JSONbored · JSONbored · Jul 14, 2026 · Jul 14, 2026
@@ -1,4 +1,4 @@
 -- Config-as-code BYOK provider/model for the AI review (the secret key stays in repository_ai_keys,
--- encrypted; these are the non-secret choices, settable via .gittensory.yml or the maintainer dashboard).
+-- encrypted; these are the non-secret choices, settable via .loopover.yml or the maintainer dashboard).
 ALTER TABLE repository_settings ADD COLUMN ai_review_provider TEXT;
 ALTER TABLE repository_settings ADD COLUMN ai_review_model TEXT;
@@ -1,5 +1,5 @@
 -- Opt-in AI-assisted slop advisory (the `slopAiAdvisory` capability). When 1 AND slop_gate_mode != 'off', a
 -- free Workers-AI pass adds an ADVISORY-only `ai_slop_advisory` finding for semantic slop the deterministic
 -- detector cannot quantify. It NEVER feeds slopRisk or the gate (only the deterministic core can block).
--- Default 0 (off) preserves existing behavior for every current repo; opt-in via `.gittensory.yml`.
+-- Default 0 (off) preserves existing behavior for every current repo; opt-in via `.loopover.yml`.
 ALTER TABLE repository_settings ADD COLUMN slop_ai_advisory INTEGER NOT NULL DEFAULT 0;
@@ -1,7 +1,7 @@
 -- Persist the latest deterministic slop assessment per cached pull request so the maintainer dashboard can
 -- surface a slop score row without re-fetching changed files on every load. Written by the public-surface
 -- processor ONLY when the repo opted into slop (slop_gate_mode != 'off'); NULL means "not assessed". These
--- are gittensory-COMPUTED signals, deliberately omitted from the GitHub-sync upsert's SET clause so a
+-- are loopover-COMPUTED signals, deliberately omitted from the GitHub-sync upsert's SET clause so a
 -- subsequent sync never clobbers them.
 ALTER TABLE pull_requests ADD COLUMN slop_risk INTEGER;
 ALTER TABLE pull_requests ADD COLUMN slop_band TEXT;
@@ -1,5 +1,5 @@
 -- Agent-layer autonomy dial (#773, Wave 2 Phase 0). Per-action-class autonomy level stored as a JSON map
 -- (action class -> observe|suggest|propose|auto_with_approval|auto). Default '{}' = deny-by-default: every
--- action class resolves to `observe` (gittensory watches but never acts) until a maintainer opts in. The
+-- action class resolves to `observe` (loopover watches but never acts) until a maintainer opts in. The
 -- single source the action layer (#778) reads via resolveAutonomy. Additive; existing repos are unaffected.
 ALTER TABLE repository_settings ADD COLUMN autonomy_json TEXT NOT NULL DEFAULT '{}';
@@ -12,7 +12,7 @@
 --   • override_audit            — recordOverrideAudit / listOverrideAudit
 -- (mirrors the reviewbot canonical tables; the columns + names match the bound queries exactly.)
 --
--- NOTE (config-application DEFERRED): gittensory's gate has NO confidenceFloor / scopeCap tunable and its
+-- NOTE (config-application DEFERRED): loopover's gate has NO confidenceFloor / scopeCap tunable and its
 -- native outcome signal measures gate FALSE POSITIVES (a loosening direction), so a promoted override here is
 -- NOT YET read by the live gate-config resolution — see src/review/selftune-wire.ts. These tables back the
 -- shadow-soak + audit + recommendation recording; reading a promoted override into the live gate is a noted

@@ -4,7 +4,7 @@
 -- cutover from reviewbot to the gittensory-native review, we must PROVE the gittensory-native gate decision
 -- matches reviewbot's on the SAME PR at the SAME COMMIT. computeGateParity / computeGateEval read this table.
 --
--- gittensory has no `review_audit` table of its own (the ported parity.ts reads reviewbot's schema — see the
+-- loopover has no `review_audit` table of its own (the ported parity.ts reads reviewbot's schema — see the
 -- LIVE-USE PREREQUISITE note in parity.ts). This migration introduces exactly the columns those pure functions
 -- read, with the two LATER-migration columns parity.ts called out — `source` (which writer made the decision)
 -- and `head_sha` (which commit it was made on) — present from the start so the self-join works:
@@ -37,7 +37,7 @@ CREATE TABLE IF NOT EXISTS review_audit (
   -- the authoritative writer added during the deploy-time dual-run. The parity self-join is per-source.
   source TEXT NOT NULL DEFAULT 'gittensory-native',
   -- The commit the decision was made on. computeGateParity REQUIRES this non-null and joins on it so
-  -- reviewbot@shaA is never compared to gittensory@shaB. Nullable in the schema (a decision with no head_sha
+  -- reviewbot@shaA is never compared to loopover@shaB. Nullable in the schema (a decision with no head_sha
   -- is recorded but excluded from pairing), matching parity's `head_sha IS NOT NULL` filter.
   head_sha TEXT,
   -- The reasonCode for this decision (computeGateParity reads it as `summary` for the per-reasonCode breakdown).

@@ -1,6 +1,6 @@
 -- #preconv-state (convergence prep): the review-target state machine + DECISION CACHE.
 --
--- This is the single missing stateful table in the reviewbot → gittensory state migration (#1025). gittensory
+-- This is the single missing stateful table in the reviewbot → loopover state migration (#1025). loopover
 -- already provisioned submitter_stats (0046), tunables_overrides/_shadow + override_audit (0047), and
 -- review_audit (0049) — but had no review_targets, even though already-ported code reads it:
 --   - src/review/ops.ts (computeAgentHealth: SELECT ... FROM review_targets; reversal join
@@ -19,7 +19,7 @@
 -- Schema = reviewbot's full accumulated review_targets (its 0001 + 0003/0005/0006/0007/0010 ALTERs folded into
 -- one CREATE). Natural key (project, kind, repo, number) == the PK id `${project}:${kind}:${repo}#${number}`.
 -- Kept raw-SQL-only (matching the 0046–0049 parity-store convention); deliberately NOT added to the Drizzle
--- schema, and the reviewbot FK review_audit.target_id → review_targets(id) is OMITTED (gittensory's review_audit
+-- schema, and the reviewbot FK review_audit.target_id → review_targets(id) is OMITTED (loopover's review_audit
 -- already dropped it, so the two tables stay decoupled and bulk copy needs no ordering FK).
 --
 -- Privacy: internal review state only — no PR content, no trust/reward internals beyond the gate verdict.

@@ -16,7 +16,7 @@
 -- (ON CONFLICT(id) target; vector ids and the storage PK are GLOBAL — the chunk id already embeds the
 -- namespace, see chunkId() in rag.ts), and `updated_at` carries the conflict touch.
 --
--- The vector EMBEDDING itself lives in Vectorize (the `gittensory-review-rag` index), NOT here — this table is
+-- The vector EMBEDDING itself lives in Vectorize (the `loopover-review-rag` index), NOT here — this table is
 -- only the chunk text + light addressing metadata. Vectorize is the index; repo_chunks is the source-of-truth
 -- text the retrieved vector ids resolve back to.
 --

@@ -4,7 +4,7 @@
 -- (method not allowed) / 409 (required check absent) / conflict throws, the action is recorded as an `error`
 -- audit row, but the pull_requests row stays plannable — so EVERY webhook + every scheduled re-gate sweep
 -- re-plans the same merge and it fails again, with no cap and no backoff. (reviewbot parity: review_targets'
--- attempt_count + terminal_at, which gittensory's normalized planner path never had.)
+-- attempt_count + terminal_at, which loopover's normalized planner path never had.)
 --
 -- AFTER: a non-transient merge failure marks the PR terminally merge-blocked FOR THE CURRENT HEAD SHA. The
 -- planner skips planning a merge while merge_blocked_sha == headSha, and the executor caps retries via

@@ -1,4 +1,4 @@
--- Gittensory Orb (#1219): local outcome-signal store. Records the gate verdict and
+-- Loopover Orb (#1219): local outcome-signal store. Records the gate verdict and
 -- final outcome (merged / closed) for every PR the engine reviewed. Used by the Orb
 -- export job to batch-send calibration signals to the central collector (opt-in) or
 -- to keep them local for operator-only analysis (ORB_AIR_GAP=true).

@@ -1,4 +1,4 @@
--- Gittensory Orb (#1219): tracks which repos have the Orb GitHub App installed.
+-- Loopover Orb (#1219): tracks which repos have the Orb GitHub App installed.
 -- `removed_at IS NULL` = currently installed; set on uninstall/removal events.
 CREATE TABLE IF NOT EXISTS orb_installations (
   id              INTEGER PRIMARY KEY,

@@ -1,4 +1,4 @@
--- Gittensory Orb (#1219): central collector store. Receives anonymized outcome signal batches
+-- Loopover Orb (#1219): central collector store. Receives anonymized outcome signal batches
 -- from self-hosted instances running exportOrbBatch. repo_hash and pr_hash are HMAC-anonymized
 -- by the sender — no repo names, owner identifiers, or PR content is stored here.
 CREATE TABLE IF NOT EXISTS orb_signals (

@@ -1,4 +1,4 @@
--- Gittensory Orb (#1255): turn Orb into the central fleet-calibration collector.
+-- Loopover Orb (#1255): turn Orb into the central fleet-calibration collector.
 --
 -- Retire the per-instance Orb GitHub App pipeline (orb_events / orb_installations were written by the
 -- now-removed /orb/webhook handler). Each self-hosted instance already records de-noised ground truth in

@@ -1,4 +1,4 @@
--- Gittensory Orb (#1255) — instance registration gate, modeled on das-github-mirror's `registered=false`
+-- Loopover Orb (#1255) — instance registration gate, modeled on das-github-mirror's `registered=false`
 -- default. Every self-host instance that POSTs anonymized batches to /v1/orb/ingest is recorded here on
 -- first contact, but its signals only count toward fleet calibration once an operator REGISTERS it
 -- (registered=1). This is the fleet's trust anchor: ingest stays open + frictionless (no shared secret —

@@ -13,7 +13,7 @@
 -- the next-stalest — full coverage of all open PRs in ceil(open/SWEEP_MAX_PRS) sweeps, convergent regardless of
 -- suppression. The GitHub-updatedAt freshness window is kept ONLY as the "don't race an in-flight webhook" guard.
 --
--- last_regated_at is gittensory-computed (sweep-written), keyed to the PR (not the head SHA), and OMITTED from
+-- last_regated_at is loopover-computed (sweep-written), keyed to the PR (not the head SHA), and OMITTED from
 -- the upsertPullRequestFromGitHub SET clause so a later GitHub sync cannot clobber it. Mirrors approved_head_sha
 -- (0053) / merge_blocked_sha (0052). Nullable / no default → backward-compatible (existing rows = NULL = never
 -- swept = maximally stale = picked first).

@@ -1,4 +1,4 @@
--- Gittensory Orb central GitHub App (#1255) — webhook delivery dedup + audit for POST /v1/orb/webhook.
+-- Loopover Orb central GitHub App (#1255) — webhook delivery dedup + audit for POST /v1/orb/webhook.
 -- The central Orb App is a SEPARATE GitHub App from the review app, with its OWN webhook secret and its OWN
 -- delivery IDs, so it gets its OWN dedup table (not webhook_events) — a GitHub delivery_id is only unique per
 -- App, so sharing one table across two Apps could collide. This receiver just verifies + records (PR1);

@@ -1,4 +1,4 @@
--- Gittensory Orb central GitHub App (#1255) — installation registry. One row per install of the shared Orb
+-- Loopover Orb central GitHub App (#1255) — installation registry. One row per install of the shared Orb
 -- App, maintained from the verified /v1/orb/webhook installation events. This is what onboarding + the
 -- token-broker (later PRs) read to know which installations exist, who owns them, and whether an operator has
 -- registered them. registered=0 by default — the Mirror-style manual-onboarding gate (an install is RECORDED

@@ -1,4 +1,4 @@
--- Gittensory Orb central GitHub App (#1255) — terminal pull-request outcomes (merged | closed) observed via
+-- Loopover Orb central GitHub App (#1255) — terminal pull-request outcomes (merged | closed) observed via
 -- the central App's webhook. The raw material for the global "proof of power" homepage counter (total merged /
 -- closed across ALL registered maintainer repos, das-github-mirror style). Aggregated only over REGISTERED
 -- installations. Idempotent on (repo, pr_number): a redelivery or a reopen→close cycle overwrites the latest

@@ -1,4 +1,4 @@
--- Gittensory Orb central GitHub App (#1255) — the token-broker enrollment ledger. A maintainer authorizes the
+-- Loopover Orb central GitHub App (#1255) — the token-broker enrollment ledger. A maintainer authorizes the
 -- Orb App (OAuth) and is bound, server-side, to a SPECIFIC installation they administer; their self-hosted
 -- container is then issued a one-time enrollment secret (stored HASHED, never plaintext) which it exchanges for
 -- short-lived installation tokens. installation_id is written here at the OAuth callback after an authority

@@ -1,5 +1,5 @@
 -- Dual-app identity (#selfhost-app-id): record which GitHub App an installation belongs to, so a backend can
--- tell its OWN installations from a SECOND gittensory App installed on the same account (cloud + self-host
+-- tell its OWN installations from a SECOND loopover App installed on the same account (cloud + self-host
 -- running side by side during the migration). Nullable: only `installation` events and the App-installation API
 -- refresh carry app_id, so existing rows backfill lazily on their next event. The webhook entry fails OPEN — an
 -- unknown app_id always processes — so this column is byte-identical until it is populated.

@@ -1,5 +1,5 @@
 -- Per-repo contributor blacklist (#1425, anti-abuse): a JSON array of banned-login entries
 -- ({ login, reason?, evidence?, addedAt? }) the converged engine deterministically closes a PR/issue against,
--- ahead of any merit/CI/AI analysis. Layered like other settings (.gittensory.yml > DB) and unioned with the
+-- ahead of any merit/CI/AI analysis. Layered like other settings (.loopover.yml > DB) and unioned with the
 -- shared/global list at the point of use. Defaults to an empty list, so existing rows are byte-identical.
 ALTER TABLE repository_settings ADD COLUMN contributor_blacklist_json TEXT NOT NULL DEFAULT '[]';
@@ -2,6 +2,6 @@
 -- published. The scheduled re-gate sweep skips re-reviewing + re-publishing a PR while
 -- last_published_surface_sha === head_sha (the surface is already current). Keyed to the head SHA so a push /
 -- rebase / force-push (new head) no longer matches → the next sweep re-reviews + re-publishes the new code.
--- NULL = never published. gittensory-computed (publish-written); like approved_head_sha / merge_blocked_sha it is
+-- NULL = never published. loopover-computed (publish-written); like approved_head_sha / merge_blocked_sha it is
 -- omitted from the GitHub-sync SET clause so a later sync cannot clobber it.
 ALTER TABLE pull_requests ADD COLUMN last_published_surface_sha TEXT;
@@ -1,11 +1,11 @@
--- Review-request nagging cooldown (#2463, anti-abuse): throttle a contributor repeatedly pinging @gittensory.
+-- Review-request nagging cooldown (#2463, anti-abuse): throttle a contributor repeatedly pinging @loopover.
 -- Defaults are byte-identical to today: review_nag_policy defaults to 'off' (disabled), so existing rows see no
 -- behavior change. review_nag_max_pings / review_nag_cooldown_days / review_nag_label only take effect once a
 -- repo opts in by setting the policy to 'hold' or 'close'.
 ALTER TABLE repository_settings ADD COLUMN review_nag_policy TEXT NOT NULL DEFAULT 'off';
 ALTER TABLE repository_settings ADD COLUMN review_nag_max_pings INTEGER NOT NULL DEFAULT 3;
 ALTER TABLE repository_settings ADD COLUMN review_nag_cooldown_days INTEGER NOT NULL DEFAULT 5;
 ALTER TABLE repository_settings ADD COLUMN review_nag_label TEXT NOT NULL DEFAULT 'review-nag-cooldown';
--- Shared repo-scoped exemption list (#2463): GitHub logins never throttled/closed by gittensory's deterministic
+-- Shared repo-scoped exemption list (#2463): GitHub logins never throttled/closed by loopover's deterministic
 -- anti-abuse mechanisms, on top of the standing owner/admin/automation-bot exemption. Defaults to an empty list.
 ALTER TABLE repository_settings ADD COLUMN auto_close_exempt_logins_json TEXT NOT NULL DEFAULT '[]';
@@ -1,5 +1,5 @@
--- Per-command @gittensory rate limit (#2560, anti-abuse): generalizes the review-nag cooldown's audit-ledger
--- counting pattern to EVERY @gittensory command, not just review-request pings. Independent of and complementary
+-- Per-command @loopover rate limit (#2560, anti-abuse): generalizes the review-nag cooldown's audit-ledger
+-- counting pattern to EVERY @loopover command, not just review-request pings. Independent of and complementary
 -- to review-nag (that stays scoped to the thread's own author; this covers any actor invoking any command).
 -- Defaults are byte-identical to today: command_rate_limit_policy defaults to 'off' (disabled), so existing
 -- repos see no behavior change until they opt in. The AI-cost-bearing commands (ask/blockers/preflight/

@@ -1,6 +1,6 @@
--- Maintainer-mention nag moderation (#label-scoping): extends the existing @gittensory review-nag cooldown
+-- Maintainer-mention nag moderation (#label-scoping): extends the existing @loopover review-nag cooldown
 -- (review_nag_policy/review_nag_max_pings/review_nag_cooldown_days/review_nag_label) to ALSO throttle a
 -- contributor who repeatedly @-mentions a configured maintainer login, counted independently per mentioned
--- login and independently of the @gittensory counter. Default '[]' (no logins watched), so existing repos see
+-- login and independently of the @loopover counter. Default '[]' (no logins watched), so existing repos see
 -- no behavior change until they opt in.
 ALTER TABLE repository_settings ADD COLUMN review_nag_monitored_mentions_json TEXT NOT NULL DEFAULT '[]';
@@ -3,7 +3,7 @@
 -- backfill that flipped any 'advisory' row to 'block' for repos with gate_check_mode='enabled'), even
 -- though missing a linked issue is only ever supposed to be advisory unless a maintainer explicitly opts
 -- into blocking. The application-level fallback (src/db/repositories.ts) and every documented default
--- (.gittensory.yml.example, docs.tuning.tsx, the settings API schema) already say 'advisory' -- only the
+-- (.loopover.yml.example, docs.tuning.tsx, the settings API schema) already say 'advisory' -- only the
 -- persisted column value drifted.
 --
 -- #gate-review-2727 round 1: require_linked_issue = 0 alone does NOT prove drift. linkedIssueGateMode and

@@ -1,5 +1,5 @@
 -- Review-evasion protection (#review-evasion-protection): a contributor closing or converting their OWN PR
--- to draft while gittensory has an ACTIVE review pass running against it is dodging the one-shot review
+-- to draft while loopover has an ACTIVE review pass running against it is dodging the one-shot review
 -- process, not making an ordinary close. active_review_tracking durably records that a fresh review pass
 -- started for a specific repo/PR/headSha BEFORE any cost-bearing AI-review work begins, so the closed/
 -- converted_to_draft webhook handlers can tell evasion (a close during an active pass) apart from an
@@ -22,7 +22,7 @@ CREATE UNIQUE INDEX IF NOT EXISTS active_review_tracking_pr_unique ON active_rev
 -- Per-repo review-evasion settings, layered the same way as every other anti-abuse mechanism in this file
 -- (contributorCap/blacklist/reviewNag): reviewEvasionProtection is off by default (zero behavior change for
 -- an install that hasn't opted in); reviewEvasionLabel is NOT NULL with a string default (mirrors
--- blacklist_label/review_nag_label -- the "no label" case is a `.gittensory.yml`-only override, never
+-- blacklist_label/review_nag_label -- the "no label" case is a `.loopover.yml`-only override, never
 -- persisted); reviewEvasionComment defaults to posting the explanation comment, matching the existing
 -- draft-dodge/reopen-reclose guards' unconditional explanation comment.
 ALTER TABLE repository_settings ADD COLUMN review_evasion_protection TEXT NOT NULL DEFAULT 'off';

@@ -1,3 +1,3 @@
 -- Opt-in oldest-first ordering mode for the scheduled re-gate sweep (#3815). Default 'staleness' (existing
--- behavior, unchanged) — a repo opts into 'oldest-first' explicitly via the dashboard/API or .gittensory.yml.
+-- behavior, unchanged) — a repo opts into 'oldest-first' explicitly via the dashboard/API or .loopover.yml.
 ALTER TABLE repository_settings ADD COLUMN regate_sweep_order_mode TEXT NOT NULL DEFAULT 'staleness';