loopover-orb orb-v3.3.0

LoopOver Orb container image:

docker pull ghcr.io/jsonbored/loopover-selfhost:orb-v3.3.0

Multi-arch (linux/amd64 + linux/arm64). See https://loopover.ai/docs/maintainer-self-hosting for setup.
Includes the Claude Code / Codex subscription CLIs by default; credentials stay runtime-only.
Sentry release id baked into the image: loopover-orb@3.3.0.

What's Changed

🚀 Features

• feat(engine): add operator-declared network-egress allowlist to AmsPolicySpec by @JSONbored in #8204
• feat(review): pure config-drift evaluator over the loosenable-knob registry by @RealDiligent in #8232
• feat(calibration): pure per-repo corpus slicing + density stats by @michiot05 in #8233
• feat(calibration): per-provider reviewer track records from the consensus corpus by @kai392 in #8238
• feat(review): capture fired signals + reversal mapping for the slop and quality gate scores by @RealDiligent in #8239
• feat(calibration): pure counterfactual fixture assembler per the replay contract by @kai392 in #8247
• feat(ui): add verify-this-review walkthrough and measured per-rule accuracy on the fairness report by @RealDiligent in #8254
• feat(calibration): claimed-confidence reliability curves with derived threshold suggestion by @oktofeesh1 in #8252
• feat(calibration): config-drift section in the maintainer recap (#8214) by @jeffrey701 in #8256

🐛 Fixes

• chore(ui): prettierignore locally generated coverage reports in all three UI workspaces by @JSONbored in #8199
• chore(main): release engine-and-dependents libraries by @JSONbored in #8201
• chore(ui): sync MCP_PACKAGE_KNOWN_LATEST_VERSION with npm dist-tags.latest by @JSONbored in #8203
• feat(selfhost): host-companion redeploy trigger via MCP admin tool by @JSONbored in #8209
• chore(main): release engine-and-dependents libraries by @JSONbored in #8237
• feat(public-stats): measured per-rule precision + reproducibility freeze point on /v1/public/stats by @JSONbored in #8241
• feat(calibration): counterfactual replay contract — fixtures, spend, and scoring decided by @JSONbored in #8242
• fix(retention): dedup the contributor-intelligence snapshot types — 2026-07 recurrence of #3810 by @JSONbored in #8240
• chore(main): release engine-and-dependents libraries by @JSONbored in #8245
• chore(ui): sync MCP_PACKAGE_KNOWN_LATEST_VERSION with npm dist-tags.latest by @JSONbored in #8251
• feat(control-plane): deliver a bootstrap secret into hosted tenant containers by @JSONbored in #8253
• feat(calibration): phase-2 hardening from the production applies — plan-file replay, class policy, rate + statement limits by @JSONbored in #8248
• feat(calibration): reason-code enrichment pass — the flat-confidence era's only discriminator by @JSONbored in #8258
• feat(calibration): per-repo knob overrides — storage scheme, resolution seam, status listing by @JSONbored in #8259
• feat(calibration): per-repo loosening loop — repos earn overrides on their own evidence by @JSONbored in #8264
• fix(scripts): don't reject miner package source files merely named with "secret" by @JSONbored in #8266
• feat(review): capture per-reviewer AI votes with swap-proof attribution by @JSONbored in #8265
• feat(calibration): unify the tightening loop under the backtest evidence standard by @JSONbored in #8267

🧹 Other Changes

• feat(engine): AMS calibration corpus — pair predicted gate verdicts with realized PR outcomes by @JSONbored in #8200
• feat(engine): Neon branch-per-attempt disposable DB fork for AMS attempts by @JSONbored in #8205
• feat(miner): wire the Neon branch-per-attempt DB fork into runAttempt by @JSONbored in #8206
• feat(calibration): phase-2 backfill — retro reversal labels + raw-context re-fetch (GitHub truth) by @JSONbored in #8207
• chore(main): release engine-and-dependents libraries by @JSONbored in #8208
• chore(ui): sync MCP_PACKAGE_KNOWN_LATEST_VERSION with npm dist-tags.latest by @JSONbored in #8210
• chore(ui): sync MCP_PACKAGE_KNOWN_LATEST_VERSION with npm dist-tags.latest by @JSONbored in #8244
• fix(control-plane): revoke orphaned secrets when createContainer fails after injectSecrets by @JSONbored in #8255
• test(calibration): invariant — live capture confidence varies with finding inputs by @JSONbored in #8260
• feat(calibration): nightly config-drift sentinel — stale config becomes a push alert by @JSONbored in #8261
• feat(calibration): reliability curves beside the ladder — knobs status + advisor surfacing by @JSONbored in #8262
• feat(miner): wire AMS's hosted entry point to the #8202 tenant-secret bootstrap by @JSONbored in #8263

Full Changelog: orb-v3.2.1-beta.13...orb-v3.3.0