fix(ai-review): restrict BYOK to confirmed contributors

[JSONbored]

Motivation

• An oss-anti-slop/block change allowed unconfirmed PR authors to enter the AI review path while still decrypting and using the maintainer BYOK provider key, which lets untrusted contributors consume BYOK quota and provider billing.
• The intent is to keep the free blocking Workers-AI review available for any author under oss-anti-slop while preventing unconfirmed contributors from using maintainer-paid BYOK resources.

Description

• Change runAiReviewForAdvisory in src/queue/processors.ts so the repository BYOK key is only decrypted/used when args.confirmedContributor is true and aiReviewByok is enabled. (Only confirmed contributors may trigger BYOK provider calls.)
• Preserve the existing oss-anti-slop behavior so unconfirmed authors can still run the free blocking consensus review (Workers AI) without access to maintainer BYOK keys.
• Add a regression test does not use the maintainer's BYOK key for non-confirmed oss-anti-slop blocking reviews in test/unit/ai-review-advisory.test.ts to assert that unconfirmed oss-anti-slop block reviews call Workers AI and do not invoke the BYOK provider.

Testing

• Ran the focused unit tests with npm test -- --run test/unit/ai-review-advisory.test.ts and the test file passed (all tests in that file succeeded).
• Ran the TypeScript check with npm run typecheck (tsc --noEmit) and it completed without errors.
• Verified repository checks with git diff --check and there were no whitespace/check failures.

---

Codex Task

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#921 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

gittensory · advisory review

Reviewed 2 changed file(s) — two independent AI reviewers.

Changed files: src/queue/processors.ts, test/unit/ai-review-advisory.test.ts

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
The PR tightens BYOK usage to only confirmed contributors, updating the AI review processor and adding a test to verify the fallback behavior for non‑confirmed contributors. The change is small, well‑scoped, and includes appropriate test coverage.

Suggestions

• Add a brief comment explaining why BYOK is restricted to confirmed contributors for future maintainers.
• Consider adding a test case for the scenario where BYOK is enabled but the maintainer has no stored key, to explicitly verify the fallback path.

Worth double-checking

• Existing workflows that relied on BYOK for non‑confirmed contributors will now fall back to free Workers AI; ensure this aligns with product expectations.
• Make sure the early‑return logic still correctly handles other gate configurations.

Reviewer B · nemotron-3-120b-a12b — recommends ✅ merge
The PR restricts BYOK key usage to confirmed contributors only by adding a condition that requires both args.confirmedContributor and args.settings.aiReviewByok to be true before decrypting and using the maintainer's provider key. A new test verifies that non-confirmed contributors fall back to Workers AI even when BYOK is enabled and the setting is for oss-anti-slop blocking. The change is small, well-tested, and maintains the public/private boundary as the BYOK key is never exposed in public output.

No blocking issues spotted.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.62%. Comparing base (f023e56) to head (642693d).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #921   +/-   ##
=======================================
  Coverage   96.62%   96.62%           
=======================================
  Files         109      109           
  Lines       14885    14885           
  Branches     5381     5381           
=======================================
  Hits        14382    14382           
  Misses        104      104           
  Partials      399      399           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.