Summary
The mirror issue API returns an inline solving_pr for any merged PR that closed an issue, but it neither filters nor exposes the solving PR’s base_ref / default_branch.
This breaks parity with the OSS PR scoring path, where merged PRs are rejected if they target a non-acceptable branch. In gittensor, issue discovery only checks that solving_pr.state == "MERGED" and then scores it, so an issue can receive discovery credit even when the solving PR would be rejected from PR scoring because it merged into a non-scoring branch.
Reproduction Steps
- Run the DAS locally with local Postgres/Redis and a dummy GitHub App key:
- Seed a repo, a closed issue, and a solving PR merged into a non-scoring branch:
- Query the mirror issue endpoint:
curl -sS \
'http://127.0.0.1:6970/api/v1/miners/111/issues?since=2026-05-01T00:00:00Z'
- Validate the same shape in
gittensor:
- Compare with normal PR scoring branch eligibility:
Actual Result
The mirror returns a solving_pr for the non-scoring-branch PR:
{
"issue_number": 9,
"state": "CLOSED",
"state_reason": "COMPLETED",
"solved_by_pr": 7,
"solving_pr": {
"pr_number": 7,
"author_github_id": "222",
"state": "MERGED",
"merged_at": "2026-05-20T01:00:00+00:00",
"edited_after_merge": false,
"head_sha": "1111111111111111111111111111111111111111",
"base_sha": "2222222222222222222222222222222222222222",
"merge_base_sha": "3333333333333333333333333333333333333333"
}
}
gittensor classifies and adapts it as scoreable:
classification: solved
adapted: True
discovery_base_score: 42.0
But the same PR is rejected by normal OSS PR scoring:
oss_pr_skip: True
reason: PR #7 merged to 'scratch-do-not-score' not in acceptable branches=['main']
Expected Result
Issue discovery should not award solved-issue credit for a PR that would fail the same merged-PR branch eligibility gate used by OSS contribution scoring.
Evidence
Local project execution:
Nest application successfully started
Bootstrap listening on port 6970
/api/v1/health returned 200 with db.ok=true and redis.ok=true
Root Cause
packages/das/src/api/miners/miners.service.ts builds inline solving_pr with only minimal fields. It does not include base_ref, head_ref, head_repo_full_name, or default_branch, and it does not filter by branch eligibility in SQL.
Relevant local files:
[miners.service.ts] (https://github.com/entrius/das-github-mirror/packages/das/src/api/miners/miners.service.ts):115
[gittensor issue discovery] (https://github.com/entrius/gittensor/gittensor/validator/issue_discovery/scan.py):692
[gittensor PR branch gate] (https://github.com/entrius/gittensor/gittensor/validator/oss_contributions/mirror/scoring.py):236
Security/Business Impact
This is a reward-integrity bug. A miner can receive issue-discovery credit for issues closed by PRs merged into branches that are explicitly not accepted for normal contribution scoring. That creates an inconsistent scoring policy and a practical bypass of repository branch restrictions.
Suggested Fix
Add solving PR branch eligibility to the issue-discovery path.
Recommended DAS-side fix:
- Include
base_ref, head_ref, head_repo_full_name, and default_branch in inline solving_pr.
- Or filter
solving_pr server-side so only PRs merged into acceptable branches are returned.
- Keep the validation rule aligned with
_should_skip_merged_mirror_pr.
Recommended gittensor-side defense-in-depth:
- Extend
MirrorSolvingPR with branch fields.
- Apply the same base/head branch gate before
_classify_issue returns solved or before _mirror_issue_for_scoring adapts the issue.
Summary
The mirror issue API returns an inline
solving_prfor any merged PR that closed an issue, but it neither filters nor exposes the solving PR’sbase_ref/default_branch.This breaks parity with the OSS PR scoring path, where merged PRs are rejected if they target a non-acceptable branch. In
gittensor, issue discovery only checks thatsolving_pr.state == "MERGED"and then scores it, so an issue can receive discovery credit even when the solving PR would be rejected from PR scoring because it merged into a non-scoring branch.Reproduction Steps
curl -sS \ 'http://127.0.0.1:6970/api/v1/miners/111/issues?since=2026-05-01T00:00:00Z'gittensor:Actual Result
The mirror returns a
solving_prfor the non-scoring-branch PR:{ "issue_number": 9, "state": "CLOSED", "state_reason": "COMPLETED", "solved_by_pr": 7, "solving_pr": { "pr_number": 7, "author_github_id": "222", "state": "MERGED", "merged_at": "2026-05-20T01:00:00+00:00", "edited_after_merge": false, "head_sha": "1111111111111111111111111111111111111111", "base_sha": "2222222222222222222222222222222222222222", "merge_base_sha": "3333333333333333333333333333333333333333" } }gittensorclassifies and adapts it as scoreable:But the same PR is rejected by normal OSS PR scoring:
Expected Result
Issue discovery should not award solved-issue credit for a PR that would fail the same merged-PR branch eligibility gate used by OSS contribution scoring.
Evidence
Local project execution:
Root Cause
packages/das/src/api/miners/miners.service.tsbuilds inlinesolving_prwith only minimal fields. It does not includebase_ref,head_ref,head_repo_full_name, ordefault_branch, and it does not filter by branch eligibility in SQL.Relevant local files:
[miners.service.ts] (https://github.com/entrius/das-github-mirror/packages/das/src/api/miners/miners.service.ts):115
[gittensor issue discovery] (https://github.com/entrius/gittensor/gittensor/validator/issue_discovery/scan.py):692
[gittensor PR branch gate] (https://github.com/entrius/gittensor/gittensor/validator/oss_contributions/mirror/scoring.py):236
Security/Business Impact
This is a reward-integrity bug. A miner can receive issue-discovery credit for issues closed by PRs merged into branches that are explicitly not accepted for normal contribution scoring. That creates an inconsistent scoring policy and a practical bypass of repository branch restrictions.
Suggested Fix
Add solving PR branch eligibility to the issue-discovery path.
Recommended DAS-side fix:
base_ref,head_ref,head_repo_full_name, anddefault_branchin inlinesolving_pr.solving_prserver-side so only PRs merged into acceptable branches are returned._should_skip_merged_mirror_pr.Recommended gittensor-side defense-in-depth:
MirrorSolvingPRwith branch fields._classify_issuereturnssolvedor before_mirror_issue_for_scoringadapts the issue.