refactor(openapi): replace the settings-parity script with a compile-time schema/type assertion (#9531) (#9585)

scripts/check-openapi-settings-parity.ts diffed the top-level KEY SETS of
RepositorySettingsSchema/RepoSettingsPreviewSchema against the two TS types by re-parsing
src/types.ts and src/signals/settings-preview.ts with brace-and-indent heuristics. It could
not see a field's optionality, nullability, or value type, and any reformatting of either
type would have silently broken its extraction.

test/unit/openapi-settings-schema-parity.test.ts replaces it with an exact-equality type
assertion in both directions, compared per key so a failure still names the drifted field.
Three published-spec defects the key-set diff had been structurally unable to see turned up
the moment it compiled:

- autonomy advertised "suggest"/"propose", removed from AutonomyLevel by #4620 and dropped
  on persist ever since;
- contributorBlacklist omitted the immutable githubId the API has returned since #9125;
- moderationRules omitted "copycat", a real ModerationRuleType since #1969.

Also: expectedCiContexts is declared and read as nullable but the schema never said so, and
the settings-preview's aiReviewConfirmedContributorsOnly advertised a null the builder's
`?? false` makes unreachable.

Reaching parity required the types to state what the read paths already guarantee. The
thirteen config-as-code fields both getRepositorySettings paths always populate become
required; the no-row defaults move into defaultRepositorySettings() so there is one home for
them, and upsertRepositorySettings echoes linkedIssueHardRules/synchronizeClosePolicy so
PUT's response matches GET's shape. resolveEffectiveSettings now skips undefined-valued
manifest keys before the spread, so config-as-code can no longer punch a hole in a resolved
DB value -- "not overridden" is what an absent value means at every other layer.

Author: JSONbored

.github/workflows/ci.yml

@@ -790,12 +790,6 @@ jobs:
       - name: OpenAPI drift check
         if: ${{ github.event_name == 'push' || needs.changes.outputs.ui == 'true' || needs.changes.outputs.uiContract == 'true' }}
         run: npm run ui:openapi:check
-      # #2556: RepositorySettingsSchema (hand-authored Zod) can silently drift from the actual
-      # RepositorySettings TS type -- the OpenAPI drift check above only verifies the generated spec
-      # matches the Zod schema, never that the schema matches the type the API actually serializes.
-      - name: OpenAPI settings-parity check
-        if: ${{ github.event_name == 'push' || needs.changes.outputs.ui == 'true' || needs.changes.outputs.uiContract == 'true' }}
-        run: npm run ui:openapi:settings-parity
       # Checks apps/loopover-ui/src' known-latest MCP version string against the published package, so
       # its dependency is `ui` (the file it scans) + `mcp` (the package it checks against) -- NOT the
       # OpenAPI contract, which this script never reads.

apps/loopover-ui/public/openapi.json

@@ -9206,7 +9206,8 @@
             "type": "array",
             "items": {
               "type": "string"
-            }
+            },
+            "nullable": true
           },
           "advisoryCheckRuns": {
             "type": "array",
@@ -9690,6 +9691,9 @@
                 },
                 "addedAt": {
                   "type": "string"
+                },
+                "githubId": {
+                  "type": "integer"
                 }
               },
               "required": [
@@ -9704,8 +9708,6 @@
                 "type": "string",
                 "enum": [
                   "observe",
-                  "suggest",
-                  "propose",
                   "auto_with_approval",
                   "auto"
                 ]
@@ -9714,8 +9716,6 @@
                 "type": "string",
                 "enum": [
                   "observe",
-                  "suggest",
-                  "propose",
                   "auto_with_approval",
                   "auto"
                 ]
@@ -9724,8 +9724,6 @@
                 "type": "string",
                 "enum": [
                   "observe",
-                  "suggest",
-                  "propose",
                   "auto_with_approval",
                   "auto"
                 ]
@@ -9734,8 +9732,6 @@
                 "type": "string",
                 "enum": [
                   "observe",
-                  "suggest",
-                  "propose",
                   "auto_with_approval",
                   "auto"
                 ]
@@ -9744,8 +9740,6 @@
                 "type": "string",
                 "enum": [
                   "observe",
-                  "suggest",
-                  "propose",
                   "auto_with_approval",
                   "auto"
                 ]
@@ -9754,8 +9748,6 @@
                 "type": "string",
                 "enum": [
                   "observe",
-                  "suggest",
-                  "propose",
                   "auto_with_approval",
                   "auto"
                 ]
@@ -9764,8 +9756,6 @@
                 "type": "string",
                 "enum": [
                   "observe",
-                  "suggest",
-                  "propose",
                   "auto_with_approval",
                   "auto"
                 ]
@@ -9774,8 +9764,6 @@
                 "type": "string",
                 "enum": [
                   "observe",
-                  "suggest",
-                  "propose",
                   "auto_with_approval",
                   "auto"
                 ]
@@ -9784,8 +9772,6 @@
                 "type": "string",
                 "enum": [
                   "observe",
-                  "suggest",
-                  "propose",
                   "auto_with_approval",
                   "auto"
                 ]
@@ -9954,7 +9940,8 @@
                 "contributor_cap",
                 "blacklist",
                 "review_nag",
-                "review_evasion"
+                "review_evasion",
+                "copycat"
               ]
             }
           },
@@ -10133,14 +10120,24 @@
           "closeOwnerAuthors",
           "autoLabelEnabled",
           "typeLabelsEnabled",
+          "linkedIssueLabelPropagation",
+          "linkedIssueHardRules",
           "gittensorLabel",
           "blacklistLabel",
           "createMissingLabel",
           "publicSurface",
           "includeMaintainerAuthors",
           "requireLinkedIssue",
           "backfillEnabled",
-          "commandAuthorization"
+          "commandAuthorization",
+          "contributorBlacklist",
+          "autonomy",
+          "moderationGateMode",
+          "fairnessAnalyticsMode",
+          "reviewEvasionProtection",
+          "draftPrClosePolicy",
+          "synchronizeClosePolicy",
+          "screenshotTableGate"
         ]
       },
       "AutomationState": {
@@ -10991,8 +10988,7 @@
                 "type": "boolean"
               },
               "aiReviewConfirmedContributorsOnly": {
-                "type": "boolean",
-                "nullable": true
+                "type": "boolean"
               },
               "commandAuthorization": {
                 "type": "object",

package.json

@@ -63,7 +63,6 @@
     "ui:test": "npm run ui:kit:build && npm --workspace @loopover/ui run test && npm --workspace @loopover/ui-miner run test",
     "ui:openapi": "tsx scripts/write-ui-openapi.ts",
     "ui:openapi:check": "tsx scripts/write-ui-openapi.ts --check",
-    "ui:openapi:settings-parity": "tsx scripts/check-openapi-settings-parity.ts",
     "cloudflare:schema": "tsx scripts/write-cloudflare-schema.ts",
     "ui:version-audit": "node --experimental-strip-types scripts/check-ui-mcp-version-copy.ts",
     "ui:version-audit:sync": "node --experimental-strip-types scripts/check-ui-mcp-version-copy.ts --write",
@@ -122,7 +121,7 @@
     "test:smoke:browser:install": "playwright install chromium",
     "test:smoke:browser": "node --experimental-strip-types scripts/smoke-ui-browser.ts",
     "pretest:ci": "npm run check-node-version",
-    "test:ci": "git diff --check && npm run actionlint && npm run lint:composite-actions && npm run db:migrations:check && npm run db:schema-drift:check && npm run selfhost:env-reference:check && npm run miner:env-reference:check && npm run selfhost:validate-observability && npm run cf-typegen:check && npm run build --workspace @loopover/engine && npm run build --workspace @loopover/discovery-index && npm run build:mcp && npm run build:miner && npm run build --workspace @loopover/ui-kit && npm run typecheck && npm run test:coverage && npm run test:engine-parity && npm run test:live-gate-parity && npm run test:driver-parity && npm run validate:mcp && npm run test --workspace @loopover/engine && npm run test:workers && npm run test:mcp-pack && npm run test:miner-pack && npm run test:engine-pack && npm run test:ui-kit-pack && npm run test:miner-deployment-docs-audit && npm run rees:test && npm run ui:openapi:check && npm run ui:openapi:settings-parity && npm run ui:version-audit && npm run docs:drift-check && npm run coverage-boltons:check && npm run import-specifiers:check && npm run dead-source-files:check && npm run regate-sort-key:check && npm run command-redelivery-guards:check && npm run dispatch-gate-reasons:check && npm run validate:no-hand-written-js && npm run replay-runner-manifest:check && npm run coco-dev-versions:check && npm run branding-drift:check && npm run manifest:drift-check && npm run engine-parity:drift-check && npm run engines-nvmrc:check && npm run release-manifest:sync:check && npm run command-reference:check && npm run ui:lint && npm run ui:typecheck && npm run ui:test && npm run ui:build",
+    "test:ci": "git diff --check && npm run actionlint && npm run lint:composite-actions && npm run db:migrations:check && npm run db:schema-drift:check && npm run selfhost:env-reference:check && npm run miner:env-reference:check && npm run selfhost:validate-observability && npm run cf-typegen:check && npm run build --workspace @loopover/engine && npm run build --workspace @loopover/discovery-index && npm run build:mcp && npm run build:miner && npm run build --workspace @loopover/ui-kit && npm run typecheck && npm run test:coverage && npm run test:engine-parity && npm run test:live-gate-parity && npm run test:driver-parity && npm run validate:mcp && npm run test --workspace @loopover/engine && npm run test:workers && npm run test:mcp-pack && npm run test:miner-pack && npm run test:engine-pack && npm run test:ui-kit-pack && npm run test:miner-deployment-docs-audit && npm run rees:test && npm run ui:openapi:check && npm run ui:version-audit && npm run docs:drift-check && npm run coverage-boltons:check && npm run import-specifiers:check && npm run dead-source-files:check && npm run regate-sort-key:check && npm run command-redelivery-guards:check && npm run dispatch-gate-reasons:check && npm run validate:no-hand-written-js && npm run replay-runner-manifest:check && npm run coco-dev-versions:check && npm run branding-drift:check && npm run manifest:drift-check && npm run engine-parity:drift-check && npm run engines-nvmrc:check && npm run release-manifest:sync:check && npm run command-reference:check && npm run ui:lint && npm run ui:typecheck && npm run ui:test && npm run ui:build",
     "test:release": "npm run test:ci && npm run changelog:check",
     "test:release:mcp": "npm run test:ci",
     "test:watch": "vitest",

scripts/check-openapi-settings-parity.ts

@@ -15,8 +15,8 @@
 // drizzle-orm's getTableColumns (keyed by each column's .name -- the actual DB column name, not the JS
 // property name). Diff the two column-name sets per table.
 //
-// Run via `tsx` (not plain `node`) for the same reason as check-migrations.ts and
-// check-openapi-settings-parity.ts: this script imports src/db/schema.ts (a .ts module) directly, and a bare
+// Run via `tsx` (not plain `node`) for the same reason as check-migrations.ts: this script imports
+// src/db/schema.ts (a .ts module) directly, and a bare
 // `node` invocation can't resolve a `.ts` import without an experimental flag CI's pinned Node isn't
 // guaranteed to support.
 import { readdirSync, readFileSync } from "node:fs";

scripts/check-schema-drift.ts

@@ -712,11 +712,16 @@ export async function listRepositories(env: Env): Promise<RepositoryRecord[]> {
   return rows.map(toRepositoryRecord);
 }
 
-export async function getRepositorySettings(env: Env, fullName: string): Promise<RepositorySettings> {
-  const db = getDb(env.DB);
-  const [row] = await db.select().from(repositorySettings).where(eq(repositorySettings.repoFullName, fullName)).limit(1);
-  if (!row) {
-    return {
+/**
+ * The complete built-in default settings for a repo LoopOver has no row for (#9531).
+ *
+ * Extracted from getRepositorySettings' no-row branch so it has ONE home: the read path returns it,
+ * and the test fixtures that build full RepositorySettings literals spread it instead of each
+ * hand-maintaining a private copy of every config-as-code default -- which is how ten of them came
+ * to silently omit the same thirteen fields.
+ */
+export function defaultRepositorySettings(fullName: string): RepositorySettings {
+  return {
       repoFullName: fullName,
       commentMode: "detected_contributors_only",
       publicAudienceMode: "oss_maintainer",
@@ -805,7 +810,13 @@ export async function getRepositorySettings(env: Env, fullName: string): Promise
       mergeTrainMode: "off",
       screenshotTableGate: { ...DEFAULT_SCREENSHOT_TABLE_GATE, whenLabels: [], whenPaths: [], requireViewports: [], requireThemes: [] },
     };
-  }
+}
+
+
+export async function getRepositorySettings(env: Env, fullName: string): Promise<RepositorySettings> {
+  const db = getDb(env.DB);
+  const [row] = await db.select().from(repositorySettings).where(eq(repositorySettings.repoFullName, fullName)).limit(1);
+  if (!row) return defaultRepositorySettings(fullName);
   return {
     repoFullName: row.repoFullName,
     // Config-as-code only (Batch A, loopover#6442): no DB column backs these 9 fields anymore -- the
@@ -1055,6 +1066,11 @@ export async function upsertRepositorySettings(env: Env, settings: Partial<Repos
     draftPrClosePolicy: "off" as const, // #6440/#draft-pr-close-policy: config-as-code only now -- any caller-supplied value is a silent no-op, configure via .loopover.yml settings.draftPrClosePolicy instead
     mergeTrainMode: "off" as const,
     screenshotTableGate: normalizeScreenshotTableGateConfig(settings.screenshotTableGate, []),
+    // #9531: both GET paths always return these two config-as-code-only fields, so RepositorySettings
+    // declares them required and this write-path echo must carry the same built-in defaults the read
+    // paths do -- omitting them made PUT's response a different shape from GET's for the same repo.
+    linkedIssueHardRules: { ...DEFAULT_LINKED_ISSUE_HARD_RULES, pointBearingLabels: [], maintainerOnlyLabels: [] },
+    synchronizeClosePolicy: "off" as const,
   } satisfies RepositorySettings;
   const db = getDb(env.DB);
   await db