fix(export): redact cached Orb token envelopes

[JSONbored]

Motivation

• Prevent encrypted GitHub installation-token envelopes stored in orb_enrollments.cached_token_json from being included in self-host D1 export artifacts, closing a redaction gap that could leak secret-bearing blobs when exports are shared.

Description

• Add cached_token_json to the orb_enrollments entry in REDACTED_COLUMNS in scripts/export-d1-core.mjs and document the column as sensitive, and extend test/unit/export-d1-core.test.ts to assert the new redaction behavior.

Testing

• Ran the focused unit regression: npx vitest run test/unit/export-d1-core.test.ts, which passed.
• Attempted broader verification: npm run test:coverage was started but unrelated long-running suites prevented a clean local completion (the targeted export redaction tests ran and passed); npm run test:ci could not fully complete locally due to actionlint/network and runner-label issues; npm audit --audit-level=moderate returned 403 from the audit endpoint so could not complete locally.

---

Codex Task

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.75%. Comparing base (2572de5) to head (2352994).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1679   +/-   ##
=======================================
  Coverage   95.75%   95.75%           
=======================================
  Files         211      211           
  Lines       22972    22972           
  Branches     8294     8294           
=======================================
  Hits        21997    21997           
  Misses        401      401           
  Partials      574      574           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-06-29 18:36:17 UTC}

2 files · 1 AI reviewer · no blockers · readiness 68/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review

Review summary
The change extends the self-host D1 export redaction list so `orb_enrollments.cached_token_json` is removed alongside the existing Orb secret fields, and the regression test exercises the production `buildTableExport` path rather than a fabricated helper-only path. The full post-change file shows `redactRow` and `buildTableExport` consume `REDACTED_COLUMNS` directly, so the new column is dropped from exported rows and surfaced in `redactedColumns` consistently. I do not see a reachable correctness, schema, or contract break in the provided diff.

Nits — 3 non-blocking

• Pull request duplicates other open work — Check for an existing pull request or issue covering this change and coordinate or consolidate before continuing.
• Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	⚠️ 2 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (size label size:XS; no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 2 registered-repo PR(s), 2 merged, 280 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 2 PR(s), 280 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 2 PR(s), 280 issue(s).
• Related work: Titles/paths share 8 meaningful terms. (PR #1690)
• Related work: Titles/paths share 6 meaningful terms. (PR #1693, PR #1716)

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• Review top overlaps.
• Add a concise scope and risk note.
• Triage stale or unlinked PRs.
• No action.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.
• Check active issues and PRs before submitting.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	2352994	Commit Preview URL Branch Preview URL	Jun 29 2026, 06:00 PM