chore(main): release engine-and-dependents libraries by JSONbored · Pull Request #9780 · JSONbored/loopover

JSONbored · 2026-07-29T08:17:35Z

🤖 I have created a release beep boop

contract: 3.17.0

3.17.0 (2026-07-29)

Features

ams: migrate the AMS miner MCP server to @loopover/contract (#9542) (9713f26), closes #9536
contract: add @loopover/contract, the single zod source for tool and API schemas (#9530) (95f1524)
contract: give the request schemas, the control plane, and the self-host endpoints one contract (#9750) (#9757) (5220a35)
contract: migrate every remote MCP tool contract to @loopover/contract (#9518) (#9559) (968c731)
gate: choose provider, model, effort and self-consistency runs — per repo, and escalated on guarded paths (#9821) (a65655c)
mcp: discovery surfaces, registry publish, and the stdio gateway (#9526) (#9735) (983ea31)
mcp: generate every tool, CLI, client, and docs surface from the contract (#9521) (#9590) (bd139a5)
mcp: migrate the stdio MCP server's 102 tools to @loopover/contract (#9537) (#9565) (d5a5a8f)
mcp: one registry-driven telemetry contract at all three dispatch chokepoints (#9525) (#9579) (06a090f)
stats: publish a fleet accuracy trend, so the weekly table means something again (#9775) (47842ec), closes #9676

Fixes

contract: close the last duplications and make the .shape trap impossible (#9762) (#9765) (edbdb58)
contract: regenerate api-schemas for #9813's ignoredCheckRuns (#9837) (8659503), closes #9836
release: publish @loopover/contract, and catch this class of break before it ships (#9749) (#9763) (6dd5791)

engine: 3.17.0

3.17.0 (2026-07-29)

Features

benchmark: anti-overfit controls — repo-level seeded split, caps, rotation (#9263) (#9600) (9942512)
benchmark: maintainer action-space schema and proposal validator (#9260) (#9595) (b543e1e)
benchmark: multi-class proposal scorer on the shared primitives (#9262) (#9599) (534dfd5)
benchmark: reversal-aware realized-history ground truth (#9261) (#9598) (1819298)
benchmark: untrusted candidate sandbox policy and fail-closed run verdict (#9264) (#9606) (3200abc)
gate: choose provider, model, effort and self-consistency runs — per repo, and escalated on guarded paths (#9821) (a65655c)
gate: gate.ignoredCheckRuns — exclude a third-party check from CI resolution entirely (#9813) (84c2462)
proof: public per-repo proof summary, endpoint and README badge (#9569) (#9608) (7ffb51e)

Fixes

ci: normalize committed CRLF to LF and name the failure for what it is (#9799) (ee98373)
engine: accept the { kind: 'existing', repo } IdeaTarget shape in validateIdeaSubmission (#9634) (c086363)
engine: drop opportunity-metadata's blanket v8-ignore directives and branch-cover the scoring logic they hid (#9635) (61ab43e), closes #9616
engine: isolate getTenantConfig reads and normalize tenant config (#9614) (#9627) (676ba3c)
engine: keep renderRepoMap's output within maxOutputChars including the marker (#9633) (d997bac)
engine: share governor-ledger's repo-segment guard with the three normalizers that skipped it (#9625) (8e3e4f5), closes #9610
engine: surface discovery-index contract-version skew and actually send the version on the query wire (#9631) (80827df), closes #9615
engine: validate the repo and PR number behind buildResultsPayload's customer link (#9611) (#9632) (5aa94b7)
eval: commit each published score to the corpus a reader can download (#9811) (bcdd2f8), closes #9805
eval: stamp the in-Worker threshold backtest with its corpus freeze point (#9804) (2755994)
openapi: declare the predictedGate/dataQuality fields branch-analysis actually returns (#9531) (#9587) (a858cbc)

mcp: 3.17.0

3.17.0 (2026-07-29)

Features

contract: add @loopover/contract, the single zod source for tool and API schemas (#9530) (95f1524)
contract: migrate every remote MCP tool contract to @loopover/contract (#9518) (#9559) (968c731)
mcp: add validate:mcp, the contract validator that enforces all three servers (#9520) (#9575) (0e990a3)
mcp: discovery surfaces, registry publish, and the stdio gateway (#9526) (#9735) (983ea31)
mcp: generate every tool, CLI, client, and docs surface from the contract (#9521) (#9590) (bd139a5)
mcp: migrate the stdio MCP server's 102 tools to @loopover/contract (#9537) (#9565) (d5a5a8f)
mcp: one registry-driven telemetry contract at all three dispatch chokepoints (#9525) (#9579) (06a090f)

Fixes

build: migrate loopover-miner/loopover-mcp to out-of-place dist/ emit (#8590) (c896797)
contract: close the last duplications and make the .shape trap impossible (#9762) (#9765) (edbdb58)
deps: resolve postcss + tar audit findings via overrides (#8612) (bca96ff)
mcp: await PostHog flush via unit-tested stdio wrapper (#8738) (7ee07cc), closes #8690
mcp: correct loopover_check_issue_slop description and drop the dead issue-slop rubric (#8959) (fcecf0c), closes #8907
mcp: exit the CLI cleanly on a broken-pipe stdout/stderr error (#8731) (2fc27bc), closes #8691
mcp: mirror loopover_clear_selftune_override in the CLI stdio package (#9300) (#9361) (09eb223)
mcp: stop --json=false and --exit-code=false enabling the flag they disable (#8725) (60f9f8f)
security: close two open GitHub Security Advisories (#9281) (29591ca)

Dependencies

The following workspace dependencies were updated
- dependencies
  - @loopover/contract bumped from ^0.1.0 to ^3.17.0
  - @loopover/engine bumped from ^3.16.0 to ^3.17.0

miner: 3.17.0

3.17.0 (2026-07-29)

Features

ams: migrate the AMS miner MCP server to @loopover/contract (#9542) (9713f26), closes #9536
contract: give the request schemas, the control plane, and the self-host endpoints one contract (#9750) (#9757) (5220a35)
mcp: discovery surfaces, registry publish, and the stdio gateway (#9526) (#9735) (983ea31)
mcp: generate every tool, CLI, client, and docs surface from the contract (#9521) (#9590) (bd139a5)
mcp: migrate the stdio MCP server's 102 tools to @loopover/contract (#9537) (#9565) (d5a5a8f)
mcp: one registry-driven telemetry contract at all three dispatch chokepoints (#9525) (#9579) (06a090f)
miner: add a claim reclaim CLI to expire orphaned soft-claims (#9717) (edf0883), closes #9686
miner: add calibration backtest-eligibility for ContributionProfile replay (#8572) (346c183)
miner: record feasibility-verdict reasons as rule-fired signals on the infeasible path (#8569) (1c7c3a7), closes #8543
miner: run the target repo's own test/lint/build commands before opening a PR (#8819) (e10abf2)
miner: wire deny-hook synthesis to a live consumer and give it an operator CLI (#8806) (#8817) (33bacda)
orb: salvageability axis — hold fixable, well-authored PRs instead of one-shot-closing (#8986) (7fd84ff)
selfhost: PostHog AI observability across ORB and AMS (#8623) (a9d9c0e)

Fixes

build: migrate loopover-miner/loopover-mcp to out-of-place dist/ emit (#8590) (c896797)
engine: surface discovery-index contract-version skew and actually send the version on the query wire (#9631) (80827df), closes #9615
engine: treat an Infinity WIP cap as uncapped, not collapsed to 0 (#8945) (6aaea39)
eval: commit each published score to the corpus a reader can download (#9811) (bcdd2f8), closes #9805
miner: add blocked_own_open_pr to the AttemptCliResult union (#9384) (42e1015)
miner: AmsPolicySpec parse warnings are computed but never surfaced to the operator (#8978) (3369ebc), closes #8853
miner: carry assignees through normalizeCandidate in opportunity-ranker (#9343) (b554957)
miner: compare-and-set the orphan reclaim so a stale probe cannot free a live re-acquired slot (#8992) (8444812)
miner: cover worktree-allocator's worktree_slots in purge-cli's right-to-be-forgotten sweep (#8570) (6c22ccd)
miner: delete the orphaned portfolio chat-action duplicate (#8662) (1cc2146)
miner: drop stale ProcessEnv casts on resolveReplaySnapshotDbPath (#8768) (7b2104d), closes #8642
miner: fail acquire() on an attempt_id/repo mismatch (#8964) (266b07d)
miner: fall back to global config.apiUrl in loopoverApiUrl (#8937) (4dfe15d)
miner: governor reputation-history read-modify-write is unguarded, unlike sibling scalar-state writes (#8988) (62e6d25), closes #8855
miner: governor-chokepoint-persisted's load-evaluate-save cycle isn't atomic (#8993) (49a27c2), closes #8856
miner: include laptop-state in doctor integrity and migrate store lists (#8749) (713145f), closes #8641
miner: log discovery-index query failures before failing open (#9346) (ab6a44d)
miner: make governor-run-halt's ledger recording a genuine transition detector (#9367) (6c220b3)
miner: printHelp() omits the working deny-hooks subcommand (#8933) (1eeaae1), closes #8851
miner: reclaim orphaned worktree allocations on every acquire() (#8918) (eab6ecf)
miner: refuse a duplicate attempt when this miner already has an open PR for the exact issue (#8808) (#8815) (d5ec15a)
miner: reject a portfolio-queue identifier containing the '::' composite-id separator (#8925) (32ee72e)
miner: replace never-registered run with loop in fleet-mode manifests (#9524) (6bb8588)
miner: self-review-context never supplies recent-merged-PR history, contradicting its own "same fidelity" claim (#8969) (987f7ce), closes #8852
miner: surface verification payload in attempt-cli JSON for verification_failed (#9372) (a58ce3d)
miner: wire AMS policy resolver to the documented discovery order (#9106) (f2f32cc), closes #8863
orb: webhook redelivery, reputation cadence, DB retention, and gate severity fidelity (#9237) (d2c8d27)
packaging: ship the LICENSE @loopover/miner declares, and assert it everywhere (#9787) (122a283)
review: auto-clear stale manual-review lock-contention hold; sync engine gate-decision twin (#9107) (6aacf08)
review: default cross-issue copycat/reward-farming dedupe on for reward-eligible repos (#9226) (b251912)

Dependencies

The following workspace dependencies were updated
- dependencies
  - @loopover/contract bumped from ^0.1.0 to ^3.17.0
  - @loopover/engine bumped from ^3.16.0 to ^3.17.0

This PR was generated with Release Please. See documentation.

loopover-orb · 2026-07-29T08:17:52Z

Caution

🛑 LoopOver review result - fixes required

_{Review updated: 2026-07-29 15:55:20 UTC}

11 files · 1 AI reviewer · 1 blocker · CI failing · unstable

🛑 Suggested Action - Manual Review

Review summary
This is the automated release-please bot PR bumping loopover-mcp, loopover-miner, loopover-engine, and loopover-contract to 3.17.0, syncing internal @loopover/contract and @loopover/engine dependency ranges, regenerating CHANGELOG.md entries, and updating package-lock.json accordingly. The version bumps and lockfile diff are internally consistent (manifest, package.json files, and lockfile all agree on 3.17.0 and the ^3.17.0 dependency ranges), and the CHANGELOG entries match the referenced issue/PR numbers from the described release set. This is not a contributor PR subject to the issue-link requirement — it's the standard release-please bot workflow — so the usual issue-scope enforcement doesn't apply here.

Nits — 4 non-blocking

The FAILED validate/validate-tests/validate-code checks have no detail provided in this context, so their cause can't be confirmed from the diff; worth checking whether they're a pre-existing pipeline issue unrelated to this bot-only version/changelog diff.
package-lock.json is large by nature of being a generated lockfile, not a genuine review-scope concern.
Confirm the FAILED validate/validate-tests/validate-code checks aren't blocking this release PR from being auto-merged by the release-please workflow, since a mechanical version-bump PR shouldn't normally fail build/test validation unless something in the referenced feature merges broke CI.
Diff looks like trivial or whitespace-only churn — Reduce whitespace-only or formatting-only churn and keep the diff focused on substantive changes.

Why this is blocked

No linked issue detected: No closing reference or linked issue number was found in the PR metadata/body. — If this PR is intended to solve an issue, link it explicitly in the PR body.

📋 Copy for AI agents — paste into your coding agent

Fix the following blocker(s) from this PR review:

1. No linked issue detected: No closing reference or linked issue number was found in the PR metadata/body. — If this PR is intended to solve an issue, link it explicitly in the PR body.

CI checks failing

validate
validate-tests

Decision drivers

❌ Code review — 1 blocker (1 reviewer)
❌ Gate result — Blocking (Repo-configured hard blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ No-issue rationale	PR body explains why no issue is linked.
Related work	⚠️ 1 scoped overlap	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 14 registered-repo PR(s), 13 merged, 330 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 14 PR(s), 330 issue(s).
Improvement	ℹ️ Insufficient signal	risk: low · value: insufficient-signal

Review context

Author: JSONbored
Role context: owner (maintainer lane)
Public audience mode: oss maintainer
Lane context: Repository is registered but has no active allocation in the current snapshot.
Public profile languages: Python, TypeScript, Ruby, Go, MDX, Shell, Solidity, JavaScript
Official Gittensor activity: 14 PR(s), 330 issue(s).
Related work: Titles/paths share 2 meaningful terms. (issue #9102)

Contributor next steps

Start here: Treat this as maintainer-lane context rather than normal contributor-lane activity.
Then work through the remaining 4 steps in the Signals table above.

Signal definitions

Related work = same linked issue, overlapping active PRs, or title/path similarity.
Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

@loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
@loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

Decision record

action: hold · clause: missing_linked_issue
config: d10f38dab514ee0cf348bb9bdeb606133981d0295ab9f624418c1ddac02ef1ba · pack: oss-anti-slop · ci: failed
record: 78d78c9c0cda1109a997f4172ef4e1a65dcbbbb1c8fb83d03724fae5004e92ff (schema v5, head 46106d0)

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

Re-run LoopOver review

superagent-security · 2026-07-29T08:19:16Z

Superagent didn't find any vulnerabilities or security issues in this PR.

codecov · 2026-07-29T08:20:15Z

❌ 1 Tests Failed:

Tests completed	Failed	Passed	Skipped
25407	1	25406	21

View the top 1 failed test(s) by shortest run time

test/unit/check-server-manifest-script.test.ts > the anti-rot path guard (#9526) > the real repository satisfies both halves

Stack Traces | 0.014s run time

AssertionError: expected [ Array(2) ] to deeply equal []

- Expected
+ Received

- []
+ [
+   {
+     "detail": "must equal @loopover/mcp's 3.17.0 (release automation owns it), got 3.15.2",
+     "field": "version",
+   },
+   {
+     "detail": "must equal @loopover/mcp's 3.17.0, got 3.15.2",
+     "field": "packages[0].version",
+   },
+ ]

 ❯ test/unit/check-server-manifest-script.test.ts:48:31

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

cloudflare-workers-and-pages · 2026-07-29T09:02:43Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
🔵 In progress View logs	loopover-ui	`69c5823`	Jul 29 2026, 01:23 PM

…ished contract (#9797) apps/loopover-ui declared "@loopover/contract": "^0.1.0". While contract sat at 0.1.0 that matched the workspace copy and npm linked it. The moment release-please bumped contract into the engine-and-dependents group at 3.17.0, the range stopped matching -- and npm did NOT fail. It resolved the dependency from the REGISTRY, installing the published 0.1.0 tarball into apps/loopover-ui/node_modules while every other consumer used 3.17.0. The website would have built against a contract ~17 minor versions stale: same import specifiers, different schemas and types, no error anywhere. It surfaced only as an `npm ci` lockfile-sync failure on the release PR (#9780), which reads like a mechanical lockfile problem rather than the dependency bug it is. Pin the private apps to "*" -- the one range that means "the workspace copy" and cannot drift -- and add workspace-dep-ranges:check. The check requires "*" for PRIVATE packages rather than merely checking that a range is satisfied, because satisfaction alone cannot see the trap: `^0.1.0` against contract@0.1.0 is valid today and silently wrong the day contract is bumped. That rule caught a second latent instance, discovery-index pinning engine to ^3.4.0. Published packages keep real ranges (npm consumers need them) and are checked for satisfaction instead.

codecov · 2026-07-29T10:49:21Z

Bundle Report

Bundle size has no change ✅

JSONbored added the autorelease: pending label Jul 29, 2026

JSONbored self-assigned this Jul 29, 2026

loopover-orb Bot added the manual-review Gittensor contributor context label Jul 29, 2026

JSONbored force-pushed the release-please--branches--main--groups--engine-and-dependents branch from 9fb4376 to 054a865 Compare July 29, 2026 09:02

JSONbored force-pushed the release-please--branches--main--groups--engine-and-dependents branch from 9edbfbf to 1017e59 Compare July 29, 2026 09:24

JSONbored mentioned this pull request Jul 29, 2026

fix(workspace): stop apps/loopover-ui silently resolving a stale published @loopover/contract #9797

Merged

JSONbored force-pushed the release-please--branches--main--groups--engine-and-dependents branch from 7b84172 to f6736c7 Compare July 29, 2026 09:45

JSONbored force-pushed the release-please--branches--main--groups--engine-and-dependents branch 2 times, most recently from 42959e5 to 79d8277 Compare July 29, 2026 10:43

JSONbored force-pushed the release-please--branches--main--groups--engine-and-dependents branch 5 times, most recently from d30799e to 69c5823 Compare July 29, 2026 13:23

JSONbored mentioned this pull request Jul 29, 2026

fix(miner-ui): type a chat-dispatch mock against the union #9815 closed #9846

Merged

JSONbored force-pushed the release-please--branches--main--groups--engine-and-dependents branch 2 times, most recently from dbb3c33 to ac4ed90 Compare July 29, 2026 14:46

chore(main): release engine-and-dependents libraries

7479575

JSONbored force-pushed the release-please--branches--main--groups--engine-and-dependents branch from 46106d0 to 7479575 Compare July 29, 2026 15:32

chore(release): sync miner engine-version pin

e8f6b1d

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(main): release engine-and-dependents libraries - #9780

chore(main): release engine-and-dependents libraries#9780
JSONbored wants to merge 2 commits into
mainfrom
release-please--branches--main--groups--engine-and-dependents

JSONbored commented Jul 29, 2026 •

edited

Loading

Uh oh!

loopover-orb Bot commented Jul 29, 2026 •

edited

Loading

🛑 LoopOver review result - fixes required

Uh oh!

superagent-security Bot commented Jul 29, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jul 29, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Jul 29, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jul 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

JSONbored commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 I have created a release beep boop

3.17.0 (2026-07-29)

Features

Fixes

3.17.0 (2026-07-29)

Features

Fixes

3.17.0 (2026-07-29)

Features

Fixes

Dependencies

3.17.0 (2026-07-29)

Features

Fixes

Dependencies

Uh oh!

loopover-orb Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛑 LoopOver review result - fixes required

Uh oh!

superagent-security Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ 1 Tests Failed:

Uh oh!

cloudflare-workers-and-pages Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

codecov Bot commented Jul 29, 2026

Bundle Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

JSONbored commented Jul 29, 2026 •

edited

Loading

loopover-orb Bot commented Jul 29, 2026 •

edited

Loading

superagent-security Bot commented Jul 29, 2026 •

edited

Loading

codecov Bot commented Jul 29, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Jul 29, 2026 •

edited

Loading