Skip to content

fix(api): scrub public subnet descriptor wording - #904

Merged
JSONbored merged 1 commit into
mainfrom
codex/fix-vulnerability-in-public-descriptor
Jun 19, 2026
Merged

fix(api): scrub public subnet descriptor wording#904
JSONbored merged 1 commit into
mainfrom
codex/fix-vulnerability-in-public-descriptor

Conversation

@JSONbored

Copy link
Copy Markdown
Owner

Motivation

  • The unauthenticated /v1/public/subnet-interface descriptor exposed scoring/ranking language (e.g. rank, earn, scoring multiplier) which violates the project's public-safety policy and can enable gaming.
  • The descriptor was returned directly without sanitization and is reachable anonymously, so sensitive contribution-mechanics wording must be removed from any public surface.
  • The change keeps the descriptor usable for discovery while removing reward/scoreability signal words from public metadata.

Description

  • Reworded curated MCP tool summaries in src/services/subnet-interface.ts to remove ranking/scoring/multiplier mechanics and replace them with neutral, public-safe descriptions.
  • Reworded the provider summary in src/services/subnet-interface.ts to avoid miner/deterministic-signal phrasing on the public surface.
  • Tightened the unit test in test/unit/subnet-interface.test.ts to assert the descriptor JSON does not match the additional scoring/ranking terms reported by the scan.
  • Changes are minimal text edits and keep the original descriptor shape and endpoints intact.

Testing

  • Ran the targeted unit and integration checks with npm test -- --run test/unit/subnet-interface.test.ts test/integration/subnet-interface.test.ts, and the test run completed successfully with all tests passing.
  • The updated buildSubnetInterfaceDescriptor unit test validates normalization and the absence of the disallowed scoring/ranking terms.

Codex Task

@ghost

ghost commented Jun 18, 2026

Copy link
Copy Markdown

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal Result Evidence Action
Gate result ⚠️ Skipped #904 is no longer open. No action.

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

@ghost ghost added the gittensory:reviewed label Jun 18, 2026
@superagent-security

Copy link
Copy Markdown
Contributor

Superagent didn't find any vulnerabilities or security issues in this PR.

@codecov

codecov Bot commented Jun 18, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.71%. Comparing base (5d9d73a) to head (333bd6f).

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #904   +/-   ##
=======================================
  Coverage   96.71%   96.71%           
=======================================
  Files         108      108           
  Lines       14641    14641           
  Branches     5298     5298           
=======================================
  Hits        14160    14160           
  Misses        102      102           
  Partials      379      379           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@ghost

ghost commented Jun 18, 2026

Copy link
Copy Markdown

gittensory · advisory review

Reviewed 2 changed file(s) — two independent AI reviewers.

Changed files: src/services/subnet-interface.ts, test/unit/subnet-interface.test.ts

Suggested action:Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
The PR updates several public-facing descriptor strings to remove private context/score language and adds a stricter test ensuring those terms are absent, aligning with the public/private sanitizer policy.

Suggestions

  • Consider adding a comment in the test explaining why the extra terms (earn, scoring, multiplier, etc.) are being checked to aid future maintainers.
  • Verify that any UI components rendering these tool summaries still fit within design constraints after wording changes.

Worth double-checking

  • Potential UI layout changes due to longer/shorter summary texts.
  • Ensure no other parts of the system rely on the previous wording for logic or matching.

Reviewer B · mistral-small-3.1-24b-instruct — recommends ✅ merge
This PR updates the public-facing wording of the Gittensory subnet descriptor to avoid forbidden terms and improve clarity. The changes are minimal and focused, adhering to the project's guidelines.

Suggestions

  • Consider adding a brief note in the PR description explaining the rationale behind the specific wording changes, especially for terms like 'earn' and 'multiplier'.
  • Ensure that the updated wording is consistent with the overall messaging and branding of the project.

Worth double-checking

  • Verify that the updated wording does not inadvertently introduce any new forbidden terms or weaken the public/private boundary.
  • Check that the changes do not affect the determinism or fairness of the contribution analysis.

@JSONbored
JSONbored merged commit 8edc2dc into main Jun 19, 2026
20 checks passed
@JSONbored
JSONbored deleted the codex/fix-vulnerability-in-public-descriptor branch June 19, 2026 05:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant