refactor(env): retire GITTENSORY_<X>/LOOPOVER_<X> dual-read across the worker

[JSONbored]

Summary

Deletes src/utils/env.ts (dualPrefixEnvString/Flag/StrictFlag) now that every call site reads its LOOPOVER_<X> var directly. This is the largest and highest-risk piece of the dual-read cleanup:

• src/auth/security.ts and src/selfhost/preflight.ts (API/MCP token auth + preflight secret checks) move in exact lockstep so a self-hoster's preflight and auth gate agree on the same var names.
• src/selfhost/ai.ts and src/selfhost/health.ts keep ENABLE_UNSAFE_CODEX_REVIEWER as a strict === "1" check (not loose truthy).
• The ~20 review/** feature flags (safety, grounding, RAG, unified comment, reputation, ops, selftune, content-lane, parity-audit, draft, planner, impact-map, culture-profile, memory, inline-comments, fix-handoff, e2e-tests, improvement-signal, enrichment, continuous) and the REVIEW_REPOS cutover allowlist move together with their existing precedence logic (master kill-switch, allowlist fallback, manifest-only opt-in) fully preserved.
• src/services/notify-discord.ts's per-repo webhook map now points jsonbored/gittensory straight at LOOPOVER_DISCORD_WEBHOOK instead of deriving it from a GITTENSORY_ name at runtime.
• wrangler.jsonc's vars block is renamed alongside src/env.d.ts — the deployed Worker's own var bindings were still declaring the pre-rebrand GITTENSORY_REVIEW_* keys, which would have left every LOOPOVER_REVIEW_* read unbound on deploy once the dual-read helper was gone. worker-configuration.d.ts and apps/gittensory-ui/src/lib/selfhost-env-reference.ts are regenerated to match.
• scripts/gen-selfhost-env-reference.mjs drops the dual-prefix AST recognition branch now that no call site needs it.
• .env.example/.env.selfhost.example flip to LOOPOVER_<X> as the live default with the retired GITTENSORY_<X> name left as a commented "no longer read" note; self-hosting docs pages (and a couple of comment-only references in packages/gittensory-engine that had drifted) are updated to match.

Fields with no LOOPOVER_ sibling (SKIP_AUTOMATION_BOT_PRS, the DRIFT_ISSUE_*/MAINTAINER_RECAP families, PUBLIC_STATS, SWEEP_WATCHDOG, PR_RECONCILIATION, EXPERIMENTAL_GITTENSOR, DUPLICATE_WINNER, OPEN_PR_FILE_COLLISION, UPLOAD_SOURCE, CONTRIBUTOR_ISSUE_TOKEN, and the bespoke REVIEW_STATS_TOKEN secret name) are left untouched — they were never part of the dual-read family.

Part of #4777

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• Linked to open issue Retire every deprecation shim #4777 (multiple PRs land against it; only the maintainer closes it once all are merged).

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally — full npm run test:ci run green end to end (826 test files, 0 failures)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate — 0 vulnerabilities
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests (auth.test.ts covers both the API and MCP token paths post-migration).
• API/OpenAPI/MCP behavior is updated and tested where needed.
• Public docs/changelogs are updated where needed; changelog itself is untouched (not a release-prep PR).

No visible UI change — the touched apps/gittensory-ui files are docs-page prose/<code> references only, so no UI Evidence section is needed.

Notes

Ran the full local gate (npm run test:ci) end to end after the fix below, exit 0, 826 test files / 0 failures, plus npm audit --audit-level=moderate clean.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	loopover-ui	3621f4a	Commit Preview URL Branch Preview URL	Jul 14 2026, 01:14 AM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.04%. Comparing base (b579eb6) to head (3621f4a).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5652      +/-   ##
==========================================
- Coverage   95.04%   95.04%   -0.01%     
==========================================
  Files         577      576       -1     
  Lines       45987    45980       -7     
  Branches    14708    14724      +16     
==========================================
- Hits        43707    43700       -7     
  Misses       1527     1527              
  Partials      753      753              

Flag	Coverage Δ
shard-1	43.97% <65.78%> (-0.01%)	⬇️
shard-2	35.66% <57.89%> (-0.03%)	⬇️
shard-3	32.33% <50.00%> (-0.07%)	⬇️
shard-4	32.67% <60.52%> (+0.10%)	⬆️
shard-5	31.76% <47.36%> (-0.02%)	⬇️
shard-6	44.43% <65.78%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...es/gittensory-engine/src/advisory/gate-advisory.ts	100.00% <ø> (ø)
packages/gittensory-engine/src/focus-manifest.ts	99.10% <ø> (ø)
src/api/routes.ts	94.32% <100.00%> (ø)
src/auth/security.ts	98.86% <100.00%> (+0.01%)	⬆️
src/index.ts	95.65% <ø> (ø)
src/mcp/server.ts	95.62% <ø> (ø)
src/queue/ai-review-orchestration.ts	100.00% <ø> (ø)
src/queue/job-dispatch.ts	100.00% <ø> (ø)
src/queue/processors.ts	95.67% <100.00%> (ø)
src/review/content-lane-wire.ts	98.55% <ø> (ø)
... and 48 more

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-14 01:17:44 UTC}

186 files · 1 AI reviewer · 1 blocker · readiness 100/100 · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
This is a large, coordinated rename/cleanup that deletes the `dualPrefixEnv*` helpers and moves every call site to read `LOOPOVER_<X>` directly, with matching updates to `wrangler.jsonc`, `worker-configuration.d.ts`, `.env.example`, and docs. The `resolveAiReviewCadence` change in `src/queue/processors.ts` correctly replaces the dual-read helper with a direct `LOOPOVER_REVIEW_CONTINUOUS` regex check and drops the now-unused `dualPrefixEnvFlag` import, and `worker-configuration.d.ts`/`wrangler.jsonc` were updated together so the deployed var bindings match the new names — the exact failure mode called out in the PR description (unbound `LOOPOVER_REVIEW_*` reads) appears to have been avoided in the visible hunks. The main gap I can't verify from the provided diff/file excerpts is whether every one of the ~20 flag call sites across the omitted files (`src/review/*-wire.ts`, `src/auth/security.ts`, `src/selfhost/preflight.ts`, `src/services/notify-discord.ts`) was converged with the same precedence logic and no leftover `GITTENSORY_` reads, since those files are not shown in full.

Nits — 6 non-blocking

• The failing `Workers Builds: loopover-ui` check should be confirmed as unrelated (e.g. flaky/infra) before merge, since this PR touches `wrangler.jsonc` and generated worker types directly.
• `src/queue/processors.ts:11228` and several other touched files (`src/api/routes.ts`, `src/mcp/server.ts`, `src/services/ai-review.ts`) are already very large; not this PR's fault, but worth flagging for a future split.
• Verify the `review/**-wire.ts` files (not shown in full here) all dropped their `GITTENSORY_` reads consistently with the same allowlist/kill-switch precedence shown in `processors.ts`.
• Since this PR is described as 'the largest and highest-risk piece of the dual-read cleanup,' consider a follow-up smoke test that deploys with only `LOOPOVER_*` vars set (no `GITTENSORY_*` present) to catch any remaining unconverted reads outside the visible diff.
• Double check the flagged potential secret-assignment matches in `test/unit/product-usage.test.ts:272` and `test/unit/selfhost-preflight.test.ts:279-291` are fixture/dummy values, not real leaked tokens.
• Possible secret-shaped assignment in the diff (generic_secret_assignment) — Verify the value is not a real credential.

Concerns raised — review before merging

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.

📋 Copy for AI agents — paste into your coding agent

Fix the following blocker(s) from this PR review:

1. No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.

Signal	Result	Evidence
Code review	❌ 1 blocker	1 reviewer
Linked issue	✅ No-issue rationale	PR body explains why no issue is linked.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 45 registered-repo PR(s), 36 merged, 321 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 45 PR(s), 321 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.
Improvement	✅ Minor	risk: clean · value: minor — Code changes are accompanied by test evidence.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, Ruby, Go, JavaScript, MDX, Shell, Solidity
• Official Gittensor activity: 45 PR(s), 321 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

[BETA] Chat with Gittensory

Ask Gittensory a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @gittensory ask <question> answers contribution-quality Q&A with source citations and freshness.
• @gittensory chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @gittensory mention with a real question is routed to the closest matching read-only command automatically -- no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/gittensory-commands

Visual preview

Route	Viewport	Before (production)	After (this PR's preview)	Diff
/docs/github-app	desktop			—
/docs/github-app	mobile			—
/docs/how-reviews-work	desktop			—
/docs/how-reviews-work	mobile			—

Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review