#6 chore: deploy Set it Free Loop (review tier, v2.0.0)

Set it Free Loop — Deployment

Version: 2.0.0
Tier: review
Source SHA: 2fa3dd4cf999c7dc1bafce641a9e7ca41764758a
Engine policy: codex-gpt-55-high

Components deployed

• labels
• governance
• sfl-pr-review

What is the Set it Free Loop?

The Set it Free Loop is a continuous
quality improvement operating model for software repositories. See the
CATALOG
for all available workflows.

Before merging

• Run .\deployment\governance\setup-labels.ps1 -Owner <org> -Repo <repo> if labels are not yet configured
• For each .md workflow: verify gh aw compile .github/workflows/<name>.md succeeds
• Trigger a workflow manually to confirm output
• Review sfl.json manifest in the repo root

---

Summary by cubic

Deploys Set it Free Loop v2.0.0 to the review tier and simplifies auth in the sfl-pr-review workflow by removing the GitHub App dependency, adding guard policies, and using standard repo secrets for tokens.

• Refactors
  • Replace GitHub App token generation with GH_AW_GITHUB_MCP_SERVER_TOKEN → GH_AW_GITHUB_TOKEN → GITHUB_TOKEN fallback.
  • Add MCP guard policies for github and safeoutputs (min integrity, allowed repos, sink visibility).
  • Remove github-app config from the workflow and drop SFL_APP_PRIVATE_KEY from required/redacted secrets.
  • Update deployment metadata (sfl.json, lockfile) for HemSoft/set-it-free-loop@2fa3dd4.

[!NOTE]

Deploy Set it Free Loop review tier v2.0.0 with token fallback and MCP guard policies

• Removes the runtime GitHub App token generation step from sfl-pr-review.lock.yml; token now sources from a secrets fallback chain: GH_AW_GITHUB_MCP_SERVER_TOKEN → GH_AW_GITHUB_TOKEN → GITHUB_TOKEN.
• Adds guard-policies to the MCP gateway config: an allow-only policy (min-integrity + repos) and a write-sink policy (accept-all with configurable sink-visibility via GH_AW_SINK_VISIBILITY).
• Removes the SFL_APP_PRIVATE_KEY secret requirement and its corresponding SECRET_SFL_APP_PRIVATE_KEY export, along with the tools.github.github-app config in sfl-pr-review.md.
• Updates sfl.json with new deployedAt timestamp and sourceSha.

^{Macroscope summarized 8177ee8.}