chore(miner): migrate leaf-most low-fan-in lib modules to typescript (batch 2.3)

[luciferlive112116]

Closes #7302

Summary

Batch 2.3 of the Phase 2 packages/loopover-miner/lib TypeScript migration (#7302): converts the 8 leaf-most, lowest-fan-in utility modules to real TypeScript, following the same in-place-emit pattern the earlier batches (#7290 → #7331) established.

Converted modules:

• version — miner release-id resolver
• slop-assessment — miner slop scoring
• discovery-throttle — pure rate-limit → concurrency back-off
• claim-ledger-expiry — pure active-claim expiry sweep
• portfolio-queue-expiry — pure stuck-lease reclaim sweep
• prompt-injection-defense — untrusted-content injection detect/defang
• execute-local-write — real sh -c subprocess local-write runner
• cross-repo-evaluation — cross-repo readiness evaluation

Each module gains a hand-authored .ts source; tsc -p tsconfig.json emits the .js + .d.ts in place with an inline sourcemap, so the published bin/lib layout is unchanged and v8 coverage remaps onto the .ts source. Every callsite continues to import the same specifier.

The conversions are type-only: no runtime branch was added. Where strict-null narrowing was needed (e.g. number | null past a Number.isFinite guard, a leasedAt that Date.parse already coerces to NaN), a cast is used rather than a new if, keeping the emitted .js byte-faithful to the prior hand-maintained .js and the branch surface identical to what existing tests already cover.

Scope

• Narrow, single coherent change (one migration batch)
• In scope (packages/), no blockedPaths
• No secrets / tokens / wallets / trust-score / reward terms anywhere
• No changelog / site/ / CNAME / lovable edits

Validation

• tsc -p packages/loopover-miner/tsconfig.json — 0 errors (emit + --noEmit typecheck)
• eslint on all 8 .ts sources — 0 problems
• node --check on all 8 emitted .js
• Fresh clean rebuild reproduces the committed .js/.d.ts exactly (no emit drift)
• vitest run on the migrated modules' unit suites — green
• Branch current with main (rebased)

Safety

• No public/private boundary touched; no wallet/hotkey/trust/reward terms
• Behaviour preserved — no runtime branch added; emitted .js is a faithful compile of the prior .js

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[JSONbored]

I rebased mid-run because I just merged some bigger CI improvements aimed at helping efficiency/performance of our CI pipeline long term.

[codecov]

Codecov Report

❌ Patch coverage is 94.96124% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 91.99%. Comparing base (f158305) to head (830ad97).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...ckages/loopover-miner/lib/cross-repo-evaluation.ts	94.70%	0 Missing and 9 partials ⚠️
packages/loopover-miner/lib/claim-ledger-expiry.ts	86.36%	0 Missing and 3 partials ⚠️
...kages/loopover-miner/lib/portfolio-queue-expiry.ts	95.45%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7333      +/-   ##
==========================================
+ Coverage   91.03%   91.99%   +0.96%     
==========================================
  Files         714      631      -83     
  Lines       72118    51470   -20648     
  Branches    19232    15673    -3559     
==========================================
- Hits        65651    47352   -18299     
+ Misses       5427     3243    -2184     
+ Partials     1040      875     -165     

Flag	Coverage Δ
rees	?
shard-1	41.31% <17.05%> (-0.41%)	⬇️
shard-2	35.69% <78.29%> (-0.03%)	⬇️
shard-3	31.58% <6.20%> (-0.04%)	⬇️
shard-4	32.73% <9.68%> (+0.15%)	⬆️
shard-5	30.06% <28.29%> (-0.51%)	⬇️
shard-6	43.78% <12.40%> (+0.23%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
packages/loopover-miner/lib/discovery-throttle.ts	100.00% <100.00%> (ø)
packages/loopover-miner/lib/execute-local-write.ts	100.00% <100.00%> (ø)
...ges/loopover-miner/lib/prompt-injection-defense.ts	100.00% <100.00%> (ø)
packages/loopover-miner/lib/slop-assessment.ts	100.00% <100.00%> (ø)
packages/loopover-miner/lib/version.ts	100.00% <100.00%> (ø)
...kages/loopover-miner/lib/portfolio-queue-expiry.ts	95.45% <95.45%> (ø)
packages/loopover-miner/lib/claim-ledger-expiry.ts	86.36% <86.36%> (ø)
...ckages/loopover-miner/lib/cross-repo-evaluation.ts	94.70% <94.70%> (ø)

... and 90 files with indirect coverage changes

[loopover-orb]

Caution

🛑 LoopOver review result - reject/close recommended

_{Review updated: 2026-07-19 18:16:15 UTC}

24 files · 1 AI reviewer · 1 blocker · CI failing · blocked

🛑 Suggested Action - Reject/Close

Review summary
This is a mechanical JS-to-TS conversion of 8 leaf modules in packages/loopover-miner/lib, following the in-place-emit pattern from prior batches (#7290→#7331). The emitted .js for cross-repo-evaluation.js is a faithful compiled equivalent of the hand-written .js it replaces (same logic, same branches), and the .ts source adds types without introducing new runtime branches, consistent with the stated 'type-only' scope. The codecov/patch failure (94.96% vs 99% target) is real and should be addressed before merge given this repo's stated coverage bar.

Blockers

• codecov/patch is failing at 94.96% against a 99% target — for a pure type-only migration this typically means a narrowing/cast branch (e.g. the `leasedAt`/`claimedAt` NaN path in claim-ledger-expiry.ts/portfolio-queue-expiry.ts, or a warning branch in cross-repo-evaluation.ts's manifest normalizers) isn't actually exercised by the existing test suite post-conversion; identify and cover the uncovered lines/branches rather than waiving the gate.

Nits — 6 non-blocking

• packages/loopover-miner/lib/prompt-injection-defense.ts:17,20 — `whitelist` should be `allowlist` per non-inclusive terminology conventions.
• packages/loopover-miner/lib/cross-repo-evaluation.ts is now 444 lines, over the repo's 400-line soft threshold — worth a follow-up split (e.g. manifest parsing vs. evaluation) rather than blocking this migration.
• No dedicated test files were added or changed in this PR; given this is described as a pure type-only conversion the existing JS test suite should still cover the emitted .js, but confirm CI's coverage delta (see blocker) isn't masking a real gap.
• Run `vitest --coverage` locally against the changed diff.hunks to find exactly which lines dropped below 99% and add/adjust a unit test rather than accepting the codecov/patch failure.
• Consider extracting the manifest-normalization helpers (normalizeBoolean, normalizeOptionalString, normalizeRepoList) out of cross-repo-evaluation.ts into a shared module given the file-length flag.
• Code changes lack test evidence — Add focused regression tests or explain why existing coverage is sufficient.

Why this is blocked

• codecov/patch is failing at 94.96% against a 99% target — for a pure type-only migration this typically means a narrowing/cast branch (e.g. the `leasedAt`/`claimedAt` NaN path in claim-ledger-expiry.ts/portfolio-queue-expiry.ts, or a warning branch in cross-repo-evaluation.ts's manifest normalizers) isn't actually exercised by the existing test suite post-conversion; identify and cover the uncovered lines/branches rather than waiving the gate.

📋 Copy for AI agents — paste into your coding agent

Fix the following blocker(s) from this PR review:

1. codecov/patch is failing at 94.96% against a 99% target — for a pure type-only migration this typically means a narrowing/cast branch \(e.g. the \`leasedAt\`/\`claimedAt\` NaN path in claim-ledger-expiry.ts/portfolio-queue-expiry.ts, or a warning branch in cross-repo-evaluation.ts's manifest normalizers\) isn't actually exercised by the existing test suite post-conversion; identify and cover the uncovered lines/branches rather than waiving the gate.

CI checks failing

• validate
• codecov/patch — 94.96% of diff hit (target 99.00%)
• validate-tests-merge

Decision drivers

• ❌ Code review — 1 blocker (1 reviewer)
• ❌ Gate result — Blocking (Repo-configured hard blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#7302
Related work	⚠️ 3 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 178 registered-repo PR(s), 109 merged, 28 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	luciferlive112116; Gittensor profile; 178 PR(s), 28 issue(s).
Improvement	ℹ️ None detected	risk: low · value: none · LLM: minor

Linked issue satisfaction

Addressed
The diff converts cross-repo-evaluation.js to a real cross-repo-evaluation.ts source (with tsc-emitted .js/.d.ts), matching one of the eight files named in the issue's batch 2.3 list; the PR description states all 8 listed modules (version, slop-assessment, discovery-throttle, claim-ledger-expiry, portfolio-queue-expiry, prompt-injection-defense, execute-local-write, cross-repo-evaluation) were co

Review context

• Author: luciferlive112116
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 178 PR(s), 28 issue(s).
• Related work: Titles/paths share 10 meaningful terms. (issue #7300)
• Related work: Titles/paths share 10 meaningful terms. (issue #7301)
• Related work: Titles/paths share 7 meaningful terms. (PR #7336)
• Additional title-only matches omitted; title-only overlap does not block.

Contributor next steps

• Start here: Review top overlaps.
• Then work through the remaining 2 steps in the Signals table above.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[loopover-orb]

LoopOver is closing this pull request on the maintainer's behalf (CI is failing (validate, codecov/patch, validate-tests-merge); AI reviewers agree on a likely critical defect: codecov/patch is failing at 94.96% against a 99% target — for a pure type-only migration this typically means a narrowing/cast branch (e.g. the `leasedAt`/`claimedAt` NaN path in claim-ledger-expiry.ts/portfolio-queue-expiry.ts, or a warning branch in cross-repo-evaluation.ts's manifest normalizers) isn't actually exercised by the existing test suite post-conversion; identify and cover the uncovered lines/branches rather than waiving the gate.). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.