loopctl-mcp-server 2.116.0 → 3.1.0

package/lib/delivery-loop.js

@@ -84,7 +84,7 @@ function refuse(body) {
  * That 404 is the problem, not a 500. It is BYTE-IDENTICAL to the 404 for a perfectly
  * well-formed id that names no story — `FallbackController` answers `{:error, :not_found}` with
  * the same `%{error: %{status: 404, message: "Not found"}}`
- * (`lib/loopctl_web/fallback_controller.ex:74-78`) — so it cannot tell an operator which
+ * (`lib/loopctl_web/fallback_controller.ex:84-88`) — so it cannot tell an operator which
  * of the two happened, and the two have opposite remedies: re-read the argument you passed, or
  * go find the right story. The check here can tell them apart, and does it without a round trip.
  *

package/lib/github-credential.js

@@ -2,8 +2,8 @@
  * `github_credential`, `set_github_credential`, `clear_github_credential` — the tenant's own
  * GitHub token (#936), `GET|PUT|DELETE /api/v1/tenants/me/github-credential`.
  *
- * loopctl calls GitHub for a tenant in the merge gate, story and post-deploy verification,
- * thread checkpoint reads and issue closing. Each call authenticates with the tenant's own
+ * loopctl calls GitHub for a tenant in the merge gate, story and post-deploy verification
+ * and issue closing. Each call authenticates with the tenant's own
  * token when one is set, else with the operator's token for the (tenant, repository) pairs
  * the operator named in VERIFICATION_OPERATOR_TOKEN_TENANTS, else not at all
  * (`credential_unavailable`). The tenant's token is what lets loopctl serve a repository

package/lib/intake-sources.js

@@ -74,10 +74,28 @@
  * is. The controller mounts `RequireRole, role: :user` — the HIERARCHY form, so a
  * `:superadmin` key would pass too and this package holds no such variable — plus
  * `RequireHumanAnchor` on create/update/delete and `RequireUnlineagedCaller` on create
- * (`lib/loopctl_web/controllers/intake_source_controller.ex:27-29`). That last one is why a
+ * (`lib/loopctl_web/controllers/intake_source_controller.ex:34-36`). That last one is why a
  * global `LOOPCTL_API_KEY` must not stand in: creating a source MINTS A CREDENTIAL that
  * belongs to no dispatch lineage, so a caller whose own key a dispatch minted is refused
- * `403 api_key_mint_forbidden`, exactly as it is on `POST /api/v1/api_keys`.
+ * `403 api_key_mint_forbidden`, exactly as it is on `POST /api/v1/api_keys`. An update that
+ * names a `chg` credential or sets `mode` to `chg` is held to the same ceiling under its own
+ * code, `403 chg_registration_forbidden`, whose remedy is the operator key itself.
+ *
+ * ## MODE `chg` AND ITS TWO CREDENTIALS (US-47.2, AC-47.7.2)
+ *
+ * A source in `mode: "chg"` has its changes landed by the change protocol (`chg submit`), and
+ * loopctl's merge precondition refuses every story on it with `409 change_protocol_enrolled`.
+ * It needs BOTH `change_events_secret` — the HMAC key chg-server signs its event webhook with,
+ * which the OPERATOR supplies because chg-server must hold the same value — and
+ * `chg_root_dispatch_id`, the parentless orchestrator-role dispatch chg-server's key was minted
+ * from (`422 chg_root_invalid` for anything else, another tenant's included).
+ *
+ * The secret is WRITE-ONLY on both sides: the server never serialises it, and `publicSource`
+ * below never names it, so no tool result carries it. A tool INPUT is recorded in the
+ * transcript too, so `change_events_secret_file` is offered beside it: the tool reads the
+ * value from that file and it never passes through a transcript at all. Exactly one trailing
+ * newline is stripped (what `openssl rand -hex 32 > file` writes); chg-server must hold the
+ * value without it.
  *
  * ## `repo_full_name` IS NOT SHAPE-CHECKED HERE, AND THAT IS A DECISION
  *
@@ -144,28 +162,142 @@ function epicRefusal(value, { clearable }) {
 }
 
 /**
- * The two merge routes a source may take (US-45.4). `pr` is the default and what every source
- * did before the field existed; `thread` makes the merge gate read the story's latest recorded
- * checkpoint instead of a pull request. NOT nullable — the server answers 422 — so a null is
- * refused here where the reason can be stated.
+ * The merge routes a source may take: `pr`, the default, and `chg` (US-47.2), where the change
+ * protocol lands the repository's changes and the PR route is closed. NOT nullable — the
+ * server answers 422 — so a null is refused here where the reason can be stated.
  */
-export const SOURCE_MODES = ["pr", "thread"];
+export const SOURCE_MODES = ["pr", "chg"];
 
 export function modeRefusal(mode) {
   if (SOURCE_MODES.includes(mode)) return null;
 
   return refuse(
-    "`mode` must be `pr` or `thread`, or must be left out entirely (enrolment then takes " +
-      "`pr`, and an update keeps the current value). It cannot be null: every source reaches " +
-      "its base branch by one route or the other.",
+    "`mode` must be `pr` or `chg`, or must be left out entirely (enrolment then takes `pr`, " +
+      "and an update keeps the current value). It cannot be null.",
+  );
+}
+
+/**
+ * The `chg` credentials a call NAMED, resolved into the request body fields, or a refusal.
+ *
+ * Resolves to `{ fields }` or `{ refusal }`. `clearable` is the update path, where an explicit
+ * null clears a credential on a `pr` source (the server refuses it on a `chg` one). No branch
+ * of this function puts the secret's value in a message.
+ */
+export async function chgCredentials(args, { clearable, fs = defaultFs, homedir = os.homedir() }) {
+  const fields = {};
+  const { change_events_secret: secret, change_events_secret_file: secretFile } = args;
+
+  if (secret !== undefined && secretFile !== undefined) {
+    return {
+      refusal: refuse(
+        "Send `change_events_secret` OR `change_events_secret_file`, not both: they are two " +
+          "ways of naming the same value.",
+      ),
+    };
+  }
+
+  if (secret !== undefined) {
+    if (secret === null && clearable) {
+      fields.change_events_secret = null;
+    } else if (typeof secret !== "string" || secret === "") {
+      return {
+        refusal: refuse(
+          "`change_events_secret` must be a non-empty string (the server holds it to " +
+            "32-256 bytes)" +
+            (clearable ? ", or null to clear it on a `pr` source." : ".") +
+            " Prefer `change_events_secret_file`, which keeps the value out of the transcript.",
+        ),
+      };
+    } else {
+      fields.change_events_secret = secret;
+    }
+  }
+
+  if (secretFile !== undefined) {
+    const read = await readSecretFile(secretFile, { fs, homedir });
+    if (read.refusal) return read;
+    fields.change_events_secret = read.secret;
+  }
+
+  const root = args.chg_root_dispatch_id;
+
+  if (root !== undefined) {
+    if (root === null && clearable) {
+      fields.chg_root_dispatch_id = null;
+    } else {
+      const badRoot = uuidRefusal(root, "chg_root_dispatch_id");
+      if (badRoot) return { refusal: badRoot };
+      fields.chg_root_dispatch_id = root;
+    }
+  }
+
+  return { fields };
+}
+
+async function readSecretFile(secretFile, { fs, homedir }) {
+  if (typeof secretFile !== "string" || secretFile.trim() === "") {
+    return {
+      refusal: refuse("`change_events_secret_file` must be a path to the file holding the secret."),
+    };
+  }
+
+  const path = expandHome(secretFile, homedir);
+  if (!nodePath.isAbsolute(path)) {
+    return {
+      refusal: refuse(
+        `change_events_secret_file must be absolute or start with ~/ (got '${secretFile}').`,
+      ),
+    };
+  }
+
+  let raw;
+  try {
+    raw = await fs.readFile(path, "utf8");
+  } catch (err) {
+    return {
+      refusal: refuse(
+        `Could not read change_events_secret_file '${path}' (${err?.code || "error"}). ` +
+          "Nothing was sent.",
+      ),
+    };
+  }
+
+  const secret = raw.replace(/\r?\n$/, "");
+  if (secret === "") {
+    return { refusal: refuse(`change_events_secret_file '${path}' is empty. Nothing was sent.`) };
+  }
+
+  return { secret };
+}
+
+/**
+ * `mode: "chg"` at ENROLMENT needs both credentials in the same call (there is no earlier
+ * stint to keep them from), so their absence is refused here, before a secret file is
+ * reserved, with the 422 the server would answer named.
+ */
+function chgEnrolmentRefusal(mode, fields) {
+  if (mode !== "chg") return null;
+
+  const missing = ["change_events_secret", "chg_root_dispatch_id"].filter(
+    (field) => fields[field] === undefined,
+  );
+
+  if (missing.length === 0) return null;
+
+  return refuse(
+    `\`mode: chg\` needs ${missing.map((f) => `\`${f}\``).join(" and ")} in the same call; ` +
+      "the server answers 422 without them. `chg_root_dispatch_id` is the parentless " +
+      "orchestrator-role dispatch chg-server's key was minted from (the operator mints it " +
+      "with `dispatch`, no parent), and the secret is the HMAC key chg-server signs its " +
+      "events with (`change_events_secret_file` keeps it out of the transcript).",
   );
 }
 
 /**
- * The CI checks a thread-mode checkpoint must pass on its exact commit (US-45.6). A list of
+ * The CI checks story verification judges a story's commit by (US-26.4.6). A list of
  * distinct, non-blank names; `local-gate` is refused because whoever pushed posts it. The
- * server holds the bounds and the "a thread source must name one" rule, which depends on the
- * stored mode this client cannot see, so only the shape is judged here.
+ * server holds the bounds, so only the shape is judged here.
  */
 export function requiredChecksRefusal(checks) {
   // The same shape the server holds (`Source.validate_required_checks/1`): non-blank, no
@@ -186,8 +318,8 @@ export function requiredChecksRefusal(checks) {
 
   if (checks.includes("local-gate")) {
     return refuse(
-      "`local-gate` can never be a required check: whoever pushed posts it, so on a thread " +
-        "it is the implementer attesting its own work. It is recorded on the checkpoint instead.",
+      "`local-gate` can never be a required check: whoever pushed posts it, so it is the " +
+        "implementer attesting its own work.",
     );
   }
 
@@ -224,6 +356,8 @@ export function publicSource(source) {
     base_branch: source.base_branch,
     mode: source.mode,
     required_checks: source.required_checks,
+    // `change_events_secret` is NEVER named here: write-only (US-47.2).
+    chg_root_dispatch_id: source.chg_root_dispatch_id,
     target_epic_id: source.target_epic_id,
     revoked_at: source.revoked_at,
     inserted_at: source.inserted_at,
@@ -258,6 +392,9 @@ export async function enrollIntakeSource(
     mode,
     required_checks,
     secret_file,
+    change_events_secret,
+    change_events_secret_file,
+    chg_root_dispatch_id,
   } = {},
   { userKey, apiCall, baseUrl, fs = defaultFs, homedir = os.homedir() } = {},
 ) {
@@ -298,21 +435,30 @@ export async function enrollIntakeSource(
   }
 
   // OPTIONAL, read by PRESENCE like the branch: omitted, the source takes `pr`. Named, it
-  // must be one of the two modes; anything else (null included) is a 422 at the server and
+  // must be a known mode; anything else (null included) is a 422 at the server and
   // is refused here, before a secret file is reserved.
   if (mode !== undefined) {
     const badMode = modeRefusal(mode);
     if (badMode) return badMode;
   }
 
-  // OPTIONAL too (US-45.6): the CI checks a thread checkpoint must pass. Its SHAPE is judged
-  // here, before a secret file is reserved; whether a thread source names enough of them
-  // depends on the stored mode, which only the server knows.
+  // OPTIONAL too: the CI checks story verification judges by. Its SHAPE is judged here,
+  // before a secret file is reserved.
   if (required_checks !== undefined) {
     const badChecks = requiredChecksRefusal(required_checks);
     if (badChecks) return badChecks;
   }
 
+  // The `chg` credentials (US-47.2), resolved and judged before a secret file is reserved.
+  const chg = await chgCredentials(
+    { change_events_secret, change_events_secret_file, chg_root_dispatch_id },
+    { clearable: false, fs, homedir },
+  );
+  if (chg.refusal) return chg.refusal;
+
+  const badChg = chgEnrolmentRefusal(mode, chg.fields);
+  if (badChg) return badChg;
+
   if (typeof secret_file !== "string" || secret_file.trim() === "") {
     return refuse(
       "`secret_file` is required: the path the webhook secret is written to (mode 0600). " +
@@ -364,6 +510,7 @@ export async function enrollIntakeSource(
   if (base_branch !== undefined) body.base_branch = base_branch;
   if (mode !== undefined) body.mode = mode;
   if (required_checks !== undefined) body.required_checks = required_checks;
+  Object.assign(body, chg.fields);
 
   let result;
   try {
@@ -518,7 +665,10 @@ export async function listIntakeSources({ include_revoked } = {}, { userKey, api
  * uses `empty_values: []` precisely so that a caller who SENT a value gets an answer about
  * the value it sent, which is a 422.
  */
-export async function updateIntakeSource(args = {}, { userKey, apiCall } = {}) {
+export async function updateIntakeSource(
+  args = {},
+  { userKey, apiCall, fs = defaultFs, homedir = os.homedir() } = {},
+) {
   if (!userKey) return refuse(MISSING_USER_KEY);
 
   const bad = uuidRefusal(args.source_id, "source_id");
@@ -557,11 +707,20 @@ export async function updateIntakeSource(args = {}, { userKey, apiCall } = {}) {
     body.required_checks = args.required_checks;
   }
 
+  // Switching to `chg` may rely on credentials an earlier `chg` stint left on the row, so their
+  // absence here is the SERVER's to judge (422 naming the missing one); only their shape is
+  // judged here.
+  const chg = await chgCredentials(args, { clearable: true, fs, homedir });
+  if (chg.refusal) return chg.refusal;
+  Object.assign(body, chg.fields);
+
   if (Object.keys(body).length === 0) {
     return refuse(
       "Nothing to update. Name at least one of `target_epic_id` (null clears it), " +
-        "`base_branch`, `mode` or `required_checks`. A body carrying none of them is refused 422 " +
-        "`nothing_to_update`, because a field you do not send is left exactly as it was.",
+        "`base_branch`, `mode`, `required_checks`, `change_events_secret` (or " +
+        "`change_events_secret_file`) or `chg_root_dispatch_id`. A body carrying none of them " +
+        "is refused 422 `nothing_to_update`, because a field you do not send is left exactly " +
+        "as it was.",
     );
   }
 

package/lib/story-update.js

@@ -72,7 +72,7 @@
  * (`lib/loopctl_web/plugs/cast_error_handler.ex:32-35`), and the body is
  * `LoopctlWeb.ErrorJSON`'s generic `{"error": {"status": 404, "message": "Not found"}}` — byte
  * for byte what `FallbackController` answers for a well-formed id naming no story
- * (`lib/loopctl_web/fallback_controller.ex:74-78`). Two opposite remedies, one answer.
+ * (`lib/loopctl_web/fallback_controller.ex:84-88`). Two opposite remedies, one answer.
  *
  * The check is `uuid()`, IMPORTED from `lib/delivery-loop.js` rather than reimplemented, so the
  * refusal a caller reads for a bad `story_id` does not depend on which tool they reached for.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loopctl-mcp-server",
-  "version": "2.116.0",
+  "version": "3.1.0",
   "description": "MCP server for loopctl — structural trust for AI development loops",
   "type": "module",
   "main": "index.js",

package/lib/threads.js

@@ -1,295 +0,0 @@
-/**
- * Change threads (loopctl US-45.1, Epic 45): read a story's thread, record a checkpoint,
- * record an entry; and review on it (US-45.3): request a review, read its payload, record a
- * fix. A review's findings and verdict are NOT here: they travel over the runner socket from
- * the runner loopctl placed the review on.
- *
- * SINGLE SOURCE OF TRUTH. index.js injects `apiCall`; the unit suite runs this code with a
- * recording fake. Keys are selected here, from the injected env, so which key a call travels
- * on is testable behaviour:
- *
- * - thread_checkpoint travels on the key claim_story claims with: LOOPCTL_API_KEY when it is
- *   set, else LOOPCTL_AGENT_KEY (the same resolveKey order). The endpoint compares the key's
- *   agent with the story's claimant, so the checkpoint must go out on the key that claimed.
- * - thread_entry writes a `message` on the key named by `principal` (agent by default; a
- *   person writes on LOOPCTL_USER_KEY).
- * - thread_request_review travels on LOOPCTL_ORCH_KEY (LOOPCTL_USER_KEY for principal user).
- * - thread_fix travels on the key claim_story claims with, as thread_checkpoint does.
- * - thread_get reads on the first key configured, agent first, then LOOPCTL_API_KEY, the
- *   orchestrator key and the user key: reads are open to every role.
- *
- * Every call passes the env var it is pinned to as `keyHint`, so a missing key is reported
- * by name rather than as some other feature's configuration error.
- *
- * Only presence of the required fields is checked here. Everything else is the server's
- * judgement and passes through unchanged.
- */
-
-const PRINCIPAL_KEYS = {
-  agent: "LOOPCTL_AGENT_KEY",
-  orchestrator: "LOOPCTL_ORCH_KEY",
-  user: "LOOPCTL_USER_KEY",
-};
-
-// One literal template per route, so `test/tool-surface.js` resolves each call site to the
-// route it sends (a path built from a suffix argument reads as no route at all).
-export function threadPath(storyId) {
-  return `/api/v1/stories/${encodeURIComponent(storyId)}/thread`;
-}
-
-export function checkpointsPath(storyId) {
-  return `/api/v1/stories/${encodeURIComponent(storyId)}/thread/checkpoints`;
-}
-
-export function entriesPath(storyId) {
-  return `/api/v1/stories/${encodeURIComponent(storyId)}/thread/entries`;
-}
-
-function missing(field) {
-  return { error: true, status: 0, body: `\`${field}\` is required.` };
-}
-
-function present(value) {
-  return typeof value === "string" && value.trim() !== "";
-}
-
-// The key claim_story claimed with (index.js resolveKey: LOOPCTL_API_KEY first), so a
-// checkpoint or an agent-principal entry is sent as the same agent that holds the claim.
-function claimKeyVar(env) {
-  return env.LOOPCTL_API_KEY ? "LOOPCTL_API_KEY" : "LOOPCTL_AGENT_KEY";
-}
-
-// `kb_refs` (loopctl #978) is optional; when given it must be an array of strings. The server
-// owns every other rule (UUIDs, the bound, which articles this key can read), so this only
-// stops a call whose shape could never be right, such as one id passed as a bare string.
-function kbRefsShape(kbRefs) {
-  return (
-    kbRefs === undefined ||
-    kbRefs === null ||
-    (Array.isArray(kbRefs) && kbRefs.every((id) => typeof id === "string"))
-  );
-}
-
-function badKbRefs() {
-  return {
-    error: true,
-    status: 0,
-    body: "`kb_refs` must be an array of knowledge article ids (strings).",
-  };
-}
-
-// Drops keys whose value is undefined or null, so an absent optional is not sent as null.
-function compact(obj) {
-  return Object.fromEntries(
-    Object.entries(obj).filter(([, v]) => v !== undefined && v !== null),
-  );
-}
-
-/** `GET /api/v1/stories/:id/thread`. */
-export async function getThread({ story_id, after_seq, limit } = {}, { apiCall, env = process.env } = {}) {
-  if (!present(story_id)) return missing("story_id");
-  const keyVar =
-    ["LOOPCTL_AGENT_KEY", "LOOPCTL_API_KEY", "LOOPCTL_ORCH_KEY", "LOOPCTL_USER_KEY"].find(
-      (name) => env[name],
-    ) || "LOOPCTL_AGENT_KEY";
-  const query = compact({ after_seq, limit });
-  const qs = new URLSearchParams(query).toString();
-  return apiCall(
-    "GET",
-    qs ? `${threadPath(story_id)}?${qs}` : threadPath(story_id),
-    null,
-    env[keyVar],
-    keyVar,
-  );
-}
-
-/** `POST /api/v1/stories/:id/thread/checkpoints` on the AGENT key. */
-export async function recordCheckpoint(
-  { story_id, claim_epoch, commit_sha, tree_sha, note, kb_refs } = {},
-  { apiCall, env = process.env } = {},
-) {
-  if (!present(story_id)) return missing("story_id");
-  if (!present(commit_sha)) return missing("commit_sha");
-  if (!kbRefsShape(kb_refs)) return badKbRefs();
-  if (!present(tree_sha)) return missing("tree_sha");
-  if (!Number.isInteger(claim_epoch) || claim_epoch < 0) {
-    return {
-      error: true,
-      status: 0,
-      body: "`claim_epoch` is required: the non-negative integer your claim returned.",
-    };
-  }
-
-  return apiCall(
-    "POST",
-    checkpointsPath(story_id),
-    compact({ claim_epoch, commit_sha, tree_sha, note, kb_refs }),
-    env[claimKeyVar(env)],
-    claimKeyVar(env),
-  );
-}
-
-export function stageTransitionsPath(storyId) {
-  return `/api/v1/stories/${encodeURIComponent(storyId)}/stage/transitions`;
-}
-
-/**
- * `POST /api/v1/stories/:id/stage/transitions` on the key claim_story claimed with (US-45.9):
- * the claimant of an INTERACTIVE thread claim reports its own story's stage transitions, as a
- * runner reports a placed claim's.
- */
-export async function reportStage(
-  { story_id, claim_epoch, from, to, edge, reason, head_sha } = {},
-  { apiCall, env = process.env } = {},
-) {
-  if (!present(story_id)) return missing("story_id");
-  if (!present(from)) return missing("from");
-  if (!present(to)) return missing("to");
-  if (!Number.isInteger(claim_epoch) || claim_epoch < 0) {
-    return {
-      error: true,
-      status: 0,
-      body: "`claim_epoch` is required: the non-negative integer your claim returned.",
-    };
-  }
-
-  return apiCall(
-    "POST",
-    stageTransitionsPath(story_id),
-    compact({
-      claim_epoch,
-      from,
-      to,
-      edge,
-      reason,
-      effects: present(head_sha) ? { head_sha } : undefined,
-    }),
-    env[claimKeyVar(env)],
-    claimKeyVar(env),
-  );
-}
-
-/** `POST /api/v1/stories/:id/thread/entries` on the key `principal` names. */
-export async function recordEntry(
-  {
-    story_id,
-    kind,
-    idempotency_key,
-    body,
-    checkpoint_id,
-    kb_refs,
-    principal = "agent",
-  } = {},
-  { apiCall, env = process.env } = {},
-) {
-  if (!present(story_id)) return missing("story_id");
-  if (!present(kind)) return missing("kind");
-  if (!present(idempotency_key)) return missing("idempotency_key");
-  if (!present(body)) return missing("body");
-  if (!kbRefsShape(kb_refs)) return badKbRefs();
-
-  const keyVar = principal === "agent" ? claimKeyVar(env) : PRINCIPAL_KEYS[principal];
-  if (!PRINCIPAL_KEYS[principal]) {
-    return {
-      error: true,
-      status: 0,
-      body: "`principal` must be one of agent, orchestrator, user.",
-    };
-  }
-
-  return apiCall(
-    "POST",
-    entriesPath(story_id),
-    compact({ kind, idempotency_key, body, checkpoint_id, kb_refs }),
-    env[keyVar],
-    keyVar,
-  );
-}
-
-// --- US-45.3: review on the thread ------------------------------------------------------
-
-export function reviewsPath(storyId) {
-  return `/api/v1/stories/${encodeURIComponent(storyId)}/thread/reviews`;
-}
-
-export function reviewPath(storyId, reviewId) {
-  return `/api/v1/stories/${encodeURIComponent(storyId)}/thread/reviews/${encodeURIComponent(reviewId)}`;
-}
-
-export function fixesPath(storyId) {
-  return `/api/v1/stories/${encodeURIComponent(storyId)}/thread/fixes`;
-}
-
-/**
- * `POST /api/v1/stories/:id/thread/reviews` on the orchestrator key (or the user key): ask
- * loopctl to place a review on a runner. No credential comes back; the review's findings and
- * verdict travel over that runner's socket, never through this server.
- */
-export async function requestReview(
-  {
-    story_id,
-    runner_id,
-    dispatch_id,
-    wall_clock_seconds,
-    max_turns,
-    repo,
-    base_branch,
-    principal = "orchestrator",
-  } = {},
-  { apiCall, env = process.env } = {},
-) {
-  if (!present(story_id)) return missing("story_id");
-  if (!present(runner_id)) return missing("runner_id");
-  if (principal !== "orchestrator" && principal !== "user") {
-    return { error: true, status: 0, body: "`principal` must be orchestrator or user." };
-  }
-
-  const keyVar = PRINCIPAL_KEYS[principal];
-  return apiCall(
-    "POST",
-    reviewsPath(story_id),
-    compact({ runner_id, dispatch_id, wall_clock_seconds, max_turns, repo, base_branch }),
-    env[keyVar],
-    keyVar,
-  );
-}
-
-/** `GET /api/v1/stories/:id/thread/reviews/:review_id` on the first key configured. */
-export async function getReview({ story_id, review_id } = {}, { apiCall, env = process.env } = {}) {
-  if (!present(story_id)) return missing("story_id");
-  if (!present(review_id)) return missing("review_id");
-  const keyVar =
-    ["LOOPCTL_AGENT_KEY", "LOOPCTL_API_KEY", "LOOPCTL_ORCH_KEY", "LOOPCTL_USER_KEY"].find(
-      (name) => env[name],
-    ) || "LOOPCTL_AGENT_KEY";
-  return apiCall("GET", reviewPath(story_id, review_id), null, env[keyVar], keyVar);
-}
-
-/** `POST /api/v1/stories/:id/thread/fixes` on the key claim_story claims with. */
-export async function recordFix(
-  { story_id, claim_epoch, checkpoint_id, finding_ids, idempotency_key, body } = {},
-  { apiCall, env = process.env } = {},
-) {
-  if (!present(story_id)) return missing("story_id");
-  if (!present(checkpoint_id)) return missing("checkpoint_id");
-  if (!present(idempotency_key)) return missing("idempotency_key");
-  if (!present(body)) return missing("body");
-  if (!Array.isArray(finding_ids) || finding_ids.length === 0) {
-    return { error: true, status: 0, body: "`finding_ids` must name at least one finding." };
-  }
-  if (!Number.isInteger(claim_epoch) || claim_epoch < 0) {
-    return {
-      error: true,
-      status: 0,
-      body: "`claim_epoch` is required: the non-negative integer your claim returned.",
-    };
-  }
-
-  return apiCall(
-    "POST",
-    fixesPath(story_id),
-    { claim_epoch, checkpoint_id, finding_ids, idempotency_key, body },
-    env[claimKeyVar(env)],
-    claimKeyVar(env),
-  );
-}