sync fork with upstream (2026-08-18) by oponder · Pull Request #19 · 0xSplits/centaur

oponder · 2026-08-18T10:50:32Z

Brings the fork up to date with upstream b985a365 (2026-08-18) — 113 upstream commits since the Jul 31 sync (#15).

Same recipe as #15: take upstream as-is and re-apply the fork's genuine changes on top. Fork main's content matched upstream 5b78273a (Jul 31) exactly except one patch, so this branch is upstream main + one commit re-applying the sentry read-only client commands fix (#13).

⚠️ Merge with a MERGE COMMIT — do not squash

#15 said the same thing and was squash-merged anyway, which severed the shared history again (that's why a plain git merge upstream/main shows phantom conflicts, and why this PR exists in replace-form). The repo allows merge commits — use "Create a merge commit". Squashing this one condemns the next sync to the same wall.

What rides along

Four new migrations (0049 company-context reader sources, 0050 granola-search RLS, 0051 hermes harness, 0052 session-execution request). They apply on the next api-rs boot after an image rebuild. Deploy api-rs first or together with the bots; note that once applied, rolling api-rs back to a pre-sync image will fail sqlx's migration check — roll forward instead.
api-rs auth refactor (protected /api/* router), workflow durability changes, githubbot/test expansions — the full upstream 2.5 weeks.

Why now

Testing our upstream PRs (paradigmxyz#1414, paradigmxyz#1415) in this deployment requires the fork to be at upstream parity: paradigmxyz#1415 ships migration 0053, which presumes 0049–0052 are applied. After this merges, upstream-status-command / upstream-review-ack are deployable here essentially 1:1.

Validation

tools/infra/sentry/test_cli.py passes (the only fork-patched code).
Every other file is byte-identical to upstream main b985a365, which upstream CI validates.
Sanity: git diff origin/main HEAD = exactly upstream's post-Jul-31 delta; git diff upstream/main HEAD = the 2 sentry files only.

🤖 Generated with Claude Code

…#1022)

* feat: proxy slack channel listing * fix: harden slack channel enrichment

fix(sandbox): support gpt-5.6-sol Co-authored-by: ecejas <15933097+ecejas@users.noreply.github.com>

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…stent account (paradigmxyz#1015)

* fix: proxy Slack file listing * feat: add direct Slack file search command * fix: correct Slack files list pagination * fix: require channel for Slack file proxy * fix: require channel for Slack file search * fix: update Slack file search callers

* feat: expose Slack file info proxy * refactor: share Slack file info helpers * fix: authorize Slack file info before config * feat: proxy Slack channel members

* fix: use host Slack team for principals * fix: stop scoping Slack channel principals by requester team The prior approach threaded the host Slack team through a request context so channel principals would use it. That is unnecessary: a Slack channel id is globally unique, so channel principals never need a team in scope. Scoping them by the message-derived team (introduced in paradigmxyz#882) let a Slack Connect requester's external workspace fork a separate principal from the host channel's. Derive channel principals without any team scope, keeping the DM metadata-team folding from paradigmxyz#882 intact, and revert the request-context plumbing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Perry Dime <260989497+svc-paradigm@users.noreply.github.com> Co-authored-by: Matthew Slipper <me@matthewslipper.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* feat: configure default sandbox capabilities * feat: manage sandbox defaults in console * feat: manage sandbox defaults in console * refactor: simplify sandbox default application * refactor: rely on sandbox setting validation * refactor: remove redundant sandbox default constants * fix: preserve explicit sandbox repo-cache labels * refactor: store sandbox repo cache as enum * refactor: require repo cache label for principals * fix: prefer principal repo cache setting over label * fix: reject sandbox repo cache label input * fix: validate sandbox repo cache label consistency * refactor: always project sandbox repo cache label

* fix: gate otlp egress on observability * chore: bump helm chart version * fix: always label api-rs for observability

* fix(slackbotv2): resolve trigger bot identities * fix(slackbotv2): match webhook bots by app identity * refactor(slackbotv2): allowlist bot members only

…le (paradigmxyz#984) Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

fix(slackbotv2): support scoped trigger bot ids Co-authored-by: Perry Dime <260989497+svc-paradigm@users.noreply.github.com>

…radigmxyz#1053)

* fix: allow hosted MCP OAuth redirects * test: update MCP redirect rejection case

* feat: sync Granola via user OAuth * fix: satisfy Granola sync CI checks

* feat: expose sandbox permission query * fix: expose console URL to sandboxes * refactor: clarify sandbox console URL wiring * fix: require explicit API server proxy hosts * chore: bump chart version to 0.1.99 * fix: require configured sandbox entitlement host

…igmxyz#1320) The example's create-secret command lists OP_SERVICE_ACCOUNT_TOKEN and OP_VAULT without saying which ironProxy.secretSource they belong to. They match the chart default, but a reader running secretSource: env copies two keys that have no effect and no way to tell from the example. Name the source each key belongs to, using the same pairings as the infra secret table in the production guide.

Both overlay mount paths are served by repo-cache, but the dependency is not stated anywhere. Record the requirement and point clusters that cannot use writable hostPath volumes at repoCache.storage.type=persistentVolumeClaim instead of disabling the cache.

* feat: add collaborative skill editors * feat: manage skill editors through API * fix: expose editors for shared skills

* fix: prevent task phrasing from selecting amp * fix: generalize amp classifier guidance

Co-authored-by: Perry Dime <260989497+svc-paradigm@users.noreply.github.com>

…z#1358)

…digmxyz#1324) sessions.harness_type is written when the session is created, and a later request for a different harness raises HarnessConflict and falls back to the session's existing harness. So sandbox.harnessEngine only affects new sessions. The reference tables say this for SLACKBOTV2_DEFAULT_HARNESS and TEAMS_DEFAULT_HARNESS_TYPE, but not where operators actually choose a harness. State it next to the harness table.

…z#991) * fix(mcp): validate tool arguments before sandbox dispatch * test(mcp): update unready app state setup --------- Co-authored-by: Matthew Slipper <me@matthewslipper.com>

* ci: close inactive draft pull requests * ci: clarify stale draft comment * ci: make stale draft comment friendlier

* feat: add sandbox API JWT capabilities * refactor: route sandbox API access through proxies * chore: bump chart version to 0.1.118 * fix: check sandbox API permissions in prompt * test: remove brittle prompt assertion

* fix: resolve OAuth identity before credential upsert * fix: handle OAuth identity network failures

* feat: add optional Console Sentry reporting * chore: add Sentry dependency and bump chart

…z#1392) * fix: enqueue session executions before processing * fix: claim persisted executions by id * fix: preserve queued executions during shutdown * refactor: simplify shutdown execution recovery

…adigmxyz#1363) * fix: do not terminalize Codex error notifications with willRetry Codex emits intermediate error notifications with willRetry=true while reconnecting a dropped model stream. Treat those as non-terminal so the turn can finish, and persist nested params.error text when it does fail. Co-authored-by: Cursor <cursoragent@cursor.com> * style(api-rs): rustfmt retryable Codex error guard Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(slack): use MCP user token for message search * test(slack): remove obsolete resource namespaces

Content is upstream main b985a36 as-is (-s ours from the upstream side); this merge exists to re-join the histories that the squash-merges of #11/#15 severed, so this and future syncs merge without phantom conflicts.

Re-applies the fork's one genuine change (#13) on top of upstream main b985a36 — the replace-with-upstream sync recipe from #15. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

mslipper and others added 30 commits July 10, 2026 08:59

fix: upsert slack dm permissions for existing principals (paradigmxyz…

1e34e6d

…#1022)

feat: proxy slack channel listing (paradigmxyz#1023)

1fafcb2

* feat: proxy slack channel listing * fix: harden slack channel enrichment

fix(sandbox): bump Codex for gpt-5.6-sol (paradigmxyz#1016)

4e589a7

fix(sandbox): support gpt-5.6-sol Co-authored-by: ecejas <15933097+ecejas@users.noreply.github.com>

chore: move the PWA install CTA into the account menu (paradigmxyz#1026)

9919f87

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

fix(sandbox): avoid Centaur AI co-author attribution as it is non-exi…

e8e54c8

…stent account (paradigmxyz#1015)

feat: support 5.6 max Codex reasoning effort (paradigmxyz#1027)

6d703ff

docs: clarify model and harness switching (paradigmxyz#1028)

64608e3

feat: expose Slack file and member proxies (paradigmxyz#1029)

0f24f0a

* feat: expose Slack file info proxy * refactor: share Slack file info helpers * fix: authorize Slack file info before config * feat: proxy Slack channel members

fix: make Attio sync resilient to detail failures (paradigmxyz#1031)

94b6022

fix: gate otlp egress on observability (paradigmxyz#1037)

3c6e84d

* fix: gate otlp egress on observability * chore: bump helm chart version * fix: always label api-rs for observability

fix(slackbotv2): resolve trigger bot identities (paradigmxyz#1043)

8a0027c

* fix(slackbotv2): resolve trigger bot identities * fix(slackbotv2): match webhook bots by app identity * refactor(slackbotv2): allowlist bot members only

feat(console): chat composer: start and continue chats from the conso…

06b836c

…le (paradigmxyz#984) Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

fix(console): preserve optimistic chat messages (paradigmxyz#1047)

9683728

docs: fix company context latest-date guidance (paradigmxyz#1049)

f3a4a4f

feat: batch company context projections (paradigmxyz#1055)

379b95d

fix(slackbotv2): support scoped trigger bot IDs (paradigmxyz#1051)

32061ce

fix(slackbotv2): support scoped trigger bot ids Co-authored-by: Perry Dime <260989497+svc-paradigm@users.noreply.github.com>

fix: include API controllers in console request logs (paradigmxyz#1056)

8357943

fix: remove company context size metric (paradigmxyz#1057)

ab8c8b2

fix(console): keep composer model picker menu inside the viewport (pa…

bf8bdc8

…radigmxyz#1053)

fix(console): preserve requester attribution for PRs (paradigmxyz#1054)

a6a7c0a

feat: add Airtable record write operations (paradigmxyz#1058)

d0271e2

fix: allow hosted MCP OAuth redirects (paradigmxyz#1059)

ee55a37

* fix: allow hosted MCP OAuth redirects * test: update MCP redirect rejection case

fix: fall back to direct Slack threads (paradigmxyz#1061)

91a619b

feat: sync Granola via user OAuth (paradigmxyz#1060)

4e6c13b

* feat: sync Granola via user OAuth * fix: satisfy Granola sync CI checks

feat: add Airtable identity health check (paradigmxyz#1062)

1a2de01

feat: add centaur console permissions tool (paradigmxyz#1065)

f8fefed

kreplik and others added 23 commits August 14, 2026 16:00

feat: add collaborative skill editors (paradigmxyz#1388)

44eb42e

* feat: add collaborative skill editors * feat: manage skill editors through API * fix: expose editors for shared skills

feat: log Slack webhook receipt metadata (paradigmxyz#1389)

e1d4c3f

fix: prevent task phrasing from selecting amp (paradigmxyz#1391)

382d1ac

* fix: prevent task phrasing from selecting amp * fix: generalize amp classifier guidance

feat: expose skill deletion (paradigmxyz#1393)

6140ec3

fix(chart): give console worker Slack token (paradigmxyz#1395)

e227dd0

Co-authored-by: Perry Dime <260989497+svc-paradigm@users.noreply.github.com>

fix(investigator): convert asyncpg records by column name (paradigmxy…

b702305

…z#1358)

ci: skip image jobs for external pull requests (paradigmxyz#1396)

c13212a

fix(mcp): validate tool arguments before sandbox dispatch (paradigmxy…

40de5cf

…z#991) * fix(mcp): validate tool arguments before sandbox dispatch * test(mcp): update unready app state setup --------- Co-authored-by: Matthew Slipper <me@matthewslipper.com>

ci: close inactive draft pull requests (paradigmxyz#1397)

f55422f

* ci: close inactive draft pull requests * ci: clarify stale draft comment * ci: make stale draft comment friendlier

feat: add sandbox API JWT capabilities (paradigmxyz#1394)

2b1b438

* feat: add sandbox API JWT capabilities * refactor: route sandbox API access through proxies * chore: bump chart version to 0.1.118 * fix: check sandbox API permissions in prompt * test: remove brittle prompt assertion

fix: resolve OAuth identity before credential upsert (paradigmxyz#1398)

36f2a71

* fix: resolve OAuth identity before credential upsert * fix: handle OAuth identity network failures

fix: exclude workflow sandboxes from session cleanup (paradigmxyz#1406)

0e58fe8

feat: add optional Console Sentry reporting (paradigmxyz#1407)

d826657

* feat: add optional Console Sentry reporting * chore: add Sentry dependency and bump chart

fix: acknowledge session execution before sandbox startup (paradigmxy…

604c887

…z#1392) * fix: enqueue session executions before processing * fix: claim persisted executions by id * fix: preserve queued executions during shutdown * refactor: simplify shutdown execution recovery

fix: preserve unchanged Slack message timestamps (paradigmxyz#1411)

82bdd28

fix(slack): use MCP user token for message search (paradigmxyz#1412)

2474727

* fix(slack): use MCP user token for message search * test(slack): remove obsolete resource namespaces

fix(auth): grant owned credentials to MCP users (paradigmxyz#1413)

b985a36

sync fork with upstream: adopt upstream tree, keep fork history

6399bc8

Content is upstream main b985a36 as-is (-s ours from the upstream side); this merge exists to re-join the histories that the squash-merges of #11/#15 severed, so this and future syncs merge without phantom conflicts.

fix(sentry): expose read-only client commands (fork patch)

9867a00

Re-applies the fork's one genuine change (#13) on top of upstream main b985a36 — the replace-with-upstream sync recipe from #15. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

oponder force-pushed the sync-upstream-2026-08-18 branch from f695010 to 9867a00 Compare August 18, 2026 11:01

oponder marked this pull request as ready for review August 18, 2026 11:04

oponder requested a review from 0xdiid August 18, 2026 11:06

0xdiid approved these changes Aug 18, 2026

View reviewed changes

oponder merged commit 2d4f2b1 into main Aug 18, 2026

oponder deleted the sync-upstream-2026-08-18 branch August 18, 2026 17:19

oponder mentioned this pull request Aug 18, 2026

fix(api-rs): authorize githubbot for all its session key families #22

Closed

Navigation Menu

Uh oh!

sync fork with upstream (2026-08-18) - #19

sync fork with upstream (2026-08-18)#19
oponder merged 405 commits into
mainfrom
sync-upstream-2026-08-18

oponder commented Aug 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Uh oh!

Conversation

oponder commented Aug 18, 2026

⚠️ Merge with a MERGE COMMIT — do not squash

What rides along

Why now

Validation

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants