fix(signals): match configured label globs in config quality and label audit (#1769)

[joaovictor91123]

Summary

Fixes #1769.

The signals layer audited a repo's configured labelMultipliers keys by comparing them as literal strings, but scoring resolves those same keys as case-insensitive fnmatch globs (selectLabelMultiplier / labelPatternToRegExp in src/scoring/preview.ts, which documents the upstream fnmatch(label.lower(), pattern.lower()) semantics). A wildcard key such as type:* never appears verbatim on a real issue/PR, so every glob-configured repo was mis-audited.

• src/scoring/preview.ts: export a small labelMatchesPattern(label, pattern) built on the existing labelPatternToRegExp, so the one matcher is shared rather than duplicated.
• src/signals/engine.ts:
  • buildConfigQuality — notObservedConfiguredLabels now treats a configured key as observed when it matches any cached label as a glob (no more spurious configured_labels_not_observed and score dock).
  • buildLabelAudit — configured and missingConfiguredLabels now match live/observed labels against the configured glob keys (no more spurious trusted_labels_missing / configured_labels_unused, and trustedPipelineReady resolves correctly).

Literal keys (no glob metacharacter) keep exact-match behavior, so non-glob configs are byte-identical.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; both branches of every changed predicate are exercised by a new regression test in test/unit/signals-coverage.test.ts (glob key observed/missing/configured, literal key, and an unmatched label).
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate (found 0 vulnerabilities)
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• None skipped; the full npm run test:ci gate was run locally and is green.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A — no such changes.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (N/A — no API/schema change; the matcher is an internal helper.)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (N/A — no UI change.)
• Visible UI changes include a UI Evidence section. (N/A — no visible UI change.)
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. (N/A.)

Notes

• The fix reuses the authoritative scoring matcher rather than re-implementing fnmatch, keeping the signals surfaces in lockstep with how multipliers are actually resolved.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-06-29 22:37:48 UTC}

3 files · 1 AI reviewer · no blockers · readiness 73/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review

Review summary
The change correctly aligns the signals audit paths with the existing scoring semantics by reusing the glob matcher for configured label multiplier keys. The two affected audit surfaces now treat a configured pattern as satisfied when any observed or live label matches it, which fixes the false missing/unused reports for wildcard label configs. The regression test covers both the matched-glob and unmatched-glob branches for config quality and label audit.

Nits — 6 non-blocking

• nit: src/scoring/preview.ts:895 adds a useful shared helper, but the comment is much longer than the helper and repeats issue-specific narrative that would be cleaner in the test or PR description.
• nit: test/unit/signals-coverage.test.ts:1678 exercises wildcard matching, but it does not lock the now-shared case-insensitive literal behavior for a non-glob configured label such as `Bug` matching `bug`.
• src/scoring/preview.ts:895: Trim the helper comment down to the contract, for example that it mirrors scoring's case-insensitive fnmatch semantics for configured label multiplier keys.
• test/unit/signals-coverage.test.ts:1678: Add one assertion for case-insensitive literal matching so future changes do not accidentally drift from `selectLabelMultiplier` behavior.
• Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#1769
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (size label size:S; 1 linked issue).
Validation posture	❌ 5/25	Preflight is holding this PR; address the blocker before review.
Contributor workload	✅ 10/10	Author activity: 37 registered-repo PR(s), 19 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	joaovictor91123; Gittensor profile; 37 PR(s), 0 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Review context

• Author: joaovictor91123
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: JavaScript, C++, MDX, Rust, TypeScript
• Official Gittensor activity: 37 PR(s), 0 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Fix the blocker.
• Triage stale or unlinked PRs.
• Refresh registry data or choose a registered active repo.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review