fix(orb): authorize feedback votes against the answer's real command policy

[galuis116]

Summary

• Thread the answered command's real auth context (commandName, commandAuthorization, commandRateLimitPolicy, open/non-draft PR state) into authorizeFeedbackActor → isAuthorizedCommandActor, instead of silently using the "preflight" default.
• A non-miner PR author can now record feedback on their own chat answer when commandRateLimitPolicy: "hold" (previously denied as pr_author_not_confirmed_miner).
• Per-repo commandAuthorization overrides are now honored for feedback votes on that command.

Closes #8682

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Validation

• git diff --check
• npm run actionlint — not applicable (no workflow changes)
• npm run typecheck — deferred to CI
• Targeted unit tests: queue-4.test.ts #8682 cases + existing feedback usefulness/owner-feedback regressions (pass locally)
• npm run test:coverage — deferred to CI (codecov/patch on src/**)
• npm run test:workers — not applicable
• npm run build:mcp — not applicable
• npm run test:mcp-pack — not applicable
• npm run ui:openapi:check — not applicable (no UI/OpenAPI changes)
• npm run ui:lint — not applicable
• npm run ui:typecheck — not applicable
• npm run ui:build — not applicable
• npm audit --audit-level=moderate — deferred to CI
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• UI/MCP/workers/actionlint skipped — this PR only touches authorizeFeedbackActor wiring and queue unit tests. Full typecheck/coverage/audit left to CI.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

Not applicable — no visible UI/frontend/docs/extension changes.

Notes

• Confirmed no open PR already targets fix(orb): authorizeFeedbackActor evaluates every command's feedback vote against the default preflight policy, never the actual command's #8682 immediately before push.
• Avoids conflict with open fix(orb): wire env into all isProtectedAutomationAuthor production callers #8742 (different call sites). Pattern matches recent merged focused orb fixes: single-issue wiring bug + tests that fail if context is dropped again.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.19%. Comparing base (a93ae0a) to head (2a6180b).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8744      +/-   ##
==========================================
+ Coverage   90.56%   91.19%   +0.63%     
==========================================
  Files          96       97       +1     
  Lines       22490    25684    +3194     
  Branches     3884     5019    +1135     
==========================================
+ Hits        20367    23423    +3056     
- Misses       1945     1994      +49     
- Partials      178      267      +89     

Flag	Coverage Δ
backend	95.67% <100.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/queue/processors.ts	95.67% <100.00%> (ø)

[loopover-orb]

Tip

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-26 05:25:27 UTC}

2 files · 1 AI reviewer · no blockers · readiness 95/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This PR threads the answered command's real auth context (commandName, commandAuthorization override, commandRateLimitPolicy, PR open/non-draft state) into authorizeFeedbackActor → isAuthorizedCommandActor, replacing the silent 'preflight' default that was causing incorrect denials (e.g. pr_author_not_confirmed_miner) or ignored per-repo overrides. The wiring is traced correctly: settings are loaded live via resolveRepositorySettings before the call, and cachedPullRequest?.state/isDraft feed pullRequestOpenAndNotDraft, mirroring the existing chat call site. Two new tests exercise the previously-broken paths (hold rate-limit chat pr_author authorization, and a commandAuthorization override for next-action) and assert against real audit-event outcomes rather than fabricated states.

Nits — 4 non-blocking

• src/queue/processors.ts:14654 — `command as LoopOverMentionCommandName` casts the DB-stored `answer.command` string without validation; if an answer was ever persisted with a stale/removed command name, this cast silently lies to isAuthorizedCommandActor instead of falling through to a safe default.
• The PR is titled/scoped as an auth-context fix but pullRequestOpenAndNotDraft is derived from `cachedPullRequest` (DB cache) rather than live state — worth confirming this matches the live-state convention used elsewhere in this file per the queue-signals-config guidance, since a stale cached PR record could momentarily mis-authorize a vote on a just-merged or just-drafted PR.
• Consider a comment or guard noting why `command` (sourced from `answer.command ?? feedback.command ?? "unknown"`) is safe to cast to `LoopOverMentionCommandName` at src/queue/processors.ts:14654, or validate it against the known command set before passing it through.
• If pullRequestOpenAndNotDraft's use of cachedPullRequest instead of a live fetch is intentional (cost tradeoff), a one-line comment noting that decision would help future readers avoid re-litigating it.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#8682
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 1881 registered-repo PR(s), 1221 merged, 56 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	galuis116; Gittensor profile; 1881 PR(s), 56 issue(s).
Improvement	✅ Minor	risk: clean · value: minor

Linked issue satisfaction

Addressed
The diff threads commandName, commandAuthorizationPolicy, commandRateLimitPolicy, and pullRequestOpenAndNotDraft from the answered command's real settings into authorizeFeedbackActor and isAuthorizedCommandActor, matching the issue's requirement, and adds two new tests covering the pr_author/hold path and a custom commandAuthorization override on feedback voting as requested.

Review context

• Author: galuis116
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: JavaScript, Python, TypeScript, Dart, HTML, MDX, Rust, C++
• Official Gittensor activity: 1881 PR(s), 56 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Start here: Triage stale or unlinked PRs.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.