docs: privacy audit of AMS telemetry/export surfaces for cross-tenant leakage

[davion-knight]

Closes #5219.

Field-level review of every telemetry / export / metrics surface AMS emits in packages/loopover-miner/lib, documenting which fields would leak cross-tenant information if AMS were hosted as-is — the AMS counterpart to ORB's #4893 privacy pass, and a sibling of the just-merged singleton-state audit (#5218).

Audit and documentation only — nothing redacted/partitioned here (each is its own follow-up).

Paths are the post-rebrand loopover-* names for the portfolio-dashboard.ts / orb-export.ts / prediction-metrics surfaces the issue cites (they are .js in the miner package).

Deliverable

A findings doc at packages/loopover-miner/docs/telemetry-export-privacy-audit.md listing each surface's field-level contents and, per flagged field, a remediation category (redact / aggregate / partition per-tenant) — the exact shape the issue requested.

Findings in brief

• orb-export.js is the model — already HMAC-anonymizes repoHash/prHash and buckets reasonBucket; its one hosted flaw is a per-machine anon secret (getOrCreateAnonSecret, orb-export.js:108) that a shared store would make cross-tenant-correlatable → per-tenant secret.
• portfolio-dashboard.js / prediction-ledger.js carry raw identifiers — repoFullName, plus targetId (issue/PR) and headSha (commit) in predictions → partition per-tenant / redact SHAs.
• Metrics renderers already aggregate — renderMinerPredictionMetrics output is identifier-free (counters keyed by conclusion); the leak is the shared input store, which folds into Audit: enumerate AMS's global-singleton state with tenant-leak risk #5218 rather than re-opening store scoping here.
• Governor reputation / recent-submission surfaces keyed by repoFullName flagged as a maintainer-owned tenancy boundary.

Every file:line reference was verified against the current main.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-14 19:55:16 UTC}

1 file · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This is a docs-only audit deliverable that inventories every telemetry/export field in packages/loopover-miner/lib and packages/loopover-engine's prediction-metrics surface, tagging each with a redact/aggregate/partition remediation category, matching exactly what #5219 asked for. It correctly identifies orb-export.js as already privacy-shaped modulo a per-machine anon secret, flags portfolio-dashboard.js and prediction-ledger.js as carrying raw repoFullName/targetId/headSha, and explicitly scopes out re-doing #5218's store-scoping work for the aggregate metrics surfaces. No code is changed, so there's no functional risk; the main open question is whether the field/line citations are accurate against current main, which can't be verified from the diff alone.

Nits — 5 non-blocking

• The doc claims 'every file:line reference was verified against current main' but the diff doesn't show the underlying lib files, so line numbers like orb-export.js:108 and portfolio-dashboard.d.ts:2-11 can't be independently confirmed from this review.
• The remediation-category table for prediction-ledger.js recommends both 'partition' and 'redact' for headSha without picking a primary default, which could leave implementers unsure which to apply first.
• Consider adding a one-line pointer in the doc to where the per-tenant secret work (orb-export getOrCreateAnonSecret) will actually be tracked, since the doc says 'each is its own follow-up' but only links issues in the closing checklist, not per-finding.
• When the follow-up partitioning issues are opened, cross-link them back into this doc so the audit doesn't go stale.
• Diff looks like trivial or whitespace-only churn — Reduce whitespace-only or formatting-only churn and keep the diff focused on substantive changes.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#5219
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 121 registered-repo PR(s), 86 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	davion-knight; Gittensor profile; 121 PR(s), 0 issue(s).
Gate result	✅ Passing	No configured blocker found.
Improvement	⚠️ ℹ️ Insufficient signal	risk: low · value: insufficient-signal — Nothing measurable for the structural-improvement analyzers on this PR (e.g. no code files changed).

Review context

• Author: davion-knight
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 121 PR(s), 0 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

[BETA] Chat with Gittensory

Ask Gittensory a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @gittensory ask <question> answers contribution-quality Q&A with source citations and freshness.
• @gittensory chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @gittensory mention with a real question is routed to the closest matching read-only command automatically -- no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/gittensory-commands

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review