Epic: hosted AMS chat platform — sign up, connect GitHub, converse with your miner

[JSONbored]

Context

#5229 decided the client-surface strategy for hosted AMS: reuse apps/loopover-miner-ui with a hosted-mode flag, defer mobile/desktop. Its blocker at the time (#7180, tenant Container+Postgres provisioning core) is now closed, and #5963 (demo Cloudflare Worker deployment prototype) remains open to inform the deployment mechanics. The miner dashboard's chat is already action-capable locally (#6504: streaming, grounding over the 11 loopover_miner_* tools, governor/portfolio action-dispatch) — but everything about it assumes a single local operator: local state, no session identity, no tenant boundaries, no signup.

The end vision is that any GitHub contributor starts with LoopOver the way they'd start with Cursor: sign up, connect GitHub, pick target repos, and converse with their autonomous miner — hosted, no local install, Gittensor registration optional. This epic is the gap between the local dashboard that exists and that hosted platform.

Scope groups (native sub-issues)

1. Hosted-mode flag — the deferred follow-up from Spec: client-surface strategy for hosted AMS (web dashboard vs. mobile/desktop apps vs. CLI-only) #5229's decision, now unblocked.
2. Tenant auth — GitHub OAuth session; per-tenant scoping of attempt/portfolio/ledger state.
3. Per-tenant grounding + action authz — the read tools and action dispatch re-based onto server-side tenant boundaries.
4. First-run onboarding — connect GitHub → select repos → first discovery conversation, zero-human path.
5. Fleet/health surfaces in chat — per-tenant health and status, chat-queryable.

Hard constraints

• The local UX must not regress: with the hosted-mode flag off, loopover-miner-ui behaves byte-identically to today.
• Per-tenant isolation is absolute: no tool response, action dispatch, ledger row, or health signal may cross tenants; every access check happens server-side (the miner⊕maintainer access boundary rules apply: identity per login, session.actor === requestedLogin).
• Goal-spec respect: hosted miners honor each target repo's .loopover-miner.yml (minerEnabled, wantedPaths, blockedPaths, claim caps) exactly as the local runtime does.
• Privacy boundary: metadata-only; no source upload; no wallet/hotkey/reward/trust-score data in any surface.

Expected outcome

A contributor signs up at loopover.ai, connects GitHub, picks repos, and their first conversation shows real claimable work — then the miner runs under their account with chat as the control surface. This is the contributor half of the hosted end vision.

References

Advances #5229's recorded decision. Relates to #5963, #6504, #6517, #5226, #7180.

[linear-code]

JSO-6344