[darkmatter]

Caution

Only a human may merge this PR. Automation never merges it.
Merge with a merge commit (“Create a merge commit”). Merge-commit ancestry is required. Do NOT squash or rebase. The upstream tip must become an ancestor of darkmatter/centaur:main so later sync, image, and GitOps stages can validate it. The previous sync (#64) was squash-merged, so main does not contain upstream 05e6ec8a. That is why this merge produced 182 raw conflicts.

Upstream sync candidate

	SHA
Upstream paradigmxyz/centaur:main	6a4c7c113ec90e9c17e3e9bc74b33d2330583c66
Base darkmatter/centaur:main	24921080251120d833e27e8bdb0821abd13c7748
Candidate head sync/upstream-main	ad9fb9b6c5d9f0e859eeebcb0724c2831e2a8205 (merge commit; parents are base and upstream)

This is a fresh git merge --no-ff of the exact upstream tip onto the exact product base. It replaces the raw candidate 6a4c7c11 with --force-with-lease.

Status: ready for human review.

How conflicts were resolved

Git's merge base is e54c7000, which is stale because #64 was squashed. The fork already contains upstream through 05e6ec8a. Each conflict was reasoned three-way against that effective base, with true upstream delta = 05e6ec8a..6a4c7c11 (58 commits). The reference result was git merge-tree --merge-base=05e6ec8a.

The stale-base auto-merge had also silently resurrected two things, and both were reverted to the correct three-way result:

• upstream's BM25-free SQL inside the released fork migrations 0012, 0028, 0029, 0030 and 0040, which would have changed their applied checksums;
• the OMP 18 tests/omp_stdio.rs and its fixtures, which the fork removed in Sync upstream main (05e6ec8a) #64.

All 182 raw conflicted paths were resolved per hunk. None was resolved by taking one side wholesale. 86 still conflicted against the correct base, and those were resolved by hand.

Layout (upstream paradigmxyz#2009)

• Adopted the single root Cargo workspace: members = ["crates/*"] and one root Cargo.lock.
• services/api-rs/crates/*, services/company-context/src and services/proxy-sync/src move to crates/*. Sub-workspace lockfiles are removed.
• Old-path modify/delete entries carried no fork-only delta since 05e6ec8a, so nothing was lost. The proxy-sync conflict code now lives in crates/centaur-console-db.
• crates/centaur-console-db is kept as upstream's new crate. Git mis-detected it as a rename of the deleted integration-test crate.
• Root Cargo.toml keeps the fork's aws-config/aws-sdk-s3 for the S3 transcript archive. Cargo.lock is upstream's lock plus the fork's aws stack at its existing versions; no upstream package version changed.

session-sqlx / migrations (crates/centaur-session-sqlx/**, .github/scripts/check-migration-order.sh)

• All 71 released fork migration, search and override files are byte-identical to main. migrations.lock is append-only.
• Upstream-numbered duplicates are removed. Each is byte-identical to its fork-numbered file, except nanocodex, which the fork's applied 0048 supersedes.
• Upstream's only new migration, 0060_slack_external_team_allowlist, becomes 0065 and is appended to the lock.
• The fork's core-migration-overrides/ mechanism is kept at its new path. Upstream's tests/fixtures/legacy-migrations are dropped because they are byte-identical to fork originals that the fork tests already use.
• The check script keeps the fork's lock check, with paths updated.

harness-server (src/{claude,codex,lib,main,omp,pi,server,traits}.rs, codex/citations.rs, Cargo.toml, tests/app_server_stdio.rs, conformance Cargo.lock, docs/pages/extend/omp-harness.mdx, the harness-development skill)

• The fork's OMP stack (omp.rs + omp_rpc.rs, OMP 17.0.5) remains the only OMP implementation. Upstream's only post-05e6ec8a change to omp.rs was an import.
• Adopted refactor(harness-server): replace codex protocol crates with local wire types paradigmxyz/centaur#2010: local crate::protocol types replace the codex protocol crates, so omp.rs/omp_rpc.rs imports were updated and the validate-* subcommands dropped.
• Adopted fix(harness-server): recover dead Codex subprocesses between turns paradigmxyz/centaur#1957 (Codex subprocess recovery) and the conformance crate. The fork's per-turn input and its session-id hooks are kept.

api-rs crates (centaur-api-server/src/{args,auth,lib,main,routes,tool_discovery}.rs, sandbox-manager, session-cli, session-core, session-runtime, telemetry, services/api-rs/AGENTS.md)

• Kept fork code:
  • OMP leases and fenced ownership
  • the workspace-diff route and its attestation
  • the repo-cache default
  • the S3 archive
  • workflow metrics
  • the allocation-only placeholder
• Added upstream code:
  • Console DB pool
  • Slack external-team allowlist routes and seeding
  • persona-pinned harness
  • workflow starter gate
  • interrupted turns cancelled
• There is a single HarnessType::Omp.

company-context / proxy-sync / tools (crates/centaur-company-context/**, crates/centaur-proxy-sync/**, tools/productivity/company_context/**, tools/productivity/slack/tests/test_client.py, .agents/skills/company-context, contrib/chart/templates/company-context.yaml)

• The fork had no delta since 05e6ec8a except conftest.py. That file merges upstream's paths with the fork's core-migration override loader.

chart / CI / docs / e2e (contrib/chart/{Chart.yaml,values.yaml,values.schema.json,templates/{apirs,console-worker,networkpolicy,slackbotv2}.yaml}, .github/{workflows/ci.yml,workflows/publish-images.yml,dependabot.yml}, .gitignore, docs/**, e2e/**, the e2e-testing and qa skills)

• Kept these fork chart settings:
  • paradedb text-search default
  • SESSION_SANDBOX_DEFAULT_REPO_CACHE_ACCESS
  • databaseUrlSecretKey/deriveDatabaseUrl
  • ompViewerUrl
  • probes, promptPath and RuntimeClass
  • OMP_MODEL mirroring
• Added upstream's token-broker and calendar/custom indexers.
• IRON_CONTROL_DATABASE_URL follows the fork's derived-URL mode when it is enabled.
• CI keeps the fork's push: main and workflow_dispatch triggers. publish-images.yml keeps the darkmatter-owner skip.
• darkmatter-images.yml now also triggers on root Cargo.toml/Cargo.lock.

JS services / sandbox / console (services/{slackbotv2,discordbot,githubbot,linearbot,teamsbot}/{Dockerfile,package.json}, slackbotv2/src/{index,server,types,response-context}.ts, its test, packages/*/package.json, pnpm-lock.yaml, services/iron-proxy/Dockerfile, services/sandbox/{Dockerfile,entrypoint.sh,SYSTEM_PROMPT.md,test_repo_cache_sync.py}, services/console/{Gemfile.lock,README.md,lib/oauth/providers.rb})

• Kept fork code:
  • the slackbotv2 OMP-viewer export command, ompViewerUrl and the OMP_MODEL footer
  • the sandbox OMP 17.0.5 install, OMP config/overlay materialization and GitHub App token refresh
• Took upstream's version bumps, the iron-proxy 0.54.0 image, the sandbox harness build from the root workspace, and the Microsoft provider entry.

Validation (local, merge commit ad9fb9b6)

• git diff --check (base→merge) is clean, and no conflict markers remain. Parents are 24921080 and 6a4c7c11.
• .github/scripts/check-migration-order.sh 24921080 passes. A separate byte-compare against old-path main confirms all 71 released migration, search and override files are unchanged and that there are no duplicate versions.
• Rust, run from the root workspace:
  • cargo fmt --all --check (stable and nightly) is clean.
  • cargo clippy --locked --workspace --all-targets -D warnings is clean.
  • The CI rust-api workspace group passes, as do:
    • session-runtime DB tests: 152, on PG16 + pgvector
    • session-sqlx on plain PG16 + pgvector: 27 + 11 + 1 + 5 + 2
    • absurd-sdk DB tests: 7
    • harness-server: 156 unit + 40 stdio (4 ignored) + 1 pi
    • unit tests in company-context, console-db and active-record-encryption
  • Conformance-workspace fmt, clippy and tests pass.
• slackbotv2: bun test gives 320 pass, 1 skip. tsgo is clean. githubbot gives 123 pass and its typecheck is clean.
• pnpm install --frozen-lockfile passes.
• Sandbox pytest (29) passes. company_context tool tests and slack client tests (88) pass.
• helm lint and helm template pass, including tokenBroker, derived-DB-URL and repo-cache variants. actionlint and YAML/JSON parsing pass.
• Not covered locally:
  • company-context DB tests need pg_search.
  • console-db, proxy-sync and token-broker integration tests need the Rails console schema; those crates are byte-identical to upstream.
  • The kind e2e is skipped on the fork.
  • check-migration-order.sh skips its base comparison on this PR because the base keeps migrations at the old path; the byte-compare above covers it.
• ci.yml was dispatched on sync/upstream-main.

Recovery re-validation (repair re-run)

On the repair re-run, the remote head ad9fb9b6 was found and handled as a recovered prior attempt, so it was not overwritten. In a fresh clone:

• Both refs are unchanged: main is 24921080 and upstream is 6a4c7c11.
• ad9fb9b6 is a merge commit whose parents are exactly those two.
• git diff --check is clean and no conflict markers remain.

Targeted checks were re-run on that commit:

• Migrations: check-migration-order.sh passes.
• Rust: cargo fmt --check and clippy --locked --workspace --all-targets -D warnings are clean. Tests pass for:
  • absurd-sdk (7)
  • session-sqlx on PG16 + pgvector (27, 11, 1, 5, 2)
  • the rust-api workspace group
  • session-runtime DB tests (152)
  • harness-server (156 + 40 + 1)
  • company-context unit tests (65)
• JS:
  • pnpm install --frozen-lockfile passes.
  • slackbotv2: 320 pass and 1 skip, with types clean.
  • githubbot: 123 pass, with types clean.
• Sandbox: bash -n entrypoint.sh passes, and pytest passes (29).
• Chart: helm lint and helm template pass, and the workflow, chart and schema files parse.

ci.yml was dispatched again on sync/upstream-main.