fix(review): default reviewEvasionProtection to close, not off (#4011)

[JSONbored]

Summary

Closes #4011.

• A repo that never discovers and explicitly sets reviewEvasionProtection got ZERO self-close/draft-dodge/repeated-cycling protection under the old "off" default — a real, already-exploited gaming vector.
• This is deliberately not a migration. The issue's own proposed approach (change the schema.ts column default) would have zero effect: upsertRepositorySettings is the only writer and always resolves an explicit value through normalizeReviewEvasionProtection, so the raw SQLite column-level default is never reached by any live write path — the identical lesson migration 0102 already documented for a sibling field (linked_issue_gate_mode). SQLite has no ALTER COLUMN SET DEFAULT, and rebuilding the table for a default nothing reads isn't worth the operational risk.
• The actually-reachable default lives in three places, all flipped together:
  1. normalizeReviewEvasionProtection (src/db/repositories.ts) — the shared read+write normalizer. Only the explicit opt-out "off" is now honored; anything else resolves to "close".
  2. getRepositorySettings's "no row exists yet" fallback object.
  3. Three independent ?? "off" fallbacks in src/queue/processors.ts that defended against an undefined settings value with the same old default, entirely independent of the DB layer.
• Left the schema.ts column-level DEFAULT untouched with an explanatory comment (linking to migration 0102's precedent) so a future reader doesn't independently "fix" it for zero effect.

Our own 3 repos are unaffected either way — they already have reviewEvasionProtection: close explicitly set in the private VPS config, which wins over any DB value regardless of this change. This protects every other repo/deployment (and any future repo we register) that hasn't discovered this field.

Scope

• Single-purpose
• In wantedPaths (src/, test/)

Validation

• npm run typecheck — clean
• npx vitest run test/unit/moderation-config-db.test.ts test/unit/queue.test.ts test/unit/focus-manifest.test.ts test/unit/agent-action-executor.test.ts — 1372/1372 passed
• Verified full branch coverage on every changed conditional via direct lcov inspection (both branches hit on all 3 processors.ts call sites and the normalizer)

Safety

• No secrets/private terms introduced
• No changes to site/, CNAME, lovable/, or the changelog

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review result - approve/merge recommended

_{Review updated: 2026-07-07 12:45:35 UTC}

5 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This PR flips the reachable default for reviewEvasionProtection from "off" to "close" by changing the three actual decision points — normalizeReviewEvasionProtection, the no-row fallback in getRepositorySettings, and the three consuming guards in processors.ts — while deliberately leaving the schema.ts column DEFAULT untouched with a clear rationale (upsertRepositorySettings always writes an explicit normalized value, so the raw DDL default is dead, same precedent as migration 0102). The normalizer and consuming-guard changes are logically consistent (undefined/garbage now resolves to protected; only explicit "off" opts out), and the test suite was updated in matching fashion across queue.test.ts and moderation-config-db.test.ts, including a new explicit-off-still-honored case. No schema/migration mismatch since no schema.ts behavior actually changed.

Nits — 6 non-blocking

• src/db/repositories.ts's normalizeReviewEvasionProtection comment is long (11 lines) for a single ternary flip — consider trimming to the essential rationale and letting migration 0102's comment carry the shared precedent instead of restating it in full.
• Worth confirming there's no other write path into repository_settings (raw INSERT/backfill script) that bypasses upsertRepositorySettings and would still rely on the now-dead schema.ts DEFAULT "off" — the PR asserts upsertRepositorySettings is the only writer but that claim isn't independently verifiable from this diff alone.
• test/unit/queue.test.ts's renamed test descriptions are a bit verbose (embedding the full rationale in the `it(...)` string) — fine for a security-sensitive default flip, but consider moving detail into a comment above the assertion for readability.
• If there is any other write path to repository_settings.review_evasion_protection besides upsertRepositorySettings, add a short grep-verified note or test proving it also normalizes through the same function.
• Consider a brief CHANGELOG/release-notes entry given this silently changes behavior (enables enforcement) for every repo that never explicitly set the field — operators should know this shipped as a behavior change, not just a bugfix.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#4011
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 51 registered-repo PR(s), 43 merged, 570 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 51 PR(s), 570 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, JavaScript, Ruby, Go, Kotlin, MDX, Shell
• Official Gittensor activity: 51 PR(s), 570 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.58%. Comparing base (49ac8d5) to head (56ed104).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4038   +/-   ##
=======================================
  Coverage   93.58%   93.58%           
=======================================
  Files         381      381           
  Lines       35504    35504           
  Branches    13018    13018           
=======================================
  Hits        33225    33225           
  Misses       1617     1617           
  Partials      662      662           

Files with missing lines	Coverage Δ
src/db/repositories.ts	96.67% <100.00%> (ø)
src/db/schema.ts	71.66% <ø> (ø)
src/queue/processors.ts	94.86% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.