feat(miner-discovery-plane): add anonymized telemetry event schema for the hosted plane (#4301)

[davion-knight]

Adds packages/gittensory-engine/src/miner-telemetry.ts — the typed, pure schema/validator for the optional hosted discovery-index service's (#4250) telemetry, so that shared service can be operated and debugged without ever holding source, diffs, or credentials.

Design

• Fixed fail-closed vocabularies (mirrors governor-ledger.ts): MINER_TELEMETRY_EVENT_TYPES (query issued, candidates returned, soft-claim attempted/succeeded/collided) and MINER_TELEMETRY_OUTCOME_BUCKETS — an unknown value throws rather than silently recording malformed data.
• Anonymization posture copied from orb-collector.ts (the one shipped precedent): repoHash/issueHash are the exporter's per-instance HMAC hashes, never a raw owner/repo; free-text-adjacent fields collapse to a fixed low-cardinality outcome bucket; metrics is count-only.
• Anti-leak guards in normalizeMinerTelemetryEvent: rejects a hash that looks like a raw identifier (contains / or whitespace), and rejects any non-finite-number metric — so no de-anonymizing or free-text data can slip onto the wire.
• NEVER INCLUDED inventory documented in the header (no source, diffs, tokens, full bodies, commit SHAs, or raw identifiers), matching orb-collector.ts's style.
• Schema/types only, per the issue: no exporter, no HMAC execution (that's feat(discovery-plane): stand up the hosted discovery-index server #4250's boundary), no endpoint wiring. Re-exported from the package barrel.

Tests

test/unit/miner-telemetry.test.ts: frozen vocabularies, a full normalize round-trip, absent/null identifier defaulting, fail-closed on unknown type/outcome + non-object, the anti-leak guard (raw owner/repo, whitespace, non-string, empty), metric validation (non-number/NaN/array/null), and barrel re-export. 100% branch coverage on the new file; typecheck clean; the engine's own suite (321 tests) and the engine-parity drift-check are green.

Closes #4301

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.95%. Comparing base (fb7b5c7) to head (2992b1e).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4438   +/-   ##
=======================================
  Coverage   93.95%   93.95%           
=======================================
  Files         412      413    +1     
  Lines       37212    37233   +21     
  Branches    13591    13602   +11     
=======================================
+ Hits        34963    34984   +21     
  Misses       1594     1594           
  Partials      655      655           

Files with missing lines	Coverage Δ
packages/gittensory-engine/src/miner-telemetry.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review result - approve/merge recommended

_{Review updated: 2026-07-09 18:56:28 UTC}

3 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
Adds a pure, side-effect-free schema/validator module (miner-telemetry.ts) for an optional future hosted telemetry service, closely mirroring the existing governor-ledger.ts fail-closed-vocabulary pattern and orb-collector.ts's anonymization posture (HMAC-hash identifiers, bucketed outcomes, count-only metrics). The validation logic is correct: normalizeOptionalHash correctly rejects raw owner/repo-shaped or whitespace-containing values, normalizeMetrics correctly rejects non-finite/non-numeric values and arrays, and eventType/outcome are checked against frozen Set vocabularies after trimming. No DB/schema change accompanies this (pure TS types + validator), so no migration is needed, and the module intentionally does no HMAC execution or endpoint wiring, matching the stated issue boundary (#4301 schema vs #4250 exporter). Tests exercise the round-trip, defaulting, fail-closed paths, the anti-leak guard, metric validation, and the barrel re-export, consistent with the claimed 100% branch coverage on the new file.

Nits — 4 non-blocking

• orb-collector.ts's anti-leak precedent doesn't reject a hash that happens to look like a bare numeric issue number (e.g. "12") passed as repoHash — worth confirming the exporter side (feat(discovery-plane): stand up the hosted discovery-index server #4250) never accidentally passes an un-hashed short numeric ID through repoHash/issueHash, since this validator's `/` and whitespace check wouldn't catch that.
• Consider validating a minimum/maximum length on repoHash/issueHash (e.g. reject empty-after-trim also catches accidental single-char values) — currently any non-empty, no-slash, no-whitespace string passes, so a caller could pass a real short raw token in error and it would sail through.
• The header comment inventory ('NEVER INCLUDED') is documentation-only and not enforced by any runtime check beyond the fields the type permits — fine for schema/types-only scope, but worth a one-line note in the PR description that enforcement is deferred to the feat(discovery-plane): stand up the hosted discovery-index server #4250 exporter boundary (largely already stated, so this is a very minor point).
• No changes required to merge as-is; the module is narrow, well-tested, and consistent with established conventions in this repo (governor-ledger.ts, orb-collector.ts).

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#4301
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 83 registered-repo PR(s), 48 merged, 3 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	davion-knight; Gittensor profile; 83 PR(s), 3 issue(s).
Gate result	✅ Passing	No configured blocker found.

Linked issue satisfaction

Addressed
The PR adds a pure, typed MinerTelemetryEvent schema in the engine package with the exact discovery-plane event types the issue asks for (query issued, candidates returned, soft-claim attempted/succeeded/collided), a bucketed outcome vocabulary mirroring bucketReasonCode, opaque repoHash/issueHash fields with anti-leak guards consistent with the orb-collector HMAC-hash posture, and an explicit 'ne

Review context

• Author: davion-knight
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 83 PR(s), 3 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.