epic: migrate fleet-wide feature-toggle env vars to .loopover.yml config-as-code

[JSONbored]

Summary

The self-host config loader treats the global .loopover.yml (at the config-dir root) as a
fallback candidate only — it's consulted purely when a repo has no per-repo config file of its
own. Since every currently-configured repo (loopover, gittensory, metagraphed, awesome-claude)
already has its own per-repo file, the global file is never actually read for any of them today.

Meanwhile, ~25 fleet-wide feature/behavior toggles are controlled exclusively by LOOPOVER_* env
vars in .env (e.g. LOOPOVER_DUPLICATE_WINNER, LOOPOVER_REVIEW_RAG, LOOPOVER_REVIEW_MEMORY,
LOOPOVER_SKIP_AUTOMATION_BOT_PRS, ...), with each per-repo .loopover.yml only able to express
inherit | off | enabled — "inherit" always defers to the env var, never to anything in the global
yml. This violates the config-as-code mandate this project otherwise holds everywhere else: every
review feature should be controllable from .loopover.yml, with env vars reserved for genuine
bootstrap-level config (secrets, DB/connection strings, fleet membership) needed before any config
file can even be located.

What surfaced this

PRs #6248 and #6249 both linked the same issue; #6248 (created first) should have survived as the
duplicate-cluster winner but was auto-closed identically to #6249. Root cause: the duplicate-winner
adjudication feature (#dup-winner) that exists specifically to spare the earliest claimant was off
fleet-wide, controllable only via LOOPOVER_DUPLICATE_WINNER in .env — not from .loopover.yml,
global or per-repo, even though the per-repo schema already exposes a duplicateWinnerMode: inherit | off | enabled field that (today) can only ever narrow the always-off global default, never widen
it via config-as-code.

Plan

Phase 1 (first sub-issue): make the global .loopover.yml a genuine base layer that per-repo
inherit values actually defer to (not just a fallback for repos with no config at all), and migrate
duplicateWinnerMode off LOOPOVER_DUPLICATE_WINNER end to end as the proof case.

Phase 2+: once the base-layer pattern is proven, migrate the remaining feature-toggle env vars
one at a time (each gets its own sub-issue once scoped):

• LOOPOVER_OPEN_PR_FILE_COLLISION, LOOPOVER_SKIP_AUTOMATION_BOT_PRS
• LOOPOVER_REVIEW_RAG, LOOPOVER_REVIEW_GROUNDING, LOOPOVER_REVIEW_IMPACT_MAP,
  LOOPOVER_REVIEW_MEMORY, LOOPOVER_REVIEW_SAFETY, LOOPOVER_REVIEW_REPUTATION,
  LOOPOVER_REVIEW_SCREENSHOTS, LOOPOVER_REVIEW_IMPROVEMENT_SIGNAL,
  LOOPOVER_REVIEW_CULTURE_PROFILE, LOOPOVER_REVIEW_DRAFT, LOOPOVER_REVIEW_INLINE_COMMENTS,
  LOOPOVER_REVIEW_FIX_HANDOFF, LOOPOVER_REVIEW_PLANNER, LOOPOVER_REVIEW_OPS,
  LOOPOVER_REVIEW_SELFTUNE, LOOPOVER_REVIEW_CONTINUOUS
• LOOPOVER_SWEEP_WATCHDOG, LOOPOVER_MAINTAINER_RECAP, LOOPOVER_PUBLIC_STATS,
  LOOPOVER_PR_RECONCILIATION, LOOPOVER_AUTO_FILE_DRIFT_ISSUES,
  LOOPOVER_ENABLE_UNSAFE_CODEX_REVIEWER, LOOPOVER_EXPERIMENTAL_GITTENSOR

Explicitly out of scope — these stay env-var/.env-only, they're genuine bootstrap config, not
review features: secrets/tokens (LOOPOVER_API_TOKEN, LOOPOVER_MCP_TOKEN,
LOOPOVER_CONTRIBUTOR_ISSUE_TOKEN, LOOPOVER_DRIFT_ISSUE_TOKEN), release metadata
(LOOPOVER_VERSION), and fleet membership (LOOPOVER_REVIEW_REPOS — needed before any per-repo
config file could even be located).

Requirements

• The global .loopover.yml must be loaded as a base layer for EVERY repo, not just repos with no
  per-repo file of their own.
• Per-repo inherit must resolve against the global yml's own value first, falling back to the env
  var only when the global yml doesn't specify it either — never silently ignoring an explicit global
  yml setting.
• No behavior change for any repo/setting that doesn't explicitly opt into the new global yml value
  (byte-identical until an operator actually sets something in the global file).

[linear-code]

JSO-4364

[JSONbored]

Correction to the original framing

The premise that "the global .loopover.yml is fallback-only, never consulted when a per-repo file
exists" was wrong. src/selfhost/private-config.ts already deep-merges shared-base → global →
per-repo config layers (#1959 / PR #3660), and has done so in production for a long time — well
before this epic was filed. See #6276 for the full trace.

What this changes: for any setting that already exposes an inherit | off | enabled yml field
(mirroring duplicateWinnerMode's pattern — skipAutomationBotAuthors confirmed to work the same
way), setting it directly in the global .loopover.yml already works today, with zero code
change — the merged value bypasses the env-var fallback entirely once it's anything other than
"inherit". duplicateWinnerMode itself is resolved: set directly in the global yml, verified live.

Re-scoped remaining work: the real gap isn't a loader architecture problem, it's coverage — some
of the ~24 other LOOPOVER_* feature-toggle env vars listed in the original description may not yet
have a corresponding inherit | off | enabled field in the manifest schema at all (only
duplicateWinnerMode, skipAutomationBotAuthors, moderationGateMode, and
openPrFileCollisionMode are confirmed to have one so far). What's actually needed per remaining
setting:

1. Audit — does a yml field already exist for it? If yes: no code needed, just set it in the
   global (or per-repo) yml directly, same as duplicateWinnerMode.
2. If no yml field exists yet — that's the only case needing an actual code change: expose an
   inherit | off | enabled field for it, mirroring the existing pattern exactly (per-repo-setting
   checklist in the contributing skill: manifest parser + settings resolver + OpenAPI + the
   .loopover.yml schema, same PR).

Leaving this open as the tracking issue for that audit + any settings that turn out to need step 2,
since it's real, scoped follow-up work — just smaller and different in shape than originally written.

[JSONbored]

Progress update — full audit complete, remaining work dispatched

Traced all ~24 remaining LOOPOVER_* settings precisely (not just grepping — read every wire
module's actual resolution logic). Final picture, much smaller than the original framing:

Already yml-controllable today, zero code needed (~20): skipAutomationBotAuthors,
openPrFileCollisionMode, moderationGateMode (settings: block) · rag, reputation, safety,
grounding, screenshots, improvementSignal, e2eTests (features: block, verified empirically
against the live merge function) · impactMap, reviewMemory, cultureProfile, inlineComments,
fixHandoff (review: block, manifest-only) · plus three more bespoke mechanisms found while
tracing: LOOPOVER_REVIEW_SELFTUNE (review.selftune, force-off-only), LOOPOVER_REVIEW_CONTINUOUS
(review.auto_review.cadence, fully per-repo), LOOPOVER_MAINTAINER_RECAP (maintainerRecap: block
on the loopover self-repo), LOOPOVER_EXPERIMENTAL_GITTENSOR (experimental.gittensor).

Genuinely needed new code (7) — now dispatched as 4 PRs, in progress:

• LOOPOVER_REVIEW_PLANNER — per-repo (settings.plannerMode, mirrors duplicateWinnerMode)
• LOOPOVER_REVIEW_OPS + LOOPOVER_PUBLIC_STATS — fleet-wide, self-repo-manifest pattern
• LOOPOVER_SWEEP_WATCHDOG + LOOPOVER_PR_RECONCILIATION — per-repo opt-out threaded into their
  existing per-repo scan loop
• LOOPOVER_REVIEW_DRAFT + LOOPOVER_AUTO_FILE_DRIFT_ISSUES — fleet-wide, self-repo-manifest pattern

Recommended to stay env-only (1), not migrating: LOOPOVER_ENABLE_UNSAFE_CODEX_REVIEWER — a
credential-isolation security gate (Codex's OAuth creds share a filesystem with prompt-injectable PR
content); making it repo-controllable would let a malicious repo manifest flip on credential exposure.

Will link each PR here as it lands.