#4 chore: deploy Set it Free Loop (review tier, v2.0.0)

Set it Free Loop — Deployment

Version: 2.0.0
Tier: review
Source SHA: 22db33a7b5de7a0431b506b29a1f8e2d7817ba3d
Engine policy: codex-gpt-55-high

Components deployed

• labels
• governance
• sfl-pr-review

What is the Set it Free Loop?

The Set it Free Loop is a continuous
quality improvement operating model for software repositories. See the
CATALOG
for all available workflows.

Before merging

• Run .\deployment\governance\setup-labels.ps1 -Owner <org> -Repo <repo> if labels are not yet configured
• For each .md workflow: verify gh aw compile .github/workflows/<name>.md succeeds
• Trigger a workflow manually to confirm output
• Review sfl.json manifest in the repo root

---

Summary by cubic

Deploys SFL review v2.0.0 with a deterministic validator and a new sfl_review_inventory tool to enforce consistent, reproducible reviews. Tightens head-drift rules, requires inventory/noop/missing-signal, and validates exact review/check shapes (incl. Overflow) before publishing.

• New Features

  • Adds sfl_review_inventory to record head SHA, per-severity new/carried counts, and overflow.
  • Introduces a Node validator that re-reads PR state and enforces: stable head or exactly one noop; only allowed output types (single terminal missing_tool/missing_data allowed); correct repo/PR targeting; exactly one inventory, one review, and one check; max 20 inline comments with severity prefixes and expected per-severity distribution; exact carried counts from unresolved SFL threads; exact consolidated review body with an Overflow row; check title “SFL full-spectrum review complete” and exact, line-by-line summary (verdict, head SHA, run ID, per-severity counts, Overflow). Forces REQUEST_CHANGES and a failing check when overflow > 0.
  • Adds a post-step that fails the run unless an inventory, a single noop, or a terminal missing-signal is present; noop is allowed only on head drift.

• Refactors

  • Activates solely via the sfl-review label; removes the same-repo gate.
  • Disables issue reporting for noop; switches token minting to SFL_APP_CLIENT_ID.
  • Replaces credit-based firewall config with explicit JSON and removes GH_AW_MAX_AI_CREDITS; updates README badge label to “SFL Upstream”; refreshes sfl.json.

[!NOTE]

Deploy Set it Free Loop review tier v2.0.0 with deterministic verdict validation

• Removes the same-repository gate so the SFL review workflow triggers on any PR with the sfl-review label, including fork PRs.
• Replaces the prior head-verification bash step with a Node-based validator in sfl-pr-review.lock.yml that enforces consistency between inline comments, the consolidated review, check run, and a new sfl_review_inventory entry against live PR state and the triggering head SHA.
• Adds sfl_review_inventory as a safe output tool with a strict input schema, wired into dynamic tools and a handler script; the agent must invoke it exactly once before other outputs.
• Sets noop report-as-issue to false and requires noop to be the sole output item when head has drifted or a signal is missing.
• Writes a concrete awf-config.json at runtime with explicit domain allowlist and model mappings instead of templated content.

^{Macroscope summarized 6e1dc20.}