chore(upstream): sync 2026-08-27

[berghtho]

Batch

Previous integrated upstream SHA: a3a8cbd60539b4af4de8f96c892dbd07a2b6c041

New integrated upstream SHA: 230c5d4a5cc31656de3d46719e7f4d2a13369991

Upstream commits:

• 33b650a5b feat(ci): download macOS preview DMGs without signing in (upstream #8243)
• f925d6394 fix(codex): accept Codex 0.150 multi-agent events (upstream #8346)
• d3c24a14b chore(release): prepare v0.0.35
• ead4ce52a fix(grok): improve skills, plans, usage, and turn reliability (upstream #8358)
• 230c5d4a5 fix(server): recover stale Codex approval callbacks (upstream #5195)

Risk And Review

Medium functional risk: provider/orchestration and shared ACP behavior, usage wire contracts, generated Codex schemas, web/mobile usage presentation, and provider approval recovery changed. Low current publication risk: the incoming macOS preview workflow and release metadata remain inert because repository Actions is disabled, and the first-release identity gate remains unchanged.

Review confirmed:

• The Lead Agent remains a presentation-only, provider-agnostic Riker boundary.
• T3 still sends only branded projectId; server-side canonical project resolution, Owner Gateway project isolation, authentication, protocol versioning, and sanitized errors are unchanged.
• No stock provider/model enum controls Riker Native Harness selection. Copilot remains available under Riker Model Policy despite stock T3 having no Copilot adapter.
• Grok/ACP behavior remains inside stock provider sessions and does not acquire Riker Command Authority.
• Codex 0.150 generated values match the intended schema delta, and stale Codex approval errors normalize at the provider-neutral reactor boundary.
• Web and mobile both expose the new Grok usage provider; desktop inherits the web surface.
• No persistence migration, cloud resource, credential decision, upstream publication target, or release authorization was introduced.

The review found one stop condition before publication: a v4 remote client could not decode a v5 summary containing the new grok literal. Commit 4103e3138 adds explicit response-version negotiation. Current web/mobile clients advertise v5; requests without that field receive a v4-labeled Claude/Codex-only summary. Focused tests model both v5-client/v4-server and v4-client/v5-server skew.

Conflicts

There were no textual merge conflicts. apps/desktop/package.json changed on both sides on separate lines; the result retains the fork's Electron 41.10.3 update and applies upstream's 0.0.35 version bump. Fork-owned Riker and governance files were unchanged.

Capability Delta

The batch adds Grok skills, reasoning controls, plan capture, usage reporting, permission reliability, and stalled-turn recovery; accepts Codex 0.150 multi-agent events; and recovers stale Codex approval callbacks. It removes or narrows no provider capability. Riker Native Harness policy remains outside stock provider enums, including Copilot support.

Verification

All commands ran in isolated execution checkouts with scrubbed credentials. Package installation produced no tracked diff.

• vp test run packages/contracts/src/leadAgent.test.ts apps/server/src/riker/LeadAgentProjectResolver.test.ts apps/server/src/riker/RikerOwnerGateway.test.ts apps/server/src/riker/LeadAgentBridge.test.ts - 25 passed
• vp test run apps/server/src/server.test.ts -t "Lead Agent" - 2 passed
• Focused provider/orchestration tests for ProviderCommandReactor, GrokSkills, GrokAdapter, GrokProvider, AcpJsonRpcConnection, AcpRuntimeModel, GrokAcpSupport, and XAiAcpExtension - passed on supported platforms
• GrokAcpCliProbe.test.ts - 5 real-provider tests intentionally skipped
• vp test run packages/contracts/src/usage.test.ts apps/server/src/usage/usageScanCache.test.ts apps/server/src/usage/usageTranscripts.test.ts packages/shared/src/usageMerge.test.ts - 50 passed
• vp test run packages/effect-codex-app-server/src/schema.test.ts packages/effect-codex-app-server/src/client.test.ts packages/effect-codex-app-server/src/protocol.test.ts - 12 passed
• vp test run apps/web/src/components/usage/UsageProviderChart.test.ts - 11 passed
• vp run --filter @t3tools/contracts typecheck - passed
• vp run --filter t3 typecheck - passed
• vp run --filter @t3tools/web typecheck - passed
• vp run --filter @t3tools/mobile typecheck - passed
• vp run --filter effect-codex-app-server typecheck - passed
• Targeted vp lint --report-unused-disable-directives and vp fmt --check across all 38 changed TypeScript/TSX files - passed with no errors
• git diff --check - passed

Windows cannot spawn the unchanged POSIX fake-grok.sh fixture (EFTYPE), so the affected Grok suite was also run in isolated WSL2 Ubuntu: 85 passed, 0 failed, with the 5 opt-in real-provider probes skipped. Across supported platforms, 274 tests passed and 0 failed.

Repository Actions remained disabled throughout. All branches, commits, and this pull request target only berghtho/t3code; pingdotgg/t3code was fetch-only.

Model: GPT-5.6 Sol. Native Harness: OpenCode.

[berghtho]

Batch

Previous integrated upstream SHA: a3a8cbd60539b4af4de8f96c892dbd07a2b6c041

New integrated upstream SHA: 230c5d4a5cc31656de3d46719e7f4d2a13369991

Upstream commits:

• 33b650a5b feat(ci): download macOS preview DMGs without signing in (upstream #8243)
• f925d6394 fix(codex): accept Codex 0.150 multi-agent events (upstream #8346)
• d3c24a14b chore(release): prepare v0.0.35
• ead4ce52a fix(grok): improve skills, plans, usage, and turn reliability (upstream #8358)
• 230c5d4a5 fix(server): recover stale Codex approval callbacks (upstream #5195)

Risk And Review

Medium functional risk: provider/orchestration and shared ACP behavior, usage wire contracts, generated Codex schemas, web/mobile usage presentation, and provider approval recovery changed. Low current publication risk: the incoming macOS preview workflow and release metadata remain inert because repository Actions is disabled, and the first-release identity gate remains unchanged.

Review confirmed:

• The Lead Agent remains a presentation-only, provider-agnostic Riker boundary.
• T3 still sends only branded projectId; server-side canonical project resolution, Owner Gateway project isolation, authentication, protocol versioning, and sanitized errors are unchanged.
• No stock provider/model enum controls Riker Native Harness selection. Copilot remains available under Riker Model Policy despite stock T3 having no Copilot adapter.
• Grok/ACP behavior remains inside stock provider sessions and does not acquire Riker Command Authority.
• Codex 0.150 generated values match the intended schema delta, and stale Codex approval errors normalize at the provider-neutral reactor boundary.
• Web and mobile both expose the new Grok usage provider; desktop inherits the web surface.
• No persistence migration, cloud resource, credential decision, upstream publication target, or release authorization was introduced.

The review found one stop condition before publication: a v4 remote client could not decode a v5 summary containing the new grok literal. Commit 4103e3138 adds explicit response-version negotiation. Current web/mobile clients advertise v5; requests without that field receive a v4-labeled Claude/Codex-only summary. Focused tests model both v5-client/v4-server and v4-client/v5-server skew.

Conflicts

There were no textual merge conflicts. apps/desktop/package.json changed on both sides on separate lines; the result retains the fork's Electron 41.10.3 update and applies upstream's 0.0.35 version bump. Fork-owned Riker and governance files were unchanged.

Capability Delta

The batch adds Grok skills, reasoning controls, plan capture, usage reporting, permission reliability, and stalled-turn recovery; accepts Codex 0.150 multi-agent events; and recovers stale Codex approval callbacks. It removes or narrows no provider capability. Riker Native Harness policy remains outside stock provider enums, including Copilot support.

Verification

All commands ran in isolated execution checkouts with scrubbed credentials. Package installation produced no tracked diff.

• vp test run packages/contracts/src/leadAgent.test.ts apps/server/src/riker/LeadAgentProjectResolver.test.ts apps/server/src/riker/RikerOwnerGateway.test.ts apps/server/src/riker/LeadAgentBridge.test.ts - 25 passed
• vp test run apps/server/src/server.test.ts -t "Lead Agent" - 2 passed
• Focused provider/orchestration tests for ProviderCommandReactor, GrokSkills, GrokAdapter, GrokProvider, AcpJsonRpcConnection, AcpRuntimeModel, GrokAcpSupport, and XAiAcpExtension - passed on supported platforms
• GrokAcpCliProbe.test.ts - 5 real-provider tests intentionally skipped
• vp test run packages/contracts/src/usage.test.ts apps/server/src/usage/usageScanCache.test.ts apps/server/src/usage/usageTranscripts.test.ts packages/shared/src/usageMerge.test.ts - 50 passed
• vp test run packages/effect-codex-app-server/src/schema.test.ts packages/effect-codex-app-server/src/client.test.ts packages/effect-codex-app-server/src/protocol.test.ts - 12 passed
• vp test run apps/web/src/components/usage/UsageProviderChart.test.ts - 11 passed
• vp run --filter @t3tools/contracts typecheck - passed
• vp run --filter t3 typecheck - passed
• vp run --filter @t3tools/web typecheck - passed
• vp run --filter @t3tools/mobile typecheck - passed
• vp run --filter effect-codex-app-server typecheck - passed
• Targeted vp lint --report-unused-disable-directives and vp fmt --check across all 38 changed TypeScript/TSX files - passed with no errors
• git diff --check - passed

Windows cannot spawn the unchanged POSIX fake-grok.sh fixture (EFTYPE), so the affected Grok suite was also run in isolated WSL2 Ubuntu: 85 passed, 0 failed, with the 5 opt-in real-provider probes skipped. Across supported platforms, 274 tests passed and 0 failed.

Repository Actions remained disabled throughout. All branches, commits, and this pull request target only berghtho/t3code; pingdotgg/t3code was fetch-only.

Model: GPT-5.6 Sol. Native Harness: OpenCode.

[berghtho]

Batch

Previous integrated upstream SHA: a3a8cbd60539b4af4de8f96c892dbd07a2b6c041

New integrated upstream SHA: 230c5d4a5cc31656de3d46719e7f4d2a13369991

Upstream commits:

• 33b650a5b feat(ci): download macOS preview DMGs without signing in (upstream #8243)
• f925d6394 fix(codex): accept Codex 0.150 multi-agent events (upstream #8346)
• d3c24a14b chore(release): prepare v0.0.35
• ead4ce52a fix(grok): improve skills, plans, usage, and turn reliability (upstream #8358)
• 230c5d4a5 fix(server): recover stale Codex approval callbacks (upstream #5195)

Risk And Review

Medium functional risk: provider/orchestration and shared ACP behavior, usage wire contracts, generated Codex schemas, web/mobile usage presentation, and provider approval recovery changed. Low current publication risk: the incoming macOS preview workflow and release metadata remain inert because repository Actions is disabled, and the first-release identity gate remains unchanged.

Review confirmed:

• The Lead Agent remains a presentation-only, provider-agnostic Riker boundary.
• T3 still sends only branded projectId; server-side canonical project resolution, Owner Gateway project isolation, authentication, protocol versioning, and sanitized errors are unchanged.
• No stock provider/model enum controls Riker Native Harness selection. Copilot remains available under Riker Model Policy despite stock T3 having no Copilot adapter.
• Grok/ACP behavior remains inside stock provider sessions and does not acquire Riker Command Authority.
• Codex 0.150 generated values match the intended schema delta, and stale Codex approval errors normalize at the provider-neutral reactor boundary.
• Web and mobile both expose the new Grok usage provider; desktop inherits the web surface.
• No persistence migration, cloud resource, credential decision, upstream publication target, or release authorization was introduced.

The review found one stop condition before publication: a v4 remote client could not decode a v5 summary containing the new grok literal. Commit 4103e3138 adds explicit response-version negotiation. Current web/mobile clients advertise v5; requests without that field receive a v4-labeled Claude/Codex-only summary. Focused tests model both v5-client/v4-server and v4-client/v5-server skew.

Conflicts

There were no textual merge conflicts. apps/desktop/package.json changed on both sides on separate lines; the result retains the fork's Electron 41.10.3 update and applies upstream's 0.0.35 version bump. Fork-owned Riker and governance files were unchanged.

Capability Delta

The batch adds Grok skills, reasoning controls, plan capture, usage reporting, permission reliability, and stalled-turn recovery; accepts Codex 0.150 multi-agent events; and recovers stale Codex approval callbacks. It removes or narrows no provider capability. Riker Native Harness policy remains outside stock provider enums, including Copilot support.

Verification

All commands ran in isolated execution checkouts with scrubbed credentials. Package installation produced no tracked diff.

• vp test run packages/contracts/src/leadAgent.test.ts apps/server/src/riker/LeadAgentProjectResolver.test.ts apps/server/src/riker/RikerOwnerGateway.test.ts apps/server/src/riker/LeadAgentBridge.test.ts - 25 passed
• vp test run apps/server/src/server.test.ts -t "Lead Agent" - 2 passed
• Focused provider/orchestration tests for ProviderCommandReactor, GrokSkills, GrokAdapter, GrokProvider, AcpJsonRpcConnection, AcpRuntimeModel, GrokAcpSupport, and XAiAcpExtension - passed on supported platforms
• GrokAcpCliProbe.test.ts - 5 real-provider tests intentionally skipped
• vp test run packages/contracts/src/usage.test.ts apps/server/src/usage/usageScanCache.test.ts apps/server/src/usage/usageTranscripts.test.ts packages/shared/src/usageMerge.test.ts - 50 passed
• vp test run packages/effect-codex-app-server/src/schema.test.ts packages/effect-codex-app-server/src/client.test.ts packages/effect-codex-app-server/src/protocol.test.ts - 12 passed
• vp test run apps/web/src/components/usage/UsageProviderChart.test.ts - 11 passed
• vp run --filter @t3tools/contracts typecheck - passed
• vp run --filter t3 typecheck - passed
• vp run --filter @t3tools/web typecheck - passed
• vp run --filter @t3tools/mobile typecheck - passed
• vp run --filter effect-codex-app-server typecheck - passed
• Targeted vp lint --report-unused-disable-directives and vp fmt --check across all 38 changed TypeScript/TSX files - passed with no errors
• git diff --check - passed

Windows cannot spawn the unchanged POSIX fake-grok.sh fixture (EFTYPE), so the affected Grok suite was also run in isolated WSL2 Ubuntu: 85 passed, 0 failed, with the 5 opt-in real-provider probes skipped. Across supported platforms, 274 tests passed and 0 failed.

Repository Actions remained disabled throughout. All branches, commits, and this pull request target only berghtho/t3code; pingdotgg/t3code was fetch-only.

Model: GPT-5.6 Sol. Native Harness: OpenCode.

[berghtho]

Batch

Previous integrated upstream SHA: a3a8cbd60539b4af4de8f96c892dbd07a2b6c041

New integrated upstream SHA: 230c5d4a5cc31656de3d46719e7f4d2a13369991

Upstream commits:

• 33b650a5b feat(ci): download macOS preview DMGs without signing in (upstream #8243)
• f925d6394 fix(codex): accept Codex 0.150 multi-agent events (upstream #8346)
• d3c24a14b chore(release): prepare v0.0.35
• ead4ce52a fix(grok): improve skills, plans, usage, and turn reliability (upstream #8358)
• 230c5d4a5 fix(server): recover stale Codex approval callbacks (upstream #5195)

Risk And Review

Medium functional risk: provider/orchestration and shared ACP behavior, usage wire contracts, generated Codex schemas, web/mobile usage presentation, and provider approval recovery changed. Low current publication risk: the incoming macOS preview workflow and release metadata remain inert because repository Actions is disabled, and the first-release identity gate remains unchanged.

Review confirmed:

• The Lead Agent remains a presentation-only, provider-agnostic Riker boundary.
• T3 still sends only branded projectId; server-side canonical project resolution, Owner Gateway project isolation, authentication, protocol versioning, and sanitized errors are unchanged.
• No stock provider/model enum controls Riker Native Harness selection. Copilot remains available under Riker Model Policy despite stock T3 having no Copilot adapter.
• Grok/ACP behavior remains inside stock provider sessions and does not acquire Riker Command Authority.
• Codex 0.150 generated values match the intended schema delta, and stale Codex approval errors normalize at the provider-neutral reactor boundary.
• Web and mobile both expose the new Grok usage provider; desktop inherits the web surface.
• No persistence migration, cloud resource, credential decision, upstream publication target, or release authorization was introduced.

The review found one stop condition before publication: a v4 remote client could not decode a v5 summary containing the new grok literal. Commit 4103e3138 adds explicit response-version negotiation. Current web/mobile clients advertise v5; requests without that field receive a v4-labeled Claude/Codex-only summary. Focused tests model both v5-client/v4-server and v4-client/v5-server skew.

Conflicts

There were no textual merge conflicts. apps/desktop/package.json changed on both sides on separate lines; the result retains the fork's Electron 41.10.3 update and applies upstream's 0.0.35 version bump. Fork-owned Riker and governance files were unchanged.

Capability Delta

The batch adds Grok skills, reasoning controls, plan capture, usage reporting, permission reliability, and stalled-turn recovery; accepts Codex 0.150 multi-agent events; and recovers stale Codex approval callbacks. It removes or narrows no provider capability. Riker Native Harness policy remains outside stock provider enums, including Copilot support.

Verification

All commands ran in isolated execution checkouts with scrubbed credentials. Package installation produced no tracked diff.

• vp test run packages/contracts/src/leadAgent.test.ts apps/server/src/riker/LeadAgentProjectResolver.test.ts apps/server/src/riker/RikerOwnerGateway.test.ts apps/server/src/riker/LeadAgentBridge.test.ts - 25 passed
• vp test run apps/server/src/server.test.ts -t "Lead Agent" - 2 passed
• Focused provider/orchestration tests for ProviderCommandReactor, GrokSkills, GrokAdapter, GrokProvider, AcpJsonRpcConnection, AcpRuntimeModel, GrokAcpSupport, and XAiAcpExtension - passed on supported platforms
• GrokAcpCliProbe.test.ts - 5 real-provider tests intentionally skipped
• vp test run packages/contracts/src/usage.test.ts apps/server/src/usage/usageScanCache.test.ts apps/server/src/usage/usageTranscripts.test.ts packages/shared/src/usageMerge.test.ts - 50 passed
• vp test run packages/effect-codex-app-server/src/schema.test.ts packages/effect-codex-app-server/src/client.test.ts packages/effect-codex-app-server/src/protocol.test.ts - 12 passed
• vp test run apps/web/src/components/usage/UsageProviderChart.test.ts - 11 passed
• vp run --filter @t3tools/contracts typecheck - passed
• vp run --filter t3 typecheck - passed
• vp run --filter @t3tools/web typecheck - passed
• vp run --filter @t3tools/mobile typecheck - passed
• vp run --filter effect-codex-app-server typecheck - passed
• Targeted vp lint --report-unused-disable-directives and vp fmt --check across all 38 changed TypeScript/TSX files - passed with no errors
• git diff --check - passed

Windows cannot spawn the unchanged POSIX fake-grok.sh fixture (EFTYPE), so the affected Grok suite was also run in isolated WSL2 Ubuntu: 85 passed, 0 failed, with the 5 opt-in real-provider probes skipped. Across supported platforms, 274 tests passed and 0 failed.

Repository Actions remained disabled throughout. All branches, commits, and this pull request target only berghtho/t3code; pingdotgg/t3code was fetch-only.

Model: GPT-5.6 Sol. Native Harness: OpenCode.

[berghtho]

Batch

Previous integrated upstream SHA: a3a8cbd60539b4af4de8f96c892dbd07a2b6c041

New integrated upstream SHA: 230c5d4a5cc31656de3d46719e7f4d2a13369991

Upstream commits:

• 33b650a5b feat(ci): download macOS preview DMGs without signing in (upstream #8243)
• f925d6394 fix(codex): accept Codex 0.150 multi-agent events (upstream #8346)
• d3c24a14b chore(release): prepare v0.0.35
• ead4ce52a fix(grok): improve skills, plans, usage, and turn reliability (upstream #8358)
• 230c5d4a5 fix(server): recover stale Codex approval callbacks (upstream #5195)

Risk And Review

Medium functional risk: provider/orchestration and shared ACP behavior, usage wire contracts, generated Codex schemas, web/mobile usage presentation, and provider approval recovery changed. Low current publication risk: the incoming macOS preview workflow and release metadata remain inert because repository Actions is disabled, and the first-release identity gate remains unchanged.

Review confirmed:

• The Lead Agent remains a presentation-only, provider-agnostic Riker boundary.
• T3 still sends only branded projectId; server-side canonical project resolution, Owner Gateway project isolation, authentication, protocol versioning, and sanitized errors are unchanged.
• No stock provider/model enum controls Riker Native Harness selection. Copilot remains available under Riker Model Policy despite stock T3 having no Copilot adapter.
• Grok/ACP behavior remains inside stock provider sessions and does not acquire Riker Command Authority.
• Codex 0.150 generated values match the intended schema delta, and stale Codex approval errors normalize at the provider-neutral reactor boundary.
• Web and mobile both expose the new Grok usage provider; desktop inherits the web surface.
• No persistence migration, cloud resource, credential decision, upstream publication target, or release authorization was introduced.

The review found one stop condition before publication: a v4 remote client could not decode a v5 summary containing the new grok literal. Commit 4103e3138 adds explicit response-version negotiation. Current web/mobile clients advertise v5; requests without that field receive a v4-labeled Claude/Codex-only summary. Focused tests model both v5-client/v4-server and v4-client/v5-server skew.

Conflicts

There were no textual merge conflicts. apps/desktop/package.json changed on both sides on separate lines; the result retains the fork's Electron 41.10.3 update and applies upstream's 0.0.35 version bump. Fork-owned Riker and governance files were unchanged.

Capability Delta

The batch adds Grok skills, reasoning controls, plan capture, usage reporting, permission reliability, and stalled-turn recovery; accepts Codex 0.150 multi-agent events; and recovers stale Codex approval callbacks. It removes or narrows no provider capability. Riker Native Harness policy remains outside stock provider enums, including Copilot support.

Verification

All commands ran in isolated execution checkouts with scrubbed credentials. Package installation produced no tracked diff.

• vp test run packages/contracts/src/leadAgent.test.ts apps/server/src/riker/LeadAgentProjectResolver.test.ts apps/server/src/riker/RikerOwnerGateway.test.ts apps/server/src/riker/LeadAgentBridge.test.ts - 25 passed
• vp test run apps/server/src/server.test.ts -t "Lead Agent" - 2 passed
• Focused provider/orchestration tests for ProviderCommandReactor, GrokSkills, GrokAdapter, GrokProvider, AcpJsonRpcConnection, AcpRuntimeModel, GrokAcpSupport, and XAiAcpExtension - passed on supported platforms
• GrokAcpCliProbe.test.ts - 5 real-provider tests intentionally skipped
• vp test run packages/contracts/src/usage.test.ts apps/server/src/usage/usageScanCache.test.ts apps/server/src/usage/usageTranscripts.test.ts packages/shared/src/usageMerge.test.ts - 50 passed
• vp test run packages/effect-codex-app-server/src/schema.test.ts packages/effect-codex-app-server/src/client.test.ts packages/effect-codex-app-server/src/protocol.test.ts - 12 passed
• vp test run apps/web/src/components/usage/UsageProviderChart.test.ts - 11 passed
• vp run --filter @t3tools/contracts typecheck - passed
• vp run --filter t3 typecheck - passed
• vp run --filter @t3tools/web typecheck - passed
• vp run --filter @t3tools/mobile typecheck - passed
• vp run --filter effect-codex-app-server typecheck - passed
• Targeted vp lint --report-unused-disable-directives and vp fmt --check across all 38 changed TypeScript/TSX files - passed with no errors
• git diff --check - passed

Windows cannot spawn the unchanged POSIX fake-grok.sh fixture (EFTYPE), so the affected Grok suite was also run in isolated WSL2 Ubuntu: 85 passed, 0 failed, with the 5 opt-in real-provider probes skipped. Across supported platforms, 274 tests passed and 0 failed.

Repository Actions remained disabled throughout. All branches, commits, and this pull request target only berghtho/t3code; pingdotgg/t3code was fetch-only.

Model: GPT-5.6 Sol. Native Harness: OpenCode.

[berghtho]

Batch

Previous integrated upstream SHA: a3a8cbd60539b4af4de8f96c892dbd07a2b6c041

New integrated upstream SHA: 230c5d4a5cc31656de3d46719e7f4d2a13369991

Upstream commits:

• 33b650a5b feat(ci): download macOS preview DMGs without signing in (upstream #8243)
• f925d6394 fix(codex): accept Codex 0.150 multi-agent events (upstream #8346)
• d3c24a14b chore(release): prepare v0.0.35
• ead4ce52a fix(grok): improve skills, plans, usage, and turn reliability (upstream #8358)
• 230c5d4a5 fix(server): recover stale Codex approval callbacks (upstream #5195)

Risk And Review

Medium functional risk: provider/orchestration and shared ACP behavior, usage wire contracts, generated Codex schemas, web/mobile usage presentation, and provider approval recovery changed. Low current publication risk: the incoming macOS preview workflow and release metadata remain inert because repository Actions is disabled, and the first-release identity gate remains unchanged.

Review confirmed:

• The Lead Agent remains a presentation-only, provider-agnostic Riker boundary.
• T3 still sends only branded projectId; server-side canonical project resolution, Owner Gateway project isolation, authentication, protocol versioning, and sanitized errors are unchanged.
• No stock provider/model enum controls Riker Native Harness selection. Copilot remains available under Riker Model Policy despite stock T3 having no Copilot adapter.
• Grok/ACP behavior remains inside stock provider sessions and does not acquire Riker Command Authority.
• Codex 0.150 generated values match the intended schema delta, and stale Codex approval errors normalize at the provider-neutral reactor boundary.
• Web and mobile both expose the new Grok usage provider; desktop inherits the web surface.
• No persistence migration, cloud resource, credential decision, upstream publication target, or release authorization was introduced.

The review found one stop condition before publication: a v4 remote client could not decode a v5 summary containing the new grok literal. Commit 4103e3138 adds explicit response-version negotiation. Current web/mobile clients advertise v5; requests without that field receive a v4-labeled Claude/Codex-only summary. Focused tests model both v5-client/v4-server and v4-client/v5-server skew.

Conflicts

There were no textual merge conflicts. apps/desktop/package.json changed on both sides on separate lines; the result retains the fork's Electron 41.10.3 update and applies upstream's 0.0.35 version bump. Fork-owned Riker and governance files were unchanged.

Capability Delta

The batch adds Grok skills, reasoning controls, plan capture, usage reporting, permission reliability, and stalled-turn recovery; accepts Codex 0.150 multi-agent events; and recovers stale Codex approval callbacks. It removes or narrows no provider capability. Riker Native Harness policy remains outside stock provider enums, including Copilot support.

Verification

All commands ran in isolated execution checkouts with scrubbed credentials. Package installation produced no tracked diff.

• vp test run packages/contracts/src/leadAgent.test.ts apps/server/src/riker/LeadAgentProjectResolver.test.ts apps/server/src/riker/RikerOwnerGateway.test.ts apps/server/src/riker/LeadAgentBridge.test.ts - 25 passed
• vp test run apps/server/src/server.test.ts -t "Lead Agent" - 2 passed
• Focused provider/orchestration tests for ProviderCommandReactor, GrokSkills, GrokAdapter, GrokProvider, AcpJsonRpcConnection, AcpRuntimeModel, GrokAcpSupport, and XAiAcpExtension - passed on supported platforms
• GrokAcpCliProbe.test.ts - 5 real-provider tests intentionally skipped
• vp test run packages/contracts/src/usage.test.ts apps/server/src/usage/usageScanCache.test.ts apps/server/src/usage/usageTranscripts.test.ts packages/shared/src/usageMerge.test.ts - 50 passed
• vp test run packages/effect-codex-app-server/src/schema.test.ts packages/effect-codex-app-server/src/client.test.ts packages/effect-codex-app-server/src/protocol.test.ts - 12 passed
• vp test run apps/web/src/components/usage/UsageProviderChart.test.ts - 11 passed
• vp run --filter @t3tools/contracts typecheck - passed
• vp run --filter t3 typecheck - passed
• vp run --filter @t3tools/web typecheck - passed
• vp run --filter @t3tools/mobile typecheck - passed
• vp run --filter effect-codex-app-server typecheck - passed
• Targeted vp lint --report-unused-disable-directives and vp fmt --check across all 38 changed TypeScript/TSX files - passed with no errors
• git diff --check - passed

Windows cannot spawn the unchanged POSIX fake-grok.sh fixture (EFTYPE), so the affected Grok suite was also run in isolated WSL2 Ubuntu: 85 passed, 0 failed, with the 5 opt-in real-provider probes skipped. Across supported platforms, 274 tests passed and 0 failed.

Repository Actions remained disabled throughout. All branches, commits, and this pull request target only berghtho/t3code; pingdotgg/t3code was fetch-only.

Model: GPT-5.6 Sol. Native Harness: OpenCode.

[berghtho]

Batch

Previous integrated upstream SHA: a3a8cbd60539b4af4de8f96c892dbd07a2b6c041

New integrated upstream SHA: 230c5d4a5cc31656de3d46719e7f4d2a13369991

Upstream commits:

• 33b650a5b feat(ci): download macOS preview DMGs without signing in (upstream #8243)
• f925d6394 fix(codex): accept Codex 0.150 multi-agent events (upstream #8346)
• d3c24a14b chore(release): prepare v0.0.35
• ead4ce52a fix(grok): improve skills, plans, usage, and turn reliability (upstream #8358)
• 230c5d4a5 fix(server): recover stale Codex approval callbacks (upstream #5195)

Risk And Review

Medium functional risk: provider/orchestration and shared ACP behavior, usage wire contracts, generated Codex schemas, web/mobile usage presentation, and provider approval recovery changed. Low current publication risk: the incoming macOS preview workflow and release metadata remain inert because repository Actions is disabled, and the first-release identity gate remains unchanged.

Review confirmed:

• The Lead Agent remains a presentation-only, provider-agnostic Riker boundary.
• T3 still sends only branded projectId; server-side canonical project resolution, Owner Gateway project isolation, authentication, protocol versioning, and sanitized errors are unchanged.
• No stock provider/model enum controls Riker Native Harness selection. Copilot remains available under Riker Model Policy despite stock T3 having no Copilot adapter.
• Grok/ACP behavior remains inside stock provider sessions and does not acquire Riker Command Authority.
• Codex 0.150 generated values match the intended schema delta, and stale Codex approval errors normalize at the provider-neutral reactor boundary.
• Web and mobile both expose the new Grok usage provider; desktop inherits the web surface.
• No persistence migration, cloud resource, credential decision, upstream publication target, or release authorization was introduced.

The review found one stop condition before publication: a v4 remote client could not decode a v5 summary containing the new grok literal. Commit 4103e3138 adds explicit response-version negotiation. Current web/mobile clients advertise v5; requests without that field receive a v4-labeled Claude/Codex-only summary. Focused tests model both v5-client/v4-server and v4-client/v5-server skew.

Conflicts

There were no textual merge conflicts. apps/desktop/package.json changed on both sides on separate lines; the result retains the fork's Electron 41.10.3 update and applies upstream's 0.0.35 version bump. Fork-owned Riker and governance files were unchanged.

Capability Delta

The batch adds Grok skills, reasoning controls, plan capture, usage reporting, permission reliability, and stalled-turn recovery; accepts Codex 0.150 multi-agent events; and recovers stale Codex approval callbacks. It removes or narrows no provider capability. Riker Native Harness policy remains outside stock provider enums, including Copilot support.

Verification

All commands ran in isolated execution checkouts with scrubbed credentials. Package installation produced no tracked diff.

• vp test run packages/contracts/src/leadAgent.test.ts apps/server/src/riker/LeadAgentProjectResolver.test.ts apps/server/src/riker/RikerOwnerGateway.test.ts apps/server/src/riker/LeadAgentBridge.test.ts - 25 passed
• vp test run apps/server/src/server.test.ts -t "Lead Agent" - 2 passed
• Focused provider/orchestration tests for ProviderCommandReactor, GrokSkills, GrokAdapter, GrokProvider, AcpJsonRpcConnection, AcpRuntimeModel, GrokAcpSupport, and XAiAcpExtension - passed on supported platforms
• GrokAcpCliProbe.test.ts - 5 real-provider tests intentionally skipped
• vp test run packages/contracts/src/usage.test.ts apps/server/src/usage/usageScanCache.test.ts apps/server/src/usage/usageTranscripts.test.ts packages/shared/src/usageMerge.test.ts - 50 passed
• vp test run packages/effect-codex-app-server/src/schema.test.ts packages/effect-codex-app-server/src/client.test.ts packages/effect-codex-app-server/src/protocol.test.ts - 12 passed
• vp test run apps/web/src/components/usage/UsageProviderChart.test.ts - 11 passed
• vp run --filter @t3tools/contracts typecheck - passed
• vp run --filter t3 typecheck - passed
• vp run --filter @t3tools/web typecheck - passed
• vp run --filter @t3tools/mobile typecheck - passed
• vp run --filter effect-codex-app-server typecheck - passed
• Targeted vp lint --report-unused-disable-directives and vp fmt --check across all 38 changed TypeScript/TSX files - passed with no errors
• git diff --check - passed

Windows cannot spawn the unchanged POSIX fake-grok.sh fixture (EFTYPE), so the affected Grok suite was also run in isolated WSL2 Ubuntu: 85 passed, 0 failed, with the 5 opt-in real-provider probes skipped. Across supported platforms, 274 tests passed and 0 failed.

Repository Actions remained disabled throughout. All branches, commits, and this pull request target only berghtho/t3code; pingdotgg/t3code was fetch-only.

Model: GPT-5.6 Sol. Native Harness: OpenCode.

[berghtho]

Batch

Previous integrated upstream SHA: a3a8cbd60539b4af4de8f96c892dbd07a2b6c041

New integrated upstream SHA: 230c5d4a5cc31656de3d46719e7f4d2a13369991

Upstream commits:

• 33b650a5b feat(ci): download macOS preview DMGs without signing in (upstream #8243)
• f925d6394 fix(codex): accept Codex 0.150 multi-agent events (upstream #8346)
• d3c24a14b chore(release): prepare v0.0.35
• ead4ce52a fix(grok): improve skills, plans, usage, and turn reliability (upstream #8358)
• 230c5d4a5 fix(server): recover stale Codex approval callbacks (upstream #5195)

Risk And Review

Medium functional risk: provider/orchestration and shared ACP behavior, usage wire contracts, generated Codex schemas, web/mobile usage presentation, and provider approval recovery changed. Low current publication risk: the incoming macOS preview workflow and release metadata remain inert because repository Actions is disabled, and the first-release identity gate remains unchanged.

Review confirmed:

• The Lead Agent remains a presentation-only, provider-agnostic Riker boundary.
• T3 still sends only branded projectId; server-side canonical project resolution, Owner Gateway project isolation, authentication, protocol versioning, and sanitized errors are unchanged.
• No stock provider/model enum controls Riker Native Harness selection. Copilot remains available under Riker Model Policy despite stock T3 having no Copilot adapter.
• Grok/ACP behavior remains inside stock provider sessions and does not acquire Riker Command Authority.
• Codex 0.150 generated values match the intended schema delta, and stale Codex approval errors normalize at the provider-neutral reactor boundary.
• Web and mobile both expose the new Grok usage provider; desktop inherits the web surface.
• No persistence migration, cloud resource, credential decision, upstream publication target, or release authorization was introduced.

The review found one stop condition before publication: a v4 remote client could not decode a v5 summary containing the new grok literal. Commit 4103e3138 adds explicit response-version negotiation. Current web/mobile clients advertise v5; requests without that field receive a v4-labeled Claude/Codex-only summary. Focused tests model both v5-client/v4-server and v4-client/v5-server skew.

Conflicts

There were no textual merge conflicts. apps/desktop/package.json changed on both sides on separate lines; the result retains the fork's Electron 41.10.3 update and applies upstream's 0.0.35 version bump. Fork-owned Riker and governance files were unchanged.

Capability Delta

The batch adds Grok skills, reasoning controls, plan capture, usage reporting, permission reliability, and stalled-turn recovery; accepts Codex 0.150 multi-agent events; and recovers stale Codex approval callbacks. It removes or narrows no provider capability. Riker Native Harness policy remains outside stock provider enums, including Copilot support.

Verification

All commands ran in isolated execution checkouts with scrubbed credentials. Package installation produced no tracked diff.

• vp test run packages/contracts/src/leadAgent.test.ts apps/server/src/riker/LeadAgentProjectResolver.test.ts apps/server/src/riker/RikerOwnerGateway.test.ts apps/server/src/riker/LeadAgentBridge.test.ts - 25 passed
• vp test run apps/server/src/server.test.ts -t "Lead Agent" - 2 passed
• Focused provider/orchestration tests for ProviderCommandReactor, GrokSkills, GrokAdapter, GrokProvider, AcpJsonRpcConnection, AcpRuntimeModel, GrokAcpSupport, and XAiAcpExtension - passed on supported platforms
• GrokAcpCliProbe.test.ts - 5 real-provider tests intentionally skipped
• vp test run packages/contracts/src/usage.test.ts apps/server/src/usage/usageScanCache.test.ts apps/server/src/usage/usageTranscripts.test.ts packages/shared/src/usageMerge.test.ts - 50 passed
• vp test run packages/effect-codex-app-server/src/schema.test.ts packages/effect-codex-app-server/src/client.test.ts packages/effect-codex-app-server/src/protocol.test.ts - 12 passed
• vp test run apps/web/src/components/usage/UsageProviderChart.test.ts - 11 passed
• vp run --filter @t3tools/contracts typecheck - passed
• vp run --filter t3 typecheck - passed
• vp run --filter @t3tools/web typecheck - passed
• vp run --filter @t3tools/mobile typecheck - passed
• vp run --filter effect-codex-app-server typecheck - passed
• Targeted vp lint --report-unused-disable-directives and vp fmt --check across all 38 changed TypeScript/TSX files - passed with no errors
• git diff --check - passed

Windows cannot spawn the unchanged POSIX fake-grok.sh fixture (EFTYPE), so the affected Grok suite was also run in isolated WSL2 Ubuntu: 85 passed, 0 failed, with the 5 opt-in real-provider probes skipped. Across supported platforms, 274 tests passed and 0 failed.

Repository Actions remained disabled throughout. All branches, commits, and this pull request target only berghtho/t3code; pingdotgg/t3code was fetch-only.

Model: GPT-5.6 Sol. Native Harness: OpenCode.