingerprint stays independent of excludePaths order,
• it changes when any retrieval parameter (queryText/topK/minScore/reranker) changes.

npm run typecheck clean; test/unit/impact-map.test.ts green (27 tests).

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.33%. Comparing base (4a5bd94) to head (29b4e5a).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6144   +/-   ##
=======================================
  Coverage   95.33%   95.33%           
=======================================
  Files         599      599           
  Lines       47186    47186           
  Branches    15032    15032           
=======================================
  Hits        44983    44983           
  Misses       1477     1477           
  Partials      726      726           

Flag	Coverage Δ
shard-1	43.93% <100.00%> (-0.01%)	⬇️
shard-2	36.68% <0.00%> (+0.01%)	⬆️
shard-3	32.17% <0.00%> (+0.06%)	⬆️
shard-4	33.99% <0.00%> (-0.01%)	⬇️
shard-5	31.45% <100.00%> (-0.04%)	⬇️
shard-6	45.23% <0.00%> (+0.03%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/review/impact-map.ts	100.00% <100.00%> (ø)

[loopover-orb]

Caution

🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥

🛑 LoopOver review result - reject/close recommended

_{Review updated: 2026-07-15 17:38:22 UTC}

2 files · 1 AI reviewer · 2 blockers · readiness 93/100 · CI green · clean

🛑 Suggested Action - Reject/Close

Review summary
This fixes a real cache-key collision in impactMapQueryFingerprint by switching from a delimiter-joined string to JSON.stringify, so unescaped "|" or "," characters in queryText/excludePaths can no longer shift a field boundary and collide two distinct queries onto one fingerprint. The fix is correct and matches the pattern used by sibling cache-key builders (linked-issue-satisfaction-cache-input.ts, ai-slop-cache-input.ts), excludePaths sorting is preserved so argument order still doesn't cause spurious misses, and the added tests directly exercise the pre-fix collision scenario plus order-independence and parameter-sensitivity.

Nits — 3 non-blocking

• Exporting impactMapQueryFingerprint widens the module's public surface solely for testability; consider whether the sibling modules test this via a re-exported helper or accept the export as precedent (src/review/impact-map.ts).
• The inline comment block above the payload construction is quite long/verbose relative to the simplicity of the fix; could be trimmed to a shorter WHY note (src/review/impact-map.ts).
• Since existing cached fingerprints in the DB were computed with the old delimiter-joined format, confirm this change doesn't need a cache invalidation/migration step for previously-stored impact-map query cache rows (harmless if they just become permanent misses, but worth a one-line confirmation in the PR description).

Why this is blocked

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

📋 Copy for AI agents — paste into your coding agent

Fix the following blocker(s) from this PR review:

1. No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.

2. Maintainer requires a linked issue — Link the relevant issue (for example `Closes #123`) before opening the PR.

Signal	Result	Evidence
Code review	❌ 2 blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 131 registered-repo PR(s), 64 merged, 34 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	jeffrey701; Gittensor profile; 131 PR(s), 34 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.
Improvement	✅ Minor	risk: clean · value: minor · LLM: moderate

Review context

• Author: jeffrey701
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: TypeScript, Clojure, JavaScript, Rust
• Official Gittensor activity: 131 PR(s), 34 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Start here: Explain no-issue PR.
• Then work through the remaining 1 step in the Signals table above.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver is closing this pull request on the maintainer's behalf (No linked issue detected; Maintainer requires a linked issue). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.