fix(signals): catch plural private terms in the public-safe comment backstop

[minion1227]

Summary

• containsPrivatePublicTerm (src/signals/engine.ts) is the fail-safe public-safe backstop that drops a public-comment line if it still names private reward/wallet/trust internals. It is the sole gate at four public-surface call sites — publicSafeNextSteps, publicSafePreflightFindings, the inline next-steps filter in buildPublicPrIntelligenceComment, and buildPublicCommentSignalBundle — with no scrub step before it (unlike src/review/unified-comment-bridge.ts, whose byte-identical PRIVATE_DROP_TERMS is safe only because publicSafeNit first scrubs with the plural-aware PRIVATE_FORBIDDEN_TERMS).
• The denylist wrapped bare-singular terms in word boundaries, so plural forms slipped through: reward matched but rewards did not — likewise payouts, wallets, hotkeys, trust scores, estimated scores. A finding/step whose text used a plural (e.g. a title "Quarterly rewards summary") therefore passed the backstop and could surface on a public GitHub PR comment.
• Fix: add the s? plural form to the pluralizable terms, matching the intent already established by every sibling denylist — CHECK_RUN_FORBIDDEN_TERMS (src/rules/advisory.ts), PRIVATE_FORBIDDEN_TERMS (src/review/unified-comment-bridge.ts), and FORBIDDEN_PUBLIC_COMMENT_WORDS (src/queue-intelligence.ts), which all use rewards? / wallets? / trust\s+scores?. Purely additive: every input matched before still matches; plurals now match too.
• No issue linked: this is a small, self-evident correctness fix to an existing sanitizer boundary, kept narrow (one regex line + a regression test). The repo's linkedIssuePolicy is preferred (not required) and issueDiscoveryPolicy is discouraged, so a direct PR with this rationale is the intended path rather than filing a discovery issue.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥97% coverage of the lines AND branches you changed (aim for 98%+ on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• None skipped. (The full suite passes with adequate per-test time; the changed line is covered by the added regression test plus existing public-comment suites.)

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics. (This PR strengthens that guarantee — it closes a plural-form leak in the public-comment backstop.)
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A — no auth/session/CORS surface; this is the public/private sanitizer boundary, covered by the added sanitizer-boundary regression test.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (N/A — no API/OpenAPI/MCP shape change.)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (N/A — no UI change.)
• Visible UI changes include a UI Evidence section below. (N/A — backend-only, no visible change.)
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

N/A — backend-only change to a sanitizer regex; no visible UI, frontend, docs, or extension change.

Notes

• Regression test (test/unit/signals-coverage.test.ts): builds the public comment signal bundle with a finding whose title carries each plural private term and asserts none survive into publicFindingTitles; a singular-form control pins that the fix does not regress the cases already caught. Verified the test fails on the pre-fix regex (the plural leaks) and passes after the fix.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Important

Gittensory found maintainer review notes

Scoped related-work signals were found for this PR. They are advisory unless the gate reports a blocker.

Readiness score: 48/100

Signal	Result	Evidence	Action
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.	Explain no-issue PR.
Related work	⚠️ 1 scoped overlap	Top overlaps are listed below; lower-confidence bulk is hidden.	Review top overlaps.
Review load	❌ 8/20	Readiness component derived from cached public PR metadata and labels; size label size:XS.	Add scope summary.
Validation evidence	❌ 5/25	Cached preflight status is hold.	Fix blocker.
Open PR queue	❌ 3/10	39 open PR(s), 12 likely reviewable, 27 unlinked.	Expect slower review.
Contributor context	✅ Confirmed Gittensor contributor	minion1227; Gittensor profile; 24 PR(s), 0 issue(s).	No action.
Gate result	⚠️ Advisory only	Advisory only.	No action.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Review load = cached public PR metadata such as size labels, changed paths, and preflight status.
• Open PR queue = repo-wide review pressure; it is not a PR quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

Review context

• Author: minion1227
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 24 PR(s), 0 issue(s).
• Related work: Titles/paths share 7 meaningful terms. (PR #1387, PR #1389)

Maintainer notes

• Repo lane is not ready for a confident recommendation: Repository registration is not available in the local Gittensory cache.
• No linked issue detected: The planned PR does not reference a closing issue or explicit linked issue number.
• Possible duplicate or overlapping work: 1 related open work cluster(s) were detected.

Contributor next steps

• Explain no-issue PR.
• Review top overlaps.
• Add scope summary.
• Fix blocker.
• Expect slower review.
• Refresh registry data or choose a registered active repo.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.
• Check active issues and PRs before submitting.

• Re-run Gittensory review

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.37%. Comparing base (314ad9d) to head (d0a2f29).
⚠️ Report is 5 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1380   +/-   ##
=======================================
  Coverage   95.37%   95.37%           
=======================================
  Files         192      192           
  Lines       20852    20852           
  Branches     7540     7540           
=======================================
  Hits        19887    19887           
  Misses        383      383           
  Partials      582      582           

Files with missing lines	Coverage Δ
src/signals/engine.ts	97.06% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[JSONbored]

Closing this, and I want to be transparent about why.

This account is permanently blocked from contributing to our repositories — for plagiarism. You filed two PRs that were copies of another contributor's open work, submitted as your own to claim the credit:

• #1377 was an identical copy of kiannidev's #1376 (same source changes, tests only reworded to disguise the lift), filed ~90 minutes later against the same issue.
• #1378 was a byte-identical copy of kiannidev's #1373, filed ~2 hours later against the same issue.

Lifting another contributor's diff is a hard line for us, not a warning-track offense — that's two strikes. Our Code of Conduct now states it plainly: plagiarism and reward-farming result in a permanent block from contributing, across JSONbored/gittensory, JSONbored/metagraphed, and JSONbored/awesome-claude.

For the record, this particular change — the plural-term backstop in containsPrivatePublicTerm — read as genuine, original work, and I'm not disputing the code. But the block is on the account, not the diff, so it doesn't get a merit review. Closed and labeled slop as enforcement of the ban. This decision is final.