fix(mcp,selfhost): audit mutating MCP tools, dedupe predict_gate agreement, guard repo privacy

[JSONbored]

Summary

• orb(mcp): every MCP write tool is unaudited — the kill switch, the autonomy dial, private-config writes and redeploys leave no audit_events row #9137 — every mutating MCP tool now records an audit_events row. Added recordAuditEvent calls to loopover_set_agent_paused, loopover_set_action_autonomy (both repo.settings_updated, mirroring PUT /v1/repos/:owner/:repo/settings's own audit shape), loopover_admin_write_config (new config.private_write event type, audited on both success and failure), and loopover_admin_trigger_redeploy (new instance.redeploy_triggered, audited on success, a failed run, and a companion connection error). I deliberately did not move the audit call down into upsertRepositorySettings itself (the "better" option the issue floats): that function has ~8 call sites across src/api/routes.ts, src/orb/apr-repo-transfer.ts, and several test files, and moving the audit there would require threading an actor parameter through all of them and re-auditing each call site for double-recording risk against the route layer's existing call — more invasive than a time-boxed pass justified. Added a table-driven invariant test (test/unit/mcp-mutating-tools-audit.test.ts) asserting all four tools produce the expected row, actor, and metadata.
• orb(mcp): predict_gate writes an un-deduped row per call and all of them pair against one real decision — a contributor can drive the agreement metric to 100% #9138 — computePredictedGateVerdict (backing both loopover_predict_gate and loopover_explain_gate_disposition) now calls enforceToolRateLimit, sharing the sibling slop-oracle tools' 20-per-300s cap instead of relying solely on the shared /mcp route class (120/min). computePredictedGateAgreement now dedupes multiple predicted calls that pair against the same real decision down to just the latest one (keyed by object identity of the paired real-decision row), so N predictions before one real merge contribute exactly one paired sample instead of N — closing the lever that let a contributor drive the agreement metric toward 100%. Gave predicted_gate_calls a 90-day retention window via RETENTION_POLICY (the same scheduled prune job that already covers audit_events/ai_usage_events/etc). Operational follow-up, not something computable from this PR: the currently-published agreement figure should be re-derived after this dedup lands, and whether the prior number was inflated should be stated separately.
• orb(privacy): private repo names and PR numbers ship to the vendor's PostHog and to unauthenticated /metrics, with no tenant opt-out — and the scrubber corrupts the repo label while doing it #9142 — operationalProperties in src/selfhost/posthog.ts now HMACs repo/repository/owner/pull/pullNumber/pr/head_sha with the same per-instance secret orb-collector.ts's exportOrbBatch already generates and persists (system_flags key orb:anon_secret), but only when the active key is the shared LOOPOVER_CENTRAL_POSTHOG_KEY fallback — an operator's own POSTHOG_API_KEY is unaffected (their own private project, no cross-tenant concern). Fails closed: if the secret hasn't been injected yet (an early-boot race), the identifying field is dropped, never sent raw. initPostHog now honors ORB_AIR_GAP=true and an explicit POSTHOG_DISABLED, and an explicitly-empty POSTHOG_API_KEY="" now means off instead of falling through to the central key. Self-hosted /metrics now pseudonymizes (not strips, not raw) the repo label on PRIVATE_REPO_LABEL_METRICS by default — the same redacted-N scheme ALWAYS_REDACT_REPO_LABEL_METRICS already uses — since a self-hosted operator legitimately wants a stable per-repo series on their own dashboards, just not the real name leaving on an endpoint that may sit in front of application auth; an operator who has verified /metrics never leaves their private network can opt back into raw labels with LOOPOVER_METRICS_REPO_LABELS=raw. observe() now routes through publicLabelsForMetric (previously the one metric-recording path that bypassed redaction entirely, including the always-redact set). Fixed the scrubber bug where PUBLIC_UNSAFE_SCRUB's bare vocabulary match corrupted structured identifiers (ossf/scorecard → ossf/private context) by skipping vocabulary/phrase scrubbing for OPERATIONAL_TAG_KEYS while keeping credential-shape scrubbing (SECRET_VALUE/JWT_VALUE/QUERY_SECRET_VALUE) unconditional.
• Drive-by: found and fixed two stray NUL bytes in predicted-gate-agreement.ts's map-key-join template literal (pre-existing corruption already on main, sitting on the exact lines the orb(mcp): predict_gate writes an un-deduped row per call and all of them pair against one real decision — a contributor can drive the agreement metric to 100% #9138 fix touches) — both the writer and reader side were consistently corrupted the same way so it never affected runtime behavior, but it made every past git diff/GitHub PR view of that file render as "Binary files differ" instead of a real line diff. Because origin/main's committed blob still has the NUL bytes, this PR's own diff for that one file will likely still render as binary (git's binary-vs-text check looks at both the old and new blob) — but the new blob is clean, so every diff of this file after this PR merges will render normally again.

Closes #9137
Closes #9138
Closes #9142

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused: three related ORB/MCP-surface privacy and integrity gaps, no UI/docs/dependency changes.
• This follows CONTRIBUTING.md and does not touch site/, CNAME, or **/lovable/**.
• Linked issues: Closes orb(mcp): every MCP write tool is unaudited — the kill switch, the autonomy dial, private-config writes and redeploys leave no audit_events row #9137, Closes orb(mcp): predict_gate writes an un-deduped row per call and all of them pair against one real decision — a contributor can drive the agreement metric to 100% #9138, Closes orb(privacy): private repo names and PR numbers ship to the vendor's PostHog and to unauthenticated /metrics, with no tenant opt-out — and the scrubber corrupts the repo label while doing it #9142 (all currently open, maintainer-only, assigned to the repo owner).

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage (full, unsharded) — not run locally, see note below; scoped coverage verification done instead.
• npm run test:workers — not run locally (no test/workers/** files touched).
• npm run build:mcp / npm run test:mcp-pack — not run locally (no packages/loopover-mcp/** changes).
• npm run ui:openapi:check (no drift — no route/schema changes in this PR)
• npm run ui:lint / npm run ui:typecheck / npm run ui:build — not run (no apps/loopover-ui/** source changes beyond the regenerated env-reference doc below).
• npm audit --audit-level=moderate — not run locally, see note below.
• New/changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries (see below).

If any required check was skipped, explain why:

• Per explicit instruction for this task, the full local gate (npm run test:ci, npm audit) was intentionally not run before pushing — GitHub CI runs it. In its place I ran and verified: npm run typecheck (clean), npm run db:migrations:check / db:schema-drift:check (no migration needed — no schema changes), npm run selfhost:env-reference:check (regenerated apps/loopover-ui/src/lib/selfhost-env-reference.ts for the two new self-host env vars this PR introduces: POSTHOG_DISABLED and LOOPOVER_METRICS_REPO_LABELS), npm run cf-typegen:check (clean — no wrangler.jsonc changes), npm run ui:openapi:check (clean), npm run coverage-boltons:check (clean — new test files don't match the bolt-on pattern), git diff --check, and npm run actionlint.
• Targeted test runs: every new/modified test file passes (mcp-mutating-tools-audit.test.ts, mcp-predict-gate.test.ts, mcp-automation-state.test.ts, mcp-admin-config-tools.test.ts, mcp-admin-redeploy-tool.test.ts, predicted-gate-agreement.test.ts, retention.test.ts, selfhost-posthog.test.ts, selfhost-metrics.test.ts, selfhost-redaction-scrub.test.ts), plus a full npm run test:changed pass (vitest's import-graph-based selection against main): 456 test files / 11,182 tests green, 0 failures.
• Coverage: rather than a full unsharded test:coverage run, I ran scoped vitest --coverage passes against just the relevant test files and inspected the per-file JSON coverage detail (statement/branch hit maps) cross-referenced line-by-line against this PR's actual diff. Every changed line/branch in src/db/retention.ts, src/mcp/server.ts (all five touched regions), src/review/predicted-gate-agreement.ts, src/selfhost/metrics.ts, src/selfhost/posthog.ts, and src/selfhost/redaction-scrub.ts is covered — 100% lines/branches on every changed region, confirmed by diffing uncovered-line output against this PR's patch. src/server.ts's two changed call sites are in codecov.yml's ignore list (Docker-boot-only entrypoint, not unit-coverable) so they carry no coverage obligation.
• npm audit --audit-level=moderate reports 5 pre-existing high-severity advisories in the eslint/brace-expansion/minimatch devDependency chain, unrelated to and unchanged by this PR (no new dependency added, no package.json/lockfile touched).

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed. (This PR's entire point is reducing what leaves the box — no new leakage introduced.)
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics. (No public-facing surface changed.)
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. — N/A, no auth/session/CORS changes.
• API/OpenAPI/MCP behavior is updated and tested where needed (four MCP tool handlers gained audit calls + a rate limit; covered by new/updated tests; no HTTP route or OpenAPI shape changed).
• UI changes use live API data — N/A, no UI changes.
• UI Evidence — N/A, no visible/frontend changes.
• Public docs/changelogs — not touched (no changelog edit, per house rule).

UI Evidence

Not applicable — this PR is backend/MCP-only (no apps/loopover-ui/** source changes beyond the regenerated, auto-generated env-reference doc).

Notes

• The self-host env-reference doc (apps/loopover-ui/src/lib/selfhost-env-reference.ts) was regenerated via npm run selfhost:env-reference to add the two new operator-facing vars this PR introduces: POSTHOG_DISABLED (explicit kill switch, src/selfhost/posthog.ts) and LOOPOVER_METRICS_REPO_LABELS (raw-label opt-out, src/server.ts).
• No DB migration needed: orb(mcp): every MCP write tool is unaudited — the kill switch, the autonomy dial, private-config writes and redeploys leave no audit_events row #9137's audit calls reuse the existing audit_events table/recordAuditEvent helper, and orb(mcp): predict_gate writes an un-deduped row per call and all of them pair against one real decision — a contributor can drive the agreement metric to 100% #9138's retention entry reuses the existing predicted_gate_calls table (already created by migration 0137) — just adding it to the in-code RETENTION_POLICY array.
• I was not able to install/authenticate the @loopover/mcp pre-submit predictor CLI in this sandboxed environment (no interactive device-flow login available), so loopover_predict_gate/loopover_check_slop_risk/loopover_lint_pr_text were not run against this PR before pushing — noting this per Phase 8's checklist rather than silently skipping it.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	loopover-ui	d93ea15	Commit Preview URL Branch Preview URL	Jul 27 2026, 05:34 AM

[codecov]

❌ 1 Tests Failed:

Tests completed	Failed	Passed	Skipped
21898	1	21897	21

View the top 1 failed test(s) by shortest run time

test/unit/check-branding-drift-script.test.ts > check-branding-drift script (real repo state) > the committed baseline matches the real current repo state (regression guard)

Stack Traces | 0.344s run time

Error: Command failed: .../hostedtoolcache/node/22.23.1.../x64/bin/node --experimental-strip-types scripts/check-branding-drift.ts
Branding-drift check found 1 issue(s):
src/review/predicted-gate-agreement.ts: "gittensory" mentions increased from 0 to 1 -- looks like new branding drift, not an intentional historical reference. If it genuinely belongs (e.g. a permanent Sentry ticket ID or a stable comment-marker already posted to live PRs), run `npm run branding-drift:update` and commit the regenerated baseline.

 ❯ test/unit/check-branding-drift-script.test.ts:143:20

⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯
Serialized Error: { status: 1, signal: null, output: [ null, '', 'Branding-drift check found 1 issue(s):\nsrc/review/predicted-gate-agreement.ts: "gittensory" mentions increased from 0 to 1 -- looks like new branding drift, not an intentional historical reference. If it genuinely belongs (e.g. a permanent Sentry ticket ID or a stable comment-marker already posted to live PRs), run `npm run branding-drift:update` and commit the regenerated baseline.\n' ], pid: 18048, stdout: '', stderr: 'Branding-drift check found 1 issue(s):\nsrc/review/predicted-gate-agreement.ts: "gittensory" mentions increased from 0 to 1 -- looks like new branding drift, not an intentional historical reference. If it genuinely belongs (e.g. a permanent Sentry ticket ID or a stable comment-marker already posted to live PRs), run `npm run branding-drift:update` and commit the regenerated baseline.\n' }

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}