fix(orb): parse the AMS PR outcome from an anchored dedupKey, not a substring scan

[shin-core]

What & why

Closes #9703.

ams_pr_outcome is the only notification kind whose rendered content depends on a field that is not
on the event. buildAmsPrOutcomeNotification recovered the merged/closed decision with
event.dedupKey.includes(":merged:") — the dedupKey was the entire carrier. Three things made that
unsafe:

1. Nothing validated the key's shape — normalizeAmsNotificationEventInput only checked non-empty
   string, so any ams_pr_outcome whose key lacked :merged: rendered as "closed without merge",
   including for a real merge.
2. Two hand-duplicated producers wrote the format literal with nothing pinning them together.
3. The server-side builder has no non-test callers — the miner's copy is what runs, so a reorder
   of decision/closedAt there would silently flip every merge notification and nothing would fail.

Change

• ams-events.ts: AMS_PR_OUTCOME_DEDUP_KEY_PATTERN (anchored, decision as capture group) +
  parseAmsPrOutcomeDecision (the single reader). The builder and the pattern derive from one shared
  prefix constant — the format is spelled once, not twice.
• normalizeAmsNotificationEventInput returns null for an ams_pr_outcome whose dedupKey doesn't
  parse (the MCP/self-host path reaches the normalizer directly, so validating only the HTTP zod schema
  isn't enough); every other AMS kind's validation is unchanged.
• service.ts uses parseAmsPrOutcomeDecision; a null parse renders the closed copy, never an
  unproven merge — unreachable from ingest now the normalizer rejects such a key upstream.

No decision field is added to the event/schema (out of scope).

Validation

• Pattern/parser tests (well-formed round-trips for both decisions; null for wrong-prefix,
  no-decision, unknown-decision, and the loose-:merged:-elsewhere trap).
• Normalizer rejects a malformed ams_pr_outcome key while other AMS kinds keep their loose check.
• buildAmsPrOutcomeNotification renders the closed copy on a null parse.
• A producer-parity test pins the miner's buildAmsPrOutcomePayload output against the server
  pattern for both decisions (the drift guard).
• Bug-catch verified: reverting the normalizer/service fails the new assertions.
• 100% patch coverage on both source files.

[superagent-security]

🚨 Contributor flagged. Click here for more info: Superagent Dashboard

[loopover-orb]

Warning

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-29 06:19:19 UTC}

5 files · 1 AI reviewer · no blockers · CI green · unstable

⏸️ Suggested Action - Manual Review

• Required AI review was skipped by a submitter-reputation downgrade: This repository requires blocking AI review, and the submitter's recent-submission signal downgraded this PR to deterministic-only checks. Those checks do not read code semantics, so the gate is held for human review instead of passing automatically.

Review summary
This PR replaces a loose `dedupKey.includes(":merged:")` substring check with an anchored regex + single parser (`parseAmsPrOutcomeDecision`), used consistently by the builder, the notification renderer, and a new ingest-time validation in `normalizeAmsNotificationEventInput`. The producer/consumer drift guard test in `miner-ams-notifications.test.ts` is a solid addition given the stated risk that the miner's copy is what actually runs. The anchored pattern is a real improvement, but because `.+` is greedy and repoFullName/closedAt are still attacker(-miner)-controlled free text reaching the same dedupKey string, a crafted key can still smuggle a fake trailing `#N:decision:` segment that regex backtracking will match over the true one — this narrows but does not fully close the original class of spoofing bug the PR is fixing.

Nits — 5 non-blocking

• `AMS_PR_OUTCOME_DEDUP_KEY_PATTERN`'s greedy `.+` before `#\d+:(merged|closed):.+$` will backtrack to the right-most `#N:decision:...` substring in the key, so a self-reported dedupKey with a crafted repoFullName or closedAt (e.g. `...closed:2026#8:merged:x`) can still flip the parsed decision — worth tightening the character classes (e.g. disallow `#`/`:` inside the closedAt segment) or adding an explicit `decision` field to the event schema as the description notes is 'out of scope' but would close this gap for good.
• External brief flags the `orb(notifications): stop deriving the AMS PR outcome by substring-scanning a client dedupKey #9703` inline reference as an unexplained magic number in `ams-events.ts:117`; consider extracting it to a named constant for consistency with how the rest of the file cites issues in comments only, not code.
• src/notifications/ams-events.ts: consider validating that the dedupKey's embedded repoFullName/pullNumber matches the event's own `repoFullName`/`pullNumber` fields at normalize time, closing the crafted-key class entirely rather than relying on regex shape alone.
• Given the PR description says a real `decision` field on the event schema is out of scope, it may be worth filing a fast-follow issue for that so the dedupKey stops being overloaded as the sole carrier long-term.
• Required AI review was skipped by a submitter-reputation downgrade — Review this PR manually, or run AI review with a trusted override, before merging.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ⚠️ Gate result — Not blocking (Advisory; not blocking this PR.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#9703
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 38 registered-repo PR(s), 26 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	shin-core; Gittensor profile; 38 PR(s), 0 issue(s).
Improvement	✅ Minor	risk: clean · value: minor

Linked issue satisfaction

Addressed
The diff adds the anchored AMS_PR_OUTCOME_DEDUP_KEY_PATTERN and parseAmsPrOutcomeDecision derived from one shared prefix constant, makes the ams_pr_outcome-only validator reject malformed keys while leaving other AMS kinds untouched, swaps service.ts's substring scan for the parser with a fail-safe closed default, and adds the required parity test pinning buildAmsPrOutcomePayload's output against

Review context

• Author: shin-core
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is registered but has no active allocation in the current snapshot.
• Public profile languages: not available
• Official Gittensor activity: 38 PR(s), 0 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Start here: Await review-lane availability.
• Then work through the remaining 2 steps in the Signals table above.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

Decision record

• action: hold · clause: ai_review_inconclusive
• config: 7bd355d8080f99f0179bd15fe0acd4275bcc60c2e3390caefe9c570eb60cce34 · pack: oss-anti-slop · ci: passed
• record: ea481806cae73e931076885748f0b68075a93df6a7ca9b2bd56e4ec5acbf257b (schema v5, head fb376bd)

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.63%. Comparing base (ef6d580) to head (fb376bd).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9752      +/-   ##
==========================================
+ Coverage   76.58%   76.63%   +0.04%     
==========================================
  Files         282      284       +2     
  Lines       59419    59529     +110     
  Branches     6553     6585      +32     
==========================================
+ Hits        45508    45618     +110     
  Misses      13629    13629              
  Partials      282      282              

Flag	Coverage Δ
backend	100.00% <100.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/notifications/ams-events.ts	100.00% <100.00%> (ø)
src/notifications/service.ts	100.00% <100.00%> (ø)

[JSONbored]

Rejecting for this reason:

The anchored pattern is a real improvement, but because `.+` is greedy and repoFullName/closedAt are still attacker(-miner)-controlled free text reaching the same dedupKey string, a crafted key can still smuggle a fake trailing `#N:decision:` segment that regex backtracking will match over the true one — this narrows but does not fully close the original class of spoofing bug the PR is fixing.