fix(mcp): keep PR body draft taxonomy public-safe

[JSONbored]

Motivation

• The MCP gittensory_draft_pr_body tool exposed internal/private scoring taxonomy in its structured output and human-visible summary, which can be serialized into client-visible text and accidentally pasted into public PRs.
• The change removes private/financial taxonomy from any user-visible output while preserving the draft's functionality as a metadata-only PR body generator.

Description

• Replace the original private scoring labels in EXCLUDED_PRIVATE_PR_BODY_FIELDS with generic, public-safe omitted-category labels in src/services/pr-body-draft.ts so the structured draft can be safely surfaced by MCP clients.
• Update the MCP tool summary text in src/mcp/server.ts to avoid the phrase "private scoreability" and instead state that internal analysis context is omitted.
• Add a focused unit test in test/unit/mcp-output-schemas.test.ts asserting that the MCP visible text and structured result do not expose private scoring taxonomy, and update test/unit/pr-body-draft.test.ts expectations to reflect the new public-safe labels.

Testing

• Ran npm test -- test/unit/pr-body-draft.test.ts --reporter=dot and the pr-body-draft unit suite passed.
• Ran the focused MCP assertion npm test -- test/unit/mcp-output-schemas.test.ts --reporter=dot -t "keeps draft PR body" and it passed, verifying both visible text and structured content are free of private taxonomy terms.
• Ran npm run typecheck and it succeeded with no type errors.
• Ran git diff --check (repository hygiene) which reported no whitespace/format issues.

---

Codex Task

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#909 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[ghost]

gittensory · advisory review

Reviewed 4 changed file(s) — two independent AI reviewers.

Changed files: src/mcp/server.ts, src/services/pr-body-draft.ts, test/unit/mcp-output-schemas.test.ts, test/unit/pr-body-draft.test.ts

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
The PR renames the excluded private PR body fields to public-safe labels, updates related comments and summary text, and adds tests to verify that no private taxonomy leaks into the draft output.

Suggestions

• Update any external documentation or integration notes that reference the old excluded field names.
• Consider adding a comment in the code explaining the rationale for the new label wording to aid future maintainers.

Worth double-checking

• If any downstream tooling parses the excluded field strings, they may need to be updated to the new labels.
• Ensure that the new labels remain covered by the public comment sanitizer (they currently do).

Reviewer B · nemotron-3-120b-a12b — recommends ✅ merge
The PR refactors the PR body draft taxonomy to use public-safe labels in the excluded fields list and associated documentation, replacing private-specific terms (e.g., 'private private context') with generic labels (e.g., 'omitted analysis details'). The actual behavior remains unchanged: the draft is still built exclusively from public-safe LocalBranchAnalysis slices and passes through sanitizePublicComment. Tests are updated to verify the new labels and ensure no private terminology leaks.

Suggestions

• Verify that the new EXCLUDED_PRIVATE_PR_BODY_FIELDS labels ('omitted analysis details', etc.) do not inadvertently contain any forbidden terms from FORBIDDEN_PUBLIC_LANGUAGE (they appear safe).
• Consider adding a comment in src/services/pr-body-draft.ts clarifying that EXCLUDED_PRIVATE_PR_BODY_FIELDS is for documentation only and does not affect field exclusion (which is handled by the PrBodyDraftSource type).

Worth double-checking

• The change alters the structured draft's excludedPrivateFields array (shown to MCP clients). Ensure these new labels are indeed public-safe and comply with the public/private boundary.
• Confirm that the updated test regex in pr-body-draft.test.ts (/analysis|signals|readiness|actions/i) correctly matches the new labels and doesn't produce false positives/negatives.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.72%. Comparing base (25b77f1) to head (6ed716b).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #909   +/-   ##
=======================================
  Coverage   96.72%   96.72%           
=======================================
  Files         109      109           
  Lines       14750    14750           
  Branches     5340     5340           
=======================================
  Hits        14267    14267           
  Misses         95       95           
  Partials      388      388           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	6ed716b	Commit Preview URL Branch Preview URL	Jun 19 2026, 05:55 AM