fix(slop): fully gate the AI slop advisory on confirmed contributor (free + BYOK)

[JSONbored]

What

Closes a cost/abuse vector in the AI-assisted slop advisory (#724/#728): it was being invoked for any PR author when slopGateMode != off and slopAiAdvisory was enabled, letting an unconfirmed/untrusted author spend both the shared free Workers AI neuron budget and the maintainer-paid BYOK quota. The AI review path (runAiReviewForAdvisory) already no-ops for unconfirmed authors; this brings the slop path in line.

How

• runAiSlopForAdvisory now returns early when !confirmedContributor (matching the AI review path exactly): no AI spend — free OR BYOK — on a PR from an unconfirmed author. The deterministic slop core still runs for everyone; only the paid AI layer is gated. Fail-closed — if the contributor can't be confirmed, no AI runs.
• confirmedContributor is computed before the slop block (the official detection + confirmation now runs ahead of the AI slop call), so the gate is enforced before any AI invocation.
• The BYOK key lookup no longer needs its own && confirmedContributor guard — the early return guarantees it.

Scope note (supersedes #727 and #739)

• fix: gate BYOK slop advisory by contributor #739 is a byte-identical duplicate of this PR (same Codex task) → closed.
• fix: gate AI slop advisory to confirmed contributors #727 independently spotted the same vector and took the full-gate approach on a pre-BYOK base (it would have regressed feat(slop): BYOK frontier model for the AI slop advisory #728). This PR adopts fix: gate AI slop advisory to confirmed contributors #727's full-gate insight while preserving the BYOK integration → fix: gate AI slop advisory to confirmed contributors #727 closed as superseded.
• Deliberately did NOT adopt fix: gate AI slop advisory to confirmed contributors #727's neuron-budget bump (1 → 6): the AI review path estimates by logical free-call count, not worst-case retries (runWorkersOpinion/runWorkersSlopOpinion retry internally but count as one logical call). A 6× reservation would be inconsistent with that convention and would over-reserve the daily budget, causing premature quota_exceeded.

Verification

• typecheck ✅ · test:coverage ✅ (1836 passed; branches 97.02%, all metrics ≥97) · git diff --check ✅ · test:workers ✅
• test/unit/ai-slop.test.ts: confirmed contributors still get the advisory (free + BYOK paths); an unconfirmed contributor now triggers a complete no-op (neither BYOK fetch nor Workers AI; no finding) — matching the AI review path.

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#737 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

gittensory · advisory review

Reviewed 2 changed file(s) — two independent AI reviewers.

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
The PR adds a confirmed‑contributor gate to the AI slop advisory, preventing AI spend for unconfirmed authors, and updates related call sites and tests accordingly. The changes are well‑scoped, compile‑time safe, and include comprehensive tests.

Suggestions

• Update the JSDoc/comments for runAiSlopForAdvisory to document the new confirmedContributor flag.
• Run the full TypeScript build to ensure no other call sites miss the new argument.
• Consider adding a unit test for the case where confirmedContributor is true but the BYOK key is missing, to verify graceful fallback.

Worth double-checking

• Potential missed call sites elsewhere in the codebase that still use the old function signature.
• Ensuring the early‑return logic does not unintentionally skip necessary deterministic slop processing.

Reviewer B · nemotron-3-120b-a12b — recommends ✅ merge
The PR adds a confirmed-contributor gate to the AI slop advisory function, preventing unconfirmed PR authors from consuming AI resources (free Workers AI or paid BYOK). It moves the contributor confirmation check earlier in the gate logic and updates the function signature and tests accordingly. The change is small, focused, and consistent with the existing AI review advisory gate.

No blocking issues spotted.