fix(review): enforce same-head self-close evasion

[JSONbored]

Motivation

• A contributor self-close during an active review was escaping enforcement because the freshness check returned non-current for a legitimately closed PR and the handler returned before reopening and re-closing.
• The intent is to enforce review-evasion when the live PR is closed but still matches the reviewed head SHA, while continuing to deny enforcement for genuinely mismatched or otherwise stale live states.

Description

• Adjusted the live freshness gate in src/queue/processors.ts to allow the single stale reason closed when liveHeadSha equals the reviewed headSha (case-insensitive), and to continue denying enforcement for any other stale result.
• Retains the existing audit/deny semantics for non-current live states and preserves the error propagation behavior when reopen succeeds but the subsequent re-close fails.
• Added a regression test covering the closed-but-same-head self-close path and the closed-but-different-head denial path in test/unit/queue.test.ts.

Testing

• Ran git diff --check which succeeded locally.
• Ran the targeted test group with NO_COLOR=1 npx vitest run test/unit/queue.test.ts -t "self-close during an active review" and the modified tests passed.
• Attempted the full gate with npm run test:ci but the run hit unrelated long-running / flaky unit-suite timeouts in existing queue/backfill tests and did not complete successfully.
• Attempted npm audit --audit-level=moderate and the registry audit endpoint returned 403 Forbidden, so the audit step did not complete here.

---

Codex Task

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-05 17:57:47 UTC}

2 files · 1 AI reviewer · 2 blockers · readiness 93/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Review summary
This fix correctly narrows the live-freshness gate in src/queue/processors.ts so that a stale/closed result only bypasses the audit-deny short-circuit when the live head SHA matches the reviewed head SHA (case-insensitive), letting a genuine self-close proceed to reopen/re-close while still denying enforcement when the closed PR's head has actually diverged. The case-insensitive SHA comparison and status/reason/null guards are all correctly ordered, and the two accompanying tests exercise exactly the two branches added (same-head closed → enforced; different-head closed → denied), matching the described defect and fix precisely.

Nits — 4 non-blocking

• The repeated status/reason/liveHeadSha conjunction could be extracted into a small named predicate (e.g. isSameHeadSelfClose) for readability, though the inline form is not incorrect.
• Consider asserting on the exact number of PATCH calls (2) rather than toBeGreaterThanOrEqual(2) in the new test to make the reopen-then-reclose sequence assertion tighter.
• src/queue/processors.ts: extract the sameHeadSelfClosed predicate into a helper function with a descriptive name if this freshness-gate logic is likely to grow more cases in future PRs.
• test/unit/queue.test.ts: tighten the PATCH call-count assertion in the new 'reopens and re-closes' test from >=2 to ===2 for a more precise regression guard.

Concerns raised — review before merging

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Signal	Result	Evidence
Code review	❌ 2 blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 56 registered-repo PR(s), 46 merged, 521 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 56 PR(s), 521 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: Python, TypeScript, JavaScript, Ruby, Go, Kotlin, MDX, Shell
• Official Gittensor activity: 56 PR(s), 521 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• No action.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.11%. Comparing base (15ace01) to head (044b688).
⚠️ Report is 15 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3583   +/-   ##
=======================================
  Coverage   93.11%   93.11%           
=======================================
  Files         305      305           
  Lines       31532    31533    +1     
  Branches    11509    11510    +1     
=======================================
+ Hits        29361    29362    +1     
  Misses       1517     1517           
  Partials      654      654           

Files with missing lines	Coverage Δ
src/queue/processors.ts	93.55% <100.00%> (+<0.01%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.