fix(signals): redact /var/ paths in the manifest public-safe guard

[jaso0n0818]

The bug

isFocusManifestPublicSafe — the public-output safety gate used by contributor-issue drafts (src/services/contributor-issue-draft.ts) and decision packs (src/services/decision-pack.ts) — lists local-filesystem path prefixes that must mirror the canonical PUBLIC_UNSAFE_PATTERN in src/signals/redaction.ts:

Path prefix	redaction.ts (canonical)	isFocusManifestPublicSafe
/Users/ /home/ /root/ /tmp/	redacted	redacted
/var/	redacted	❌ leaks

So a manifest string containing a /var/ path — /var/log/..., /var/folders/... (macOS temp), or a CI workspace under /var/ — passes as public-safe and leaks a local filesystem path into public output.

The fix

Add /var/ to the path alternatives so the guard matches the canonical set exactly. One-line regex change; the forbidden-term list is untouched. This completes the canonical path parity for this guard.

Tests

Extends the existing path regression test with a /var/log/build.log case (the test previously covered /Users/, /home/, /root/, /tmp/, and both Windows forms). Full local gate green; codecov patch covers the changed line; OpenAPI unchanged.

No linked issue: a one-line, self-evident security fix — no behavior change beyond closing the leak, no API/schema/DB change.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review result - approve/merge recommended

_{Review updated: 2026-06-29 21:47:56 UTC}

2 files · 1 AI reviewer · no blockers · readiness 73/100 · CI green · unknown

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This change adds `/var/` to the public-safe filesystem path guard and extends the existing path regression coverage with a `/var/log` case. The regex update matches the described canonical prefix set, and the new test drives `isFocusManifestPublicSafe` directly, so the public-output leak for that prefix is closed. The notable remaining risk is maintainability: this guard still mirrors the canonical matcher manually, so future prefix drift can recur.

Nits — 4 non-blocking

• src/signals/focus-manifest.ts:294: nit: The filesystem-prefix alternatives are still duplicated by hand from the canonical public-unsafe matcher, so future additions can drift again unless parity is enforced structurally.
• src/signals/focus-manifest.ts:294: Extract the shared public-unsafe path matcher, or add a parity test that exercises both this guard and the canonical matcher against the same prefix table.
• Code changes lack test evidence — Add focused regression tests or explain why existing coverage is sufficient.
• Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ No-issue rationale	PR body explains why no issue is linked.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (size label size:XS; no linked issue context).
Validation posture	❌ 5/25	Preflight is holding this PR; address the blocker before review.
Contributor workload	✅ 10/10	Author activity: 593 registered-repo PR(s), 376 merged, 6 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	jaso0n0818; Gittensor profile; 593 PR(s), 6 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: jaso0n0818
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 593 PR(s), 6 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Fix the blocker.
• Triage stale or unlinked PRs.
• Refresh registry data or choose a registered active repo.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.59%. Comparing base (29da3b1) to head (f19fc26).
⚠️ Report is 16 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1749   +/-   ##
=======================================
  Coverage   95.59%   95.59%           
=======================================
  Files         204      204           
  Lines       22316    22316           
  Branches     8067     8067           
=======================================
  Hits        21332    21332           
  Misses        408      408           
  Partials      576      576           

Files with missing lines	Coverage Δ
src/signals/focus-manifest.ts	99.17% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.