feat(review): miner-aware exemption and fleet-scale defaults for GLOBAL_CONTRIBUTOR_OPEN_ITEM_CAP

[JSONbored]

Summary

• GLOBAL_CONTRIBUTOR_OPEN_ITEM_CAP was unset-by-default (no install-wide cap at all) and had zero awareness of the confirmed_miner role used elsewhere for authorization — so a legitimate miner fleet would either sail through with zero cross-repo defense, or get throttled identically to a farming attack, depending entirely on whether an operator had proactively opted in and pre-sized it.
• Unset/malformed now falls back to a real default (20) instead of silently disabling the defense — a config typo can no longer turn this off by accident. The literal string "off" is the explicit escape hatch back to unconditional no-cap.
• New GLOBAL_CONTRIBUTOR_OPEN_ITEM_CAP_MINER env var gives a CONFIRMED official Gittensor miner (checked via the same getCachedOfficialMinerDetection path the codebase already trusts for this) its own, higher default (50) instead of either extreme.
• Both the PR-path (runAgentMaintenancePlanAndExecute) and issue-path (maybeCloseIssueOverContributorCap) install-wide checks defer the miner-identity lookup (cached, but not free) until at least one of the two resolvers is actually active, so a fully-opted-out install pays no extra cost.

Test plan

• test/unit/global-contributor-cap.test.ts — rewrote the resolver tests for the new default-based behavior, added coverage for the miner resolver and the "off" escape hatch (100% stmt/branch/func/line coverage on the file)
• test/unit/queue.test.ts — updated two now-inaccurately-titled "off by default" integration tests (assertions still hold since the sample counts stay under the new default), added a new end-to-end test proving a confirmed miner gets the higher cap even where the human cap alone would already be exceeded
• npx tsc --noEmit clean (one pre-existing, unrelated error in miner-opportunity-ranker.test.ts from upstream drift, not touched by this PR)

Fixes #4511

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

❌ Patch coverage is 78.26087% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 94.03%. Comparing base (95e9ec6) to head (9c07155).
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/queue/processors.ts	64.28%	0 Missing and 5 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4541      +/-   ##
==========================================
- Coverage   94.04%   94.03%   -0.02%     
==========================================
  Files         422      422              
  Lines       37600    37614      +14     
  Branches    13736    13741       +5     
==========================================
+ Hits        35362    35371       +9     
  Misses       1583     1583              
- Partials      655      660       +5     

Files with missing lines	Coverage Δ
src/settings/global-contributor-cap.ts	100.00% <100.00%> (ø)
src/queue/processors.ts	95.26% <64.28%> (-0.14%)	⬇️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Caution

🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥

🛑 Gittensory review result - fixes required

_{Review updated: 2026-07-10 00:36:09 UTC}

5 files · 1 AI reviewer · no blockers · readiness 100/100 · CI failing · unstable

🛑 Suggested Action - Manual Review

• Touches a guarded path — held for manual review: This PR changes guardrail-protected path(s): src/queue/processors.ts (matched src/queue/**).

Review summary
This PR replaces the install-wide contributor open-item cap's 'unset = no cap' behavior with a real default (20), adds a separate higher default (50) for a CONFIRMED official miner via the existing getCachedOfficialMinerDetection path, and adds an explicit "off" escape hatch — wired through both the PR-close and issue-close paths with the miner-identity lookup correctly deferred until at least one resolver is active so opted-out installs pay no extra cost. The resolver logic, deferred-lookup gating, and deliveryId threading all check out against the new tests, and the default-behavior change is intentional and well-documented (tied to issue #4511) rather than a silent drift.

Nits — 7 non-blocking

• codecov/patch is at 78.26% vs the 99% target — add a test for a CONFIRMED miner with GLOBAL_CONTRIBUTOR_OPEN_ITEM_CAP_MINER="off" (miner fully exempt while non-miners stay capped), which isn't covered by the queue.test.ts cases shown.
• Consider a test for a non-'confirmed' officialMiner.status branch (e.g. unconfirmed/error) combined with only the miner-cap resolver being active, to lock in that the human cap/no-cap path is chosen correctly there.
• src/settings/global-contributor-cap.ts:17 still references 'global_contributor_blacklist' in a pre-existing comment (not introduced by this diff) — worth a follow-up rename to 'denylist' for terminology consistency.
• Double-check the generic_secret_assignment flag at test/unit/queue.test.ts:14065 — almost certainly the existing generatePrivateKeyPem() test-fixture pattern rather than a real secret, but worth a quick confirm.
• Close the codecov/patch gap by adding the miner-'off' and non-confirmed-status test cases noted above.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

CI checks failing

• codecov/patch — 78.26% of diff hit (target 99.00%)

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#4511
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 48 registered-repo PR(s), 40 merged, 363 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 48 PR(s), 363 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Linked issue satisfaction

Addressed
The diff adds a real default cap (20) when GLOBAL_CONTRIBUTOR_OPEN_ITEM_CAP is unset/malformed with an explicit 'off' opt-out, introduces a confirmed_miner-aware resolver (GLOBAL_CONTRIBUTOR_OPEN_ITEM_CAP_MINER, default 50) checked via getCachedOfficialMinerDetection in both the PR and issue enforcement paths, adds tests for default-cap-when-unset, the miner exemption path, and the off escape hatc

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 48 PR(s), 363 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review