refactor(signals): shared public-safe redaction module (#542)

[JSONbored]

What

Closes #542. Lift the private isPublicSafeText out of src/signals/local-branch.ts into a shared src/signals/redaction.ts, so every public surface (PR/issue comments, check annotations, notifications, badge, extension payloads, slop/advisory reasons) filters through one canonical regex instead of re-deriving its own and drifting.

How

• New src/signals/redaction.ts exports isPublicSafeText + a reusable PUBLIC_UNSAFE_PATTERN constant. The regex is byte-for-byte identical to the old in-file one and intentionally non-global, so .test() stays stateless (no lastIndex carry-over).
• local-branch.ts imports it; its 8 call sites are unchanged. No behavior change — the existing local-branch redaction tests stay green.
• New test/unit/redaction.test.ts exercises the boundary directly: economic/identity signals (reward/score/wallet/hotkey/coldkey/mnemonic/farming/payout/ranking/raw-trust/trust-score/reviewability) and local filesystem paths are rejected; clean text is accepted; and a guard asserts the pattern is non-global (stateless).

Scope note

Per the issue, this updates the single importer (local-branch.ts) with no call-site behavior change. Three service modules (pr-body-draft.ts, agent-action-explanation-card.ts, miner-dashboard-recommendations.ts) carry their own related — but not identical (gi-global, different alternations) — redaction patterns; consolidating those onto PUBLIC_UNSAFE_PATTERN is deliberately left as follow-up to avoid a behavior change here.

Verification

• typecheck ✅ · test:coverage ✅ (1849 passed; branches 97.04%, all metrics ≥97) · git diff --check ✅ · ui:openapi:check ✅

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#743 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[ghost]

gittensory · advisory review

Reviewed 3 changed file(s) — two independent AI reviewers.

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
This PR introduces a shared redaction module that centralizes public‑safe text validation, removes the duplicated regex implementation from local‑branch, and adds comprehensive unit tests.

Suggestions

• Consider adding a comment in the module about the intended usage locations to aid future developers.
• Verify that all existing call sites of isPublicSafeText now correctly reference the imported function after the removal of the local definition.

Worth double-checking

• If any file still relied on the now‑removed local version without importing the new module, it could cause a compile error.
• The regex may inadvertently flag legitimate public text containing the word "score" in unrelated contexts; monitor for false positives.

Reviewer B · nemotron-3-120b-a12b — recommends ✅ merge
The PR introduces a shared redaction module to centralize the public/private boundary logic, replacing a duplicate function in src/signals/local-branch.ts with an import from the new module. The change is a pure refactor with identical behavior, adding comprehensive unit tests. It strengthens maintainability without altering functionality or risking the public/private invariant.

No blocking issues spotted.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.