chore(release): cut orb-v2.1.0

[github-actions]

Proposes cutting orb-v2.1.0 (a minor release) from the current
stable release orb-v2.0.0.

Merging this PR tags orb-v2.1.0 and dispatches the image build/publish --
which still requires a release environment approval before anything reaches GHCR (see
.github/workflows/release-selfhost.yml). The daily beta channel is unaffected either way.

Image-relevant commits since the last stable release

• feat(gate): configurable advisory check-runs so a stuck external status never freezes the gate (feat(gate): configurable advisory check-runs so a non-resolving external status never blocks or stalls the gate forever #4372) (3175d74)
• test(gate): pin the advisory-hold cache-invalidation guarantee end-to-end (feat(gate): configurable advisory check-runs so a non-resolving external status never blocks or stalls the gate forever #4372) (1b33341)
• feat(review): add OpenAI and Anthropic API key patterns to secret scan (6a8cc67)
• fix(rebrand): rename gittensory-repo-focus-manifest.ts module (6b5b020)
• feat(mcp): expose skipped-PR audit trail as a maintainer MCP tool (6e059b0)
• feat(mcp): expose repo registration readiness as a read-only MCP tool (f7266c4)
• fix(review): treat a blank consentPhrase as unset in evaluateClaCheck (fix(review): evaluateClaCheck treats an empty-string consentPhrase as unconditionally satisfied #5838) (0a10fcb)
• fix(review): sanitize control characters in RAG chunk text before Postgres insert (2afe341)
• fix(selfhost): preserve stack traces and split fingerprints for RAG/enrichment Sentry captures (02ed1ff)
• fix(review): scan added lines whose content starts with ++ for secrets (fix(review): stale +++ file-header guard in scanDiffForSecretsWithLocations bypasses secret scanning on added lines starting with ++ #5942) (fix(review): scan added lines whose content starts with ++ for secrets #5952) (fe331a9)
• fix(signals): filter public-unsafe wantedPaths/preferredLabels from manifest findings (fix(signals): filter public-unsafe wantedPaths/preferredLabels from manifest findings #5967) (4076df1)
• fix(queue): scan patch-less copied/changed/unchanged files for secrets (fix(queue): shouldAttemptPatchLessSecretScan silently skips copied/changed/unchanged file statuses, bypassing the fail-closed secret scan guarantee #5947) (fix(queue): scan patch-less copied/changed/unchanged files for secret scan #5951) (49883fa)
• feat(selfhost): warn loudly when the private config mount is empty (6b97ffe)
• fix(review): apply the prompt-injection reputation override before the minSample guard (fix(review): apply the prompt-injection reputation override before the minSample guard #5975) (ac83483)
• fix(review): hash a JSON payload in linkedIssueSatisfactionCacheInputFingerprint (fix(review): hash a JSON payload to prevent linked-issue-satisfaction cache-key collisions #5976) (68fac24)
• fix(selfhost): give structural AI-provider config errors a long circuit-breaker cooldown (c5940b7)
• fix(selfhost): instrument the silent orb-relay-drain reentrancy skip (dd4addb)
• fix(signals): filter wantedPaths before interpolating focus-area PR guidance (fix(signals): filter wantedPaths before interpolating focus-area PR guidance #5987) (46581d7)
• fix(review): fold repo into ops_anomaly's Sentry fingerprint (def4205)
• fix(signals): make blockers explain every not-ready registration report (fix(signals): buildRegistrationReadiness can return ready:false with an empty blockers array #5946) (55cd8da)
• fix(selfhost): attach a pg.Pool error listener to prevent uncaught-exception crashes (592fdc8)
• fix(review): make size-gate file/line thresholds configurable (df54527)
• feat(review): wire the copycat containment engine into the gate (feat(review): wire the copycat containment engine into the gate #5999) (9c5a6e0)
• fix(review): give LOOPOVER_DUPLICATE_WINNER a per-repo config override (39cdc9f)
• fix(queue): log unrecognized job types in processJob instead of dropping silently (fix(queue): processJob silently drops unrecognized job types with no default case or logging #5836) (42853bd)
• fix(signals): flag the .at(-1)/.at(0) idiom in boundary-test-generation (fix(signals): flag the .at(-1)/.at(0) idiom in boundary-test-generation #6006) (3db64d8)
• fix(orb): close 5 silent-failure and missing-timeout gaps in the ORB subsystem (b490199)
• fix(orb): use String(error) instead of an untested instanceof-Error ternary (de97a73)
• fix(review): add missing duplicationDelta to REES_ANALYZER_NAMES (fix(review): add missing duplicationDelta to REES_ANALYZER_NAMES #6009) (f4e327a)
• feat(mcp): expose .loopover.yml config recommendations as a read-only MCP tool (feat(mcp): expose .loopover.yml config recommendations as a read-only MCP tool #6016) (3912e7d)
• fix(review): give LOOPOVER_OPEN_PR_FILE_COLLISION a per-repo config override (d3bf13b)
• fix(review): honor ContentRepoSpec.urlFields in directory-index synthesis (fix(review): honor ContentRepoSpec.urlFields in directory-index synthesis #6018) (018b713)
• fix(signals): carry labelPolicy.note through focusManifestPolicyToCompilerOutput (fix(signals): carry labelPolicy.note through focusManifestPolicyToCompilerOutput #6020) (79bfa91)
• feat(orb): wire Sentry into the Cloudflare Worker (central ORB broker) (f8d4a16)
• fix(orb): v8-ignore the Worker-runtime-only Sentry middleware branch (9597167)
• fix(review): preserve lockfile-tamper entry tracking across nested dependencies (fix(review): lockfile-tamper check loses entry tracking across a nested dependencies sub-object, evadable by key reordering #5837) (fix(review): preserve lockfile-tamper entry tracking across nested dependencies (#5837) #6038) (497505c)
• fix(docs): sweep remaining gittensory-* rename residue in self-host ops docs (fix(docs): sweep remaining gittensory-* rename residue in self-host ops docs #6044) (fcedc47)
• fix: bound duplicate-sibling live GitHub fetch concurrency (fix(queue): reconcileLiveDuplicateSiblings fans out unbounded GitHub fetches per duplicate-cluster sibling #5835) (fix(queue): cap duplicate-sibling live GitHub fetch concurrency (#5835) #6049) (cef9795)
• fix(config): warn on unknown top-level fields in the focus-manifest validator (fix(config): warn on unknown top-level fields in the focus-manifest validator #6075) (e3957da)
• fix(review): close draft-conversion evasion after review publishes, not just mid-review (8843bfa)
• fix(orb): add per-row identifying context to relay bulk-delete drop logs (1c25803)
• review: drop redundant banner + demote readiness chip off-ready (review: drop redundant banner + demote readiness chip off-ready #6077) (889123b)
• fix(webhook): recognize full GitHub issue URL in closing keywords (0760e1f)
• review: collapse the signal table into decision drivers + advisory fold (2e7e3e2)
• review: wire per-blocker AI fix-context, CodeRabbit-style (c1f0695)
• review: aggregate comment-size budget guard (cd05d7f)
• fix(webhook): don't trust a sparse first-ever sync as confirmed no linked issue (0ad33b7)
• docs(selfhost): document ams-observability and backup in the compose PROFILES header (chore(selfhost): docker-compose.yml PROFILES header is missing ams-observability and backup #5812) (docs(selfhost): document ams-observability and backup in the compose PROFILES header #6109) (b2df9a1)
• docs(api): add operation-level summaries to all OpenAPI routes (docs(api): add operation-level summary/description to all 78 OpenAPI routes #5810) (docs(api): add operation-level summaries to all OpenAPI routes #6111) (70d46de)
• fix(signals): sync extension overlay redaction with canonical PUBLIC_UNSAFE_TERMS (fix(signals): sync extension overlay redaction with canonical PUBLIC_UNSAFE_TERMS #6119) (d3bc79e)
• fix(queue): close self-close review-evasion after publish, not just mid-review (1d3e1a9)
• perf(queue): fetch copycat candidate files concurrently, not sequentially (daf9440)
• feat(auth): persist the GitHub user-to-server token from login (b974e10)
• review: remove the legacy comment renderer (buildPublicPrIntelligenceComment) (061bec7)
• feat(selfhost): add real end-to-end review-latency metric (ced563d)
• fix: renumber migration to 0154 (0153 claimed by feat(auth): persist the GitHub user-to-server token from login #6125 on main) (f0e960b)
• feat(auth): refresh the session's GitHub token near/past its 8h expiry (a47574a)
• fix: renumber migration to 0155 (0154 was claimed by a concurrent merge) (3db50f3)
• review: unwind the retired unifiedComment feature key (review: remove the legacy comment renderer (buildPublicPrIntelligenceComment) #6103 follow-up) (362a615)
• fix(auth): rate-limit the GitHub token-retrieval endpoint by session, not IP (4442153)
• fix(auth): rate-limit /v1/auth/extension/session by session, not IP (11b3bab)

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	loopover-ui	ea76493	Jul 15 2026, 09:09 PM

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.