Update agent-loop to 0.16.6 and keep replay provenance in sync - abandoned

renovate.json

@@ -3,9 +3,36 @@
         "config:recommended",
         ":preserveSemverRanges"
     ],
-    "packageRules": [{
+    "customManagers": [
+        {
+            "customType": "regex",
+            "managerFilePatterns": [
+                "/^tools\\/agent-loop\\/dogfood\\/issue-\\d+\\.json$/"
+            ],
+            "matchStrings": [
+                "\\\"agent_loop_release\\\"\\s*:\\s*\\\"(?<currentValue>[^\\\"]+)\\\""
+            ],
+            "depNameTemplate": "voku/agent-loop",
+            "datasourceTemplate": "packagist",
+            "versioningTemplate": "composer"
+        }
+    ],
+    "packageRules": [
+        {
+            "description": "Keep agent-loop tool and replay provenance updates together",
+            "matchPackageNames": [
+                "voku/agent-loop"
+            ],
+            "matchManagers": [
+                "composer",
+                "custom.regex"
+            ],
+            "groupName": "agent-loop toolchain"
+        },
+        {
             "matchPackageNames": [
                 "!phpunit/phpunit"
             ]
-    }]
+        }
+    ]
 }

tools/agent-loop/README.md

@@ -13,9 +13,11 @@ The first replay uses historical issue #60, `Update for use with PHP 8.4`.
 The workflow freezes three things before context discovery:
 
 - issue title/body and the pre-fix base commit `5156d5d74ca1bce275219f4571efd54ec44be911`;
-- `agent-loop 0.16.5` as the direct first-party release-set authority;
+- the `agent-loop` release recorded in the replay input as the direct first-party release-set authority;
 - agent-skills commit `c7e9d8bdda59d957600bca8dc9f787f03286b277` and the `reproduce-before-fix` L2 recipe.
 
+The replay `agent_loop_release` value and `tools/agent-loop/composer.json` intentionally describe the same direct dependency. Renovate owns updating those direct-version references together. Do not copy sibling `agent-*` versions into Composer or replay metadata; they are resolved evidence owned transitively by `agent-loop`.
+
 Before resolution, `verify-release-set.php` fails if the tool project or replay input reintroduces sibling `agent-*` version authority. After resolution, the same verifier requires the complete first-party release set to be present in `composer.lock` and reports the versions Composer actually selected.
 
 If a replay needs byte-for-byte dependency identity rather than compatibility through the frozen `agent-loop` release, commit and install an exact lock file. Do not approximate a lock by copying transitive package versions into another JSON authority.

tools/agent-loop/composer.json

@@ -4,7 +4,7 @@
   "type": "project",
   "license": "Apache-2.0",
   "require-dev": {
-    "voku/agent-loop": "0.16.5",
+    "voku/agent-loop": "0.16.6",
     "voku/simple-php-code-parser": "0.22.3"
   },
   "minimum-stability": "dev",

tools/agent-loop/dogfood/issue-101.json

@@ -10,7 +10,7 @@
   },
   "target_base_commit": "53f1b5085ee883560afa9326ee914f6b23acd6ae",
   "toolchain": {
-    "agent_loop_release": "0.16.5",
+    "agent_loop_release": "0.16.6",
     "agent_skills_commit": "c7e9d8bdda59d957600bca8dc9f787f03286b277",
     "operating_prompt": "reproduce-before-fix"
   }

tools/agent-loop/dogfood/issue-60.json

@@ -10,7 +10,7 @@
   },
   "target_base_commit": "5156d5d74ca1bce275219f4571efd54ec44be911",
   "toolchain": {
-    "agent_loop_release": "0.16.5",
+    "agent_loop_release": "0.16.6",
     "agent_skills_commit": "c7e9d8bdda59d957600bca8dc9f787f03286b277",
     "operating_prompt": "reproduce-before-fix"
   }