sync fork with upstream 2026-08-20 - #24
Merged
Merged
Conversation
* feat: run workflow agents in parallel * docs: align parallel agent result example
…ew (paradigmxyz#1414) * feat(githubbot): ack owned-PR management turns with a working reaction (PE-8082) Review-request and issue-work turns already ack instantly (eyes on the subject, settled to rocket/confused when the turn finishes), but owned-PR management turns — address-review, CI-fix, conflict resolution — gave no signal until the agent pushed or replied. A reviewer leaving feedback on a bot-owned PR saw silence while the turn ran. Fire the same subject-reaction lifecycle from fireManagementTurn, the choke point all management turns flow through: eyes before the turn starts (not awaited, so the ack can't delay the turn), settled in the background chain. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(githubbot): move the review ack onto the review itself via GraphQL Live testing showed the PR-top-post ack goes unnoticed — reviewers look at their own review, and a reaction on the PR description isn't clearly tied to anything. The REST reactions API has no endpoint for reviews, so the ack now goes through the GraphQL addReaction mutation with the review's node id: eyes lands on the reviewer's review, settled to rocket/confused there. Turns with no triggering review (CI-fix, conflict resolution) no longer react at all. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat: allow workflows to select principals * fix: prevent session principal rebinding
…gmxyz#1419) fix(sentry): expose read-only client commands (fork patch) Re-applies the fork's one genuine change (#13) on top of upstream main b985a36 — the replace-with-upstream sync recipe from #15. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat: add an option to configure openAI base url * fix: preserve activity summary endpoint overrides * fix: remove ineffective Codex base URL config * refactor: remove unused OpenAI URL re-export * chore(chart): bump chart version to 0.1.117 --------- Co-authored-by: Matthew Slipper <me@matthewslipper.com>
…th 6 updates (paradigmxyz#1424) Bumps the api-rs-dependencies group with 6 updates in the /services/api-rs directory: | Package | From | To | | --- | --- | --- | | [async-trait](https://github.com/dtolnay/async-trait) | `0.1.91` | `0.1.92` | | [aws-smithy-types](https://github.com/smithy-lang/smithy-rs) | `1.6.1` | `1.6.2` | | [eyre](https://github.com/eyre-rs/eyre) | `0.6.12` | `0.6.14` | | [thiserror](https://github.com/dtolnay/thiserror) | `2.0.19` | `2.0.20` | | [uuid](https://github.com/uuid-rs/uuid) | `1.24.0` | `1.24.1` | | [futures](https://github.com/rust-lang/futures-rs) | `0.3.33` | `0.3.34` | Updates `async-trait` from 0.1.91 to 0.1.92 - [Release notes](https://github.com/dtolnay/async-trait/releases) - [Commits](dtolnay/async-trait@0.1.91...0.1.92) Updates `aws-smithy-types` from 1.6.1 to 1.6.2 - [Release notes](https://github.com/smithy-lang/smithy-rs/releases) - [Changelog](https://github.com/smithy-lang/smithy-rs/blob/main/CHANGELOG.md) - [Commits](https://github.com/smithy-lang/smithy-rs/commits) Updates `eyre` from 0.6.12 to 0.6.14 - [Commits](eyre-rs/eyre@eyre-v0.6.12...v0.6.14) Updates `thiserror` from 2.0.19 to 2.0.20 - [Release notes](https://github.com/dtolnay/thiserror/releases) - [Commits](dtolnay/thiserror@2.0.19...2.0.20) Updates `uuid` from 1.24.0 to 1.24.1 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](uuid-rs/uuid@v1.24.0...v1.24.1) Updates `futures` from 0.3.33 to 0.3.34 - [Release notes](https://github.com/rust-lang/futures-rs/releases) - [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md) - [Commits](rust-lang/futures-rs@0.3.33...0.3.34) --- updated-dependencies: - dependency-name: async-trait dependency-version: 0.1.92 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: api-rs-dependencies - dependency-name: aws-smithy-types dependency-version: 1.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: api-rs-dependencies - dependency-name: eyre dependency-version: 0.6.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: api-rs-dependencies - dependency-name: thiserror dependency-version: 2.0.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: api-rs-dependencies - dependency-name: uuid dependency-version: 1.24.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: api-rs-dependencies - dependency-name: futures dependency-version: 0.3.34 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: api-rs-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…z#1405) Bumps the github-actions group with 3 updates: [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain), [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) and [actions/github-script](https://github.com/actions/github-script). Updates `dtolnay/rust-toolchain` from e97e2d8cc328f1b50210efc529dca0028893a2d9 to 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 - [Commits](dtolnay/rust-toolchain@e97e2d8...6c977a6) Updates `astral-sh/setup-uv` from 9.0.0 to 10.0.1 - [Commits](astral-sh/setup-uv@c771a70...20cfd1b) Updates `actions/github-script` from d746ffe35508b1917358783b479e04febd2b8f71 to 3a2844b7e9c422d3c10d287c895573f7108da1b3 - [Commits](actions/github-script@d746ffe...3a2844b) --- updated-dependencies: - dependency-name: dtolnay/rust-toolchain dependency-version: 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 dependency-type: direct:production dependency-group: github-actions - dependency-name: astral-sh/setup-uv dependency-version: 10.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/github-script dependency-version: 3a2844b7e9c422d3c10d287c895573f7108da1b3 dependency-type: direct:production dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Matthew Slipper <me@matthewslipper.com>
fix: send Slack DMs without im:write scope
…z#992) Co-authored-by: Matthew Slipper <me@matthewslipper.com>
fix: allow explicit Console service hosts Co-authored-by: Matthew Slipper <me@matthewslipper.com>
…gmxyz#998) * docs: drop dead secret keys; fix stale proxy-fallback comment SANDBOX_SIGNING_KEY, LOCAL_DEV_API_KEY, and IRON_BROKER_TOKEN have no consumers left on main — they are python-era / standalone-token-broker leftovers. Remove them from the secret tables and examples in the docs (and the matching lines in the docs/public/md mirrors) and stop seeding them in bootstrap-k8s-secrets.sh. Also fix the IRON_CONTROL_URL comment in the api-rs template: there is no static-proxy-config fallback; api-rs fails fast when iron-proxy is configured without iron-control. Closes paradigmxyz#996 * docs: correct broker credential setup --------- Co-authored-by: Matthew Slipper <me@matthewslipper.com>
…adigmxyz#1322) * fix(chart): roll repo-cache when its GitHub token secret changes repo-cache authenticates to GitHub from a token file mounted off repoCache.githubToken, but its pod template carries no annotation tied to that secret. Every other component in the chart has checksum/infra-secrets, so repo-cache is the only workload that keeps running against a stale token after the secret is rotated or recreated. Recovering means noticing that repos have stopped syncing and deleting the pod by hand. Add checksum/github-token, built from the same centaur.secretResourceVersion helper the other components use. Recreating a Secret changes its resourceVersion, so the next upgrade rolls the pod. Rendered only when a token is configured, so token-less deployments see no change. * chore(chart): bump release to 0.1.122 --------- Co-authored-by: Matthew Slipper <me@matthewslipper.com>
) * docs: document the access-token broker credential bootstrap; hint at it from api-rs In access_token mode the harness proxy fragment references a console broker credential (openai-codex / anthropic-claude) that must be created out of band with 'centaur-perms broker create'. The production guide never mentioned it, and instead described the removed standalone token-broker flow (OPENAI_CODEX_BLOB / CLAUDE_CODE_BLOB items in the secrets backend that nothing reads anymore), so a fresh deployment ends in an api-rs crash-loop on the console's 422. - rewrite the Codex/Claude Auth Modes sections around the real bootstrap: codex/claude login, store OPENAI_CODEX_ACCOUNT_ID (codex only), create the broker credential, restart api-rs; keep the token-family reuse warnings - select the mode via sandbox.codexAuthMode / sandbox.claudeCodeAuthMode instead of sandbox.extraEnv — extraEnv only reaches sandbox pods, not api-rs, which is the component that acts on the mode - point at the out-of-band step from the bootstrap script usage text - api-rs: when the registration 422 names a missing broker credential, append a 'centaur-perms broker create' hint to the startup error Closes paradigmxyz#995 * docs: correct broker bootstrap instructions --------- Co-authored-by: Matthew Slipper <me@matthewslipper.com>
* fix(attio): support replacing record values Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com> * fix(attio): harden CRM mutations and pagination Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com> * fix(attio): parse rate-limit reset dates Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>
* feat(console): add Slack channel autocomplete * fix(console): allow editing existing Slack permissions --------- Co-authored-by: Matthew Slipper <me@matthewslipper.com>
…gmxyz#1335) paradigmxyz#832 fixed this argument in tools/productivity/linear/readonly.py and pinned it with a regression test. There is a second, independent copy of the same client at workflows/linear/readonly.py that was never touched -- it still builds: query SearchIssues($query: String!, ...) { searchIssues(query: $query, ...) } while the copy upstream tests builds `searchIssues(term: $term, ...)`. The two disagree on the argument name, and only one of them is pinned. This copy ships: services/api-rs/Dockerfile copies workflows/ into the image, WORKFLOW_DIRS points at it, and LinearReadonlyClient is exported from workflows/linear/__init__.py. Nothing calls search_issues on this path today, so it is latent rather than a live break -- which is why it went unnoticed. The test is a mirror of the one paradigmxyz#832 added, asserting the same three things against this client. The absence of a test here is the reason the fix did not propagate; paradigmxyz#1300 now runs workflows/tests in CI, so it is gated from here on. Verified it fails against the unfixed client and passes against the fixed one. Scope is the argument name only. The two copies still differ in their selection sets -- the tools copy also selects `project` and `projectMilestone` -- and this change leaves that alone rather than quietly widening the payload of a query nobody calls yet. Co-authored-by: aaditya krishnamohan <201291201+aadityakbh@users.noreply.github.com>
Co-authored-by: José Ribeiro <32641844+ribeirojose@users.noreply.github.com>
… 4 updates (paradigmxyz#1403) * chore(deps): bump the ruby-dependencies group across 1 directory with 4 updates Bumps the ruby-dependencies group with 4 updates in the /services/console directory: [rails-paradedb](https://github.com/paradedb/rails-paradedb), [bootsnap](https://github.com/rails/bootsnap), [thruster](https://github.com/basecamp/thruster) and [selenium-webdriver](https://github.com/SeleniumHQ/selenium). Updates `rails-paradedb` from 0.7.0 to 0.12.0 - [Release notes](https://github.com/paradedb/rails-paradedb/releases) - [Changelog](https://github.com/paradedb/rails-paradedb/blob/main/CHANGELOG.md) - [Commits](paradedb/rails-paradedb@v0.7.0...v0.12.0) Updates `bootsnap` from 1.24.6 to 1.25.0 - [Release notes](https://github.com/rails/bootsnap/releases) - [Changelog](https://github.com/rails/bootsnap/blob/main/CHANGELOG.md) - [Commits](rails/bootsnap@v1.24.6...v1.25.0) Updates `thruster` from 0.1.23 to 0.1.25 - [Changelog](https://github.com/basecamp/thruster/blob/main/CHANGELOG.md) - [Commits](basecamp/thruster@v0.1.23...v0.1.25) Updates `selenium-webdriver` from 4.46.0 to 4.47.0 - [Release notes](https://github.com/SeleniumHQ/selenium/releases) - [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES) - [Commits](SeleniumHQ/selenium@selenium-4.46.0...selenium-4.47.0) --- updated-dependencies: - dependency-name: bootsnap dependency-version: 1.25.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ruby-dependencies - dependency-name: rails-paradedb dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ruby-dependencies - dependency-name: selenium-webdriver dependency-version: 4.47.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: ruby-dependencies - dependency-name: thruster dependency-version: 0.1.25 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ruby-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * fix: keep ParadeDB Rails integration compatible --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Matthew Slipper <me@matthewslipper.com>
* feat: add server-side Slack app DMs * revert: remove standalone Slack app DM tool * feat: customize workflow Slack messages * refactor: simplify workflow Slack method signature --------- Co-authored-by: Vijith Bheemireddi <vijith@khvkmhft4w.tail388b2e.ts.net> Co-authored-by: Matthew Slipper <me@matthewslipper.com>
Co-authored-by: ecejas <15933097+ecejas@users.noreply.github.com>
fix: upgrade Slack API emulator
…sole in the ruby-dependencies group (paradigmxyz#1430) chore(deps): bump rails-paradedb Bumps the ruby-dependencies group in /services/console with 1 update: rails-paradedb. Updates `rails-paradedb` from 0.7.0 to 0.9.0 --- updated-dependencies: - dependency-name: rails-paradedb dependency-version: 0.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ruby-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* refactor(slack): own nanocodex rollout policy * chore(chart): bump version to 0.1.121 * refactor(slack): simplify rollout selection check * docs: correct nanocodex rollout visibility * docs(chart): describe nanocodex rollout value
fix: align Figma credential contract
* feat: support custom Codex providers Amp-Thread-ID: https://ampcode.com/threads/T-01a0118a-4098-7650-b30b-fce6b8237f41 Co-authored-by: Amp <amp@ampcode.com> * fix: persist custom Codex providers across turns * chore(chart): bump chart to 0.1.123 * chore(chart): bump chart to 0.1.124 --------- Co-authored-by: Amp <amp@ampcode.com> Co-authored-by: Matthew Slipper <me@matthewslipper.com>
…radigmxyz#1435) The platform scoping added in paradigmxyz#1374 pins each ingress key to a single thread-key prefix, but githubbot mints four: github: (chat), github-issue: (issue work), github-manage: (owned-PR management) and github-review: (review runs). Only the first matched, so api-rs 403'd the bot out of its own issue-work, management and review sessions ("ingress caller denied for another platform's session"). Callers now carry the full list of prefixes their ingress mints, and the session guard accepts any of them. The other ingresses each mint a single family and keep their single prefix; unlisted github-* strings stay denied. Both ends of the contract are pinned so they cannot drift apart silently: the api-rs test asserts the shipped ingress spec rather than a hand-written list, and githubbot pins the prefix each of its thread-key helpers produces. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…#1429) * chore(deps): bump the harness-server-dependencies group across 1 directory with 3 updates Bumps the harness-server-dependencies group with 3 updates in the /crates/harness-server directory: [allocative](https://github.com/facebookexperimental/allocative), [thiserror](https://github.com/dtolnay/thiserror) and [uuid](https://github.com/uuid-rs/uuid). Updates `allocative` from 0.3.4 to 0.3.6 - [Release notes](https://github.com/facebookexperimental/allocative/releases) - [Commits](https://github.com/facebookexperimental/allocative/commits) Updates `thiserror` from 2.0.19 to 2.0.20 - [Release notes](https://github.com/dtolnay/thiserror/releases) - [Commits](dtolnay/thiserror@2.0.19...2.0.20) Updates `uuid` from 1.24.0 to 1.24.1 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](uuid-rs/uuid@v1.24.0...v1.24.1) --- updated-dependencies: - dependency-name: allocative dependency-version: 0.3.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: harness-server-dependencies - dependency-name: thiserror dependency-version: 2.0.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: harness-server-dependencies - dependency-name: uuid dependency-version: 1.24.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: harness-server-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * fix(deps): retain compatible allocative version --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Matthew Slipper <me@matthewslipper.com>
Co-authored-by: Liam Horne <1933029+snario@users.noreply.github.com>
Co-authored-by: Perry Dime <260989497+svc-paradigm@users.noreply.github.com>
Merges upstream main bc72622 — 36 commits since the 2026-08-18 sync point (b985a36). No conflicts. The fork carries no local divergence after this: upstream took both fork patches, the sentry read-only CLI commands (paradigmxyz#1419) and githubbot's session key families (paradigmxyz#1435), so the merged tree matches upstream main exactly. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
oponder
marked this pull request as ready for review
August 20, 2026 17:46
0xdiid
approved these changes
Aug 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
16 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Syncs the fork with upstream
mainatbc72622b— 36 commits since the 2026-08-18 sync point. Merged cleanly, no conflicts.The fork now carries zero local divergence: upstream took both fork patches, so the merged tree is byte-identical to upstream main.
98fba269sentry read-only CLI commands (fix(sentry): expose read-only client commands through the CLI paradigmxyz/centaur#1419) — our fix(sentry): expose read-only client commands #13/sync fork with upstream #15 patchcafc4e4dgithubbot session key families (fix(api-rs): authorize githubbot for all its session key families paradigmxyz/centaur#1435) — our fix(api-rs): authorize githubbot for all its session key families #22 fix, including thegithub-issue:family that fix(api-rs): authorize githubbot for all its session key families #22 was missing until yesterdayWhat else comes in
api-rs — Standard Webhooks authentication (paradigmxyz#1380), workflow principals resolved by OID (paradigmxyz#1439), customizable workflow Slack messages (paradigmxyz#1401)
slackbotv2 — owns its nanocodex rollout policy (paradigmxyz#1437), Slack API emulator upgrade (paradigmxyz#1152), retries for transient sync failures (paradigmxyz#1443), stale channel catalog retained on fetch failure (paradigmxyz#1441)
console — Slack channel autocomplete (paradigmxyz#1408), Ruby dependency bumps
sandbox — brokered Codex auth seeded for Hermes (paradigmxyz#1368), custom Codex providers (paradigmxyz#1410)
chart — explicit Console service hosts via
console.allowedHosts(paradigmxyz#1144), repo-cache rolls when its GitHub token secret changes (paradigmxyz#1322)tools / workflows — Figma credential contract (paradigmxyz#1146), Attio CRM mutation + pagination hardening (paradigmxyz#1306), Granola shared meeting links (paradigmxyz#1434), Linear
searchIssuestakesterm(paradigmxyz#1335)Validation
Tree matches upstream
mainexactly, so upstream CI onbc72622bcovers it. Locally re-ran the parts we changed most recently:cargo test -p centaur-api-server --libandbun test testinservices/githubbot(101 pass).Follow-ups
feat/githubbot-ignored-checksneeds a rebase — it touchescontrib/chart/values.yamlandgithubbot.yaml, both of which move in this sync.🤖 Generated with Claude Code