From 528b92b6b6f02cf28285956e7df950f2d60df388 Mon Sep 17 00:00:00 2001
From: JSONbored <49853598+JSONbored@users.noreply.github.com>
Date: Fri, 17 Jul 2026 13:39:01 -0700
Subject: [PATCH] ci(workflows): enforce 4 drift checks in CI that only ran
 locally

miner:env-reference:check, manifest:drift-check, engine-parity:drift-check,
and branding-drift:check were all part of the local `npm run test:ci`
aggregate but never wired into .github/workflows/ci.yml -- the exact same
gap class the "Selfhost env-reference drift check" comment already
documents having bitten twice before. Confirmed harmful live: the
miner:env-reference gap let a stale generated doc merge to main with green
CI, then block an unrelated MCP npm release days later, since the release
workflow (before being scoped down) was the only place that check ever
actually ran.

Also adds .loopover.yml to the `backend` path filter so an edit to just
that file still re-triggers manifest:drift-check, which reads it directly.
---
 .github/workflows/ci.yml | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 27ab0d7bd0..60f4f1d124 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -66,6 +66,7 @@ jobs:
               - '.github/workflows/**'
               - 'wrangler.jsonc'
               - 'worker-configuration.d.ts'
+              - '.loopover.yml'
             observability:
               - 'grafana/dashboards/**'
               - 'prometheus/rules/**'
@@ -269,6 +270,16 @@ jobs:
       - name: Selfhost env-reference drift check
         if: ${{ github.event_name == 'push' || needs.changes.outputs.backend == 'true' || needs.changes.outputs.ui == 'true' }}
         run: npm run selfhost:env-reference:check
+      # Miner/AMS twin of the selfhost check above -- same generated-artifact-drift class, same
+      # local-only-until-now gap (an `env.SOMETHING` read added under packages/loopover-miner/**
+      # with no CI signal that packages/loopover-miner/docs/env-reference.md and
+      # apps/loopover-ui/src/lib/ams-env-reference.ts had gone stale). Confirmed harmful live: this
+      # exact gap let a stale env-reference block an unrelated MCP npm release, since the release
+      # workflow was the only place this check ever ran. Gated on `ui` too, same reason as its sibling:
+      # the generated UI-side file lives under apps/loopover-ui/**.
+      - name: Miner env-reference drift check
+        if: ${{ github.event_name == 'push' || needs.changes.outputs.miner == 'true' || needs.changes.outputs.ui == 'true' }}
+        run: npm run miner:env-reference:check
       # Same generated-artifact-drift class, extracted from src/github/commands.ts's command catalogs (#3046).
       # Also local-only until now; same backend-or-ui gating rationale as the step above.
       - name: Command reference drift check
@@ -282,6 +293,27 @@ jobs:
       - name: Docs drift check
         if: ${{ github.event_name == 'push' || needs.changes.outputs.backend == 'true' || needs.changes.outputs.ui == 'true' }}
         run: npm run docs:drift-check
+      # Cross-checks the bundled fallback YAML in src/config/loopover-repo-focus-manifest.ts against the
+      # real root .loopover.yml -- see the script's own header comment. Same local-only-until-now gap as
+      # the drift checks above: nothing in this workflow previously ran it, so the two could silently
+      # diverge with zero CI signal. .loopover.yml itself is now part of the `backend` path filter above
+      # specifically so an edit to ONLY that file still re-triggers this job.
+      - name: Manifest drift check
+        if: ${{ github.event_name == 'push' || needs.changes.outputs.backend == 'true' }}
+        run: npm run manifest:drift-check
+      # Mechanical drift tripwire for the hand-duplicated src/{review,settings,signals} <-> loopover-engine
+      # twin files, plus a version-skew check on the installed @loopover/engine (#4260). Same
+      # local-only-until-now gap as the drift checks above.
+      - name: Engine-parity drift check
+        if: ${{ github.event_name == 'push' || needs.changes.outputs.backend == 'true' || needs.changes.outputs.engine == 'true' }}
+        run: npm run engine-parity:drift-check
+      # Guards against the "gittensory" branding creeping back into runtime source after the LoopOver
+      # rebrand -- see the script's own header comment (#6786 is the concrete incident this was written
+      # for). Scoped broadly (src/** plus every workspace package's bin/lib/src/scripts dirs), so it's
+      # gated broadly to match; same local-only-until-now gap as the drift checks above.
+      - name: Branding drift check
+        if: ${{ github.event_name == 'push' || needs.changes.outputs.backend == 'true' || needs.changes.outputs.mcp == 'true' || needs.changes.outputs.engine == 'true' || needs.changes.outputs.miner == 'true' || needs.changes.outputs.ui == 'true' }}
+        run: npm run branding-drift:check
       - name: Validate observability configs
         if: ${{ github.event_name == 'push' || needs.changes.outputs.backend == 'true' || needs.changes.outputs.observability == 'true' }}
         env: