fix(test): rename the stale gittensory GITHUB_APP_SLUG default to loopover-orb

[JSONbored]

Summary

• test/helpers/d1.ts's createTestEnv() defaulted GITHUB_APP_SLUG to "gittensory" -- the pre-rename product name -- even though the real, live canonical GitHub App is "loopover-orb" (src/services/subnet-interface.ts's PUBLIC_GITHUB_APP_SLUG, described in its own comment as "the same stable, real app across every deployment") and production's own unset-fallback is "loopover" (src/api/routes.ts:936).
• Surfaced while investigating an unrelated flaky-test report: two tests (test/unit/github-labels.test.ts, test/unit/github-pr-actions.test.ts, fixed in fix(test): stop rebuilding env/keys per iteration in repo-name validation tests #6880) constructed a fresh RSA key and D1 database per loop iteration; fixing that revealed the shared GITHUB_APP_SLUG default itself was stale.
• Renames the default to "loopover-orb" and updates every fixture across ~20 files that depends on it: bot-login strings ("gittensory[bot]" -> "loopover-orb[bot]"), check-run app.slug fixtures, explicit GITHUB_APP_SLUG overrides, and one test that asserts on the resulting project-slug value directly.
• Left deliberately untouched (confirmed preserved on purpose, not stale -- verified via explicit code comments and other tests that pin these exact values): sticky-comment HTML markers (e.g. <!-- gittensory-pr-panel:v1 -->, never renamed in production), the "gittensory-native" DB-source literal (written into review_audit/contributor_gate_history rows, renaming would orphan existing data), Sentry ticket IDs (GITTENSORY-*), the GITTENSORY_LEGACY_*_CHECK_NAME constants (kept for self-hoster upgrade compatibility), and the "JSONbored/gittensory" generic-placeholder-repo-name pattern used across ~144 files (not swapped for "JSONbored/loopover", which is a live self-repo sentinel value that would silently change unrelated tests' behavior via isLoopOverSelfRepo()).

Two subtleties worth calling out for reviewers:

• Matching semantics matter. isOwnReviewThreadAuthor does prefix matching, not exact matching, so its own dedicated test (backfill-2.test.ts) needed an explicit bare "loopover" override to keep testing multiple suffix forms, rather than inheriting the new "loopover-orb" default -- a bare "loopover[bot]" fixture would not prefix-match a "loopover-orb" configured slug (traced through isAuthorizedReviewThreadAuthor's early-return logic to confirm this before assuming).
• Regenerated the branding-drift baseline. A one-line comment fix in packages/loopover-mcp/bin/loopover-mcp.js (a stale claim that enrichment-analyzers "keeps its legacy gittensory:// URI on purpose" -- it was already loopover://, confirmed against src/review/enrichment-analyzers-taxonomy.ts) dropped that file's tracked "gittensory" mention count from 3 to 2, so npm run branding-drift:update was run and the regenerated scripts/branding-drift-baseline.json is included.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused on one coherent change (a stale shared test default and its dependents) despite touching many files -- splitting it would leave intermediate states with failing tests, since the default and its dependent fixtures must change together atomically.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves -- not applicable; this is a maintainer-authored test-reliability fix discovered during unrelated work, not a contributor PR under the linked-issue policy.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally -- test-only change (plus a regenerated baseline JSON and one comment fix), which Codecov does not measure under test/**, so there is no patch-coverage obligation.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries -- not applicable; no production code changed, and all ~20 affected files' existing tests (1621 total) still pass unchanged in intent.

Additional validation: all ~20 affected files verified individually and together (1621 tests, zero failures). A full local npm run test:ci run is green for everything this PR touches. That run also surfaced two unrelated, pre-existing failures, both confirmed via git blame/content inspection to be nothing to do with this change: test/unit/root-terraform-grafana-firewall.test.ts fails because terraform/ was deliberately deleted in an earlier, separate commit (9001197c, "chore: remove unused terraform/ directory") that didn't clean up this test; test/unit/selfhost-sentry-release.test.ts fails because scripts/deploy-selfhost-prebuilt.sh has already been renamed to loopover-selfhost while the test still pins the old gittensory-selfhost value. Both are being fixed in a small separate follow-up PR.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics. (Not applicable -- test-only change.)
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (Not applicable -- no such changes; this only touches how the App's identity is represented in test fixtures, not any auth/session logic.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (Not applicable -- no such changes.)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (Not applicable -- no UI changes.)
• Visible UI changes include a UI Evidence section below. (Not applicable -- no visible/UI changes.)
• Public docs/changelogs are updated where needed. (Not applicable.)

UI Evidence

Not applicable -- test-only change (plus one generated baseline file and one comment fix), no UI/frontend/docs surface touched.

Notes

• Companion PRs from the same investigation: fix(test): stop ai-summaries forbidden-word sweep timing out under load #6874 (ai-summaries.test.ts), fix(test): reduce and widen the agent-sdk-driver real-git test timeout #6871 (agent-sdk-driver.test.ts), fix(test): widen timeouts on real-git miner clone/worktree tests #6869 (miner clone/worktree suite), fix(test): stop rebuilding env/keys per iteration in repo-name validation tests #6880 (github-labels/github-pr-actions redundant-setup fix), fix(test): match release-selfhost-prerelease.test.ts to the loopover-orb rename #6883 (release-selfhost-prerelease.test.ts -- a related but independently-discovered gittensory-orb -> loopover-orb staleness in a different subsystem).
• A follow-up PR will clean up the two unrelated pre-existing failures noted above (terraform/ test, Sentry release-script test).

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.70%. Comparing base (e118f6e) to head (9034739).
⚠️ Report is 5 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6900   +/-   ##
=======================================
  Coverage   93.70%   93.70%           
=======================================
  Files         685      685           
  Lines       68284    68284           
  Branches    18715    18715           
=======================================
  Hits        63985    63985           
  Misses       3302     3302           
  Partials      997      997           

Flag	Coverage Δ
shard-1	43.68% <ø> (ø)
shard-2	36.79% <ø> (ø)
shard-3	32.66% <ø> (ø)
shard-4	34.76% <ø> (ø)
shard-5	31.17% <ø> (ø)
shard-6	45.68% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

[loopover-orb]

Caution

🛑 LoopOver review result - fixes required

_{Review updated: 2026-07-17 11:30:25 UTC}

22 files · 1 AI reviewer · 1 blocker · CI failing · blocked

🛑 Suggested Action - Manual Review

Review summary
This is a mechanical, scoped rename of the stale `GITHUB_APP_SLUG` test default from "gittensory" to "loopover-orb" in `test/helpers/d1.ts`, propagated consistently across ~20 fixture files (bot logins, check-run `app.slug`, explicit overrides, and assertion values). The rename correctly leaves sticky-comment HTML markers, the `gittensory-native` DB-source literal, Sentry ticket IDs, legacy check-name constants, and the generic placeholder repo name untouched, matching the stated rationale that those are load-bearing or intentionally preserved. The one detail that doesn't line up: `scripts/branding-drift-baseline.json` drops the `packages/loopover-mcp/bin/loopover-mcp.js` count from 3 to 2, but no change to that file is visible anywhere in this diff.

Nits — 3 non-blocking

• scripts/branding-drift-baseline.json:4 lowers the `packages/loopover-mcp/bin/loopover-mcp.js` count from 3 to 2 with no corresponding change to that file visible in the diff (it's not in the ~20 test fixtures listed) — confirm that file was actually edited elsewhere in the full PR and the baseline isn't just drifting from reality.
• The failing `validate` and `validate-tests (1)`/`validate-tests (4)` checks are worth a quick look before merge given they align with jobs that would plausibly check branding-drift consistency, even though CI status itself isn't a code defect to block on here.
• Double check the branding-drift-baseline.json count change against the actual diff for packages/loopover-mcp/bin/loopover-mcp.js since it isn't shown in this PR's visible file list.

Why this is blocked

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.

📋 Copy for AI agents — paste into your coding agent

Fix the following blocker(s) from this PR review:

1. No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.

CI checks failing

• validate
• validate-tests (1)
• validate-tests (4)

Decision drivers

• ❌ Code review — 1 blocker (1 reviewer)
• ❌ Gate result — Blocking (Repo-configured hard blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ No-issue rationale	PR body explains why no issue is linked.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 33 registered-repo PR(s), 26 merged, 375 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 33 PR(s), 375 issue(s).
Improvement	ℹ️ Insufficient signal	risk: clean · value: insufficient-signal

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, Ruby, Go, JavaScript, MDX, Shell, Solidity
• Official Gittensor activity: 33 PR(s), 375 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Start here: Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review