feat(signals): slop signal — missing test evidence

[kiannidev]

Summary

• Scaffold buildSlopAssessment in src/signals/slop.ts with SLOP_WEIGHTS, SLOP_RUBRIC_MARKDOWN, and deterministic band mapping.
• Add the missing-test-evidence slop signal using hasLocalTestEvidence / isTestPath from src/signals/test-evidence.ts and isCodeFile / isTestFile from src/signals/local-branch.ts.
• Add unit coverage in test/unit/slop.test.ts for code-only vs test-bearing diffs and public/private output boundaries.

Fixes #559

Scope

• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; global coverage stays at or above 97% for lines, statements, functions, and branches (aim for 98%+ branch coverage locally so CI variance does not fail near the threshold)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm run audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• npm run validate was run locally (covers typecheck + test:coverage); branch coverage met the 97% threshold.
• Remaining CI checks are left for CI to run.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (not applicable)
• API/OpenAPI/MCP behavior is updated and tested where needed. (internal slop scorer only)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (not applicable — backend only)
• Visible UI changes include screenshots or a short recording. (not applicable)
• Public docs/changelogs are updated where needed. (not applicable)

Notes

• Parent epic: feat(signals): deterministic slop-assessment core #530
• This PR includes the minimal slop assessment shell required for the signal; additional slop signals land in follow-on issues.

Made with Cursor

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#616 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

gittensory · advisory review

Reviewed 3 changed file(s) — two independent AI reviewers.

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

What changed

• src/signals/local-branch.ts: isTestFile and isCodeFile are now exported.
• src/signals/slop.ts: new file implementing the slop signal, weight constants, rubric markdown, assessment builder, and public‑safety helpers.
• test/unit/slop.test.ts: unit tests covering the slop assessment, risk calculation, band determination, and public text sanitization.

Reviewer A · gpt-oss-120b — recommends ✅ merge
This PR adds a new slop signal that flags code changes lacking test evidence, exports helper functions for test/file detection, and includes comprehensive unit tests. The implementation is clean, respects public safety constraints, and the tests verify behavior and sanitization.

Suggestions

• Add the new signal to the central signal registry if it should be active in production.
• Export isTestFile and isCodeFile from the package's public index only if they are intended for external use; otherwise keep them internal to avoid unnecessary API surface.
• Consider adding unit tests for the helper functions slopBandFor and clamp for full coverage.

Worth double-checking

• Exporting isTestFile and isCodeFile may unintentionally expose internal logic to consumers.
• If the slop signal is not registered, the new code will have no effect until integrated.

Reviewer B · nemotron-3-120b-a12b — recommends ✅ merge
The PR adds a new 'slop signal' to detect missing test evidence for code changes. It exports two helper functions from local-branch.ts, implements the slop assessment logic in slop.ts, and adds comprehensive unit tests. The change follows project conventions, includes proper public text sanitization, and appears deterministic and safe.

Suggestions

• Consider adding a test case for buildMissingTestEvidenceFinding where isFocusManifestPublicSafe returns false to verify the fallback path.
• The SLOP_WEIGHTS constant could be made more extensible for future signals (e.g., using an object rather than hardcoded).
• Ensure the focus-manifest module's isFocusManifestPublicSafe function is thoroughly tested elsewhere, as this signal depends on it for public safety.

Worth double-checking

• The slop signal currently only considers missing test evidence; ensure future expansions maintain the public/private boundary.
• Dependence on isFocusManifestPublicSafe requires trust in its correctness - a failure there could leak forbidden terms.
• Verify that the clamp function handles edge cases correctly (though it's a standard implementation).