chore(release): resolve manifest conflict against main (contract/mcp/engine/miner at 3.21.1)

Author: JSONbored

.github/workflows/ci.yml

@@ -889,6 +889,9 @@ jobs:
       # matches the pattern already used by "Save Turborepo cache"/"Save TypeScript incremental build
       # cache" elsewhere in this file: still run after an earlier step's failure, just not after the job
       # was cancelled outright. The job as a whole still fails if any of the three fails.
+      - name: UI tests (ui-kit)
+        if: ${{ !cancelled() && (github.event_name == 'push' || needs.changes.outputs.ui == 'true') }}
+        run: npm --workspace @loopover/ui-kit run test
       - name: UI tests (ui)
         if: ${{ !cancelled() && (github.event_name == 'push' || needs.changes.outputs.ui == 'true') }}
         run: npm --workspace @loopover/ui run test

.github/workflows/mcp-release-please.yml

@@ -178,31 +178,31 @@ jobs:
         if: ${{ steps.release.outputs['packages/loopover-mcp--release_created'] == 'true' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh workflow run publish-mcp.yml --ref "${{ steps.release.outputs['packages/loopover-mcp--tag_name'] }}" -f released_by_release_please=true
+        run: gh workflow run publish-mcp.yml --ref "${{ steps.release.outputs['packages/loopover-mcp--tag_name'] }}" -f released_by_release_please=true -f dispatched_by_automation=true
 
       - name: Dispatch Engine publish
         if: ${{ steps.release.outputs['packages/loopover-engine--release_created'] == 'true' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh workflow run publish-engine.yml --ref "${{ steps.release.outputs['packages/loopover-engine--tag_name'] }}" -f released_by_release_please=true
+        run: gh workflow run publish-engine.yml --ref "${{ steps.release.outputs['packages/loopover-engine--tag_name'] }}" -f released_by_release_please=true -f dispatched_by_automation=true
 
       - name: Dispatch Contract publish
         if: ${{ steps.release.outputs['packages/loopover-contract--release_created'] == 'true' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh workflow run publish-contract.yml --ref "${{ steps.release.outputs['packages/loopover-contract--tag_name'] }}" -f released_by_release_please=true
+        run: gh workflow run publish-contract.yml --ref "${{ steps.release.outputs['packages/loopover-contract--tag_name'] }}" -f released_by_release_please=true -f dispatched_by_automation=true
 
       - name: Dispatch Miner publish
         if: ${{ steps.release.outputs['packages/loopover-miner--release_created'] == 'true' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh workflow run publish-miner.yml --ref "${{ steps.release.outputs['packages/loopover-miner--tag_name'] }}" -f released_by_release_please=true
+        run: gh workflow run publish-miner.yml --ref "${{ steps.release.outputs['packages/loopover-miner--tag_name'] }}" -f released_by_release_please=true -f dispatched_by_automation=true
 
       - name: Dispatch UI Kit publish
         if: ${{ steps.release.outputs['packages/loopover-ui-kit--release_created'] == 'true' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh workflow run publish-ui-kit.yml --ref "${{ steps.release.outputs['packages/loopover-ui-kit--tag_name'] }}" -f released_by_release_please=true
+        run: gh workflow run publish-ui-kit.yml --ref "${{ steps.release.outputs['packages/loopover-ui-kit--tag_name'] }}" -f released_by_release_please=true -f dispatched_by_automation=true
 
   # Self-heal for a known, reproducible, upstream googleapis/release-please limitation
   # (googleapis/release-please#1946, #1444, #1406 -- all the same "There are untagged, merged release
@@ -282,7 +282,7 @@ jobs:
             # `before_ts` only on the rare case the URL wasn't returned.
             local before_ts run_id dispatch_output
             before_ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-            dispatch_output="$(gh workflow run "$workflow" --repo "$GITHUB_REPOSITORY" 2>&1)"
+            dispatch_output="$(gh workflow run "$workflow" --repo "$GITHUB_REPOSITORY" -f dispatched_by_automation=true 2>&1)"
             echo "$dispatch_output"
             run_id="$(printf '%s' "$dispatch_output" | grep -oE '/runs/[0-9]+' | grep -oE '[0-9]+' | tail -1 || true)"
             if [ -z "$run_id" ]; then

.github/workflows/publish-contract.yml

@@ -23,6 +23,18 @@ on:
         description: "Internal: set by the release automation's dispatch so this run skips re-creating the GitHub release it already made."
         type: boolean
         default: false
+      dispatched_by_automation:
+        description: "Internal: set by the release automation's dispatch so a hand retry is not counted as an outage. Informational -- it feeds run-name below and nothing else."
+        type: boolean
+        default: false
+
+# PROVENANCE STAMP (#10234). `run-name` is the ONLY dispatch-time signal the runs API gives back (as
+# `display_title`): the reconcile path dispatches bare against main under a PAT, so `event`, `head_branch`
+# and `triggering_actor` are identical to a human's `gh workflow run`, and run objects carry no `inputs`.
+# scripts/escalate-workflow-outage.ts recovers "was this automated?" from the marker below -- see its
+# header for the full story. The marker must stay in lockstep with that script's
+# AUTOMATION_RUN_NAME_MARKER; scripts/check-dispatch-provenance-stamped.ts fails the build if they drift.
+run-name: "Publish Contract Package${{ inputs.dispatched_by_automation && ' [automated]' || '' }}"
 
 permissions:
   contents: read

.github/workflows/publish-engine.yml

@@ -18,6 +18,18 @@ on:
         description: "Internal: set by the release automation's dispatch so this run skips re-creating the GitHub release it already made."
         type: boolean
         default: false
+      dispatched_by_automation:
+        description: "Internal: set by the release automation's dispatch so a hand retry is not counted as an outage. Informational -- it feeds run-name below and nothing else."
+        type: boolean
+        default: false
+
+# PROVENANCE STAMP (#10234). `run-name` is the ONLY dispatch-time signal the runs API gives back (as
+# `display_title`): the reconcile path dispatches bare against main under a PAT, so `event`, `head_branch`
+# and `triggering_actor` are identical to a human's `gh workflow run`, and run objects carry no `inputs`.
+# scripts/escalate-workflow-outage.ts recovers "was this automated?" from the marker below -- see its
+# header for the full story. The marker must stay in lockstep with that script's
+# AUTOMATION_RUN_NAME_MARKER; scripts/check-dispatch-provenance-stamped.ts fails the build if they drift.
+run-name: "Publish Engine Package${{ inputs.dispatched_by_automation && ' [automated]' || '' }}"
 
 permissions:
   contents: read

.github/workflows/publish-mcp.yml

@@ -12,6 +12,18 @@ on:
         description: "Internal: set by the release automation's dispatch so this run skips re-creating the GitHub release it already made."
         type: boolean
         default: false
+      dispatched_by_automation:
+        description: "Internal: set by the release automation's dispatch so a hand retry is not counted as an outage. Informational -- it feeds run-name below and nothing else."
+        type: boolean
+        default: false
+
+# PROVENANCE STAMP (#10234). `run-name` is the ONLY dispatch-time signal the runs API gives back (as
+# `display_title`): the reconcile path dispatches bare against main under a PAT, so `event`, `head_branch`
+# and `triggering_actor` are identical to a human's `gh workflow run`, and run objects carry no `inputs`.
+# scripts/escalate-workflow-outage.ts recovers "was this automated?" from the marker below -- see its
+# header for the full story. The marker must stay in lockstep with that script's
+# AUTOMATION_RUN_NAME_MARKER; scripts/check-dispatch-provenance-stamped.ts fails the build if they drift.
+run-name: "Publish MCP Package${{ inputs.dispatched_by_automation && ' [automated]' || '' }}"
 
 permissions:
   contents: read

.github/workflows/publish-miner.yml

@@ -18,6 +18,18 @@ on:
         description: "Internal: set by the release automation's dispatch so this run skips re-creating the GitHub release it already made."
         type: boolean
         default: false
+      dispatched_by_automation:
+        description: "Internal: set by the release automation's dispatch so a hand retry is not counted as an outage. Informational -- it feeds run-name below and nothing else."
+        type: boolean
+        default: false
+
+# PROVENANCE STAMP (#10234). `run-name` is the ONLY dispatch-time signal the runs API gives back (as
+# `display_title`): the reconcile path dispatches bare against main under a PAT, so `event`, `head_branch`
+# and `triggering_actor` are identical to a human's `gh workflow run`, and run objects carry no `inputs`.
+# scripts/escalate-workflow-outage.ts recovers "was this automated?" from the marker below -- see its
+# header for the full story. The marker must stay in lockstep with that script's
+# AUTOMATION_RUN_NAME_MARKER; scripts/check-dispatch-provenance-stamped.ts fails the build if they drift.
+run-name: "Publish Miner Package${{ inputs.dispatched_by_automation && ' [automated]' || '' }}"
 
 permissions:
   contents: read

.github/workflows/publish-ui-kit.yml

@@ -18,6 +18,18 @@ on:
         description: "Internal: set by the release automation's dispatch so this run skips re-creating the GitHub release it already made."
         type: boolean
         default: false
+      dispatched_by_automation:
+        description: "Internal: set by the release automation's dispatch so a hand retry is not counted as an outage. Informational -- it feeds run-name below and nothing else."
+        type: boolean
+        default: false
+
+# PROVENANCE STAMP (#10234). `run-name` is the ONLY dispatch-time signal the runs API gives back (as
+# `display_title`): the reconcile path dispatches bare against main under a PAT, so `event`, `head_branch`
+# and `triggering_actor` are identical to a human's `gh workflow run`, and run objects carry no `inputs`.
+# scripts/escalate-workflow-outage.ts recovers "was this automated?" from the marker below -- see its
+# header for the full story. The marker must stay in lockstep with that script's
+# AUTOMATION_RUN_NAME_MARKER; scripts/check-dispatch-provenance-stamped.ts fails the build if they drift.
+run-name: "Publish UI Kit Package${{ inputs.dispatched_by_automation && ' [automated]' || '' }}"
 
 permissions:
   contents: read

.release-please-manifest.json

@@ -1,7 +1,7 @@
 {
-  "packages/loopover-contract": "3.19.0",
-  "packages/loopover-mcp": "3.19.0",
-  "packages/loopover-engine": "3.19.0",
-  "packages/loopover-miner": "3.19.0",
+  "packages/loopover-contract": "3.21.1",
+  "packages/loopover-mcp": "3.21.1",
+  "packages/loopover-engine": "3.21.1",
+  "packages/loopover-miner": "3.21.1",
   "packages/loopover-ui-kit": "1.6.0"
 }

apps/loopover-ui/content/docs/self-hosting-operations.mdx

@@ -676,13 +676,18 @@ three standalone bindings (`AI_EMBED`, `AI_VISION`, `AI_ADVISORY`).
     {
       title: "Content policy",
       description:
-        "Metadata only — never the prompt or completion text. $ai_generation's own optional content fields ($ai_input/$ai_output_choices) are never populated, the same redaction posture as every other capture path on this page.",
+        "Metadata only by default — no prompt or completion text leaves the box unless you explicitly opt in. $ai_generation's optional content fields ($ai_input/$ai_output_choices) stay unpopulated unless LOOPOVER_POSTHOG_AI_CONTENT is set, so upgrading never starts shipping content on its own.",
     },
     {
       title: "Model labelling",
       description:
         "$ai_model is always the model the provider actually resolved — on the failure path too. The core passes a Workers-AI model id that every self-host provider discards, so it is resolved to the real one (or <provider>-default) before capture and never reported verbatim.",
     },
+    {
+      title: "Trace naming",
+      description:
+        "$ai_trace names the whole review in PostHog's Traces view. Emitted once per trace, by the outermost pipeline span, and only when at least one AI call actually ran under it — a pipeline span with no generations is never given a trace row.",
+    },
     {
       title: "Degraded requests",
       description:
@@ -691,6 +696,28 @@ three standalone bindings (`AI_EMBED`, `AI_VISION`, `AI_ADVISORY`).
   ]}
 />
 
+### Capturing prompts and completions (`LOOPOVER_POSTHOG_AI_CONTENT`)
+
+**Off by default, and deliberately so.** With it unset, no prompt, diff or model completion ever leaves the
+box — only the metadata listed above. Set `LOOPOVER_POSTHOG_AI_CONTENT=1` to populate `$ai_input` and
+`$ai_output_choices`, which is what unlocks PostHog's conversation view, sentiment, evaluations and
+LLM-judge surfaces. Read this before turning it on:
+
+- **Your PR diffs and review text go to PostHog.** The prompt for a review contains the diff and the
+  assembled repo context. On a private repository that is private source code leaving your infrastructure.
+  Only enable it on a project you are willing to have that content in.
+- **The same redaction still applies.** Captured content passes through the identical `before_send` scrub
+  (`src/selfhost/redaction-scrub.ts`) as every other field — credential shapes, JWTs and query-string
+  secrets are redacted from it. That is a backstop, not a licence: it removes credential shapes, not the
+  source code itself.
+- **Content is truncated.** Each message is capped at 10,000 characters
+  (`LOOPOVER_POSTHOG_AI_CONTENT_MAX_CHARS`) and marked `…[truncated]`. A review prompt can exceed 300,000
+  characters, so an uncapped capture would blow past PostHog's payload limits and be dropped entirely. A
+  non-numeric, zero or negative override falls back to the default rather than disabling the cap.
+- **Images are never captured.** An image content block is dropped, not base64-encoded into the event.
+- **On a failure, the prompt is captured but there is no completion** — a `claude_stalled_no_output` or a
+  context-length rejection is only diagnosable against the input that produced it.
+
 A CLI-subscription provider declining an embedding request (`claude_code_no_embed` / `codex_no_embed`)
 is routing working as designed — it is how an embed reaches an embed-capable provider — so it is exempt
 from both captures. A chain with **no** embed-capable member at all is a real misconfiguration, but it