chore(upstream): sync 2026-09-09

[berghtho]

Summary

Integrate upstream through 6c583620f while preserving CMD Riker's Owner Gateway, project isolation, client routing, and provider-agnostic turns. Adapt fork-only Effect error classes and retained conflict tests to the incoming APIs.

The Owner clarified that upstream supplies the tested and maintained stock source. Our responsibility is Riker integration. This PR updates AGENTS.md, the fork policy, and the sync runbook accordingly. It supersedes the earlier broad verification demands in #33 and the historical draft report. Upstream pipelines, review agents, scans, native matrices, stock bug fixes, and release checks are not fork sync work.

Provenance

• Previous integrated upstream: 9a47c7bd40522977c7df022a5b64759aae7b58e0
• Frozen upstream head: 6c583620ff7ad3235b135af7107c0543467eecfa
• Upstream batch comparison, 176 commits.
• Integration merge: 74f7a255426ed1cd4fb40d7a9f0fad9312bd73bf, with fork base afad9579515649988c13f3193d4f8317068fb720 as first parent and the frozen upstream head as second parent.
• Policy follow-up: 00f2256c5, followed by 30a4ddc33 restoring non-executable documentation modes after the Windows-to-Linux copy.
• Final head: 30a4ddc33fa7e77940b0fda4ad74b66b35d3c446
• Final tree: 859ae75ca76a1a47690524c32e8b361083c33588

Riker integration and conflicts

• Migrated LeadAgentError and RikerOwnerGatewayError to Schema.TaggedError for Effect rc.112. Preserved typed failures and wire fields.
• Retained the Lead Agent RPC group, authorization mapping, server layer, capability advertisement, branded project resolution, lazy gateway connection, shared client state, page route, and command-palette context.
• Retained both sides of the server-settings and command-palette test conflicts. Preserved older-client usage projection in the usage-contract conflict.
• Updated retained hub-service test fixtures for auth-files and api-call, preserving refresh, removal, and sanitized-failure assertions.
• Resolved the two vendored Effect conflicts using the Owner-approved coherent incoming reference pair. Its mysql2 3.23.4 supersedes the prior fork reference update to 3.23.1.
• Kept fork governance and the release gate. Replaced upstream security-contact/safe-harbor claims with the fork's actual deferred reporting status. No new reporting service was configured.

Owner turns still carry only branded projectId and Owner content. The server canonicalizes the configured Target Project before invoking Riker. No stock provider/model enum controls CMD Riker Native Harness selection. The capability regression preserves Copilot and other Riker-supported harnesses under Riker Model Policy. A real Copilot session is not required or claimed by this sync.

Verification

The application code, dependencies, and executable configuration at the final head are byte-identical to the verified integration commit. Only three documentation files changed afterward, confirmed with an excluding-path Git diff. Existing Riker evidence therefore applies to this head.

vp test run packages/contracts/src/leadAgent.test.ts apps/server/src/riker/LeadAgentProjectResolver.test.ts apps/server/src/riker/RikerOwnerGateway.test.ts apps/server/src/riker/LeadAgentBridge.test.ts
  25 passed.
vp test run apps/server/src/server.test.ts -t "Lead Agent"
  2 passed; 181 unrelated tests filtered out.
vp run --filter @t3tools/contracts typecheck
  Passed.
vp run --filter t3 typecheck
  Passed.
vp test run packages/contracts/src/usage.test.ts apps/server/src/serverSettings.test.ts apps/server/src/usage/UsageLimitSources.test.ts apps/server/src/usage/cliproxyApi.test.ts apps/web/src/components/CommandPalette.logic.test.ts packages/client-runtime/src/state/leadAgent.test.ts
  81 passed.
vp run --filter @t3tools/web typecheck
  Passed.
vp run --filter @t3tools/client-runtime typecheck
  Passed.
vp fmt --check AGENTS.md docs/internals/downstream-fork.md docs/operations/upstream-sync.md
  Passed for the policy correction.
git diff --check
  Passed for the documentation changes before commit.

Earlier verification used a disposable Docker Linux checkout with Node 24.13.1, pnpm 11.10.0, and Vite+ 0.3.0. Frozen installation passed without manifest/lockfile drift. Integration-file formatting and lint passed within the earlier wider check. That wider check reported 424 upstream warnings and vendored whitespace; neither is a Riker gate. Detailed historical evidence is retained in the earlier PR comment, with its former blocker status superseded by the Owner's responsibility decision.

The original merge hook returned zero despite a vendored-file restaging failure; its committed tree exactly matched the verified tree. Both documentation follow-up hooks completed successfully. No hook was bypassed and no upstream tooling repair is required for this sync.

The earlier stock-client findings, native/migration backlog, deferred reporting setup, and unrelated pre-existing fork observations are not demonstrated Riker regressions introduced by this batch. They are not sync blockers or new fork maintenance assignments. No claim is made that those checks ran or those findings were fixed.

Publication boundary

Actions remains disabled. Incoming workflow and review-agent files remain inert source; this sync enables or recreates no upstream automation. Branch, PR, and merge publication target only berghtho/t3code; upstream remains fetch-only. The existing first-release gate remains in force.

GitHub cannot render this batch's full diff because it exceeds 300 files. The Riker integration was reviewed locally; the GitHub commit API is used to verify the published head, tree, and parent ancestry before merge.

Model: openai/gpt-6-astra. Native Harness: OpenCode.

[berghtho]

Isolated daily-sync verification, 2026-09-09

Final result

The authorized install retry and normal frozen installation succeeded. All four mandatory Riker commands passed. The requested focused suites passed. Web and client-runtime typechecks passed. Targeted formatting passed after applying formatter-only changes to seven files. Targeted lint exited 0 in all chunks, with 424 warnings and no errors.

Final committed tree: bba7fb06c79927a99259be6edc7b0d0122c39e15.

The existing full cached whitespace check still exits 2 because of vendored whitespace errors. Its non-vendored counterpart passes. The Lead's other sync stop conditions and draft/publication decisions remain outside this Worker's verification scope.

The Lead subsequently authorized a local integration merge commit so the existing pre-commit hook could run in isolation. Commit 74f7a255426ed1cd4fb40d7a9f0fad9312bd73bf was created without publication. The hook ran but reported a restaging anomaly described below. The container remains running and retained for the Lead.

Authorized local merge commit and hook result

Before committing, the Worker inspected git status --short --branch, git diff, git diff --cached --stat, git log --oneline -10, and an empty git diff --cached --exit-code bba7fb06c79927a99259be6edc7b0d0122c39e15. This proved that the staged index contained exactly the Lead-confirmed integration tree. No verification scratch files, logs, bundles, or container credentials were staged. No unresolved entries or non-ignored untracked files existed.

git config --show-origin --get core.hooksPath returned file:.git/config .vite-hooks/_. The executable .vite-hooks/_/pre-commit sources its existing h wrapper, which invokes the tracked .vite-hooks/pre-commit containing vp staged. The staged task is vp fmt --no-error-on-unmatched-pattern. The Worker inspected that chain and did not change the hook, repository configuration, or any hook-skip setting.

Exact commit command:

git commit -m "chore(upstream): sync through 6c583620f"

Exit 0 in 5.325 seconds, starting 2026-09-09T08:45:04.384598+00:00. Author and committer identity were supplied only through the four requested process environment variables:

Thomas Berghold-Wieser <thomas.berghold-wieser@tieto.com>

Git Trace2 was enabled through a container-local process environment variable to /evidence/commit-trace.jsonl. It proves the pre-commit hook started and exited with code 0 after 5.289407 seconds. The hook log records completion of all 15 formatter tasks. It then records this failure while applying/restaging their output:

[FAILED] The following paths are ignored by one of your .gitignore files:
[FAILED] .repos/alchemy-effect/processes
[FAILED] .repos/alchemy-effect/scripts/release

vp staged still returned zero, and Git created the merge commit. This is an observed hook anomaly, not a fully successful hook workflow. No bypass was used. The Worker did not force-add ignored paths or suppress the error. The hook cleaned up its temporary stash, and git stash list is empty.

The resulting tree is byte-identical to the verified pre-hook tree. commit-hook-changes.patch is empty. No affected-code rerun was justified; the recorded mandatory and focused checks already tested this exact tree.

Commit field	Verified value
Commit	74f7a255426ed1cd4fb40d7a9f0fad9312bd73bf
Tree	bba7fb06c79927a99259be6edc7b0d0122c39e15
First parent	afad9579515649988c13f3193d4f8317068fb720
Second parent	6c583620ff7ad3235b135af7107c0543467eecfa
Subject	chore(upstream): sync through 6c583620f
Author and committer	Thomas Berghold-Wieser <thomas.berghold-wieser@tieto.com>
Post-commit status	Clean

Evidence: precommit-inspection.log, hook-chain-inspection.log, integration-commit.log, commit-trace.jsonl, commit-evidence.json, postcommit-status.log, and postcommit-details.log.

Incremental bundle and upstream inventory

The incremental bundle was created inside the container with:

git bundle create /evidence/committed-sync.bundle refs/heads/upstream-sync/2026-09-09 ^afad9579515649988c13f3193d4f8317068fb720 ^6c583620ff7ad3235b135af7107c0543467eecfa
git bundle verify /evidence/committed-sync.bundle
git bundle list-heads /evidence/committed-sync.bundle

All commands exited 0. Verification confirms the bundle advertises only refs/heads/upstream-sync/2026-09-09 at the new commit and requires exactly the two known parent commits. git rev-list HEAD --not <first-parent> <second-parent> returns only the new merge commit.

Artifact	Bytes	SHA-256
committed-sync.bundle	10,919	43480987939f1271bd081e7c62e7d139dd909c8e1f0bc9f204b62e647176fc8e
inventory.md	40,762	1ac4c7f10a50486b98eb69fc361da2fff0fd96cddd9c0f7da6c7b6983c4e297b
commit-hook-changes.patch	0	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

inventory.md contains all 176 upstream commits in the fixed range 9a47c7bd40522977c7df022a5b64759aae7b58e0..6c583620ff7ad3235b135af7107c0543467eecfa, generated with local git log --reverse --topo-order --format=%H%x00%s. Every entry links its full commit SHA. 165 commits have source PR links derived from subject numbers; 11 commits without PR numbers have direct commit links. git rev-list --count independently confirms the count. inventory.json preserves the raw SHA/subject pairs.

Both requested artifacts and all new evidence were copied to the existing host evidence directory. No GitHub request or remote publication operation was used.

Container and immutable inputs

Item	Value
Container ID	6fe6448403150a91ca0efe201d5d301529c91f72b466cee9db580c82ade53569
Container name	upstream-sync-2026-09-09-verify
Image tag	node:24.13.1-bookworm
Exact image	node@sha256:00e9195ebd49985a6da8921f419978d85dfe354589755192dc090425ce4da2f7
Architecture	Linux amd64
Checkout	/work
Branch	upstream-sync/2026-09-09
Fork base / first parent	afad9579515649988c13f3193d4f8317068fb720
Upstream / second parent	6c583620ff7ad3235b135af7107c0543467eecfa
Final HEAD	74f7a255426ed1cd4fb40d7a9f0fad9312bd73bf
Supplied and pre-format tree	d4649320b140a912f0fb4690170338fbc561c65e
Final formatted tree	bba7fb06c79927a99259be6edc7b0d0122c39e15
Bundle SHA-256	edf822973ad4e278139d25b9f584d3b0184d8e2b14043652ec1e432b93717163
Archive SHA-256	95da7b60f952458e6fc6350efbcd4e7b196868aa960bb7b7826b59171640a44d

Docker inspection at return confirms running state, OOMKilled false, and mounts []. The container has no published ports, drops all capabilities, and uses no-new-privileges and Docker init. No host mounts, socket mounts, or credentials were forwarded. Inputs arrived through docker cp.

Fresh container state paths are HOME /sandbox/home, XDG_CONFIG_HOME /sandbox/config, XDG_CACHE_HOME /sandbox/cache, XDG_DATA_HOME /sandbox/data, XDG_STATE_HOME /sandbox/state, and T3CODE_HOME /sandbox/t3. The remaining environment is CI=true and image-provided PATH/NODE_VERSION/YARN_VERSION.

The supplied tree was reconstructed over an uncommitted merge and matched before package operations. The local bundle needed an explicit fetch of its two remote-tracking refs after cloning. See setup.log and FIRST-ATTEMPT.md for the complete reconstruction and initial failure history.

Tool versions

Tool	Version
Docker Engine	29.7.2
Docker Desktop	4.90.0
Node	24.13.1
npm	11.8.0
Corepack	0.34.6, already present
pnpm	11.10.0
Vite+ CLI	0.3.0
Vite	8.2.2
Rolldown	1.2.5
Vitest	4.1.11
Oxfmt	0.64.0
Oxlint	1.79.0
oxlint-tsgolint	7.0.2001
tsdown	0.22.14
TypeScript	7.0.2, patched by @effect/tsgo 0.41.0
Git	2.39.5
Python	3.11.2
GNU Make	4.3
g++	Debian 12.2.0-14+deb12u1

The full Bookworm image already contained the build prerequisites. No host package operations or apt installation occurred.

@voidzero-dev/vite-plus@0.3.0 returned npm E404. The repository's actual vite-plus@0.3.0 package provides vp and was installed with pnpm 11.10.0 into /bootstrap using npm with lifecycle scripts disabled. No unpinned installer was used.

Install retry and lifecycle review

The single authorized retry used a 1,200-second outer bound, a 300,000-ms fetch timeout, and network concurrency 8:

timeout 1200 pnpm install --frozen-lockfile --ignore-scripts --fetch-timeout=300000 --network-concurrency=8

Exit 0 in 624.848 seconds, starting 2026-09-09T08:13:06.077740+00:00.

• All 16 workspace projects installed.
• Lockfile was up to date; resolution was skipped.
• All 2,169 entries passed supply-chain policy checks in 2m 3.2s.
• Final progress: 1,820 resolved, 1,739 reused, 50 downloaded, 1,820 added.
• No policy setting was waived or weakened.

The Worker inventoried installed lifecycle metadata and inspected applicable downloaded hook sources for esbuild, node-pty, node-gyp-build-optional-packages, and sharp. These select/check installed native binaries or perform local node-gyp builds; esbuild includes version-pinned npm fallback downloads. The existing allowBuilds policy was retained. Electron 44.1.0 has no install lifecycle hook in its installed manifest. Workspace manifests and root preparation were also inspected.

Evidence: workspace-lifecycle-inventory.log, lifecycle-source-review.log, and test-tool-config.log for the optional-native build test source.

Normal frozen installation:

timeout 1200 pnpm install --frozen-lockfile --fetch-timeout=300000 --network-concurrency=8

Exit 0 in 3.176 seconds. pnpm accepted the recently verified supply-chain result and the existing lockfile. Root preparation ran effect-tsgo patch && vp config --no-agent, patching the installed TypeScript executable. The install log records root preparation but does not establish a separate native build verification. No broader native verification was requested.

The complete tracked working diff was empty immediately after installation. No package manifest, workspace configuration, or lockfile changed.

Test-runner correction

The first Riker invocation used /bootstrap/node_modules/.bin/vp. All four suites failed collection with Cannot read properties of undefined (reading 'config'), and no tests ran. This failed invocation is preserved in riker-baseline.log.

Only the verification helper's PATH changed, placing /work/node_modules/.bin before /bootstrap/node_modules/.bin. Running the same baseline with the installed workspace CLI passed all 25 tests. The bootstrap/workspace CLI selection caused the collection failure. No source, test, dependency version, or repository configuration changed to resolve it.

Final command logs include the exact PATH. It begins with the workspace .bin, then the bootstrap .bin. Repeated PATH prefixes in nested helper logs are harmless and recorded as actually executed.

Mandatory verification on the final formatted tree

Each command below ran in /work against tree bba7fb06c79927a99259be6edc7b0d0122c39e15. Durations are outer wall-clock measurements, not only Vitest test time.

vp test run packages/contracts/src/leadAgent.test.ts apps/server/src/riker/LeadAgentProjectResolver.test.ts apps/server/src/riker/RikerOwnerGateway.test.ts apps/server/src/riker/LeadAgentBridge.test.ts

Exit 0, 2.566 seconds, 25 tests passed across four files:

• Lead Agent contracts: 4.
• LeadAgentProjectResolver: 3.
• RikerOwnerGateway: 12.
• LeadAgentBridge: 6.

The contracts suite includes the unconditional Native Harness boundary test with Copilot input. It verifies that Owner turns expose only the intended project/content fields to T3. This is capability-boundary evidence, not a live Copilot invocation.

vp test run apps/server/src/server.test.ts -t "Lead Agent"

Exit 0, 10.792 seconds, 2 passed, 181 intentionally skipped by the name filter. The passing tests cover snapshot/events/Owner turns over WebSocket RPC and a typed failure for an unavailable project.

vp run --filter @t3tools/contracts typecheck

Exit 0, 2.297 seconds.

vp run --filter t3 typecheck

Exit 0, 28.441 seconds.

Typechecks emitted Effect suggestions, but no TypeScript errors. Complete output is preserved in the final-*-typecheck.log files.

Focused tests and additional typechecks

Final-tree focused command:

vp test run packages/contracts/src/usage.test.ts apps/server/src/serverSettings.test.ts apps/server/src/usage/UsageLimitSources.test.ts apps/server/src/usage/cliproxyApi.test.ts apps/web/src/components/CommandPalette.logic.test.ts packages/client-runtime/src/state/leadAgent.test.ts

Exit 0, 5.710 seconds, 81 tests passed across six files:

File	Passed
packages/contracts/src/usage.test.ts	3
apps/server/src/serverSettings.test.ts	41
apps/server/src/usage/UsageLimitSources.test.ts	2
apps/server/src/usage/cliproxyApi.test.ts	12
apps/web/src/components/CommandPalette.logic.test.ts	19
packages/client-runtime/src/state/leadAgent.test.ts	4

Total distinct requested tests passed: 108 across 11 files. The earlier successful runs are preserved separately and are not double-counted.

Additional scoped typechecks ran before formatting, which changed only desktop/server files:

Command	Exit	Duration
vp run --filter @t3tools/web typecheck	0	11.576s
vp run --filter @t3tools/client-runtime typecheck	0	4.817s

Targeted lint and formatting

The explicit input list came from:

git diff --cached --name-only --diff-filter=ACMR -z afad9579515649988c13f3193d4f8317068fb720

After filtering to existing non-vendored .ts and .tsx files, 857 paths were divided into 18 chunks of at most 48 paths. changed-typescript-files.json and targeted-chunks.json preserve every path and chunk. No repository-wide lint or format command ran.

For every chunk, exact expanded commands and per-command durations are in commands.jsonl and the individual logs:

vp fmt --check <explicit chunk paths>
vp fmt <explicit chunk paths>
vp fmt --check <explicit chunk paths>
vp lint --report-unused-disable-directives <explicit chunk paths>

• Initial formatting failed in chunks 01, 07, 08, and 10.
• All 18 formatter application commands exited 0.
• All 18 final formatting checks exited 0.
• Total format/check orchestration: 26.118 seconds.
• All 18 lint commands exited 0: 424 warnings, zero errors.
• Total lint orchestration: 18.670 seconds.
• Each tool processed 856 files. Both honored the existing generated-file ignore for apps/web/src/routeTree.gen.ts.

Warnings include React compiler diagnostics and other warning-level rules. They were preserved and not classified as pre-existing, suppressed, or fixed. See lint-01.log through lint-18.log.

Formatter patch and final integrity

formatting.patch and verification-changes.patch contain the same 10,411-byte formatter-only diff relative to the supplied tree.

SHA-256: 04c65a71accf7c2c847309afa9c862371643a2516fc8d452d116a452c1c3f34a.

Changed files:

• apps/desktop/src/backend/DesktopBackendManager.ts
• apps/server/src/diagnostics/ProcessDiagnostics.ts
• apps/server/src/mcp/McpHttpServer.ts
• apps/server/src/preview/Manager.ts
• apps/server/src/processRunner.ts
• apps/server/src/resourceTelemetry/DesktopTelemetryReceiver.ts
• apps/server/src/resourceTelemetry/ResourceTelemetry.ts

The reviewed changes are layout and trailing-comma formatting around typed arrow callbacks. No logic edits were made. The seven paths were staged explicitly in the isolated clone to record the final tree. Applying this patch to the supplied tree reproduces bba7fb06c79927a99259be6edc7b0d0122c39e15.

Checks recorded before the authorized commit:

Check	Outcome
git diff --check	Exit 0
git diff --cached --check	Exit 2, vendored whitespace only
git diff --cached --check -- . ':(exclude).repos'	Exit 0
Whitespace check of supplied tree to formatted tree	Exit 0
Unstaged tracked diff	Empty
Unresolved index entries	None
Non-ignored untracked files	None
Vendored tree compared to supplied snapshot	Identical
All package manifests, workspace configuration, lockfile	Identical to supplied snapshot
HEAD and MERGE_HEAD	Original required SHAs

Vendored whitespace remains under .repos/alchemy-effect/ and .repos/effect-smol/. final-cached-diff-check.log records every diagnostic. Git also reports that exhaustive rename detection was skipped because of the incoming file count.

Evidence and limits

Host directory:

C:\Users\THOMAS~1\AppData\Local\Temp\opencode\upstream-sync-2026-09-09-verification-evidence

The container retains the same evidence under /evidence, including full command logs, initial failures, retry results, lifecycle review, all check output, and patches. final-formatted-tree.txt and final-checks.log record the current final tree. Earlier final-tree.log and final-evidence.log belong to the first attempt and correctly record the original supplied tree.

The initial registry timeout is resolved by the authorized retry. The initial test collection failure is resolved by using the workspace CLI. No requested focused test or scoped typecheck remains failing. Outstanding recorded diagnostics are the warning-level lint findings, vendored whitespace failure, and the hook restaging anomaly. The Lead retains responsibility for other batch review and stop conditions.

No repo-wide checks, dev servers, browsers, real relay/FCM operations, broader native verification, deployment/distribution scripts, or remote publishing operations ran. The one explicitly authorized merge commit ran with the existing hooks inside the retained container. All incoming executable and package-manager operations ran there. Host operations were Docker control/transfers and helper/evidence file handling.

Worker model and harness: openai/gpt-6-astra, OpenCode.

Lead publication and audit addendum

Published only to the downstream fork as draft PR #34.
Merge blockers are recorded at #33.

GitHub's commit API confirms commit 74f7a255426ed1cd4fb40d7a9f0fad9312bd73bf, tree
bba7fb06c79927a99259be6edc7b0d0122c39e15, and both ordered parents. The PR diff endpoint returns
HTTP 406 because the diff exceeds 300 files. This confirms publication integrity, not completion
of remote-diff review. The fork base remains contained in the integration head. Actions remains
disabled. The PR is open, draft, and unmerged.

The pre-commit hook returned zero despite an explicit restaging failure. Its workflow did not fully
succeed. The unchanged commit tree preserves the applicability of the tests; issue #33 tracks the
hook anomaly.

The inventory checksum recorded earlier applies to the original Worker export. The Lead subsequently
expanded inventory.md into the PR body, so that checksum does not validate its current contents.

A separate audit session used openai/gpt-6-astra as well. Cross-model review could not be established
because this harness exposes no model-family selector. No workspace transcript file was available
for that auditor; Owner decisions were recorded by the Lead from the active conversation. Raw command
logs remain in the session-local evidence directory; this report is published as a PR comment.

At handoff, the Lead stopped the exact captured verification container. Docker reports exited.
Its disposable filesystem and installed tools are retained for resumption; no verification process
remains running. The host checkout is clean on upstream-sync/2026-09-09 at the published head.