fix(engine): warn on out-of-range self-plagiarism similarityThreshold

[galuis116]

Summary

• normalizeSelfPlagiarismPolicy now warns and falls back to the default threshold when similarityThreshold is non-finite or outside [0,1], matching sibling normalizers instead of silently clamping via resolveSelfPlagiarismConfig.
• Add parser tests for 5, -1, NaN, and a valid 0.9 threshold.

Closes #8862

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Validation

• git diff --check
• npm --workspace @loopover/engine run build
• node --test dist-test/miner-goal-spec-parser.test.js (18 passed)
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• Engine package-local build + parser suite cover the change. Full monorepo typecheck/coverage not re-run locally.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

N/A — engine MinerGoalSpec normalizer only; no UI surface change.

Notes

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

❌ 1 Tests Failed:

Tests completed	Failed	Passed	Skipped
21929	1	21928	21

View the top 1 failed test(s) by shortest run time

test/unit/miner-worktree-allocator-collisions.test.ts > loopover-miner worktree allocator collisions (#4298) > returns distinct worktree paths when multiple processes acquire simultaneously

Stack Traces | 0.44s run time

AssertionError: expected 4 to be 5 // Object.is equality

- Expected
+ Received

- 5
+ 4

 ❯ test/unit/miner-worktree-allocator-collisions.test.ts:148:41

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[loopover-orb]

Caution

🛑 LoopOver review result - fixes required

_{Review updated: 2026-07-26 14:49:14 UTC}

2 files · 1 AI reviewer · no blockers · CI failing · blocked

🛑 Suggested Action - Fix Blockers

Review summary
This PR tightens `normalizeSelfPlagiarismPolicy` in packages/loopover-engine/src/miner-goal-spec.ts:255 so a non-finite or out-of-[0,1] `similarityThreshold` warns and falls back to the default instead of being silently passed through to `resolveSelfPlagiarismConfig`, which previously could clamp without any warning. The new checks (`!Number.isFinite`, `< 0`, `> 1`) run before delegating to `resolveSelfPlagiarismConfig(value)` for the valid case, correctly preserving the pass-through for anything else `resolveSelfPlagiarismConfig` normalizes (e.g. missing key). Four new tests (5, -1, NaN, 0.9) directly exercise both new branches and the valid pass-through, matching the pattern used by sibling normalizers like `normalizeFeasibilityGatePolicy`.

Nits — 4 non-blocking

• The two warning branches (non-number/non-finite vs out-of-range) are structurally identical except for the message and predicate — could be collapsed into one validation step with a computed message, though the current form is consistent with this file's other normalizers so it's a style call, not a defect.
• The PR description says npm build and a package-local test run were done but full monorepo typecheck/coverage wasn't reverified locally; the CI FAILED checks (validate-tests, validate) have no detail, and the branch is 7 commits behind the current default branch, so that gap is a plausible cause worth ruling out by rebasing rather than assuming a content defect.
• Rebase onto the current default branch to pick up whatever landed in those 7 commits and get a fresh, comparable CI run before merge.
• Consider whether `resolveSelfPlagiarismConfig` itself should also reject/warn on out-of-range values so any other caller of that function (not just this parser) gets the same guard, matching the PR's stated 'matching sibling normalizers' intent at the source layer.

CI checks failing

• validate
• validate-tests

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#8862
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 1856 registered-repo PR(s), 1210 merged, 54 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	galuis116; Gittensor profile; 1856 PR(s), 54 issue(s).
Improvement	✅ Minor	risk: clean · value: minor · LLM: moderate

Linked issue satisfaction

Addressed
The diff adds a finite/range check on similarityThreshold that warns and falls back to the default, mirroring the sibling normalizer convention, and includes tests for 5, -1, NaN, and a valid 0.9 threshold covering the new branches.

Review context

• Author: galuis116
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 1856 PR(s), 54 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Start here: Triage stale or unlinked PRs.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[JSONbored]

Failing CI, closing.