fix(orb): derive a dedicated anonymization key + log export failures

Address two review findings on the always-on telemetry:

P1 — stop reusing GITHUB_WEBHOOK_SECRET as the anonymization key. A low-entropy webhook secret made the
24-char HMACs brute-forceable, and coupling the two boundaries meant rotating the webhook secret would
silently break repo-hash dedup continuity on the collector. Derive a DEDICATED, domain-separated key
from GITHUB_APP_PRIVATE_KEY (high-entropy RSA material) via HMAC(appKey, "gittensory-orb-anon-v1"), and
gate export on the App private key. No new operator config; the webhook secret stays single-purpose.

P2 — the always-on hourly export cron no longer swallows errors silently; it logs a structured
selfhost_orb_export_error (message) so operators can detect reliability issues.

Author: JSONbored

.env.example

@@ -170,8 +170,9 @@ GITTENSORY_REVIEW_DRAFT=false
 #
 # WHAT IS SENT (per resolved PR, hourly): the gate verdict, the realized outcome (merged/closed), a reversal
 # flag, a bucketed reason category, and cycle time. NEVER sent: repo/owner/PR names, commit SHAs, code,
-# diffs, comments, or logins. Repo/PR identifiers are HMAC-anonymized with YOUR OWN GitHub App webhook
-# secret (GITHUB_WEBHOOK_SECRET), so even gittensory (running the collector) can never de-anonymize them.
+# diffs, comments, or logins. Repo/PR identifiers are HMAC-anonymized with a DEDICATED key derived from YOUR
+# OWN App private key (GITHUB_APP_PRIVATE_KEY) — high-entropy and independent of your webhook secret, so even
+# gittensory (running the collector) can never de-anonymize them.
 # The export carries no shared key; the collector treats it as untrusted, rate-limited, aggregate-only data.
 # ORB_AIR_GAP=false                          # air-gapped/OFFLINE deployments only: compute locally, never send
 # ORB_ANONYMIZE=true                         # HMAC-hash repo/PR before export (default true; false = raw names)

src/selfhost/orb-collector.ts

@@ -4,15 +4,16 @@
 // collector so the gate can be calibrated across the whole self-host fleet.
 //
 // Export is ALWAYS ON once the GitHub App is configured (the fleet-telemetry contract of self-hosting) —
-// there is no opt-out flag. It self-gates on a configured App webhook secret (no App → no review data to
-// export anyway), and uses that secret as the per-instance anonymization key.
+// there is no opt-out flag. It self-gates on a configured App private key (no App → no review data to
+// export anyway), from which it derives a DEDICATED, domain-separated anonymization key (so it never
+// reuses the webhook-verification secret and survives webhook-secret rotation).
 //   ORB_COLLECTOR_URL=<url>   — endpoint (default: gittensory's hosted collector)
 //   ORB_AIR_GAP=true          — air-gapped/offline deployments only: compute locally, never send
 //   ORB_ANONYMIZE=true        — HMAC-hash repo/PR before export (default: true)
 //
 // No diffs, no code, no comments, no logins, no commit SHAs — only verdict + outcome + reversal + a bucketed
-// reason category + cycle time, with repo/PR identifiers HMAC'd by THIS instance's own secret (the collector
-// holds no instance secret, so it can never de-anonymize).
+// reason category + cycle time, with repo/PR identifiers HMAC'd by a key the collector never holds (so it
+// can never de-anonymize).
 import { createHash, createHmac } from "node:crypto";
 import { incr } from "./metrics";
 
@@ -125,11 +126,16 @@ export async function exportOrbBatch(db: D1Database, batchSize = 200, fetchFn: t
   // Always on (no opt-out). Air-gapped/offline deployments may suppress the outbound call.
   if ((process.env.ORB_AIR_GAP ?? "").toLowerCase() === "true") return 0;
 
-  // gittensory's hosted collector. No shared secret is sent: repo/PR identifiers are HMAC'd with THIS
-  // instance's OWN GitHub App webhook secret, so the collector can never de-anonymize them.
+  // No App configured → no review data to export anyway. The App's PRIVATE KEY (high-entropy RSA material)
+  // gates export and seeds anonymization; the webhook-verification secret is never reused here.
+  const appKey = process.env.GITHUB_APP_PRIVATE_KEY ?? "";
+  if (!appKey) return 0;
+
+  // gittensory's hosted collector. No shared secret is sent: repo/PR identifiers are HMAC'd with a DEDICATED,
+  // domain-separated key derived from THIS instance's App private key — so it's high-entropy (not brute-forceable),
+  // single-purpose (independent of webhook-secret rotation), and the collector can never de-anonymize them.
   const collectorUrl = process.env.ORB_COLLECTOR_URL ?? "https://gittensory-api.aethereal.dev/v1/orb/ingest";
-  const secret = process.env.GITHUB_WEBHOOK_SECRET ?? "";
-  if (!secret) return 0; // App not configured yet — no anonymization key, and no review data to export
+  const secret = createHmac("sha256", appKey).update("gittensory-orb-anon-v1").digest("hex");
   const anonymize = (process.env.ORB_ANONYMIZE ?? "true").toLowerCase() !== "false";
   const instance = instanceId();
 

src/server.ts

@@ -290,7 +290,7 @@ async function main(): Promise<void> {
   const runOrbExport = () =>
     exportOrbBatch(backend.db)
       .then((n) => { if (n > 0) console.log(JSON.stringify({ event: "selfhost_orb_export", exported: n })); })
-      .catch(() => undefined);
+      .catch((error) => console.error(JSON.stringify({ level: "error", event: "selfhost_orb_export_error", error: error instanceof Error ? error.message : "unknown error" })));
   void runOrbExport(); // flush any pending events at startup
   setInterval(runOrbExport, 3_600_000); // then hourly
 

test/unit/selfhost-orb-collector.test.ts

@@ -47,18 +47,18 @@ describe("bucketReasonCode()", () => {
 describe("exportOrbBatch() — always-on; reads review_audit, ships anonymized reversal-aware signal", () => {
   beforeEach(() => {
     resetMetrics();
-    process.env.GITHUB_WEBHOOK_SECRET = "test-secret"; // the App secret doubles as the anonymization key
+    (process.env as NodeJS.Dict<string>).GITHUB_APP_PRIVATE_KEY = "test-private-key"; // seeds the derived anonymization key
     process.env.ORB_APP_ID = "555";
     process.env.ORB_ANONYMIZE = "true";
     delete process.env.ORB_AIR_GAP;
     delete process.env.ORB_COLLECTOR_URL;
   });
   afterEach(() => {
-    for (const k of ["GITHUB_WEBHOOK_SECRET", "ORB_APP_ID", "ORB_ANONYMIZE", "ORB_AIR_GAP", "ORB_COLLECTOR_URL", "GITHUB_APP_ID"]) delete (process.env as NodeJS.Dict<string>)[k];
+    for (const k of ["GITHUB_APP_PRIVATE_KEY", "ORB_APP_ID", "ORB_ANONYMIZE", "ORB_AIR_GAP", "ORB_COLLECTOR_URL", "GITHUB_APP_ID"]) delete (process.env as NodeJS.Dict<string>)[k];
   });
 
-  it("returns 0 when the App secret is not configured (App not set up → nothing to export)", async () => {
-    delete (process.env as NodeJS.Dict<string>).GITHUB_WEBHOOK_SECRET;
+  it("returns 0 when the App private key is not configured (App not set up → nothing to export)", async () => {
+    delete (process.env as NodeJS.Dict<string>).GITHUB_APP_PRIVATE_KEY;
     const db = makeDb();
     await audit(db, "o/r", 1, "gate_decision", "merge", "2026-01-01T00:00:00Z");
     await audit(db, "o/r", 1, "pr_outcome", "merged", "2026-01-01T01:00:00Z");