fix(scripts): drift-check forbidden-content.ts's secret patterns against secret-patterns.ts (#8674)

[RealDiligent]

Problem

Closes #8674.

scripts/forbidden-content.ts's FORBIDDEN_CONTENT is a third hand-copy (#7433) of the HARD_SECRET_KINDS regex bodies in src/review/secret-patterns.ts — used by the four package-manifest checkers to reject a packed tarball embedding a provider secret. Unlike the REES copy, it was never in check-engine-parity.ts's NAMED_TWIN_PAIRS, so a tightened/added HARD_SECRET_KINDS pattern would silently leave packaged tarballs scanning with a stale body.

Fix

Register forbidden-content.ts as a new NamedTwinPair against secret-patterns.ts, with FORBIDDEN_CONTENT_MARKERS covering the distinctive backslash-free core of each of the 13 exactly-copied HARD_SECRET_KINDS bodies (aws_access_key … jwt). github_token/github_pat/private_key_block are deliberately excluded (forbidden-content keeps looser pre-#7433 bodies for those — a false-fail otherwise), mirroring how SECRET_DETECTION_MARKERS excludes its own divergent kinds.

Tests

A drift-fail case + identity/exclusion assertions; the existing 'all named pairs pass against the real repo' guard now also covers this pair (13 markers verified present in both live files). git diff --check clean. Rebased onto latest main (past #8719 and #8723's parity changes).

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.80%. Comparing base (6735ef1) to head (3a8b097).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8736      +/-   ##
==========================================
+ Coverage   90.56%   93.80%   +3.24%     
==========================================
  Files          96      797     +701     
  Lines       22490    79508   +57018     
  Branches     3884    24094   +20210     
==========================================
+ Hits        20367    74584   +54217     
- Misses       1945     3555    +1610     
- Partials      178     1369    +1191     

Flag	Coverage Δ
backend	95.08% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 701 files with indirect coverage changes

[loopover-orb]

Warning

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-26 05:09:28 UTC}

2 files · 1 AI reviewer · no blockers · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
This registers scripts/forbidden-content.ts as a new drift-checked twin pair against src/review/secret-patterns.ts, closing the gap called out in #8674 where a third hand-copy of HARD_SECRET_KINDS regex bodies had no CI tripwire. The marker set correctly anchors on the backslash-free regex core (avoiding the single-vs-double-backslash false-fail between regex literals and string bodies) and deliberately excludes the three kinds (github_token/github_pat/private_key_block) that forbidden-content.ts intentionally keeps looser — each marker checked against the current secret-patterns.ts source in this review matches. Tests mirror the existing SECRET_DETECTION_TWIN_PAIR pattern exactly (drift-fail reproduction, exclusion assertions, and the real-repo regression guard now covering all 7 named pairs), and CI is green.

Nits — 3 non-blocking

• scripts/check-engine-parity.ts's sendgrid_key marker (`[A-Za-z0-9_-]{43}(?![A-Za-z0-9_-])`) is a very generic 43-char class with no `SG.` prefix anchor — it's only used for `.includes()` presence-checking so it's functionally safe, but consider a slightly more distinctive substring if one exists in forbidden-content.ts's actual body.
• The new `FORBIDDEN_CONTENT_TWIN_PAIR`/`FORBIDDEN_CONTENT_MARKERS` doc comment is long (matching the file's existing convention) but could link back to `SECRET_DETECTION_MARKERS`'s comment more explicitly since the exclusion rationale is near-identical.
• Nothing to add beyond the nits above — the change is narrow, well-tested, and follows the file's own established pattern for named twin pairs.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#8674
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 328 registered-repo PR(s), 136 merged, 37 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	RealDiligent; Gittensor profile; 328 PR(s), 37 issue(s).
Improvement	✅ Minor	risk: clean · value: minor

Linked issue satisfaction

Addressed
The PR registers scripts/forbidden-content.ts as a new NamedTwinPair in NAMED_TWIN_PAIRS with a dedicated FORBIDDEN_CONTENT_MARKERS set covering the shared HARD_SECRET_KINDS bodies, and adds tests for registration, exclusion of the deliberately divergent kinds, and drift-detection failure, plus the existing 'all named pairs pass against real repo' guard now covers this pair for live-source calibra

Review context

• Author: RealDiligent
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 328 PR(s), 37 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Start here: Triage stale or unlinked PRs.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review