You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
packages/loopover-miner/lib/purge-cli.js's own header comment documents its purpose as an operator-invoked
"right-to-be-forgotten path across the local ledgers... the six stores that have a real repoColumn", listing REAL_PURGE_TARGETS (lines 35-42) as exactly claim-ledger, event-ledger, governor-ledger, prediction-ledger, portfolio-queue, and run-state. Two other stores in the package hold genuine,
directly repo-scoped local data and are structurally identical to that pattern, but are absent from REAL_PURGE_TARGETS:
packages/loopover-miner/lib/contribution-profile-cache.js's miner_contribution_profile_cache table is
keyed repo_full_name TEXT PRIMARY KEY (line 51) — one row per repo, holding the extracted label taxonomy and
doc-derived eligibility signals (AMS contribution-profile: implement generic label/docs/agent-file extraction #6796/AMS contribution-profile: local cache store + doctor integration #6797) for that specific repo. This is exactly the "a real repoColumn"
shape purge-cli.js's own doc comment describes as its purge criterion, yet the store is entirely absent from REAL_PURGE_TARGETS, store-maintenance.js's purge-spec constants, and purgeOneStore's target list.
packages/loopover-miner/lib/governor-state.js has TWO genuinely repo-scoped tables: governor_reputation_history
(composite PRIMARY KEY (api_base_url, repo_full_name), lines 97-104) and governor_own_submissions
(repo_full_name TEXT NOT NULL, indexed on (repo_full_name, id), lines ~150-158) — both hold real per-repo
data (reputation decision tallies, own-submission fingerprints/PR/issue numbers) derived from that repo's
history. Neither is covered by purge-cli.js. (governor_scalar_state, the third table in this same file, is
correctly NOT a purge candidate — it is a single whole-run scalar row with no repo dimension, and this issue
does not touch it.)
This is the same gap shape the still-open #6987 already identifies for policy_verdict_cache.js (also a repoColumn-shaped store missing from these same lists) — that issue explicitly scopes itself to policy_verdict_cache only and says nothing about contribution-profile-cache.js or governor-state.js,
confirming those two were simply missed by the same audit rather than deliberately excluded (unlike attempt-log.js/plan-store.js/policy-doc-cache.js, which store-maintenance.js's own comment and #6987's
own text correctly document as intentionally excluded because their payloads have no dedicated repo column).
Requirements
Add a CONTRIBUTION_PROFILE_CACHE_PURGE_SPEC = { table: "miner_contribution_profile_cache", repoColumn: "repo_full_name" } to store-maintenance.js (matching the exact shape of the six existing purge specs; use contribution-profile-cache.js's own exported CONTRIBUTION_PROFILE_STORE_TABLE constant for the table name
rather than a second hardcoded literal) and wire it into purge-cli.js's REAL_PURGE_TARGETS.
Add GOVERNOR_REPUTATION_HISTORY_PURGE_SPEC = { table: "governor_reputation_history", repoColumn: "repo_full_name" } and GOVERNOR_OWN_SUBMISSIONS_PURGE_SPEC = { table: "governor_own_submissions", repoColumn: "repo_full_name" } to store-maintenance.js and wire both into purge-cli.js's REAL_PURGE_TARGETS, opening governor-state.js's DB handle once and purging both tables against it (do not
open the same DB file twice for one purge run).
The purge for governor_reputation_history MUST delete every matching row regardless of api_base_url (i.e.
filter on repo_full_name alone, matching purgeStoreByRepo's existing single-column DELETE ... WHERE {repoColumn} = ? shape) — a right-to-be-forgotten purge must remove a repo's reputation history across every
forge host it was recorded against, not just the default one.
governor_scalar_state MUST NOT be touched by this change — it has no repo dimension and stays out of scope.
purge-cli.js's dry-run reporting path (runPurgeDryRun) MUST cover the three newly-added targets identically
to the six existing ones (a row-count preview, not an actual delete).
Deliverables
contribution-profile-cache, governor-reputation-history, and governor-own-submissions are purgeable
by repo via loopover-miner purge --repo <owner/repo> (both real and --dry-run).
store-maintenance.js exports the three new purge-spec constants described above.
A test confirming a real purge run actually deletes matching rows from all three newly-wired tables (and
leaves governor_scalar_state and other repos' rows untouched).
A test confirming --dry-run reports an accurate row count for each of the three new targets without
deleting anything.
Test Coverage Requirements
99%+ Codecov patch coverage on every changed line and branch across store-maintenance.js and purge-cli.js,
plus the regression tests above confirming all three newly-wired stores are actually reached by both the real
and dry-run purge paths.
Expected Outcome
loopover-miner purge --repo <owner/repo> removes a repo's cached contribution-eligibility profile and its
governor reputation-history/own-submission records, not just the original six ledgers — closing the same class
of right-to-be-forgotten completeness gap #6987 is already fixing for policy_verdict_cache, for the two
stores that audit missed.
Links & Resources
packages/loopover-miner/lib/purge-cli.js:1-42 (REAL_PURGE_TARGETS) — the list to extend.
packages/loopover-miner/lib/store-maintenance.js:27-36 — the six-store purge-spec pattern to extend.
packages/loopover-miner/lib/contribution-profile-cache.js:51 — miner_contribution_profile_cache's repo_full_name TEXT PRIMARY KEY schema.
packages/loopover-miner/lib/governor-state.js — governor_reputation_history/governor_own_submissions
schemas (both repo-scoped) and governor_scalar_state (correctly out of scope).
Context
packages/loopover-miner/lib/purge-cli.js's own header comment documents its purpose as an operator-invoked"right-to-be-forgotten path across the local ledgers... the six stores that have a real
repoColumn", listingREAL_PURGE_TARGETS(lines 35-42) as exactlyclaim-ledger,event-ledger,governor-ledger,prediction-ledger,portfolio-queue, andrun-state. Two other stores in the package hold genuine,directly repo-scoped local data and are structurally identical to that pattern, but are absent from
REAL_PURGE_TARGETS:packages/loopover-miner/lib/contribution-profile-cache.js'sminer_contribution_profile_cachetable iskeyed
repo_full_name TEXT PRIMARY KEY(line 51) — one row per repo, holding the extracted label taxonomy anddoc-derived eligibility signals (AMS contribution-profile: implement generic label/docs/agent-file extraction #6796/AMS contribution-profile: local cache store + doctor integration #6797) for that specific repo. This is exactly the "a real
repoColumn"shape
purge-cli.js's own doc comment describes as its purge criterion, yet the store is entirely absent fromREAL_PURGE_TARGETS,store-maintenance.js's purge-spec constants, andpurgeOneStore's target list.packages/loopover-miner/lib/governor-state.jshas TWO genuinely repo-scoped tables:governor_reputation_history(composite
PRIMARY KEY (api_base_url, repo_full_name), lines 97-104) andgovernor_own_submissions(
repo_full_name TEXT NOT NULL, indexed on(repo_full_name, id), lines ~150-158) — both hold real per-repodata (reputation decision tallies, own-submission fingerprints/PR/issue numbers) derived from that repo's
history. Neither is covered by
purge-cli.js. (governor_scalar_state, the third table in this same file, iscorrectly NOT a purge candidate — it is a single whole-run scalar row with no repo dimension, and this issue
does not touch it.)
This is the same gap shape the still-open #6987 already identifies for
policy_verdict_cache.js(also arepoColumn-shaped store missing from these same lists) — that issue explicitly scopes itself topolicy_verdict_cacheonly and says nothing aboutcontribution-profile-cache.jsorgovernor-state.js,confirming those two were simply missed by the same audit rather than deliberately excluded (unlike
attempt-log.js/plan-store.js/policy-doc-cache.js, whichstore-maintenance.js's own comment and #6987'sown text correctly document as intentionally excluded because their payloads have no dedicated repo column).
Requirements
CONTRIBUTION_PROFILE_CACHE_PURGE_SPEC = { table: "miner_contribution_profile_cache", repoColumn: "repo_full_name" }tostore-maintenance.js(matching the exact shape of the six existing purge specs; usecontribution-profile-cache.js's own exportedCONTRIBUTION_PROFILE_STORE_TABLEconstant for the table namerather than a second hardcoded literal) and wire it into
purge-cli.js'sREAL_PURGE_TARGETS.GOVERNOR_REPUTATION_HISTORY_PURGE_SPEC = { table: "governor_reputation_history", repoColumn: "repo_full_name" }andGOVERNOR_OWN_SUBMISSIONS_PURGE_SPEC = { table: "governor_own_submissions", repoColumn: "repo_full_name" }tostore-maintenance.jsand wire both intopurge-cli.js'sREAL_PURGE_TARGETS, openinggovernor-state.js's DB handle once and purging both tables against it (do notopen the same DB file twice for one purge run).
governor_reputation_historyMUST delete every matching row regardless ofapi_base_url(i.e.filter on
repo_full_namealone, matchingpurgeStoreByRepo's existing single-columnDELETE ... WHERE {repoColumn} = ?shape) — a right-to-be-forgotten purge must remove a repo's reputation history across everyforge host it was recorded against, not just the default one.
governor_scalar_stateMUST NOT be touched by this change — it has no repo dimension and stays out of scope.purge-cli.js's dry-run reporting path (runPurgeDryRun) MUST cover the three newly-added targets identicallyto the six existing ones (a row-count preview, not an actual delete).
Deliverables
contribution-profile-cache,governor-reputation-history, andgovernor-own-submissionsare purgeableby repo via
loopover-miner purge --repo <owner/repo>(both real and--dry-run).store-maintenance.jsexports the three new purge-spec constants described above.leaves
governor_scalar_stateand other repos' rows untouched).--dry-runreports an accurate row count for each of the three new targets withoutdeleting anything.
Test Coverage Requirements
99%+ Codecov patch coverage on every changed line and branch across
store-maintenance.jsandpurge-cli.js,plus the regression tests above confirming all three newly-wired stores are actually reached by both the real
and dry-run purge paths.
Expected Outcome
loopover-miner purge --repo <owner/repo>removes a repo's cached contribution-eligibility profile and itsgovernor reputation-history/own-submission records, not just the original six ledgers — closing the same class
of right-to-be-forgotten completeness gap #6987 is already fixing for
policy_verdict_cache, for the twostores that audit missed.
Links & Resources
packages/loopover-miner/lib/purge-cli.js:1-42(REAL_PURGE_TARGETS) — the list to extend.packages/loopover-miner/lib/store-maintenance.js:27-36— the six-store purge-spec pattern to extend.packages/loopover-miner/lib/contribution-profile-cache.js:51—miner_contribution_profile_cache'srepo_full_name TEXT PRIMARY KEYschema.packages/loopover-miner/lib/governor-state.js—governor_reputation_history/governor_own_submissionsschemas (both repo-scoped) and
governor_scalar_state(correctly out of scope).policy_verdict_cache; this issue covers the two stores thataudit did not.