Severity: CRITICAL
Location: src/queue-intelligence.ts:43
Found via a full-system adversarial audit of the ORB review/scoring engine (2026-07-15) — 2 independent skeptic passes, both had to vote "confirmed" for this to survive.
Failure scenario
src/queue-intelligence.ts:43-71 defines FORBIDDEN_PUBLIC_COMMENT_WORDS (a flat substring wordlist) and :147-154 defines sanitizePublicComment(comment) which THROWS if any listed word/phrase is a substring of the text (case-insensitive). This is the SOLE public/private boundary for AI-review advisory notes and consensus-defect text: src/services/ai-review.ts:563-571 toPublicSafe() calls it inside a try/catch and returns the text UNMODIFIED (only markdown-neutralized, not scrubbed) whenever it does NOT throw; a throw just drops the whole string. It is also used directly (same import) in src/services/ai-summaries.ts, src/services/ai-chat-qa.ts, and src/review/enrichment-wire.ts. Compare the wordlist to the canonical vocabulary in src/signals/redaction.ts:23 (PUBLIC_UNSAFE_TERMS = ...cohort\w*...|miner[-_\s]?originated|human[-_\s]?originated|...|raw[-_\s]?trust|...): FORBIDDEN_PUBLIC_COMMENT_WORDS contains NO entry for 'cohort' at all, NO bare 'score' (only qualified phrases like 'estimated score', 'score preview', 'public score estimate'), and NO standalone 'miner-originated' / 'human-originated' / 'raw trust' (only the compound 'raw trust score'). A second, independently-maintained regex-replace sanitizer with the exact same gaps lives in src/github/commands.ts:1841-1867 (byte-identical to packages/loopover-engine/src/github/sanitize-public-comment.ts) and is used for @Loopover mention-command replies, chat-qa answers, and action-explanation help text. Concrete trigger: the maintainer AI-review's free-text model output (unconstrained natural language, explicitly documented at ai-review.ts:17-21 as gittensor-context-aware) contains a sentence like 'This diff looks miner-originated and the resulting cohort standing / score would only shift modestly.' Neither sanitizer throws or redacts any of 'miner-originated', 'cohort', or bare 'score' — toPublicSafe() returns the sentence essentially verbatim and it is posted as a real, public GitHub PR comment.
Impact
Leaks exactly the category of gittensor economic/identity signal (score, cohort, miner/human-originated flags, raw-trust language) that the canonical PUBLIC_UNSAFE_TERMS boundary (src/signals/redaction.ts) and the project's house rules (CLAUDE.md: 'no secrets/wallets/hotkeys/trust scores/reward values anywhere') exist to block. Because this happens on the AI-review/chat-qa/enrichment code paths specifically — the surfaces most likely to produce unconstrained, gittensor-aware language — the highest-risk text is the one going through the weakest filter. Existing tests (test/unit/queue-intelligence.test.ts:295-330) only assert against FORBIDDEN_PUBLIC_COMMENT_WORDS itself, so this gap is not caught by CI.
Severity: CRITICAL
Location:
src/queue-intelligence.ts:43Found via a full-system adversarial audit of the ORB review/scoring engine (2026-07-15) — 2 independent skeptic passes, both had to vote "confirmed" for this to survive.
Failure scenario
src/queue-intelligence.ts:43-71 defines FORBIDDEN_PUBLIC_COMMENT_WORDS (a flat substring wordlist) and :147-154 defines sanitizePublicComment(comment) which THROWS if any listed word/phrase is a substring of the text (case-insensitive). This is the SOLE public/private boundary for AI-review advisory notes and consensus-defect text: src/services/ai-review.ts:563-571 toPublicSafe() calls it inside a try/catch and returns the text UNMODIFIED (only markdown-neutralized, not scrubbed) whenever it does NOT throw; a throw just drops the whole string. It is also used directly (same import) in src/services/ai-summaries.ts, src/services/ai-chat-qa.ts, and src/review/enrichment-wire.ts. Compare the wordlist to the canonical vocabulary in src/signals/redaction.ts:23 (
PUBLIC_UNSAFE_TERMS = ...cohort\w*...|miner[-_\s]?originated|human[-_\s]?originated|...|raw[-_\s]?trust|...): FORBIDDEN_PUBLIC_COMMENT_WORDS contains NO entry for 'cohort' at all, NO bare 'score' (only qualified phrases like 'estimated score', 'score preview', 'public score estimate'), and NO standalone 'miner-originated' / 'human-originated' / 'raw trust' (only the compound 'raw trust score'). A second, independently-maintained regex-replace sanitizer with the exact same gaps lives in src/github/commands.ts:1841-1867 (byte-identical to packages/loopover-engine/src/github/sanitize-public-comment.ts) and is used for @Loopover mention-command replies, chat-qa answers, and action-explanation help text. Concrete trigger: the maintainer AI-review's free-text model output (unconstrained natural language, explicitly documented at ai-review.ts:17-21 as gittensor-context-aware) contains a sentence like 'This diff looks miner-originated and the resulting cohort standing / score would only shift modestly.' Neither sanitizer throws or redacts any of 'miner-originated', 'cohort', or bare 'score' — toPublicSafe() returns the sentence essentially verbatim and it is posted as a real, public GitHub PR comment.Impact
Leaks exactly the category of gittensor economic/identity signal (score, cohort, miner/human-originated flags, raw-trust language) that the canonical PUBLIC_UNSAFE_TERMS boundary (src/signals/redaction.ts) and the project's house rules (CLAUDE.md: 'no secrets/wallets/hotkeys/trust scores/reward values anywhere') exist to block. Because this happens on the AI-review/chat-qa/enrichment code paths specifically — the surfaces most likely to produce unconstrained, gittensor-aware language — the highest-risk text is the one going through the weakest filter. Existing tests (test/unit/queue-intelligence.test.ts:295-330) only assert against FORBIDDEN_PUBLIC_COMMENT_WORDS itself, so this gap is not caught by CI.