fix(services): catch the plural "rankings" in remediation-plan's forbidden-word gate

[kai392]

Summary

FORBIDDEN_PATTERN in remediation-plan.ts matched only the bare singular ranking. Because the
trailing \b can never sit between "g" and "s", the pattern could never match inside "rankings", so
the plural slipped past this secondary public-safety gate (FORBIDDEN_PATTERN.test("...the rankings of...") returned false).

• Changes ranking to rankings?, matching the sibling regex fix already applied in input-model.ts (Fix public scenario reward/ranking sanitization #913).
• Exports FORBIDDEN_PATTERN so its forbidden-term coverage can be asserted directly — the term is
  unreachable through the public builder because sanitizePublicComment rewrites it before this gate
  is consulted, exactly how the issue itself verified the gap.

Test plan

• New: FORBIDDEN_PATTERN matches both ranking and rankings, and a benign prefix ("rankboard") still passes
• Non-vacuity verified: reverting rankings? → ranking makes the plural assertion fail
• npx vitest run test/unit/remediation-plan.test.ts — 17/17 pass; tsc --noEmit clean

Closes #8886

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.57%. Comparing base (8a3d2c9) to head (75cfd87).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8913      +/-   ##
==========================================
- Coverage   93.84%   90.57%   -3.28%     
==========================================
  Files         803       97     -706     
  Lines       80084    22548   -57536     
  Branches    24277     3907   -20370     
==========================================
- Hits        75157    20422   -54735     
+ Misses       3562     1946    -1616     
+ Partials     1365      180    -1185     

Flag	Coverage Δ
backend	94.82% <100.00%> (-0.31%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/services/remediation-plan.ts	94.82% <100.00%> (ø)

... and 706 files with indirect coverage changes

[loopover-orb]

Tip

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-26 13:35:52 UTC}

2 files · 1 AI reviewer · no blockers · readiness 95/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
The AI review returned non-blocking notes for this change but did not include a separate narrative summary. Review the nits below before deciding this PR.

Nits — 1 non-blocking

• src/services/remediation-plan.ts:37-39 — the 3-line comment above `FORBIDDEN_PATTERN` is fairly verbose for a one-word regex change; a shorter inline note referencing fix(services): remediation-plan.ts's forbidden-word regex fails to catch the plural "rankings" #8886 would suffice.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#8886
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 133 registered-repo PR(s), 66 merged, 6 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	kai392; Gittensor profile; 133 PR(s), 6 issue(s).
Improvement	✅ Minor	risk: clean · value: minor · LLM: minor

Review context

• Author: kai392
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, Cuda, JavaScript, Kotlin, Perl, TypeScript, Vue
• Official Gittensor activity: 133 PR(s), 6 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Start here: Triage stale or unlinked PRs.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.