fix(queue-intelligence): move bare reward/rewards to the always-forbidden tier and correct the contract doc

[kai392]

Closes #9702

What

sanitizePublicComment's JSDoc (src/queue-intelligence.ts) claimed that "reward" is never skippable and that allowBareScoreTerm only ever relaxes the bare \bscore\w*\b check — both false. The flag swaps FORBIDDEN_PUBLIC_COMMENT_WORDS for ALWAYS_FORBIDDEN_PUBLIC_COMMENT_WORDS, which relaxes the entire AMBIGUOUS_PUBLIC_COMMENT_WORDS tier — and "reward"/"rewards" lived in that tier. So sanitizePublicComment("12 TAO reward for this", { allowBareScoreTerm: true }) (live for any repo in LOOPOVER_PUBLIC_SCORE_TERMS_ALLOWED_REPOS) returned the string unchanged, contradicting the safety claim.

Resolved in favour of the doc's safety intent:

• Moved "reward"/"rewards" from AMBIGUOUS_PUBLIC_COMMENT_WORDS to ALWAYS_FORBIDDEN_PUBLIC_COMMENT_WORDS, so a bare reward is rejected on every repo including allowlisted ones. Qualified forms already in the always-forbidden tier (reward estimate, …) are unaffected.
• Rewrote the JSDoc to describe the code as written: it swaps to ALWAYS_FORBIDDEN_PUBLIC_COMMENT_WORDS and relaxes the whole ambiguous tier. Removed the false "reward … NEVER skippable" and "only the over-broad bare-word check is ever relaxed" claims, and the totalScore/baseTotalScore/credibility example (the \bscore\w*\b pattern doesn't match those camelCase identifiers). Also fixed the two adjacent tier-constant doc comments that still cited bare reward as ambiguous.

BARE_SCORE_TERM_PATTERN, isPublicScoreTermSafeForRepo, and the allowlist env var are unchanged.

Tests

New #9702 block: a bare reward throws with the flag on (the installation-token / allowlisted-repo gap) and off; a bare score still passes with the flag on (intended relaxation preserved); and an invariant pinning reward/rewards to the always-forbidden tier (never the ambiguous tier) so the doc and constants can't drift again. The existing parameterized SECURITY/INVARIANT suites now also exercise reward in the always-forbidden tier. Verified locally: 55/55 in queue-intelligence.test.ts, tsc --noEmit clean, git diff --check clean. (Both arms of the allowBareScoreTerm ternary are exercised against a reward-bearing and a bare-score string.)

[loopover-orb]

Warning

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-29 19:02:51 UTC}

2 files · 1 AI reviewer · no blockers · CI green · clean

⏸️ Suggested Action - Manual Review

• AI review did not produce public notes: The configured AI reviewer returned no usable public assessment for this PR head.

Review summary
AI review is unavailable for this PR head. LoopOver is holding this PR for manual review until the configured AI provider returns a usable public review summary.

Nits — 1 non-blocking

• AI review did not produce public notes — Fix the configured AI provider, then re-run LoopOver review before relying on the result.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ⚠️ Gate result — Not blocking (Advisory; not blocking this PR.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#9702
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 89 registered-repo PR(s), 43 merged, 7 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	kai392; Gittensor profile; 89 PR(s), 7 issue(s).
Improvement	✅ Minor	risk: clean · value: minor

Review context

• Author: kai392
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is registered but has no active allocation in the current snapshot.
• Public profile languages: Python, Cuda, JavaScript, Kotlin, MDX, Perl, Ruby, TypeScript
• Official Gittensor activity: 89 PR(s), 7 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Start here: Await review-lane availability.
• Then work through the remaining 2 steps in the Signals table above.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

Decision record

• action: hold · clause: ai_review_inconclusive
• config: 733a91409e0b72e31717c7c20a564079004a4ed8eaadb553273fe98586aa9935 · pack: oss-anti-slop · ci: passed
• record: 94ae1643ac10eaf7dc19be1b1b6d183caff9dffd9131927b5b20e5ba0c6ccdb2 (schema v5, head 0610eca)

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.28%. Comparing base (8e2d51d) to head (0610eca).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #9884       +/-   ##
===========================================
- Coverage   91.75%   79.28%   -12.47%     
===========================================
  Files         919      282      -637     
  Lines      112987    58536    -54451     
  Branches    27193     8611    -18582     
===========================================
- Hits       103667    46413    -57254     
- Misses       8034    11840     +3806     
+ Partials     1286      283     -1003     

Flag	Coverage Δ
backend	100.00% <ø> (+4.30%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/queue-intelligence.ts	100.00% <ø> (ø)

... and 770 files with indirect coverage changes