refactor(engine): extract shared telemetry-anonymization primitive

[JSONbored]

Summary

• Orb's self-host collector (src/selfhost/orb-collector.ts) hand-rolled its own per-instance-secret HMAC anonymization with no reusable module.
• AMS is about to need the identical pattern to safely export its own telemetry (Wire AMS's dead orb-export.js telemetry stub to a real central ingest endpoint #5681) -- extracting it now means one implementation instead of two independently-maintained copies of the same security-sensitive logic.
• New packages/gittensory-engine/src/telemetry/anonymize.ts exports generateAnonSecret/hmacAnonymize (pure, no I/O); orb-collector.ts re-wired onto it with a fixed-vector regression test asserting identical output to the pre-extraction implementation.

Test plan

• npm run build --workspace @loopover/engine clean
• Engine's own node:test suite: 550/550 pass
• npx tsc --noEmit --incremental false clean
• Root vitest: test/unit/engine-telemetry-anonymize.test.ts + test/unit/selfhost-orb-collector.test.ts (21/21 pass, confirms zero behavior change to Orb's live export)
• npm run test:coverage (unsharded): both changed files at 100% line/branch/function coverage per coverage/lcov.info

Closes #5680

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	loopover-ui	85c798a	Commit Preview URL Branch Preview URL	Jul 14 2026, 02:28 AM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.04%. Comparing base (ebb540d) to head (85c798a).
⚠️ Report is 4 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5683   +/-   ##
=======================================
  Coverage   95.04%   95.04%           
=======================================
  Files         576      577    +1     
  Lines       45991    45992    +1     
  Branches    14724    14724           
=======================================
+ Hits        43713    43714    +1     
  Misses       1525     1525           
  Partials      753      753           

Flag	Coverage Δ
shard-1	43.98% <100.00%> (+<0.01%)	⬆️
shard-2	35.74% <40.00%> (+0.01%)	⬆️
shard-3	32.38% <40.00%> (+0.06%)	⬆️
shard-4	32.73% <0.00%> (+0.07%)	⬆️
shard-5	31.72% <0.00%> (-0.04%)	⬇️
shard-6	44.41% <0.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...kages/gittensory-engine/src/telemetry/anonymize.ts	100.00% <100.00%> (ø)
src/selfhost/orb-collector.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-14 02:40:32 UTC}

5 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review: This PR changes guardrail-protected path(s): packages/gittensory-engine/src/index.ts (matched packages/gittensory-engine/**), packages/gittensory-engine/src/telemetry/anonymize.ts (matched packages/gittensory-engine/**), packages/gittensory-engine/test/anonymize.test.ts (matched packages/gittensory-engine/**), src/selfhost/orb-collector.ts (matched src/selfhost/**).

Review summary
This PR extracts Orb's inline HMAC-anonymization helper into a shared `@​loopover/engine` primitive (`generateAnonSecret`/`hmacAnonymize`), re-wires `orb-collector.ts` onto it, and includes a fixed-vector regression test proving byte-identical output to the pre-extraction implementation — good discipline for a security-sensitive dedup. However, `src/selfhost/orb-collector.ts` imports the new function via a raw relative path straight into the sibling package's `src/` TypeScript file instead of the workspace package name, and this lines up exactly with the failing 'build + boot smoke test' CI check.

Blockers

• src/selfhost/orb-collector.ts:16 imports `generateAnonSecret`/`hmacAnonymize` via `"../../packages/gittensory-engine/src/telemetry/anonymize.js"` — a raw relative reach into the sibling package's TS source rather than the `@​loopover/engine` workspace package (as `index.ts`'s own barrel re-export implies consumers should use); this fragile cross-package relative path is the most plausible cause of the failing 'build + boot smoke test' check and should instead import from the compiled `@​loopover/engine` package.

Nits — 7 non-blocking

• The magic numbers in anonymize.ts (32-byte/256-bit secret, 24-char truncation) are already well-explained by the surrounding doc comments, so extracting named constants is optional polish, not required.
• packages/gittensory-engine/test/anonymize.test.ts imports from `../dist/index.js`, so this test silently no-ops on a stale build if `npm run build` isn't re-run before `node:test` — worth a comment noting the build dependency, mirroring the app-vitest file's explanatory header.
• Fix the orb-collector.ts import to `import { generateAnonSecret, hmacAnonymize } from "@​loopover/engine";` (or whatever the existing cross-package import convention is elsewhere in src/selfhost) and re-run the build to confirm the smoke-test failure clears.
• Consider grep'ing src/selfhost for how other engine exports (e.g. subprocess-env's redactSecrets) are imported today, and match that pattern exactly for consistency.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.
• Possible secret-shaped assignment in the diff (generic_secret_assignment) — Verify the value is not a real credential.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#5680
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 45 registered-repo PR(s), 37 merged, 330 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 45 PR(s), 330 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.
Improvement	✅ Minor	risk: clean · value: minor — Code changes are accompanied by test evidence.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, Ruby, Go, JavaScript, MDX, Shell, Solidity
• Official Gittensor activity: 45 PR(s), 330 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

[BETA] Chat with Gittensory

Ask Gittensory a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @gittensory ask <question> answers contribution-quality Q&A with source citations and freshness.
• @gittensory chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @gittensory mention with a real question is routed to the closest matching read-only command automatically -- no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/gittensory-commands

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[JSONbored]

Re: the flagged "blocker" about the relative-path import being the likely cause of the build + boot smoke test failure — that's not what happened here.

The actual failure (see the job log) was ERROR: write /app/node_modules/@opentelemetry/sdk-logs/build/.../InMemoryLogRecordExporter.d.ts: no space left on device during Docker layer import — a runner disk-space flake, unrelated to any source change. I re-ran the identical job with zero code changes and it passed clean (build + boot smoke test pass 4m47s), which rules out the import path as the cause: a real build-time defect wouldn't fix itself on an unchanged re-run.

The relative-path import itself (../../packages/gittensory-engine/src/telemetry/anonymize.js) is also this codebase's existing, deliberate convention for src/ consumers of engine code, not something introduced by this PR — see src/signals/reward-risk.ts:22, src/signals/duplicate-winner.ts:15, and src/mcp/issue-rag.ts:6, all importing engine internals the same way (the published @loopover/engine package is what packages/gittensory-miner uses instead, since that's a separately-published consumer). Switching this one call site to the package import would be inconsistent with every sibling file in src/selfhost/src/signals.

Leaving the code as-is. Held for manual review per the guarded-path policy, which is correct — over to a maintainer to merge.