fix: harden manifest public-safe filter

src/signals/focus-manifest.ts

@@ -1,4 +1,4 @@
 import { parse as parseYaml } from "yaml";
 import type { GatePolicyPack, GateRuleMode, JsonValue, RepositorySettings } from "../types";
 
 export type FocusManifestSource = "repo_file" | "api_record" | "none";
@@ -179,7 +179,7 @@
  * text must not leak reward, wallet/key, ranking, or local filesystem path material.
  */
 export function isFocusManifestPublicSafe(text: string): boolean {
-  return !/\b(reward\w*|score\w*|wallet|hotkey|coldkey|mnemonic|farming|payout|ranking|raw[-\s]?trust|trust score|private[-\s]?reviewability|reviewability)\b|\/Users\/|\/home\/|\/tmp\/|[A-Z]:\\Users\\/i.test(text);
+  return !/\b(reward\w*|score\w*|wallets?|hotkeys?|coldkeys?|seed[-\s]?phrases?|mnemonics?|private[-\s]?keys?|farming|payouts?|rankings?|raw[-\s]?trust(?:[-\s]?scores?)?|trust[-\s]?scores?|private[-\s]?reviewability|reviewability(?:[-\s]?internals?)?|private[-\s]?scoreability|scoreability|public[-\s]?score[-\s]?(?:estimate|prediction|claim)s?|estimated[-\s]?scores?|score[-\s]?(?:estimate|prediction|preview)s?)\b|\/Users\/|\/home\/|\/tmp\/|[A-Z]:\\Users\\/i.test(text);
 }
 
 function emptyManifest(source: FocusManifestSource, warnings: string[] = []): FocusManifest {

test/unit/focus-manifest.test.ts

@@ -1,4 +1,4 @@
 import { describe, expect, it } from "vitest";
 import {
   buildFocusManifestGuidance,
   compileFocusManifestPolicy,
@@ -911,6 +911,19 @@
     expect(m.warnings.some((w) => /review\.note.*public-safe/.test(w))).toBe(true);
   });
 
+  it("drops review override terms covered by the public comment sanitizer", () => {
+    const m = parseFocusManifest({
+      review: {
+        footer: { text: "Maintainer note: include seed phrase details." },
+        note: "Intro note mentions private rankings.",
+      },
+    });
+    expect(m.review.footerText).toBeNull();
+    expect(m.review.note).toBeNull();
+    expect(m.warnings.some((w) => /review\.footer\.text.*public-safe/.test(w))).toBe(true);
+    expect(m.warnings.some((w) => /review\.note.*public-safe/.test(w))).toBe(true);
+  });
+
   it("ignores invalid field toggles and non-mapping footer/fields with warnings", () => {
     const m = parseFocusManifest({ review: { footer: ["nope"], fields: "nope" } });
     expect(m.review.present).toBe(false);

test/unit/policy-sanitizer.test.ts

@@ -1,4 +1,4 @@
 import { describe, expect, it } from "vitest";
 import { __controlPanelRolesInternals, buildControlPanelRoleSummary } from "../../src/services/control-panel-roles";
 import {
   buildCollisionReport,
@@ -395,12 +395,16 @@
       "hotkey abc123",
       "coldkey xyz",
       "mnemonic phrase",
+      "seed phrase",
+      "private key",
       "payout estimate",
       "reward estimate value",
       "raw trust score",
       "trust score context",
       "farming strategy",
       "private reviewability",
+      "private rankings",
+      "rankings",
       "score context",
       "scored output",
     ];