chore(main): release engine-and-dependents libraries by JSONbored · Pull Request #9780 · JSONbored/loopover

JSONbored · 2026-07-29T08:17:35Z

🤖 I have created a release beep boop

contract: 3.17.0

3.17.0 (2026-07-29)

Features

ams: migrate the AMS miner MCP server to @loopover/contract (#9542) (9713f26), closes #9536
contract: add @loopover/contract, the single zod source for tool and API schemas (#9530) (95f1524)
contract: give the request schemas, the control plane, and the self-host endpoints one contract (#9750) (#9757) (5220a35)
contract: migrate every remote MCP tool contract to @loopover/contract (#9518) (#9559) (968c731)
gate: choose provider, model, effort and self-consistency runs — per repo, and escalated on guarded paths (#9821) (a65655c)
mcp: discovery surfaces, registry publish, and the stdio gateway (#9526) (#9735) (983ea31)
mcp: generate every tool, CLI, client, and docs surface from the contract (#9521) (#9590) (bd139a5)
mcp: migrate the stdio MCP server's 102 tools to @loopover/contract (#9537) (#9565) (d5a5a8f)
mcp: one registry-driven telemetry contract at all three dispatch chokepoints (#9525) (#9579) (06a090f)
stats: publish a fleet accuracy trend, so the weekly table means something again (#9775) (47842ec), closes #9676

Fixes

contract: close the last duplications and make the .shape trap impossible (#9762) (#9765) (edbdb58)
contract: regenerate api-schemas for #9813's ignoredCheckRuns (#9837) (8659503), closes #9836
release: publish @loopover/contract, and catch this class of break before it ships (#9749) (#9763) (6dd5791)

engine: 3.17.0

3.17.0 (2026-07-29)

Features

benchmark: anti-overfit controls — repo-level seeded split, caps, rotation (#9263) (#9600) (9942512)
benchmark: maintainer action-space schema and proposal validator (#9260) (#9595) (b543e1e)
benchmark: multi-class proposal scorer on the shared primitives (#9262) (#9599) (534dfd5)
benchmark: reversal-aware realized-history ground truth (#9261) (#9598) (1819298)
benchmark: untrusted candidate sandbox policy and fail-closed run verdict (#9264) (#9606) (3200abc)
gate: choose provider, model, effort and self-consistency runs — per repo, and escalated on guarded paths (#9821) (a65655c)
gate: gate.ignoredCheckRuns — exclude a third-party check from CI resolution entirely (#9813) (84c2462)
proof: public per-repo proof summary, endpoint and README badge (#9569) (#9608) (7ffb51e)

Fixes

ci: normalize committed CRLF to LF and name the failure for what it is (#9799) (ee98373)
engine: accept the { kind: 'existing', repo } IdeaTarget shape in validateIdeaSubmission (#9634) (c086363)
engine: drop opportunity-metadata's blanket v8-ignore directives and branch-cover the scoring logic they hid (#9635) (61ab43e), closes #9616
engine: isolate getTenantConfig reads and normalize tenant config (#9614) (#9627) (676ba3c)
engine: keep renderRepoMap's output within maxOutputChars including the marker (#9633) (d997bac)
engine: share governor-ledger's repo-segment guard with the three normalizers that skipped it (#9625) (8e3e4f5), closes #9610
engine: surface discovery-index contract-version skew and actually send the version on the query wire (#9631) (80827df), closes #9615
engine: validate the repo and PR number behind buildResultsPayload's customer link (#9611) (#9632) (5aa94b7)
eval: commit each published score to the corpus a reader can download (#9811) (bcdd2f8), closes #9805
eval: stamp the in-Worker threshold backtest with its corpus freeze point (#9804) (2755994)
openapi: declare the predictedGate/dataQuality fields branch-analysis actually returns (#9531) (#9587) (a858cbc)

mcp: 3.17.0

3.17.0 (2026-07-29)

Features

contract: add @loopover/contract, the single zod source for tool and API schemas (#9530) (95f1524)
contract: migrate every remote MCP tool contract to @loopover/contract (#9518) (#9559) (968c731)
mcp: add validate:mcp, the contract validator that enforces all three servers (#9520) (#9575) (0e990a3)
mcp: discovery surfaces, registry publish, and the stdio gateway (#9526) (#9735) (983ea31)
mcp: generate every tool, CLI, client, and docs surface from the contract (#9521) (#9590) (bd139a5)
mcp: migrate the stdio MCP server's 102 tools to @loopover/contract (#9537) (#9565) (d5a5a8f)
mcp: one registry-driven telemetry contract at all three dispatch chokepoints (#9525) (#9579) (06a090f)

Fixes

build: migrate loopover-miner/loopover-mcp to out-of-place dist/ emit (#8590) (c896797)
contract: close the last duplications and make the .shape trap impossible (#9762) (#9765) (edbdb58)
deps: resolve postcss + tar audit findings via overrides (#8612) (bca96ff)
mcp: await PostHog flush via unit-tested stdio wrapper (#8738) (7ee07cc), closes #8690
mcp: correct loopover_check_issue_slop description and drop the dead issue-slop rubric (#8959) (fcecf0c), closes #8907
mcp: exit the CLI cleanly on a broken-pipe stdout/stderr error (#8731) (2fc27bc), closes #8691
mcp: mirror loopover_clear_selftune_override in the CLI stdio package (#9300) (#9361) (09eb223)
mcp: stop --json=false and --exit-code=false enabling the flag they disable (#8725) (60f9f8f)
security: close two open GitHub Security Advisories (#9281) (29591ca)

Dependencies

The following workspace dependencies were updated
- dependencies
  - @loopover/contract bumped from ^0.1.0 to ^3.17.0
  - @loopover/engine bumped from ^3.16.0 to ^3.17.0

miner: 3.17.0

3.17.0 (2026-07-29)

Features

ams: migrate the AMS miner MCP server to @loopover/contract (#9542) (9713f26), closes #9536
contract: give the request schemas, the control plane, and the self-host endpoints one contract (#9750) (#9757) (5220a35)
mcp: discovery surfaces, registry publish, and the stdio gateway (#9526) (#9735) (983ea31)
mcp: generate every tool, CLI, client, and docs surface from the contract (#9521) (#9590) (bd139a5)
mcp: migrate the stdio MCP server's 102 tools to @loopover/contract (#9537) (#9565) (d5a5a8f)
mcp: one registry-driven telemetry contract at all three dispatch chokepoints (#9525) (#9579) (06a090f)
miner: add a claim reclaim CLI to expire orphaned soft-claims (#9717) (edf0883), closes #9686
miner: add calibration backtest-eligibility for ContributionProfile replay (#8572) (346c183)
miner: record feasibility-verdict reasons as rule-fired signals on the infeasible path (#8569) (1c7c3a7), closes #8543
miner: run the target repo's own test/lint/build commands before opening a PR (#8819) (e10abf2)
miner: wire deny-hook synthesis to a live consumer and give it an operator CLI (#8806) (#8817) (33bacda)
orb: salvageability axis — hold fixable, well-authored PRs instead of one-shot-closing (#8986) (7fd84ff)
selfhost: PostHog AI observability across ORB and AMS (#8623) (a9d9c0e)

Fixes

build: migrate loopover-miner/loopover-mcp to out-of-place dist/ emit (#8590) (c896797)
engine: surface discovery-index contract-version skew and actually send the version on the query wire (#9631) (80827df), closes #9615
engine: treat an Infinity WIP cap as uncapped, not collapsed to 0 (#8945) (6aaea39)
eval: commit each published score to the corpus a reader can download (#9811) (bcdd2f8), closes #9805
miner: add blocked_own_open_pr to the AttemptCliResult union (#9384) (42e1015)
miner: AmsPolicySpec parse warnings are computed but never surfaced to the operator (#8978) (3369ebc), closes #8853
miner: carry assignees through normalizeCandidate in opportunity-ranker (#9343) (b554957)
miner: compare-and-set the orphan reclaim so a stale probe cannot free a live re-acquired slot (#8992) (8444812)
miner: cover worktree-allocator's worktree_slots in purge-cli's right-to-be-forgotten sweep (#8570) (6c22ccd)
miner: delete the orphaned portfolio chat-action duplicate (#8662) (1cc2146)
miner: drop stale ProcessEnv casts on resolveReplaySnapshotDbPath (#8768) (7b2104d), closes #8642
miner: fail acquire() on an attempt_id/repo mismatch (#8964) (266b07d)
miner: fall back to global config.apiUrl in loopoverApiUrl (#8937) (4dfe15d)
miner: governor reputation-history read-modify-write is unguarded, unlike sibling scalar-state writes (#8988) (62e6d25), closes #8855
miner: governor-chokepoint-persisted's load-evaluate-save cycle isn't atomic (#8993) (49a27c2), closes #8856
miner: include laptop-state in doctor integrity and migrate store lists (#8749) (713145f), closes #8641
miner: log discovery-index query failures before failing open (#9346) (ab6a44d)
miner: make governor-run-halt's ledger recording a genuine transition detector (#9367) (6c220b3)
miner: printHelp() omits the working deny-hooks subcommand (#8933) (1eeaae1), closes #8851
miner: reclaim orphaned worktree allocations on every acquire() (#8918) (eab6ecf)
miner: refuse a duplicate attempt when this miner already has an open PR for the exact issue (#8808) (#8815) (d5ec15a)
miner: reject a portfolio-queue identifier containing the '::' composite-id separator (#8925) (32ee72e)
miner: replace never-registered run with loop in fleet-mode manifests (#9524) (6bb8588)
miner: self-review-context never supplies recent-merged-PR history, contradicting its own "same fidelity" claim (#8969) (987f7ce), closes #8852
miner: surface verification payload in attempt-cli JSON for verification_failed (#9372) (a58ce3d)
miner: wire AMS policy resolver to the documented discovery order (#9106) (f2f32cc), closes #8863
orb: webhook redelivery, reputation cadence, DB retention, and gate severity fidelity (#9237) (d2c8d27)
packaging: ship the LICENSE @loopover/miner declares, and assert it everywhere (#9787) (122a283)
review: auto-clear stale manual-review lock-contention hold; sync engine gate-decision twin (#9107) (6aacf08)
review: default cross-issue copycat/reward-farming dedupe on for reward-eligible repos (#9226) (b251912)

Dependencies

The following workspace dependencies were updated
- dependencies
  - @loopover/contract bumped from ^0.1.0 to ^3.17.0
  - @loopover/engine bumped from ^3.16.0 to ^3.17.0

This PR was generated with Release Please. See documentation.

loopover-orb · 2026-07-29T08:17:52Z

Important

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏳ LoopOver is waiting…

LoopOver has seen this pull request and is waiting on CI checks to finish before reviewing it. This comment will update once the review runs.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟨 Waiting}

superagent-security · 2026-07-29T08:19:16Z

Superagent didn't find any vulnerabilities or security issues in this PR.

codecov · 2026-07-29T08:20:15Z

❌ 1 Tests Failed:

Tests completed	Failed	Passed	Skipped
25407	1	25406	21

View the top 1 failed test(s) by shortest run time

test/unit/check-server-manifest-script.test.ts > the anti-rot path guard (#9526) > the real repository satisfies both halves

Stack Traces | 0.014s run time

AssertionError: expected [ Array(2) ] to deeply equal []

- Expected
+ Received

- []
+ [
+   {
+     "detail": "must equal @loopover/mcp's 3.17.0 (release automation owns it), got 3.15.2",
+     "field": "version",
+   },
+   {
+     "detail": "must equal @loopover/mcp's 3.17.0, got 3.15.2",
+     "field": "packages[0].version",
+   },
+ ]

 ❯ test/unit/check-server-manifest-script.test.ts:48:31

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

cloudflare-workers-and-pages · 2026-07-29T09:02:43Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
🔵 In progress View logs	loopover-ui	`69c5823`	Jul 29 2026, 01:23 PM

…ished contract (#9797) apps/loopover-ui declared "@loopover/contract": "^0.1.0". While contract sat at 0.1.0 that matched the workspace copy and npm linked it. The moment release-please bumped contract into the engine-and-dependents group at 3.17.0, the range stopped matching -- and npm did NOT fail. It resolved the dependency from the REGISTRY, installing the published 0.1.0 tarball into apps/loopover-ui/node_modules while every other consumer used 3.17.0. The website would have built against a contract ~17 minor versions stale: same import specifiers, different schemas and types, no error anywhere. It surfaced only as an `npm ci` lockfile-sync failure on the release PR (#9780), which reads like a mechanical lockfile problem rather than the dependency bug it is. Pin the private apps to "*" -- the one range that means "the workspace copy" and cannot drift -- and add workspace-dep-ranges:check. The check requires "*" for PRIVATE packages rather than merely checking that a range is satisfied, because satisfaction alone cannot see the trap: `^0.1.0` against contract@0.1.0 is valid today and silently wrong the day contract is bumped. That rule caught a second latent instance, discovery-index pinning engine to ^3.4.0. Published packages keep real ranges (npm consumers need them) and are checked for satisfaction instead.

codecov · 2026-07-29T10:49:21Z

Bundle Report

Bundle size has no change ✅

check-server-manifest requires server.json's version and packages[0].version to equal @loopover/mcp's, and release-please bumps the package without touching server.json -- so every release PR fails this check until the file is synced by hand. Automating that is #9874.

JSONbored added the autorelease: pending label Jul 29, 2026

JSONbored self-assigned this Jul 29, 2026

loopover-orb Bot added the manual-review Gittensor contributor context label Jul 29, 2026

JSONbored force-pushed the release-please--branches--main--groups--engine-and-dependents branch from 9fb4376 to 054a865 Compare July 29, 2026 09:02

JSONbored force-pushed the release-please--branches--main--groups--engine-and-dependents branch from 9edbfbf to 1017e59 Compare July 29, 2026 09:24

JSONbored mentioned this pull request Jul 29, 2026

fix(workspace): stop apps/loopover-ui silently resolving a stale published @loopover/contract #9797

Merged

JSONbored force-pushed the release-please--branches--main--groups--engine-and-dependents branch from 7b84172 to f6736c7 Compare July 29, 2026 09:45

JSONbored force-pushed the release-please--branches--main--groups--engine-and-dependents branch 2 times, most recently from 42959e5 to 79d8277 Compare July 29, 2026 10:43

JSONbored force-pushed the release-please--branches--main--groups--engine-and-dependents branch 5 times, most recently from d30799e to 69c5823 Compare July 29, 2026 13:23

JSONbored mentioned this pull request Jul 29, 2026

fix(miner-ui): type a chat-dispatch mock against the union #9815 closed #9846

Merged

JSONbored force-pushed the release-please--branches--main--groups--engine-and-dependents branch 2 times, most recently from dbb3c33 to ac4ed90 Compare July 29, 2026 14:46

chore(main): release engine-and-dependents libraries

7479575

JSONbored force-pushed the release-please--branches--main--groups--engine-and-dependents branch from 46106d0 to 7479575 Compare July 29, 2026 15:32

github-actions Bot and others added 2 commits July 29, 2026 15:32

chore(release): sync miner engine-version pin

e8f6b1d

JSONbored mentioned this pull request Jul 29, 2026

release: server.json's version is not bumped by release automation, so every release PR fails server-manifest:check #9874

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(main): release engine-and-dependents libraries - #9780

chore(main): release engine-and-dependents libraries#9780
JSONbored wants to merge 3 commits into
mainfrom
release-please--branches--main--groups--engine-and-dependents

JSONbored commented Jul 29, 2026 •

edited

Loading

Uh oh!

loopover-orb Bot commented Jul 29, 2026 •

edited

Loading

⏳ LoopOver is waiting…

Uh oh!

superagent-security Bot commented Jul 29, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jul 29, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Jul 29, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jul 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

JSONbored commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 I have created a release beep boop

3.17.0 (2026-07-29)

Features

Fixes

3.17.0 (2026-07-29)

Features

Fixes

3.17.0 (2026-07-29)

Features

Fixes

Dependencies

3.17.0 (2026-07-29)

Features

Fixes

Dependencies

Uh oh!

loopover-orb Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⏳ LoopOver is waiting…

Uh oh!

superagent-security Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ 1 Tests Failed:

Uh oh!

cloudflare-workers-and-pages Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

codecov Bot commented Jul 29, 2026

Bundle Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

JSONbored commented Jul 29, 2026 •

edited

Loading

loopover-orb Bot commented Jul 29, 2026 •

edited

Loading

superagent-security Bot commented Jul 29, 2026 •

edited

Loading

codecov Bot commented Jul 29, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Jul 29, 2026 •

edited

Loading