fix(review): drop unsafe enrichment sections

[JSONbored]

Motivation

• Prevent leaking sensitive values that can survive a line-based sanitizer by removing entire markdown sections when a heading is flagged non-public-safe.
• Retain useful public-safe enrichment context where a single non-heading line is rejected so functionality and availability are preserved.

Description

• Replace the line-only fallback in sanitizeEnrichmentPromptSection with a section-aware fallback that drops a heading's entire section when the heading fails sanitizePublicComment.
• Add helpers markdownHeadingLevel, isPublicSafeEnrichmentLine, and retainPublicSafeEnrichmentSections in src/review/enrichment-wire.ts to detect markdown headings and retain only public-safe sections.
• Keep the original behavior of preserving isolated safe lines when no heading structure is implicated.
• Add a regression unit test it("drops non-public-safe enrichment sections with adjacent unlabeled values") to test/unit/enrichment-wire.test.ts that asserts unlabeled values adjacent to a forbidden heading are not retained.

Testing

• Ran npx vitest run test/unit/enrichment-wire.test.ts, which passed (44 tests).
• Ran npm run typecheck (tsc --noEmit), which passed with no type errors.
• Coverage runs were attempted but blocked: npx vitest run --coverage test/unit/enrichment-wire.test.ts failed during coverage remapping with TypeError: jsTokens is not a function, and a full npm run test:coverage run encountered unrelated runtime coverage errors and was terminated.
• npm audit --audit-level=moderate could not complete due to a registry 403 Forbidden when hitting the audit endpoint.

---

Codex Task

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Caution

🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥

🛑 Gittensory review result - fixes required

_{Review updated: 2026-07-07 09:10:10 UTC}

2 files · 1 AI reviewer · 3 blockers · readiness 93/100 · CI failing · unstable

🛑 Suggested Action - Manual Review

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.
• AI reviewers agree on a likely critical defect: The PR description does not close or reference any open issue (no "Fixes #N"/issue link), which this repo's contribution policy requires for external PRs before it can be treated as merge-ready. — Resolve the flagged defect, or override if the AI reviewers are mistaken, then re-run the gate.

Review summary
The AI review returned blocking findings for this change but did not include a separate narrative summary. Review the blockers below before deciding this PR.

Blockers

• The PR description does not close or reference any open issue (no "Fixes #N"/issue link), which this repo's contribution policy requires for external PRs before it can be treated as merge-ready.

Nits — 5 non-blocking

• codecov/patch failed at 90.90% (target 99%); the likely gap is the untested branch in the while-loop condition at src/review/enrichment-wire.ts (`nextLevel !== undefined && nextLevel <= headingLevel`) for a heading nested *deeper* than the rejected heading (e.g. a level-4 heading inside a dropped level-3 section) — the current test only covers non-heading lines and a same-level sibling heading as the stop condition, add a case with a nested sub-heading to close that branch.
• markdownHeadingLevel only handles ATX-style `#`-headings; Setext headings (`Heading` underlined with `===`/`---`) would not be detected as section boundaries and their content would fall back to line-only filtering — likely fine given REES briefs are presumably ATX-only, but worth a one-line comment noting that assumption.
• The magic number `6` in `/^(#{1,6})\s+/` at src/review/enrichment-wire.ts:165 is just the standard markdown max heading depth — not worth a named constant, but a short inline comment (`// ATX heading levels 1-6`) would save the next reader a beat.
• Add a nested-heading test case (rejected heading containing a deeper sub-heading) to close the coverage gap flagged by codecov/patch.
• Reference or open an issue for this fix and link it in the PR description per repo convention.

Why this is blocked

• The PR description does not close or reference any open issue (no "Fixes #N"/issue link), which this repo's contribution policy requires for external PRs before it can be treated as merge-ready.
• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

CI checks failing

• codecov/patch — 90.90% of diff hit (target 99.00%)

Signal	Result	Evidence
Code review	❌ 3 blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 51 registered-repo PR(s), 43 merged, 569 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 51 PR(s), 569 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, JavaScript, Ruby, Go, Kotlin, MDX, Shell
• Official Gittensor activity: 51 PR(s), 569 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

❌ Patch coverage is 90.90909% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.66%. Comparing base (1ce4364) to head (5beb933).
⚠️ Report is 15 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/review/enrichment-wire.ts	90.90%	0 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3949      +/-   ##
==========================================
- Coverage   93.66%   93.66%   -0.01%     
==========================================
  Files         372      372              
  Lines       34856    34872      +16     
  Branches    12743    12748       +5     
==========================================
+ Hits        32649    32663      +14     
  Misses       1588     1588              
- Partials      619      621       +2     

Files with missing lines	Coverage Δ
src/review/enrichment-wire.ts	98.14% <90.90%> (-1.17%)	⬇️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.