chore(release): cut orb-v3.4.0

[github-actions]

Proposes cutting orb-v3.4.0 (a minor release) from the current
stable release orb-v3.3.0.

Merging this PR tags orb-v3.4.0 and dispatches the image build/publish --
which still requires a release environment approval before anything reaches GHCR (see
.github/workflows/release-selfhost.yml). The daily beta channel is unaffected either way.

Image-relevant commits since the last stable release

• feat(calibration): counterfactual prompt replay — offline harness + budget-gated advisory CI check (counterfactual: the replay harness CLI — score a prompt/model variant against historical judgments #8221, counterfactual: advisory check when reviewer prompt versions change #8222) (feat(calibration): counterfactual prompt replay — offline harness + budget-gated advisory CI check #8271) (1f15694)
• fix(observability): stop two Sentry noise sources — benign update-branch 422 and reconciler success logs (fix(observability): stop two Sentry noise sources — benign update-branch 422 and reconciler success logs #8276) (516fb44)
• feat(calibration): register the slop gate score as the registry's first ceiling knob, report-only (calibration: register slop + quality score knobs (report-only) in LOOSENABLE_KNOBS #8224) (feat(calibration): register the slop gate score as the registry's first ceiling knob, report-only #8275) (112ead6)
• fix(rules): disclose configured blockers omitted past the inline gate-check cap (formatGateCheckOutput silently truncates configured blockers past 8 with no omitted-count disclosure #8323) (fix(rules): disclose configured blockers omitted past the inline gate-check cap (#8323) #8367) (ce5f5aa)
• fix(selfhost): add the ams_signals conflict key so Postgres AMS ingest stops throwing (fix(selfhost): REPLACE_CONFLICT_KEYS omits ams_signals, crashing AMS telemetry ingest on the self-host Postgres backend #8382) (fix(selfhost): add the ams_signals conflict key so Postgres AMS ingest stops throwing #8398) (fab2fce)
• fix(auth): stop auditing routine device-flow polls as denied, mark access_denied correctly (fix(auth): device-flow poll audits routine polling as denied, a real user decline as error #8378) (fix(auth): stop auditing routine device-flow polls as denied, mark access_denied correctly #8400) (4e0a1c9)
• fix(db): add $defaultFn(nowIso) to upstreamDriftReports.updatedAt (upstreamDriftReports.updatedAt is missing $defaultFn, unlike ~30 sibling updatedAt columns #8369) (fix(db): add $defaultFn(nowIso) to upstreamDriftReports.updatedAt #8404) (8a6632b)
• fix(github): reject malformed repoFullName in app.ts and comments.ts (fix(github): reject malformed repoFullName in app.ts and comments.ts #8402) (00b7f8c)
• fix(api): return a graceful 503 badge instead of an unhandled 500 when the loader throws (fix(api): badge.svg/badge.json have no error handling, unlike sibling public routes #8377) (fix(api): return a graceful 503 badge instead of an unhandled 500 when the loader throws #8403) (4b6e3fc)
• fix(selfhost): make PgStatement.first() coalesce to null like the D1 adapter (fix(selfhost): make PgStatement.first() coalesce to null like the D1 adapter #8411) (eff6fa4)
• fix(github): stop the open-issues GraphQL supplement when endCursor is missing (fix(github): stop the open-issues GraphQL supplement when endCursor is missing #8410) (424078c)
• fix(db): fold seven raw-SQL identity tables into renameRepositoryIdentity (renameRepositoryIdentity omits 7 raw-SQL identity tables, including two structurally identical to already-fixed siblings review_audit/contributor_gate_history #8380) (fix(db): fold seven raw-SQL identity tables into renameRepositoryIdentity #8409) (c02da85)
• fix(selfhost): record an error metric when the webhook-dedup Redis cache fails (fix(selfhost): record an error metric when the webhook-dedup Redis cache fails #8415) (2494517)
• fix(db): fold seven Drizzle-schema identity tables into renameRepositoryIdentity (renameRepositoryIdentity omits 7 identity-bearing Drizzle-schema tables (repository_ai_keys, repository_linear_keys, bounties, review_suppression, agent_pending_actions, issue_watch_subscriptions, github_agent_command_feedback) #8379) (fix(db): fold seven Drizzle-schema identity tables into renameRepositoryIdentity #8424) (3c815ea)
• fix(orb): cap gate_verdict length in orb_signals ingest (orb_signals.gate_verdict has no length cap, unlike every sibling string field in the same insert #8333) (fix(orb): cap gate_verdict length in orb_signals ingest (#8333) #8429) (0b5d6d8)
• fix(orb): catch stream-read errors in readOrbIngestBody (readOrbIngestBody can throw uncaught on a dropped connection, unlike its documented twin readOrbRelayRegisterBody #8330) (fix(orb): catch stream-read errors in readOrbIngestBody (#8330) #8432) (af3340f)
• chore(review): delegate diffFilePriority's lockfile match to the canonical isLockfile (chore(review): delegate diffFilePriority's lockfile match to the canonical isLockfile #8427) (7cf89c6)
• fix(review): remove structurally-unreachable branch in classifyChangedFile (fix(review): classifyChangedFile's isTestFile || isTestPath check is a permanently unreachable branch #8353) (fix(review): remove structurally-unreachable branch in classifyChangedFile (#8353) #8412) (7f5550b)
• fix(selfhost): bound s3-blob-store fetch calls with a per-attempt timeout (s3-blob-store.ts's fetch calls have no timeout, breaking the repo's bounded-fetch convention #8362) (fix(selfhost): bound s3-blob-store fetch calls with a per-attempt timeout (#8362) #8442) (8dffb03)
• fix(queue): observe unresolved required-contexts lookups (fix(queue): cachedRequiredStatusContexts computes a resolved flag that no caller ever consumes #8358) (fix(queue): observe unresolved required-contexts lookups (#8358) #8447) (061c22c)
• fix(db): age-prune webhook_events via RETENTION_POLICY (fix(db): age-prune webhook_events via RETENTION_POLICY #8449) (32f37d5)
• fix(signals): guard focus-manifest's preferred linked-issue nudge on bodyObserved (focus-manifest.ts's preferred linked-issue branch is missing the bodyObserved false-positive guard its required sibling has #8326) (fix(signals): guard focus-manifest's preferred linked-issue nudge on bodyObserved (#8326) #8448) (14ad838)
• fix(selfhost): block deploy-selfhost-prebuilt on container health, sharing wait_for_healthy (deploy-selfhost-prebuilt.sh reports complete without waiting for container health, unlike its sibling deploy-selfhost-image.sh #8395) (fix(selfhost): block deploy-selfhost-prebuilt on container health, sharing wait_for_healthy #8444) (e3a091e)
• fix(review): re-sync the two public-surface redaction term lists (fix(review): re-sync the two public-surface redaction term lists #8445) (ac97dee)
• fix(db): tolerate SQLite's optional COLUMN keyword in migration parsing (Migration column-extraction regexes require the literal COLUMN keyword, but SQLite doesn't #8368) (fix(db): tolerate SQLite optional COLUMN keyword in migration parsing (#8368) #8456) (9adcccb)
• fix(rules): honor alreadyPublicSafe in check-run annotations (buildCheckRunAnnotations scrubs alreadyPublicSafe findings that formatCheckRunOutput already renders verbatim #8321) (fix(rules): honor alreadyPublicSafe in check-run annotations (#8321) #8459) (b554e15)
• fix(control-panel): deduplicate the access-scope computation behind one shared helper (fix(control-panel): deduplicate identical access-scope computation in control-panel-roles.ts #8373) (fix(control-panel): deduplicate the access-scope computation behind one shared helper #8453) (12f2e14)
• fix(orb): guard finalizeRelayFailureRetryRow DB writes against duplicate redelivery (finalizeRelayFailureRetryRow's unguarded DB writes contradict retryFailedRelays's documented Never throws contract #8332) (fix(orb): guard finalizeRelayFailureRetryRow DB writes against duplicate redelivery (#8332) #8462) (9b9924b)
• fix(scenarios): reject non-array changedFiles that bypasses the source-upload scan (fix(scenarios): reject non-array changedFiles that bypasses the source-upload scan #8467) (04d38b6)
• fix(queue): isolate per-repo failures in backfill-registered-repos fan-out (fix(queue): backfill-registered-repos cron fan-out has no per-repo isolation, risking duplicate dispatch on partial failure #8355) (fix(queue): isolate per-repo failures in backfill-registered-repos fan-out (#8355) #8473) (f1b5cc1)
• fix(review): derive linked-issue fact-fetch from the same fresh body parse as the overflow check (fix(review): derive linked-issue fact-fetch from the same fresh body parse as the overflow check #8477) (df753da)
• fix(github): reuse an existing repo-docs branch ref instead of failing (fix(github): repo-doc PR refresh permanently breaks after the loopover/repo-docs branch is closed without deleting it #8310) (fix(github): reuse an existing repo-docs branch ref instead of failing (#8310) #8481) (f50d010)
• feat(notifications): per-repo Slack webhook routing to match Discord/PagerDuty (feat(notifications): per-repo Slack webhook routing to match Discord/PagerDuty #8471) (73fef0a)
• feat(lockfile): enhance handling of unattributed lockfile entries across hunk boundaries (fix(review): correlate cross-hunk lockfile tamper signals by package (#8351) #8491) (7480c78)
• fix(review): surface per-model terminal errors and readable diagnostics in review-failure telemetry (fix(review): surface per-model terminal errors and readable diagnostics in review-failure telemetry #8302) (f791f61)
• feat(review): evidence-weighted reviewer routing, stage 1 — the report-only shadow (calibration: evidence-weighted reviewer routing (flag-gated, report-first) #8229) (feat(review): evidence-weighted reviewer routing, stage 1 — the report-only shadow #8301) (353d019)
• feat(selfhost): allow per-repo AI CLI timeout overrides in review.ai_model (AI CLI timeout knobs are env-var-only, unlike the sibling model/effort knobs (config-as-code gap) #8364) (feat(selfhost): allow per-repo AI CLI timeout overrides in review.ai_model (#8364) #8458) (ac06b43)
• fix(orb): drop unreachable bare ::1 branch in isLocalBrokerHost (fix(orb): drop unreachable bare ::1 branch in isLocalBrokerHost #8340) (5bfc9d3)
• fix(review): skip unlinked-issue verify rate ceiling without AI binding (fix(review): skip unlinked-issue verify rate ceiling without AI binding (#8356) #8446) (ac5ffbd)
• fix(review): make resolveInlineCommentAnchor enforce its own no-422 contract (fix(review): make resolveInlineCommentAnchor enforce its own no-422 contract #8455) (3ca5337)
• fix(orb): isolate APR transfer probe failures so polls never throw (fix(orb): isolate APR transfer probe failures so polls never throw (#8331) #8461) (c6f4ee2)
• fix(notifications): wire the calibration/gate-outcomes/per-repo builders into the recap digest (fix(notifications): wire the calibration/gate-outcomes/per-repo builders into the recap digest #8511) (fe816af)
• fix(queue): stop paging Sentry daily for release-please PRs' expected stuck CI (fix(queue): stop paging Sentry daily for release-please PRs' expected stuck CI #8530) (5c5f461)
• perf(test): memoize the shared GitHub App test keypair and cap rag-index's fixture size (perf(test): memoize the shared GitHub App test keypair and cap rag-index's fixture size #8550) (798f32e)
• perf(imports): break the github/client <-> db/repositories cycle taxing every test import (perf(imports): break the github/client <-> db/repositories cycle taxing every test import #8548) (ec6f6e6)
• perf(test): eliminate SQLite fsync and real rate-limit backoff wait in tests (perf(test): eliminate SQLite fsync and real rate-limit backoff wait in tests #8553) (59faa47)
• fix(queue): retry a transient GitHub mergeable_state read before deferring to the next sweep (fix(queue): retry a transient GitHub mergeable_state read before deferring to the next sweep #8560) (bd273c1)
• fix(review): scope the bare-score public-safety check per repo (metagraphed#8038) (fix(review): scope the bare-score public-safety check per repo (metagraphed#8038) #8562) (a864c0e)
• perf(test): eliminate two more real-wait retry-backoff hotspots (perf(test): eliminate two more real-wait retry-backoff hotspots #8573) (a4a5013)
• fix(build): migrate loopover-miner/loopover-mcp to out-of-place dist/ emit (fix(build): migrate loopover-miner/loopover-mcp to out-of-place dist/ emit #8590) (c896797)
• api: remove the orphaned browser-extension backend surface from src/ (api: remove the orphaned browser-extension backend surface from src/ #8604) (f4f001d)
• fix(review): raise the patch-less secret-scan cap from 512KB to 4MB (fix(review): raise the patch-less secret-scan cap from 512KB to 4MB #8605) (16dc507)
• feat(selfhost): add PostHog error tracking as a parallel sink alongside Sentry (feat(selfhost): add PostHog error tracking as a parallel sink alongside Sentry #8607) (a972353)
• feat(api): add PostHog exception capture to the hosted ORB Worker path (feat(api): add PostHog exception capture to the hosted ORB Worker path #8611) (a9056ae)
• feat(rees): replace Sentry with PostHog for error tracking + source maps (feat(rees): replace Sentry with PostHog for error tracking + source maps #8615) (e56e9a7)
• fix(selfhost): replace Sentry with PostHog for error tracking (PostHog error tracking for the ORB self-host server (swap the src/selfhost/sentry.ts sink; cron-monitor heartbeat design) #8287) (fix(selfhost): replace Sentry with PostHog for error tracking #8617) (0e93a85)
• fix(api): replace Sentry with PostHog for the hosted ORB Worker (PostHog error tracking for the hosted ORB Worker path (raw $exception, no SDK in the bundle) #8288) (fix(api): replace Sentry with PostHog for the hosted ORB Worker #8618) (a266d7a)
• fix(selfhost): upload self-host source maps to PostHog, not Sentry (fix(selfhost): upload self-host source maps to PostHog, not Sentry #8619) (49ba70f)
• fix(selfhost): read POSTHOG_CLI_PROJECT_ID/HOST from secrets, not vars (fix(selfhost): read POSTHOG_CLI_PROJECT_ID/HOST from secrets, not vars #8621) (a3465a1)
• fix(selfhost): unset POSTHOG_CLI_HOST when blank, don't pass empty (fix(selfhost): unset POSTHOG_CLI_HOST when blank, don't pass empty #8622) (5f5f52b)
• feat(selfhost): PostHog AI observability across ORB and AMS (feat(selfhost): PostHog AI observability across ORB and AMS #8623) (a9d9c0e)
• fix(posthog): pass release-name and release-version as separate CLI flags (fix(posthog): pass release-name and release-version as separate CLI flags #8624) (cdad5c2)
• fix(selfhost): consume the injected central PostHog key as a POSTHOG_API_KEY fallback (fix(selfhost): consume the injected central PostHog key as a POSTHOG_API_KEY fallback #8635) (9f69c95)
• fix(scripts): detect globalThis-cast and severity-threshold env reads (fix(scripts): detect globalThis-cast and severity-threshold env reads #8632) (bacfcdf)

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	loopover-ui	16a28f6	Commit Preview URL Branch Preview URL	Jul 25 2026, 04:54 PM

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.