fix(miner): log prompt-injection audit from buildTaskBrief

[RealDiligent]

Summary

• Make buildTaskBrief emit the same prompt_injection_neutralized audit event buildInstructions already logs when title/body redaction actually fires.
• Add acceptance-criteria-path regression coverage for both-fields, title-only, body-only, and benign (no log) cases.

Closes #7441

Test plan

• npx vitest run test/unit/miner-coding-task-spec.test.ts
• git diff --check
• CI green (especially codecov/patch ≥99%)

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.40%. Comparing base (9ecf8c1) to head (074dacd).
⚠️ Report is 11 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7486      +/-   ##
==========================================
- Coverage   91.41%   91.40%   -0.01%     
==========================================
  Files         717      717              
  Lines       73032    73034       +2     
  Branches    21636    21633       -3     
==========================================
- Hits        66762    66757       -5     
- Misses       5227     5234       +7     
  Partials     1043     1043              

Flag	Coverage Δ
shard-1	34.34% <0.00%> (-0.02%)	⬇️
shard-2	39.11% <0.00%> (-0.01%)	⬇️
shard-3	36.15% <0.00%> (-0.09%)	⬇️
shard-4	43.37% <0.00%> (-0.01%)	⬇️
shard-5	31.89% <37.50%> (-0.01%)	⬇️
shard-6	31.48% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
packages/loopover-miner/lib/coding-task-spec.ts	100.00% <100.00%> (ø)

... and 1 file with indirect coverage changes

[loopover-orb]

Tip

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-20 13:30:50 UTC}

3 files · 1 AI reviewer · no blockers · readiness 98/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This PR extracts the existing `prompt_injection_neutralized` audit logging from `buildInstructions` into a shared `logPromptInjectionNeutralized` helper and calls it from `buildTaskBrief` too, so the audit event now fires consistently for both code paths that embed neutralized issue text. The .js file is a compiled mirror of the .ts source and both are updated in lockstep, which is correct but a maintenance smell if these are meant to be build artifacts. Test coverage is thorough, covering both-fields, title-only, body-only, null-body, and benign cases with exact JSON assertions.

Nits — 5 non-blocking

• The console.log calls flagged by the external brief (coding-task-spec.ts:99, coding-task-spec.js:40) are the pre-existing audit-logging pattern being relocated/reused, not new debug leftovers — worth confirming with the maintainer that this isn't flagged as a debug statement by mistake.
• packages/loopover-miner/lib/coding-task-spec.js appears to be a compiled/generated artifact tracked alongside the .ts source; if so, verify it's regenerated via build script rather than hand-edited, since manual sync drift between the two is easy to introduce.
• The helper doc-comment cites 'fix(miner): coding-task-spec.js's buildTaskBrief silently drops the prompt-injection audit event its sibling buildInstructions always logs #7441 audit parity with Prompt-injection & content-sanitization defense #4795' — worth double-checking Prompt-injection & content-sanitization defense #4795 is the correct historical reference since it can't be verified from this diff alone.
• Consider whether coding-task-spec.js should be gitignored/build-generated rather than committed, to avoid the double-maintenance burden shown in this diff's duplicated hunks.
• The new tests are acceptance-criteria-path-only (via buildCodingTaskAcceptanceCriteria) — confirm buildTaskBrief's direct callers (e.g. buildPromptPacket) are also exercised somewhere, since the PR title calls out buildTaskBrief specifically.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#7441
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 370 registered-repo PR(s), 171 merged, 34 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	RealDiligent; Gittensor profile; 370 PR(s), 34 issue(s).
Improvement	✅ Minor	risk: clean · value: minor · LLM: moderate

Linked issue satisfaction

Addressed
buildTaskBrief now captures the neutralizePromptInjection result and calls a shared logPromptInjectionNeutralized helper (identical event shape/fields convention to buildInstructions), and the PR adds tests covering both-fields, title-only, body-only, and benign no-log cases against buildCodingTaskAcceptanceCriteria's output, matching all stated requirements and deliverables.

Review context

• Author: RealDiligent
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, JavaScript, Ruby, Svelte, TypeScript, Markdown, MDX
• Official Gittensor activity: 370 PR(s), 34 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.