feat(notifications): render the maintainer recap digest body (#2240)

[e11734937-beep]

Fixes #2240.

Adds formatMaintainerRecap(report: RecapReport): string in src/services/maintainer-recap.ts — the pure markdown digest-body renderer for the #1963 recap. The builder (buildMaintainerRecap, #2239) and the Discord/Slack embed delivery already exist, but there was no reusable string formatter that turns a RecapReport into a titled-section body. This is that seam, mirroring formatWeeklyValueReportMarkdown (weekly-value-report.ts): a header plus ## Summary, ## Totals, and ## Per-repo sections. No delivery, no I/O.

What it does

• Header (# Maintainer recap) with generated timestamp, window, and repo count.
• ## Summary from report.summary; ## Totals from report.totals (with an n/a false-positive rate when nothing was blocked); ## Per-repo from report.repos.
• Empty sections render a single italic fallback line instead of dangling under the header.
• Redaction, both arms. Every free-text value is routed through redactRecapLine, which composes the shared redaction primitives from src/signals/redaction.ts: PUBLIC_LOCAL_PATH_SCRUB_PATTERN scrubs an absolute local path to <redacted-path>, then PUBLIC_UNSAFE_PATTERN blanks the whole line to <redacted> if any economic/identity term (reward/score/wallet/payout/…) survives. Defense in depth: the builder already sanitizes, but the formatter re-guards every emitted line so a hand-built or future report can never leak a private term into a digest.

Tests

test/unit/maintainer-recap-format.test.ts:

• empty window → header + all three section headers render, both fallback lines present, n/a rate;
• populated report → per-repo row, percent rate, a clean line survives verbatim, a local path is scrubbed (arm 1), and an payout line is fully redacted (arm 2).

Covers every added branch (fallback vs populated section, null vs numeric rate, redaction no-op vs path-scrub vs term-blank).

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.97%. Comparing base (3e4df6d) to head (db74746).
⚠️ Report is 24 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4415   +/-   ##
=======================================
  Coverage   93.96%   93.97%           
=======================================
  Files         401      401           
  Lines       36913    36922    +9     
  Branches    13497    13499    +2     
=======================================
+ Hits        34687    34696    +9     
  Misses       1570     1570           
  Partials      656      656           

Files with missing lines	Coverage Δ
src/services/maintainer-recap.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-09 17:22:56 UTC}

2 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review: This PR changes guardrail-protected path(s): src/services/maintainer-recap.ts (matched src/services/**).

Review summary
This adds `formatMaintainerRecap(report: RecapReport): string` as a pure markdown renderer for the maintainer digest, mirroring the existing `formatWeeklyValueReportMarkdown` pattern. The redaction path is correctly layered — `redactRecapLine` re-applies the path-scrub and unsafe-term blank on every emitted line (including already-sanitized `repoFullName` values from `buildMaintainerRecap`), which is redundant but harmless defense-in-depth as described, not a bug. Tests cover both fallback/populated branches for each section, both the null and numeric false-positive-rate arms, and both redaction arms (path scrub and full-line blank) against the real emitted strings, not fabricated payloads.

Nits — 4 non-blocking

• src/services/maintainer-recap.ts:107/109/122/151 — the 240-char cap, feat(notifications): recap markdown/section formatter for the maintainer digest body #2240 references, and 3-decimal-style literals are unexplained magic numbers; consider a shared named constant (e.g. `MAX_LINE_LENGTH = 240`) since the same 240 already appears in `sanitizeRecapText` above — worth deduplicating rather than repeating the literal.
• redactRecapLine re-scrubs repoFullName values that buildMaintainerRecap already ran through sanitizeRecapText — intentional per the PR description, but worth a one-line comment at the call site (not just the function doc) noting the double-pass is deliberate so a future reader doesn't 'simplify' it away.
• Consider extracting the shared 240-char slice logic between sanitizeRecapText and redactRecapLine into one helper to avoid drift if the cap ever changes.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#2240
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 83 registered-repo PR(s), 44 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	e11734937-beep; Gittensor profile; 83 PR(s), 0 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Linked issue satisfaction

Addressed
The PR adds formatMaintainerRecap(report) in maintainer-recap.ts producing a header plus titled Summary/Totals/Per-repo sections with fallback lines for empty sections, and routes every emitted free-text line through redactRecapLine, which composes PUBLIC_LOCAL_PATH_SCRUB_PATTERN and PUBLIC_UNSAFE_PATTERN from src/signals/redaction.ts as the issue's alternate acceptable path. The added test file e

Review context

• Author: e11734937-beep
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 83 PR(s), 0 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review