fix(scenarios): sync forbidden public-language regex across summary guards by philluiz2323 · Pull Request #8920 · JSONbored/loopover

philluiz2323 · 2026-07-26T13:29:04Z

Summary

Export a single FORBIDDEN_PUBLIC_LANGUAGE from input-model.ts (the Fix public scenario reward/ranking sanitization #913 term set including rewards? / estimated rewards / rankings?).
scenario-summary.ts now imports that shared constant instead of a stale private copy that missed those terms.
Export assertPublicSummaryClean and add a unit test proving bare rewards / rankings in headline/notes throw.

Closes #8885

Scope

The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Validation

git diff --check
npx vitest run test/unit/scenario-summary.test.ts (11 passed)
New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

Narrow src/scenarios + unit-test change; vitest covers the synced guard. Full monorepo typecheck/coverage not re-run locally.

Safety

No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
API/OpenAPI/MCP behavior is updated and tested where needed.
UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

N/A — backend/scenarios public-safety guard only; no UI surface change.

Notes

…uards scenario-summary.ts kept a stale copy of FORBIDDEN_PUBLIC_LANGUAGE that missed rewards/estimated rewards/rankings after JSONbored#913. Export one shared constant from input-model and cover assertPublicSummaryClean for those terms. Closes JSONbored#8885

superagent-security · 2026-07-26T13:29:45Z

Superagent didn't find any vulnerabilities or security issues in this PR.

codecov · 2026-07-26T13:36:20Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.61%. Comparing base (8a3d2c9) to head (09f6a8c).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8920      +/-   ##
==========================================
- Coverage   93.84%   90.61%   -3.24%     
==========================================
  Files         803       98     -705     
  Lines       80084    22625   -57459     
  Branches    24277     3926   -20351     
==========================================
- Hits        75157    20502   -54655     
+ Misses       3562     1945    -1617     
+ Partials     1365      178    -1187

Flag	Coverage Δ
backend	`100.00% <ø> (+4.86%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/scenarios/input-model.ts	`100.00% <ø> (ø)`
src/scenarios/scenario-summary.ts	`100.00% <ø> (ø)`

... and 705 files with indirect coverage changes

loopover-orb · 2026-07-26T13:39:50Z

Tip

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-26 13:40:06 UTC}

3 files · 1 AI reviewer · no blockers · readiness 93/100 · CI green · clean

✅ Suggested Action - Approve/Merge

safe to merge

Review summary
The AI review returned non-blocking notes for this change but did not include a separate narrative summary. Review the nits below before deciding this PR.

Nits — 4 non-blocking

input-model.ts:33 and scenario-summary.ts:135 still have two separate defensive guards (assertPublicScenarioSnapshotSafe and assertPublicSummaryClean) built on the same regex — worth a comment or shared helper noting they must both use the shared constant so this drift can't recur.
The v8 ignore comments were stripped from assertPublicSummaryClean in scenario-summary.ts:135-141 but left in place on the sibling guard in input-model.ts:213-219; confirm coverage tooling doesn't flag the newly-exercised branch inconsistently between the two guards.
Consider adding a lint rule or a single shared assertion helper (e.g. assertNoForbiddenPublicLanguage(serialized)) used by both guards in input-model.ts and scenario-summary.ts, so future changes to the term set only need to touch one place, not two v8-ignored call sites.
The PR could link Fix public scenario reward/ranking sanitization #913 directly in a comment near the FORBIDDEN_PUBLIC_LANGUAGE export for future readers, since the JSDoc references 'fix(scenarios): FORBIDDEN_PUBLIC_LANGUAGE sanitizer regex diverged between two parallel public-safety guards #8885 / Fix public scenario reward/ranking sanitization #913' but the original term-set issue number isn't otherwise documented in code.

Decision drivers

✅ Code review — No blockers (1 reviewer)
✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#8885
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 987 registered-repo PR(s), 565 merged, 125 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	philluiz2323; Gittensor profile; 987 PR(s), 125 issue(s).
Improvement	✅ Minor	risk: clean · value: minor · LLM: moderate

Review context

Author: philluiz2323
Role context: outside_contributor
Public audience mode: oss maintainer
Lane context: Repository is configured for direct PR review.
Public profile languages: Python, JavaScript, MDX, TypeScript, CSS, Cuda, HTML, Kotlin
Official Gittensor activity: 987 PR(s), 125 issue(s).
PR-specific overlap: none found.

Contributor next steps

Start here: Triage stale or unlinked PRs.

Signal definitions

Related work = same linked issue, overlapping active PRs, or title/path similarity.
Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

@loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
@loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

Re-run LoopOver review

loopover-orb

LoopOver approves — the gate is satisfied and CI is green.

philluiz2323 requested a review from JSONbored as a code owner July 26, 2026 13:29

loopover-orb Bot added the gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier. label Jul 26, 2026

loopover-orb Bot assigned philluiz2323 Jul 26, 2026

loopover-orb Bot approved these changes Jul 26, 2026

View reviewed changes

loopover-orb Bot merged commit 64383b5 into JSONbored:main Jul 26, 2026
8 checks passed

github-actions Bot mentioned this pull request Jul 27, 2026

chore(release): cut orb-v3.5.0 #9419

Merged

Navigation Menu

Uh oh!

fix(scenarios): sync forbidden public-language regex across summary guards - #8920

fix(scenarios): sync forbidden public-language regex across summary guards#8920
loopover-orb[bot] merged 1 commit into
JSONbored:mainfrom
philluiz2323:fix/8885-sync-forbidden-public-language

philluiz2323 commented Jul 26, 2026

Uh oh!

superagent-security Bot commented Jul 26, 2026

Uh oh!

codecov Bot commented Jul 26, 2026 •

edited

Loading

Uh oh!

loopover-orb Bot commented Jul 26, 2026 •

edited

Loading

✅ LoopOver review result - approve/merge recommended

Uh oh!

loopover-orb Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

philluiz2323 commented Jul 26, 2026

Summary

Scope

Validation

Safety

UI Evidence

Notes

Uh oh!

superagent-security Bot commented Jul 26, 2026

Uh oh!

codecov Bot commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

loopover-orb Bot commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ LoopOver review result - approve/merge recommended

Uh oh!

loopover-orb Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

codecov Bot commented Jul 26, 2026 •

edited

Loading

loopover-orb Bot commented Jul 26, 2026 •

edited

Loading