chore(main): release engine-and-dependents libraries

[JSONbored]

🤖 I have created a release beep boop

engine: 3.2.3

3.2.3 (2026-07-18)

Fixes

• advisory: redact the check-run leak terms sanitizePublicComment already caught (39a431b)
• advisory: redact the check-run leak terms sanitizePublicComment already caught (3b956f4), closes #7074
• config: recognize federatedIntelligence manifest block in lint and preview (95ba59a)
• config: recognize federatedIntelligence manifest block in lint and preview (1c80fb8)

mcp: 3.2.3

3.2.3 (2026-07-18)

Fixes

• api: blunt slop-risk / issue-slop REST + CLI to match the MCP tools (#6990) (#7052) (9971476)
• release: scope MCP publish validation to its own package (86ee117)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @loopover/engine bumped from ^3.2.2 to ^3.2.3

miner: 3.2.3

3.2.3 (2026-07-18)

Fixes

• miner: bound oauth-device-flow.js's GitHub fetches with a request timeout (cd9aedf)
• miner: bound oauth-device-flow.js's GitHub fetches with a request timeout (77ca20f)
• miner: fail closed when a chat-action handler throws (8ba48bd)
• miner: fail closed when a chat-action handler throws (bdb11d9), closes #6989
• miner: purge contribution-profile-cache and governor-state's repo-scoped tables (#7091) (#7110) (6cb2c17)
• miner: reclaim worktree slots by lease age, not cross-container PID liveness (#7131) (237530a), closes #7085
• miner: retry transient 5xx/rate-limit in contribution-profile getJson (#7126) (ec15d24), closes #7090
• miner: retry transient live-state fetch in checkSubmissionFreshness before failing closed (#7129) (2183167), closes #7089
• miner: wire policy_verdict_cache into purge/status/migrate local stores (#7136) (d0fbe82), closes #6987
• release: scope MCP publish validation to its own package (86ee117)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @loopover/engine bumped from ^3.2.2 to ^3.2.3

---

This PR was generated with Release Please. See documentation.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	loopover-ui	975e26d	Commit Preview URL Branch Preview URL	Jul 18 2026, 01:14 AM

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Bundle Report

Bundle size has no change ✅

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.75%. Comparing base (c4eb125) to head (975e26d).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7144   +/-   ##
=======================================
  Coverage   93.75%   93.75%           
=======================================
  Files         692      692           
  Lines       68832    68832           
  Branches    18781    18781           
=======================================
  Hits        64535    64535           
  Misses       3302     3302           
  Partials      995      995           

Flag	Coverage Δ
shard-1	43.75% <ø> (ø)
shard-2	36.91% <ø> (ø)
shard-3	33.14% <ø> (ø)
shard-4	34.44% <ø> (ø)
shard-5	32.27% <ø> (ø)
shard-6	45.90% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

[loopover-orb]

Warning

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-18 00:47:25 UTC}

9 files · 1 AI reviewer · 1 blocker · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
This is an automated release-please version-bump PR: it mechanically syncs version numbers (3.2.2 → 3.2.3) across the manifest, package.json files, lockfile, and expected-engine.version, and appends the corresponding changelog entries. All changes are consistent and self-contained — version bumps match the manifest, workspace dependency ranges (@​loopover/engine ^3.2.2 → ^3.2.3) are updated in lockstep with the engine's own bump, and the changelog content matches the described fixes. The failing CI checks (validate-code, validate-tests, security, changes, Build UI preview artifact) are unusual for a pure version-bump PR and warrant a look, but that is a CI-status fact, not a code defect visible in this diff.

Nits — 5 non-blocking

• The package-lock.json diff is large (thousands of lines) but is fully mechanical/generated and expected for a version-bump release PR — not a real review burden.
• The external brief's 'no SLSA/sigstore attestation' and 'long-file' flags are boilerplate noise for a release-please bot PR; they don't indicate an actual defect in this diff.
• Confirm the FAILED CI checks (validate-code, validate-tests, security) aren't masking a real regression before merging, since a pure version-bump normally shouldn't fail those.
• Standard for a release-please PR: verify the bump matches semantic-release's computed version from the referenced commits (it does here, per the manifest and changelogs shown).
• Diff looks like trivial or whitespace-only churn — Reduce whitespace-only or formatting-only churn and keep the diff focused on substantive changes.

Concerns raised — review before merging

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.

📋 Copy for AI agents — paste into your coding agent

Fix the following blocker(s) from this PR review:

1. No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.

Decision drivers

• ❌ Code review — 1 blocker (1 reviewer)
• ❌ Gate result — Blocking (Repo-configured hard blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ No-issue rationale	PR body explains why no issue is linked.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 32 registered-repo PR(s), 25 merged, 366 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 32 PR(s), 366 issue(s).
Improvement	ℹ️ Insufficient signal	risk: low · value: insufficient-signal · LLM: minor

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, Ruby, Go, JavaScript, MDX, Shell, Solidity
• Official Gittensor activity: 32 PR(s), 366 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Start here: Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review