Skip to content

chore(main): release engine-and-dependents libraries - #9780

Open
JSONbored wants to merge 2 commits into
mainfrom
release-please--branches--main--groups--engine-and-dependents
Open

chore(main): release engine-and-dependents libraries#9780
JSONbored wants to merge 2 commits into
mainfrom
release-please--branches--main--groups--engine-and-dependents

Conversation

@JSONbored

@JSONbored JSONbored commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

🤖 I have created a release beep boop

contract: 3.17.0

3.17.0 (2026-07-29)

Features

  • ams: migrate the AMS miner MCP server to @loopover/contract (#9542) (9713f26), closes #9536
  • contract: add @loopover/contract, the single zod source for tool and API schemas (#9530) (95f1524)
  • contract: give the request schemas, the control plane, and the self-host endpoints one contract (#9750) (#9757) (5220a35)
  • contract: migrate every remote MCP tool contract to @loopover/contract (#9518) (#9559) (968c731)
  • mcp: discovery surfaces, registry publish, and the stdio gateway (#9526) (#9735) (983ea31)
  • mcp: generate every tool, CLI, client, and docs surface from the contract (#9521) (#9590) (bd139a5)
  • mcp: migrate the stdio MCP server's 102 tools to @loopover/contract (#9537) (#9565) (d5a5a8f)
  • mcp: one registry-driven telemetry contract at all three dispatch chokepoints (#9525) (#9579) (06a090f)
  • stats: publish a fleet accuracy trend, so the weekly table means something again (#9775) (47842ec), closes #9676

Fixes

  • contract: close the last duplications and make the .shape trap impossible (#9762) (#9765) (edbdb58)
  • release: publish @loopover/contract, and catch this class of break before it ships (#9749) (#9763) (6dd5791)
engine: 3.17.0

3.17.0 (2026-07-29)

Features

  • benchmark: anti-overfit controls — repo-level seeded split, caps, rotation (#9263) (#9600) (9942512)
  • benchmark: maintainer action-space schema and proposal validator (#9260) (#9595) (b543e1e)
  • benchmark: multi-class proposal scorer on the shared primitives (#9262) (#9599) (534dfd5)
  • benchmark: reversal-aware realized-history ground truth (#9261) (#9598) (1819298)
  • benchmark: untrusted candidate sandbox policy and fail-closed run verdict (#9264) (#9606) (3200abc)
  • gate: gate.ignoredCheckRuns — exclude a third-party check from CI resolution entirely (#9813) (84c2462)
  • proof: public per-repo proof summary, endpoint and README badge (#9569) (#9608) (7ffb51e)

Fixes

  • ci: normalize committed CRLF to LF and name the failure for what it is (#9799) (ee98373)
  • engine: accept the { kind: 'existing', repo } IdeaTarget shape in validateIdeaSubmission (#9634) (c086363)
  • engine: drop opportunity-metadata's blanket v8-ignore directives and branch-cover the scoring logic they hid (#9635) (61ab43e), closes #9616
  • engine: isolate getTenantConfig reads and normalize tenant config (#9614) (#9627) (676ba3c)
  • engine: keep renderRepoMap's output within maxOutputChars including the marker (#9633) (d997bac)
  • engine: share governor-ledger's repo-segment guard with the three normalizers that skipped it (#9625) (8e3e4f5), closes #9610
  • engine: surface discovery-index contract-version skew and actually send the version on the query wire (#9631) (80827df), closes #9615
  • engine: validate the repo and PR number behind buildResultsPayload's customer link (#9611) (#9632) (5aa94b7)
  • eval: commit each published score to the corpus a reader can download (#9811) (bcdd2f8), closes #9805
  • openapi: declare the predictedGate/dataQuality fields branch-analysis actually returns (#9531) (#9587) (a858cbc)
mcp: 3.17.0

3.17.0 (2026-07-29)

Features

  • contract: add @loopover/contract, the single zod source for tool and API schemas (#9530) (95f1524)
  • contract: migrate every remote MCP tool contract to @loopover/contract (#9518) (#9559) (968c731)
  • mcp: add validate:mcp, the contract validator that enforces all three servers (#9520) (#9575) (0e990a3)
  • mcp: discovery surfaces, registry publish, and the stdio gateway (#9526) (#9735) (983ea31)
  • mcp: generate every tool, CLI, client, and docs surface from the contract (#9521) (#9590) (bd139a5)
  • mcp: migrate the stdio MCP server's 102 tools to @loopover/contract (#9537) (#9565) (d5a5a8f)
  • mcp: one registry-driven telemetry contract at all three dispatch chokepoints (#9525) (#9579) (06a090f)

Fixes

  • build: migrate loopover-miner/loopover-mcp to out-of-place dist/ emit (#8590) (c896797)
  • contract: close the last duplications and make the .shape trap impossible (#9762) (#9765) (edbdb58)
  • deps: resolve postcss + tar audit findings via overrides (#8612) (bca96ff)
  • mcp: await PostHog flush via unit-tested stdio wrapper (#8738) (7ee07cc), closes #8690
  • mcp: correct loopover_check_issue_slop description and drop the dead issue-slop rubric (#8959) (fcecf0c), closes #8907
  • mcp: exit the CLI cleanly on a broken-pipe stdout/stderr error (#8731) (2fc27bc), closes #8691
  • mcp: mirror loopover_clear_selftune_override in the CLI stdio package (#9300) (#9361) (09eb223)
  • mcp: stop --json=false and --exit-code=false enabling the flag they disable (#8725) (60f9f8f)
  • security: close two open GitHub Security Advisories (#9281) (29591ca)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @loopover/contract bumped from ^0.1.0 to ^3.17.0
      • @loopover/engine bumped from ^3.16.0 to ^3.17.0
miner: 3.17.0

3.17.0 (2026-07-29)

Features

  • ams: migrate the AMS miner MCP server to @loopover/contract (#9542) (9713f26), closes #9536
  • contract: give the request schemas, the control plane, and the self-host endpoints one contract (#9750) (#9757) (5220a35)
  • mcp: discovery surfaces, registry publish, and the stdio gateway (#9526) (#9735) (983ea31)
  • mcp: generate every tool, CLI, client, and docs surface from the contract (#9521) (#9590) (bd139a5)
  • mcp: migrate the stdio MCP server's 102 tools to @loopover/contract (#9537) (#9565) (d5a5a8f)
  • mcp: one registry-driven telemetry contract at all three dispatch chokepoints (#9525) (#9579) (06a090f)
  • miner: add a claim reclaim CLI to expire orphaned soft-claims (#9717) (edf0883), closes #9686
  • miner: add calibration backtest-eligibility for ContributionProfile replay (#8572) (346c183)
  • miner: capture bounded candidate context in eligibility-exclusion metadata (#8561) (f79f827)
  • miner: extract contribution rules from AGENTS.md/CLAUDE.md (#8518) (e25cffe)
  • miner: record feasibility-verdict reasons as rule-fired signals on the infeasible path (#8569) (1c7c3a7), closes #8543
  • miner: run the target repo's own test/lint/build commands before opening a PR (#8819) (e10abf2)
  • miner: wire deny-hook synthesis to a live consumer and give it an operator CLI (#8806) (#8817) (33bacda)
  • miner: wire Phase 7 calibration runner into calibration snapshot CLI (#8503) (4bfb322)
  • orb: salvageability axis — hold fixable, well-authored PRs instead of one-shot-closing (#8986) (7fd84ff)
  • selfhost: PostHog AI observability across ORB and AMS (#8623) (a9d9c0e)

Fixes

  • build: migrate loopover-miner/loopover-mcp to out-of-place dist/ emit (#8590) (c896797)
  • engine: surface discovery-index contract-version skew and actually send the version on the query wire (#9631) (80827df), closes #9615
  • engine: treat an Infinity WIP cap as uncapped, not collapsed to 0 (#8945) (6aaea39)
  • eval: commit each published score to the corpus a reader can download (#9811) (bcdd2f8), closes #9805
  • miner: add blocked_own_open_pr to the AttemptCliResult union (#9384) (42e1015)
  • miner: AmsPolicySpec parse warnings are computed but never surfaced to the operator (#8978) (3369ebc), closes #8853
  • miner: carry assignees through normalizeCandidate in opportunity-ranker (#9343) (b554957)
  • miner: compare-and-set the orphan reclaim so a stale probe cannot free a live re-acquired slot (#8992) (8444812)
  • miner: cover worktree-allocator's worktree_slots in purge-cli's right-to-be-forgotten sweep (#8570) (6c22ccd)
  • miner: delegate three resolve*DbPath helpers to resolveLocalStoreDbPath (#8336) (#8524) (ee4fa21)
  • miner: delete the orphaned portfolio chat-action duplicate (#8662) (1cc2146)
  • miner: drop stale ProcessEnv casts on resolveReplaySnapshotDbPath (#8768) (7b2104d), closes #8642
  • miner: fail acquire() on an attempt_id/repo mismatch (#8964) (266b07d)
  • miner: fall back to global config.apiUrl in loopoverApiUrl (#8937) (4dfe15d)
  • miner: governor reputation-history read-modify-write is unguarded, unlike sibling scalar-state writes (#8988) (62e6d25), closes #8855
  • miner: governor-chokepoint-persisted's load-evaluate-save cycle isn't atomic (#8993) (49a27c2), closes #8856
  • miner: include laptop-state in doctor integrity and migrate store lists (#8749) (713145f), closes #8641
  • miner: log discovery-index query failures before failing open (#9346) (ab6a44d)
  • miner: make governor-run-halt's ledger recording a genuine transition detector (#9367) (6c220b3)
  • miner: printHelp() omits the working deny-hooks subcommand (#8933) (1eeaae1), closes #8851
  • miner: reclaim orphaned worktree allocations on every acquire() (#8918) (eab6ecf)
  • miner: refuse a duplicate attempt when this miner already has an open PR for the exact issue (#8808) (#8815) (d5ec15a)
  • miner: reject a portfolio-queue identifier containing the '::' composite-id separator (#8925) (32ee72e)
  • miner: replace never-registered run with loop in fleet-mode manifests (#9524) (6bb8588)
  • miner: resolve prediction correct/incorrect in metrics CLI (#8510) (048aeb7)
  • miner: route orb-export, deny-hook-synthesis, and laptop-init through openLocalStoreDb (#8319) (#8529) (219d5a7)
  • miner: self-review-context never supplies recent-merged-PR history, contradicting its own "same fidelity" claim (#8969) (987f7ce), closes #8852
  • miner: surface verification payload in attempt-cli JSON for verification_failed (#9372) (a58ce3d)
  • miner: wire AMS policy resolver to the documented discovery order (#9106) (f2f32cc), closes #8863
  • orb: webhook redelivery, reputation cadence, DB retention, and gate severity fidelity (#9237) (d2c8d27)
  • packaging: ship the LICENSE @loopover/miner declares, and assert it everywhere (#9787) (122a283)
  • review: auto-clear stale manual-review lock-contention hold; sync engine gate-decision twin (#9107) (6aacf08)
  • review: default cross-issue copycat/reward-farming dedupe on for reward-eligible repos (#9226) (b251912)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @loopover/contract bumped from ^0.1.0 to ^3.17.0
      • @loopover/engine bumped from ^3.16.0 to ^3.17.0

This PR was generated with Release Please. See documentation.

@loopover-orb

loopover-orb Bot commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏳ LoopOver is waiting…

LoopOver has seen this pull request and is waiting on CI checks to finish before reviewing it. This comment will update once the review runs.

🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟨 Waiting

@superagent-security

superagent-security Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

Superagent didn't find any vulnerabilities or security issues in this PR.

@codecov

codecov Bot commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown

❌ 7 Tests Failed:

Tests completed Failed Passed Skipped
25173 7 25166 21
View the top 3 failed test(s) by shortest run time 
test/unit/check-server-manifest-script.test.ts > the anti-rot path guard (#9526) > the real repository satisfies both halves
Stack Traces | 0.014s run time 
AssertionError: expected [ Array(2) ] to deeply equal []

- Expected
+ Received

- []
+ [
+   {
+     "detail": "must equal @loopover/mcp's 3.17.0 (release automation owns it), got 3.15.2",
+     "field": "version",
+   },
+   {
+     "detail": "must equal @loopover/mcp's 3.17.0, got 3.15.2",
+     "field": "packages[0].version",
+   },
+ ]

 ❯ test/unit/check-server-manifest-script.test.ts:48:31
test/unit/config-templates.test.ts > config/examples review templates (#1682) > loopover.full.yml body matches .loopover.yml.example from WHERE IT LIVES onward
Stack Traces | 0.0288s run time 
AssertionError: expected '# WHERE IT LIVES (first match wins):\…' to be '# WHERE IT LIVES (first match wins):\…' // Object.is equality

- Expected
+ Received

@@ -260,29 +260,10 @@
    # column or dashboard toggle.
    advisoryCheckRuns:
      - name: Contributor trust
        appSlug: example-security-app

-   # Check-runs to IGNORE ENTIRELY (#9810) — the stronger sibling of advisoryCheckRuns above. Same
-   # spoof-resistant { name, appSlug } matching, but a matched run is treated as if it did not exist: it never
-   # gates CI, never counts as "still running", and — unlike advisory — never routes the PR to a manual-review
-   # hold either. Its conclusion is surfaced informationally only.
-   #
-   # Use this when a check's verdict carries no signal for YOUR repo while OTHER checks from the same app stay
-   # meaningful. The motivating case: a vendor app publishes both a real security scan AND a heuristic
-   # contributor-trust score. The scan is worth gating on; the trust score fails for perfectly good
-   # contributors, and listing it under advisoryCheckRuns still converts every one of their otherwise-clean PRs
-   # into a manual review — automation replaced by a queue of human decisions, and contributors left wondering
-   # whether they are being judged fairly. Ignoring the trust check keeps the scan's protection and drops the
-   # noise. If BOTH lists name the same check, ignore wins (it is the stronger, more explicit intent).
-   #
-   # List of { name, appSlug }, or omit. Default: not configured (byte-identical behavior for every repo that
-   # doesn't opt in). Config-as-code only — no DB column or dashboard toggle.
-   ignoredCheckRuns:
-     - name: Contributor trust
-       appSlug: example-security-app
-
    # Promote a confident AI-judgment-only finding (one the reviewer itself placed under "Blockers", never
    # a "Nit") into a real, deterministic gate blocker instead of leaving it advisory (#3907). Only matters
    # for repos already running the registry content lane (see contentLane below) — content/registry repos
    # have no schema/lint/codecov net to catch a semantically-wrong-but-structurally-valid defect, so their
    # own AI reviewer's judgment is the only thing that ever catches it.

 ❯ test/unit/config-templates.test.ts:39:57
test/unit/agent-approval-queue.test.ts > agent approval queue (#779) > falls back to expectedCiContexts when the accept-time branch-protection read fails
Stack Traces | 0.0365s run time 
AssertionError: expected "vi.fn()" to be called with arguments: [ { …(29) }, 'owner/repo', 'h7', …(4) ]

Received:

  1st vi.fn() call:

@@ -46,12 +46,13 @@
        "send": [Function send],
      },
    },
    "owner/repo",
    "h7",
-   Any<String>,
+   "test-installation-token",
    Set {
      "build",
    },
-   Any<String>,
+   "installation:5",
+   null,
    null,
  ]


Number of calls: 1

 ❯ test/unit/agent-approval-queue.test.ts:617:34
test/unit/agent-approval-queue.test.ts > agent approval queue (#779) > unions branch-protection contexts into the accept-time live CI re-check
Stack Traces | 0.0579s run time 
AssertionError: expected "vi.fn()" to be called with arguments: [ { …(29) }, 'owner/repo', 'h7', …(4) ]

Received:

  1st vi.fn() call:

@@ -46,13 +46,14 @@
        "send": [Function send],
      },
    },
    "owner/repo",
    "h7",
-   Any<String>,
+   "test-installation-token",
    Set {
      "branch-required",
      "build",
    },
-   Any<String>,
+   "installation:5",
+   undefined,
    undefined,
  ]

  2nd vi.fn() call:

@@ -46,13 +46,14 @@
        "send": [Function send],
      },
    },
    "owner/repo",
    "h7",
-   Any<String>,
+   "test-installation-token",
    Set {
      "branch-required",
      "build",
    },
-   Any<String>,
-   undefined,
+   "installation:5",
+   null,
+   null,
  ]


Number of calls: 2

 ❯ test/unit/agent-approval-queue.test.ts:602:34
test/unit/agent-approval-queue.test.ts > agent approval queue (#779) > threads the repo's expectedCiContexts into the accept-time live CI re-check
Stack Traces | 0.0909s run time 
AssertionError: expected "vi.fn()" to be called with arguments: [ { …(29) }, 'owner/repo', 'h7', …(4) ]

Received:

  1st vi.fn() call:

@@ -46,13 +46,14 @@
        "send": [Function send],
      },
    },
    "owner/repo",
    "h7",
-   Any<String>,
+   "test-installation-token",
    Set {
      "build",
      "test",
    },
-   Any<String>,
+   "installation:5",
+   undefined,
    undefined,
  ]

  2nd vi.fn() call:

@@ -46,13 +46,14 @@
        "send": [Function send],
      },
    },
    "owner/repo",
    "h7",
-   Any<String>,
+   "test-installation-token",
    Set {
      "build",
      "test",
    },
-   Any<String>,
-   undefined,
+   "installation:5",
+   null,
+   null,
  ]


Number of calls: 2

 ❯ test/unit/agent-approval-queue.test.ts:586:34
test/unit/queue.test.ts > queue processors > durable CI-state snapshot cache (#selfhost-ci-verification, cross-job) > REGRESSION (#selfhost-ci-verification gate review): a swallowed branch-protection read failure never writes the fail-open aggregate through to the durable cache
Stack Traces | 0.321s run time 
AssertionError: expected { …(24) } to match object { ciState: 'passed', …(1) }
(22 matching properties omitted from actual)

- Expected
+ Received

  {
-   "ciRequiredContextsKey": "[\"trusted-required-ci\"]|adv:",
+   "ciRequiredContextsKey": "[\"trusted-required-ci\"]|adv:|ign:",
    "ciState": "passed",
  }

 ❯ test/unit/queue.test.ts:3172:81
test/unit/queue.test.ts > queue processors > surfaces stale optional CI after the stale-CI cap
Stack Traces | 0.335s run time 
AssertionError: expected "fetchLiveCiAggregatePreferGraphQl" to be called with arguments: [ Anything, 'owner/agent-repo', …(5) ]

Received:

  1st fetchLiveCiAggregatePreferGraphQl call:

  [
-   Anything,
+   {
+     "ADMIN_GITHUB_LOGINS": "jsonbored",
+     "AI_REVIEW_CLOSE_CONFIDENCE_AUTOTUNE_ENABLED": "false",
+     "AI_REVIEW_CLOSE_CONFIDENCE_TIGHTEN_ENABLED": "false",
+     "CONFIG_DRIFT_SENTINEL_ENABLED": "false",
+     "DB": TestD1Database {
+       "db": DatabaseSync {
+         "isOpen": true,
+         "isTransaction": false,
+         Symbol(sqlite-type): "node:sqlite",
+       },
+     },
+     "GITHUB_APP_ID": "3824093",
+     "GITHUB_APP_PRIVATE_KEY": "-----BEGIN PRIVATE KEY-----
+ MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCkyVwl+JUMcOgh
+ 3+iVZAishcw28LJl6gKM1Xh8L/aF4HdRvp9LwORdUpBGpqb9WqjC4Z7GeK9eYDyv
+ 11vFhnQmYw46CQVA9+qRq0C88Lfiv6sWIgbLvDq39A/VEHwhnFTgxppiVQzQmn5F
+ T9E/i9TiMvqvJoQRSQNk8/jGZfPyv54NZ81xh4K0dAYozfBkd6hMl0LZ0ihaonki
+ lxy1IXazoc3H40NsrNxBB5NnwO6+YCkPgKTFky0ahAK39Yk0wauEdisznJ60jHbG
+ o1EMY6WezfYteci3XmF3eINI9z4WUZ+u9Dz9UbiHXd6yahrVRmwFLi5oHXWmdxK/
+ 5/fubfc9AgMBAAECggEAJ4/INb2GWyRINsnA1wzbIEBHFPGYgus5jYI6mOYS83U+
+ cDupltBKgzUtOikMckrvtUnhipiy0Z+dMkIr4DI1dHnXkotT3ZMnl61br4DDRQbr
+ Fjc5FnSsTDmmC2sXwiH8JrLHoc/1caeFpTJSdEUn6N6AXMiMcHHtBLGmCkuz05VW
+ H4mlEFCIDo4qiR88eH/mwCBnF9P2g9HRKF3YnFaXwagU0Tf9SpkC0p5fILDWbbti
+ TrQr+dkb0eI1c7jSCF5y3zOiimEG0wSzKZSVGziYFVrqodE/qykRGUkdVeGX1lfI
+ z5Oo8LIV/+Z0Dq2cszhhtzkYnYNg7V7qMAXS8LtLwQKBgQDmgOvRwqdQqJzoxq2i
+ H5J5qcZeeB4Zugr4ZVgHAbFduZr6LCGBZVdNcXtE8AmnQ2IvVHXRWNcMTKfJxx8C
+ IZ5J4C4yiMTAOAngkxUg/q3tcBF86oem8RSQs9QhwU3OzGCSnKveG9quJddN7qo8
+ CqXFum2uMiXvplPHZEyz3AmMVQKBgQC3A446leQP0/a6FGwJBrQOtnwJs9HTmfsH
+ prYzkhBT79gOttmzJdpNT84kHVFPYO4Hn8w0uNSjDLJJs1TCFbN8O8BP6NdDhoIH
+ 1HmLqN7D1UPHgrplx1FUB2OU7bH/YaM6Da/PXoDbS1ucsFPxIY85lDdgLjjkISMS
+ 4ksiYgQnSQKBgQC2vLY3kU37z/C1Se0VflotQb8V3bxfQPK5gf6Lb3ghiaendZ0K
+ bEEOEE1dlb7Rb8ZDJ35P/VJfWdYbTVTz55sJjkSRo4P3r3WFKJWzlrRkbFgw4+2v
+ F6jqHuap7Am3TKezE6ndZ8+yCCXsjq0+9GH/o5CYbQFOQFpi1M1KOcMIEQKBgDpd
+ 2u1aQmq92fEMdEwIpEIQ9swNWjzW3dVZ2L/ntGdglZJTxGg7CT0g14hzBSyAqEks
+ MG8cB0yczvtsQvrG+wAC+llB0+1IJ44huEXPLIReLoiha5rsD0byOFMV32+oDuuD
+ 0+8Zn5TQmr4FCjBb2Java120QBaZbtsl6npjshlpAoGBAK2XW85dnikWs6vOzZhO
+ vRW+AFa/qsEQ7kv5Xn2jVeHTko2khXrIGO0aXe0xXv9rYZdjP8PlKPHFJAkoT/45
+ 0dPkRcRshZOMwr38COJLtGwav+J1gq5FixYpG11Qr9jAj5PABvAU5MPLjwYT/yU4
+ AxLIEj+y6B3i3WxYSD6aZLG9
+ -----END PRIVATE KEY-----",
+     "GITHUB_APP_SLUG": "loopover-orb",
+     "GITHUB_WEBHOOK_SECRET": "test-webhook-secret",
+     "GITTENSOR_REGISTRY_URL": "https://raw.githubusercontent..../validator/weights/master_repositories.json",
+     "GITTENSOR_UPSTREAM_REF": "test",
+     "GITTENSOR_UPSTREAM_REPO": "entrius/gittensor",
+     "INTERNAL_JOB_TOKEN": "dev-internal-token",
+     "JOBS": {
+       "send": [Function send],
+     },
+     "LOOPOVER_API_TOKEN": "test-api-token",
+     "LOOPOVER_AUTO_FILE_DRIFT_ISSUES": "false",
+     "LOOPOVER_DRIFT_ISSUE_REPO": "test-harness/no-self-repo-match",
+     "LOOPOVER_EXPERIMENTAL_GITTENSOR": "false",
+     "LOOPOVER_FAIRNESS_ANALYTICS": "false",
+     "LOOPOVER_MCP_TOKEN": "test-mcp-token",
+     "LOOPOVER_REVIEW_REPOS": "JSONbored/gittensory,acme/widgets",
+     "LOOPOVER_SKIP_AUTOMATION_BOT_PRS": "true",
+     "MCP_ACTUATION_REPO_ALLOWLIST": "*",
+     "MCP_READ_REPO_ALLOWLIST": "*",
+     "PUBLIC_API_ORIGIN": "https://api.loopover.ai",
+     "PUBLIC_SITE_ORIGIN": "https://loopover.ai",
+     "SATISFACTION_FLOOR_AUTOTUNE_ENABLED": "false",
+     "SELFHOST_TRANSIENT_CACHE": {
+       "claim": [Function claim],
+       "del": [Function del],
+       "get": [Function get],
+       "releaseIfValue": [Function releaseIfValue],
+       "set": [Function set],
+     },
+     "WEBHOOKS": {
+       "send": [Function send],
+     },
+   },
    "owner/agent-repo",
    "a7",
-   Any<String>,
+   "installation-token",
    Set {
      "trusted-required-ci",
    },
    "installation:9001",
+   undefined,
    undefined,
  ]

  2nd fetchLiveCiAggregatePreferGraphQl call:

  [
-   Anything,
+   {
+     "ADMIN_GITHUB_LOGINS": "jsonbored",
+     "AI_REVIEW_CLOSE_CONFIDENCE_AUTOTUNE_ENABLED": "false",
+     "AI_REVIEW_CLOSE_CONFIDENCE_TIGHTEN_ENABLED": "false",
+     "CONFIG_DRIFT_SENTINEL_ENABLED": "false",
+     "DB": TestD1Database {
+       "db": DatabaseSync {
+         "isOpen": true,
+         "isTransaction": false,
+         Symbol(sqlite-type): "node:sqlite",
+       },
+     },
+     "GITHUB_APP_ID": "3824093",
+     "GITHUB_APP_PRIVATE_KEY": "-----BEGIN PRIVATE KEY-----
+ MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCkyVwl+JUMcOgh
+ 3+iVZAishcw28LJl6gKM1Xh8L/aF4HdRvp9LwORdUpBGpqb9WqjC4Z7GeK9eYDyv
+ 11vFhnQmYw46CQVA9+qRq0C88Lfiv6sWIgbLvDq39A/VEHwhnFTgxppiVQzQmn5F
+ T9E/i9TiMvqvJoQRSQNk8/jGZfPyv54NZ81xh4K0dAYozfBkd6hMl0LZ0ihaonki
+ lxy1IXazoc3H40NsrNxBB5NnwO6+YCkPgKTFky0ahAK39Yk0wauEdisznJ60jHbG
+ o1EMY6WezfYteci3XmF3eINI9z4WUZ+u9Dz9UbiHXd6yahrVRmwFLi5oHXWmdxK/
+ 5/fubfc9AgMBAAECggEAJ4/INb2GWyRINsnA1wzbIEBHFPGYgus5jYI6mOYS83U+
+ cDupltBKgzUtOikMckrvtUnhipiy0Z+dMkIr4DI1dHnXkotT3ZMnl61br4DDRQbr
+ Fjc5FnSsTDmmC2sXwiH8JrLHoc/1caeFpTJSdEUn6N6AXMiMcHHtBLGmCkuz05VW
+ H4mlEFCIDo4qiR88eH/mwCBnF9P2g9HRKF3YnFaXwagU0Tf9SpkC0p5fILDWbbti
+ TrQr+dkb0eI1c7jSCF5y3zOiimEG0wSzKZSVGziYFVrqodE/qykRGUkdVeGX1lfI
+ z5Oo8LIV/+Z0Dq2cszhhtzkYnYNg7V7qMAXS8LtLwQKBgQDmgOvRwqdQqJzoxq2i
+ H5J5qcZeeB4Zugr4ZVgHAbFduZr6LCGBZVdNcXtE8AmnQ2IvVHXRWNcMTKfJxx8C
+ IZ5J4C4yiMTAOAngkxUg/q3tcBF86oem8RSQs9QhwU3OzGCSnKveG9quJddN7qo8
+ CqXFum2uMiXvplPHZEyz3AmMVQKBgQC3A446leQP0/a6FGwJBrQOtnwJs9HTmfsH
+ prYzkhBT79gOttmzJdpNT84kHVFPYO4Hn8w0uNSjDLJJs1TCFbN8O8BP6NdDhoIH
+ 1HmLqN7D1UPHgrplx1FUB2OU7bH/YaM6Da/PXoDbS1ucsFPxIY85lDdgLjjkISMS
+ 4ksiYgQnSQKBgQC2vLY3kU37z/C1Se0VflotQb8V3bxfQPK5gf6Lb3ghiaendZ0K
+ bEEOEE1dlb7Rb8ZDJ35P/VJfWdYbTVTz55sJjkSRo4P3r3WFKJWzlrRkbFgw4+2v
+ F6jqHuap7Am3TKezE6ndZ8+yCCXsjq0+9GH/o5CYbQFOQFpi1M1KOcMIEQKBgDpd
+ 2u1aQmq92fEMdEwIpEIQ9swNWjzW3dVZ2L/ntGdglZJTxGg7CT0g14hzBSyAqEks
+ MG8cB0yczvtsQvrG+wAC+llB0+1IJ44huEXPLIReLoiha5rsD0byOFMV32+oDuuD
+ 0+8Zn5TQmr4FCjBb2Java120QBaZbtsl6npjshlpAoGBAK2XW85dnikWs6vOzZhO
+ vRW+AFa/qsEQ7kv5Xn2jVeHTko2khXrIGO0aXe0xXv9rYZdjP8PlKPHFJAkoT/45
+ 0dPkRcRshZOMwr38COJLtGwav+J1gq5FixYpG11Qr9jAj5PABvAU5MPLjwYT/yU4
+ AxLIEj+y6B3i3WxYSD6aZLG9
+ -----END PRIVATE KEY-----",
+     "GITHUB_APP_SLUG": "loopover-orb",
+     "GITHUB_WEBHOOK_SECRET": "test-webhook-secret",
+     "GITTENSOR_REGISTRY_URL": "https://raw.githubusercontent..../validator/weights/master_repositories.json",
+     "GITTENSOR_UPSTREAM_REF": "test",
+     "GITTENSOR_UPSTREAM_REPO": "entrius/gittensor",
+     "INTERNAL_JOB_TOKEN": "dev-internal-token",
+     "JOBS": {
+       "send": [Function send],
+     },
+     "LOOPOVER_API_TOKEN": "test-api-token",
+     "LOOPOVER_AUTO_FILE_DRIFT_ISSUES": "false",
+     "LOOPOVER_DRIFT_ISSUE_REPO": "test-harness/no-self-repo-match",
+     "LOOPOVER_EXPERIMENTAL_GITTENSOR": "false",
+     "LOOPOVER_FAIRNESS_ANALYTICS": "false",
+     "LOOPOVER_MCP_TOKEN": "test-mcp-token",
+     "LOOPOVER_REVIEW_REPOS": "JSONbored/gittensory,acme/widgets",
+     "LOOPOVER_SKIP_AUTOMATION_BOT_PRS": "true",
+     "MCP_ACTUATION_REPO_ALLOWLIST": "*",
+     "MCP_READ_REPO_ALLOWLIST": "*",
+     "PUBLIC_API_ORIGIN": "https://api.loopover.ai",
+     "PUBLIC_SITE_ORIGIN": "https://loopover.ai",
+     "SATISFACTION_FLOOR_AUTOTUNE_ENABLED": "false",
+     "SELFHOST_TRANSIENT_CACHE": {
+       "claim": [Function claim],
+       "del": [Function del],
+       "get": [Function get],
+       "releaseIfValue": [Function releaseIfValue],
+       "set": [Function set],
+     },
+     "WEBHOOKS": {
+       "send": [Function send],
+     },
+   },
    "owner/agent-repo",
    "a7",
-   Any<String>,
+   "installation-token",
    Set {
      "trusted-required-ci",
    },
    "installation:9001",
+   undefined,
    undefined,
  ]


Number of calls: 2

 ❯ test/unit/queue.test.ts:1872:25

To view more test analytics, go to the Test Analytics Dashboard
📋 Got 3 mins? Take this short survey to help us improve Test Analytics.

@JSONbored JSONbored self-assigned this Jul 29, 2026
@loopover-orb loopover-orb Bot added the manual-review Gittensor contributor context label Jul 29, 2026
@JSONbored
JSONbored force-pushed the release-please--branches--main--groups--engine-and-dependents branch from 9fb4376 to 054a865 Compare July 29, 2026 09:02
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
🔵 In progress
View logs		 loopover-ui c6e884d Jul 29 2026, 12:19 PM

@JSONbored
JSONbored force-pushed the release-please--branches--main--groups--engine-and-dependents branch from 9edbfbf to 1017e59 Compare July 29, 2026 09:24
@JSONbored JSONbored mentioned this pull request Jul 29, 2026
Merged
@JSONbored
JSONbored force-pushed the release-please--branches--main--groups--engine-and-dependents branch from 7b84172 to f6736c7 Compare July 29, 2026 09:45
JSONbored added a commit that referenced this pull request Jul 29, 2026
@JSONbored
fix(workspace): stop apps/loopover-ui silently resolving a stale publ…
ace8d1a 
…ished contract (#9797)

apps/loopover-ui declared "@loopover/contract": "^0.1.0". While contract sat at
0.1.0 that matched the workspace copy and npm linked it. The moment release-please
bumped contract into the engine-and-dependents group at 3.17.0, the range stopped
matching -- and npm did NOT fail. It resolved the dependency from the REGISTRY,
installing the published 0.1.0 tarball into apps/loopover-ui/node_modules while
every other consumer used 3.17.0.

The website would have built against a contract ~17 minor versions stale: same
import specifiers, different schemas and types, no error anywhere. It surfaced only
as an `npm ci` lockfile-sync failure on the release PR (#9780), which reads like a
mechanical lockfile problem rather than the dependency bug it is.

Pin the private apps to "*" -- the one range that means "the workspace copy" and
cannot drift -- and add workspace-dep-ranges:check.

The check requires "*" for PRIVATE packages rather than merely checking that a
range is satisfied, because satisfaction alone cannot see the trap: `^0.1.0` against
contract@0.1.0 is valid today and silently wrong the day contract is bumped. That
rule caught a second latent instance, discovery-index pinning engine to ^3.4.0.
Published packages keep real ranges (npm consumers need them) and are checked for
satisfaction instead.
@JSONbored
JSONbored force-pushed the release-please--branches--main--groups--engine-and-dependents branch 2 times, most recently from 42959e5 to 79d8277 Compare July 29, 2026 10:43
@codecov

codecov Bot commented Jul 29, 2026

Copy link
Copy Markdown

Bundle Report

Bundle size has no change ✅

@JSONbored
JSONbored force-pushed the release-please--branches--main--groups--engine-and-dependents branch 2 times, most recently from 94edf96 to 3e653c0 Compare July 29, 2026 11:23
@JSONbored
JSONbored force-pushed the release-please--branches--main--groups--engine-and-dependents branch from 3260327 to c6e884d Compare July 29, 2026 12:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment