fix(analytics): redact Slack tokens in weekly value report rollups

[kiannidev]

Summary

• Scrub xox*-prefixed Slack tokens from operator weekly-value-report rollup dimensions.
• Aligns with existing GitHub/API key redaction in sanitizeReportText.

No-issue rationale

Operator analytics redaction hardening with no linked issue.

Test plan

• npx vitest run test/unit/weekly-value-report.test.ts -t \"redacts Slack\"

Made with Cursor

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.73%. Comparing base (17d70b2) to head (396c9a1).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2110      +/-   ##
==========================================
+ Coverage   95.71%   95.73%   +0.01%     
==========================================
  Files         222      223       +1     
  Lines       24661    24741      +80     
  Branches     8949     8969      +20     
==========================================
+ Hits        23605    23685      +80     
  Misses        433      433              
  Partials      623      623              

Files with missing lines	Coverage Δ
src/services/weekly-value-report.ts	100.00% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Caution

🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥

🛑 Gittensory review result - reject/close recommended

_{Review updated: 2026-07-01 17:59:31 UTC}

2 files · 1 AI reviewer · 1 blocker · readiness 66/100 · CI green · blocked

🛑 Suggested Action - Reject/Close

• AI reviewers agree on a likely critical defect: src/services/weekly-value-report.ts:414 only redacts `xox[baprs]-...`, so a rollup dimension containing another `xox` Slack credential prefix such as `xoxc-...` will pass through `countDimensions()` into `operatorDetails.topRepos` unredacted. — Resolve the flagged defect, or override if the AI reviewers are mistaken, then re-run the gate.

Review summary
The change correctly routes the new redaction through the existing sanitizeReportText path used by rollup dimension aggregation, so covered bot-style Slack credentials are collapsed before operator details are emitted. However, the implementation does not match the PR's stated xox*-prefixed scope: it hard-codes only a small prefix subset, leaving other Slack credential prefixes unredacted on the same reachable rollup path.

Blockers

• src/services/weekly-value-report.ts:414 only redacts `xox[baprs]-...`, so a rollup dimension containing another `xox` Slack credential prefix such as `xoxc-...` will pass through `countDimensions()` into `operatorDetails.topRepos` unredacted.

Nits — 4 non-blocking

• test/unit/weekly-value-report.test.ts:213 covers only the `xoxb` case, so it would not catch the prefix coverage gap introduced in `sanitizeReportText`.
• src/services/weekly-value-report.ts:414 should match the claimed `xox*-` family, for example by using an `xox[A-Za-z0-9]*-` branch with the existing credential body length guard, or document and test the intentionally supported prefix allowlist.
• test/unit/weekly-value-report.test.ts:213 should be table-driven across at least the known bot case and a non-bot `xox` prefix so the redaction contract is locked to the PR summary.
• Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.

Why this is blocked

• src/services/weekly-value-report.ts:414 only redacts `xox[baprs]-...`, so a rollup dimension containing another `xox` Slack credential prefix such as `xoxc-...` will pass through `countDimensions()` into `operatorDetails.topRepos` unredacted.

Signal	Result	Evidence
Code review	❌ 1 blocker	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (size label size:XS; no linked issue context).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 2694 registered-repo PR(s), 1487 merged, 48 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	kiannidev; Gittensor profile; 2694 PR(s), 48 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.

Review context

• Author: kiannidev
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 2694 PR(s), 48 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Explain no-issue PR.
• Await review-lane availability.
• Triage stale or unlinked PRs.
• Refresh registry data or choose a registered active repo.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[kiannidev]

Fixed Gittensory gate: Slack token fixture is built from split fragments. Reverted the merge-from-main that introduced the broken tokenless Codecov upload path; CI should match #2105's fork-coverage artifact flow.