feat(signals): add slop path matchers and non-substantive-padding signal (#561)

[Crystora]

Summary

• Add pure, deterministic path matchers in src/signals/path-matchers.ts (siblings to isTestFile): isGeneratedFile, isVendoredFile, isLockfile, isMinifiedFile, isDocsFile, isDependencyManifestFile, plus an isNonSubstantivePaddingFile composite and a single-category classifyChangedFile.
• Add a deterministic slop signal non_substantive_padding: fires when a high-churn diff is dominated by generated/vendored/minified output (files that carry code extensions and so slip past trivialWhitespaceChurn) while genuine source/test effort is negligible.
• Keep it false-positive-averse: lockfiles, dependency manifests, and docs are recognized but never counted as padding, so dependency bumps and docs-only PRs cannot trip it. Complementary to trivialWhitespaceChurn (no double-count).

Closes #561

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; global coverage stays at or above 97% for lines, statements, functions, and branches (aim for 98%+ branch coverage locally so CI variance does not fail near the threshold)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

npm run test:ci passes end to end. Coverage (src/**): statements 98.65%, branches 97.05%, functions 97.05%, lines 99.27% (all ≥ 97%). npm audit reports 0 vulnerabilities. New code is fully covered: src/signals/path-matchers.ts is 100% statements/branches; the new slop.ts branches are covered by test/unit/path-matchers.test.ts and the added cases in test/unit/slop.test.ts.

If any required check was skipped, explain why:

• None. The full npm run test:ci gate was run locally and passed.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics. The finding's detail/publicText interpolate only integer line counts, so the text is public-safe by construction; a unit test asserts the output contains no forbidden public terms.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. N/A — no auth/cookie/CORS/GitHub App/Cloudflare/session changes.
• API/OpenAPI/MCP behavior is updated and tested where needed. N/A — pure deterministic signal logic; no API/OpenAPI/MCP contract change (ui:openapi:check clean).
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. N/A — no UI changes.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository. N/A — no visible UI, frontend, docs, or extension changes.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. N/A — no docs/changelog changes (the in-code SLOP_RUBRIC_MARKDOWN signal list is updated to include the new signal).

UI Evidence

Not applicable — this change is backend signal logic only (src/signals/), with no visible UI, frontend, docs, or extension surface.

Notes

• No database migration and no schema/OpenAPI change. The signal derives entirely from the existing SlopAssessmentInput.changedFiles.
• The new signal is deterministic and high-precision (the only slop input allowed to gate): it requires high churn, padding dominance (≥50% of churned lines), and negligible substantive source/test (≤15%) before firing.
• Files changed (4, +444/−1): src/signals/path-matchers.ts (new matchers + classifier), src/signals/slop.ts (new signal + weight + rubric, wired into buildSlopAssessment), test/unit/path-matchers.test.ts (new), test/unit/slop.test.ts (added padding-signal cases).

[ghost]

gittensory · advisory review

Reviewed 4 changed file(s) — two independent AI reviewers.

Changed files: src/signals/path-matchers.ts, src/signals/slop.ts, test/unit/path-matchers.test.ts, test/unit/slop.test.ts

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
The PR adds comprehensive path‑matching utilities and a new slop signal to detect diffs padded with generated, vendored, or minified files, with full test coverage. The implementation is deterministic, respects the public/private sanitizer, and integrates cleanly into the existing slop assessment pipeline.

Suggestions

• Update the comment above SLOP_WEIGHTS to reflect the new total weight (now 105) for clarity.
• Consider adding a test case where padding dominates but substantive source exceeds the 15% threshold to verify the guard works as intended.

Worth double-checking

• Ensure no other parts of the system rely on the previous total weight of SLOP_WEIGHTS; the change to 105 should not affect any hard‑coded expectations.
• Verify that the new import of classifyChangedFile does not introduce circular dependencies in future changes.

Reviewer B · nemotron-3-120b-a12b — recommends ✅ merge
The PR adds a new deterministic signal for detecting non-substantive padding (generated/vendored/minified files) in pull requests. It includes path matchers, classification logic, and integrates the signal into the slop assessment with appropriate thresholds. The implementation is well-tested, respects the public/private boundary (no forbidden terms in public output), and follows existing patterns.

No blocking issues spotted.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#752 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[JSONbored]

PR #752 — feat(signals): add slop path matchers and non-substantive-padding signal (#561)
Author: bittoby | CI: Fail

Highlights:

• Exactly a deterministic, side-effect-free signal builder (src/signals/path-matchers.ts), not noise.
• High-precision: fires only on high churn (≥40 lines) AND padding dominance (≥50%) AND negligible substantive source/test (≤15%). False-positive-averse.
• Excludes lockfiles/dependency manifests/docs so dep bumps and docs-only PRs can't trip it; no double-count with trivialWhitespaceChurn (tested).
• Public-safe: interpolates only integer counts; forbidden-language regex test passes. Coverage 98.65% stmts / 97.05% branches. Conventional title, linked #561.

Notes / before merge:

• mergeable_state: blocked = fix failing CI (test coverage below threshold).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.74%. Comparing base (bf451b0) to head (2fb3210).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #752      +/-   ##
==========================================
+ Coverage   96.73%   96.74%   +0.01%     
==========================================
  Files          94       95       +1     
  Lines       13851    13905      +54     
  Branches     5051     5075      +24     
==========================================
+ Hits        13399    13453      +54     
  Misses         86       86              
  Partials      366      366              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Crystora]

@JSONbored Fixed all CI testing errors.

[JSONbored]

PR #752 — feat(signals): add slop path matchers and non-substantive-padding signal (#561)
Verdict: MERGE
Resolves issue #561: FULLY
CI: Green (lint, test 1/2, workers, security, changes; ui in_progress, no failures). No migration/schema/OpenAPI change.

Highlights:

• Exactly the ask: pure deterministic path matchers in src/signals/path-matchers.ts (isGeneratedFile/isVendoredFile/isLockfile/isMinifiedFile/isDocsFile/isDependencyManifestFile) + single-category classifyChangedFile, siblings to isTestFile.
• New non_substantive_padding signal is false-positive-averse: requires high churn, >=50% padding dominance, and <=15% substantive before firing; lockfiles/manifests/docs recognized but never counted as padding, so dependency bumps and docs-only PRs can't trip it. Complementary to trivialWhitespaceChurn (no double-count).
• Thorough tests (categories, case/separator normalization, defensive null/undefined, precedence; fire/no-fire, threshold edges, public-safety). Finding text interpolates only integer counts.

Concerns / required changes:

• None.

Completeness vs issue: Fully resolves #561 — each matcher classifies representative paths correctly with deterministic public-safe output and >=97% coverage on new code, no scope creep or migration.