-
Notifications
You must be signed in to change notification settings - Fork 22
docs(upstream): sync round 6 — advance baseline to 1e8c7e7 (2026-05-26) #88
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| { | ||
| "upstream": "affaan-m/everything-claude-code", | ||
| "lastSyncedSha": "3b7e0ba30a027ffd3319c2f145c63076c296d80a", | ||
| "lastSyncedAt": "2026-05-18", | ||
| "notes": "Round 5 sync. Triage and per-commit dispositions: upstream/sync-rounds/2026-05-18.md. The SHA is the last commit *evaluated* — not necessarily the last commit ported. No new EGC-authored ECC PR opens this round because the two PRs that landed during this window (ECC #1970 workflow-security validator + #1971 ecc-metrics-bridge cost fixes) were EGC-authored against the previous baseline and are now part of ECC main. Deferred net-new ECC features added to the queue: uncloud skill, recsys-pipeline-architect skill, Thai (th) locale, full Japanese (ja-JP) translation, installer --locale flag, TypeScript 6 + @types/node 25 bumps, Zed install target." | ||
| "lastSyncedSha": "1e8c7e7994223e0ff337d1626cd08e04a1ae67ed", | ||
| "lastSyncedAt": "2026-05-26", | ||
| "notes": "Round 6 sync. Triage and per-commit dispositions: upstream/sync-rounds/2026-05-26.md. The SHA is the last commit *evaluated* — not necessarily the last commit ported. No new EGC-authored ECC PR opens this round; two EGC-authored PRs that landed during this window (ECC #1982 Unicode Tag denylist in check-unicode-safety + ECC #1983 writeBridgeAtomic/writeWarnState atomic-write race) target ECC-only file surfaces and are not back-portable to EGC. One trivial clean-delete candidate filed for follow-up: 812d4d0 (delete skills/strategic-compact/suggest-compact.sh, unreferenced in EGC). Deferred net-new ECC features added to the queue: Blender motion-state inspection skill, harness-audit integration scoring extension (ECC #1990), continuous-learning-v2 project-registry maintenance." | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,110 @@ | ||
| # Upstream sync inventory — 2026-05-26 | ||
|
|
||
| Sixth sync round. 102 commits between baseline `3b7e0ba3` and HEAD `1e8c7e7`, dominated again by ECC release-readiness / billing-readback / AgentShield / Linear roadmap evidence logs with no EGC analogue. Two EGC-authored PRs landed upstream during this window (`#1982` Unicode Tag denylist, `#1983` `writeBridgeAtomic` race), both targeting ECC-only file surfaces; no EGC-side port follows because the surface does not exist here. One trivial clean-delete is the only candidate for a follow-up port PR; everything else is either out-of-surface, defer, or skip. | ||
|
|
||
| ## Range | ||
|
|
||
| - **Recorded baseline** in `upstream/.upstream-sync.json`: [`3b7e0ba3`](https://github.com/affaan-m/everything-claude-code/commit/3b7e0ba30a027ffd3319c2f145c63076c296d80a) (2026-05-18) — `docs: refresh catalog and operator dashboard` | ||
| - **Upstream HEAD at this round**: [`1e8c7e7`](https://github.com/affaan-m/everything-claude-code/commit/1e8c7e7994223e0ff337d1626cd08e04a1ae67ed) (2026-05-20) — `docs: sync live native payments gate evidence` | ||
|
|
||
| **Total drift**: 102 commits. | ||
|
|
||
| ## What was already in flight from EGC and now in ECC `main` | ||
|
|
||
| Two EGC-authored PRs landed during this window: | ||
|
|
||
| - ECC [PR #1982](https://github.com/affaan-m/everything-claude-code/pull/1982) `fix(ci): cover Unicode Tag block + other invisibles in check-unicode-safety (ASCII smuggling)` — merged across three commits (`e3483fd`, `b068069`, `33ed494`). Extends `scripts/ci/check-unicode-safety.js`'s denylist to cover the Unicode Tag block (`U+E0000–U+E007F`) — the canonical "ASCII smuggling" / "Tag Smuggling" LLM prompt-injection vector — plus six other widely-cited invisible code points (`U+180E`, `U+115F`, `U+1160`, `U+2061–U+2064`, `U+3164`). **Not back-portable to EGC** because `scripts/ci/check-unicode-safety.js` does not exist in EGC's port surface — the validator is ECC-only. If EGC adds a Unicode-safety validator in a future round, the denylist (eight ranges) is the canonical reference. | ||
|
|
||
| - ECC [PR #1983](https://github.com/affaan-m/everything-claude-code/pull/1983) `fix(lib/hooks): eliminate ENOENT + corruption race in writeBridgeAtomic and writeWarnState` — merged across six commits (`28548f6`, `7c2f713`, `5acb01a`, `d904edc`, `116e61d`, `f93e8f6`). Switches both atomic-write call sites to a per-process unique tmp suffix (eliminates concurrent-writer ENOENT races) and adds a Windows EPERM/EACCES/EBUSY rename retry via a shared `renameWithRetry` helper. **Not back-portable to EGC** because the `ecc-metrics-bridge` / `ecc-context-monitor` cost-observability surface does not exist in EGC — same surface-out-of-scope reasoning as round 5's PR #1971 disposition. | ||
|
|
||
| Net effect: two more high-value security/robustness fixes landed in ECC main during this window. Both originated as EGC-authored upstream contributions, both close on the ECC side, neither produces a downstream EGC port because the underlying file surface is ECC-only. | ||
|
|
||
| ## Per-bucket dispositions | ||
|
|
||
| | Bucket | Count | Disposition | | ||
| |---|---|---| | ||
| | E:shared-logic (EGC-authored, already in ECC) | 9 | **already upstream** — see "What was already in flight" above | | ||
| | A:docs/sync (May 18–20 readiness, billing readback, dashboard refresh, Linear/AgentShield/ECC-Tools, README rename, release supply-chain evidence) | 63 | **skip** — internal ECC release-prep telemetry / cosmetic README rename, no EGC analogue | | ||
| | A:chore (ECC 2.0 release machinery: video suite, owner approval packet, hypergrowth release lane, suite count evidence) | 8 | **skip** — release-pipeline specific to ECC | | ||
| | A:test (release/dashboard fixtures, Windows lifecycle, release-workflow line endings, insaits monitor, platform audit) | 6 | **skip** — paired with A:docs / release machinery | | ||
| | A:chore (release) — `7911af4` security: scope release oidc publishing | 1 | **skip** — ECC release workflow specific | | ||
| | A:skills (net-new) — `922d2d8` Blender motion-state inspection | 1 | **deferred** — community contribution; same disposition shape as round 5's `uncloud` / `recsys-pipeline-architect` | | ||
| | A:misc — `4d6fc19` include blender skill in install manifest | 1 | **paired with `922d2d8`** — defer together | | ||
| | A:skills (delete) — `812d4d0` delete `skills/strategic-compact/suggest-compact.sh` | 1 | **portable (small follow-up)** — clean `-54` LOC delete; EGC has the same leftover file and the `.sh` is unreferenced by any EGC code path | | ||
| | D:other-harness (claude-project install target) — `7004a66` `b2c2616` `98bd517` | 3 | **skip** — adapter installs ECC content into a per-project `.claude/` directory; EGC's install targets are Gemini CLI / Antigravity | | ||
| | D:other-harness (gateguard) — `14d88e5` preserve quoted git introspection args | 1 | **skip** — `scripts/hooks/gateguard-fact-force.js` not in EGC's port surface (same shape as round 4's gateguard disposition) | | ||
| | X:fix (LLM providers) — `cc62e89` `eb0d893` `80f6c27` OpenAI / AstraFlow empty-choices guard | 3 | **skip** — `src/llm/providers/*.py` not in EGC's port surface | | ||
| | X:fix (MCP health-check) — `386326d` treat HTTP 406 probes as reachable | 1 | **skip** — `scripts/hooks/mcp-health-check.js` not in EGC | | ||
| | X:fix (IOC scanner) — `04d4d81` ignore defensive ioc deny rules | 1 | **skip** — `scripts/security/scan-supply-chain-iocs.js` not in EGC | | ||
| | X:hooks — `6cb194a` avoid escaped quotes in plugin bootstrap | 1 | **skip** — touches `scripts/lib/resolve-ecc-root.js`, which does not exist in EGC | | ||
| | X:feat — `af9b2c1` harness-audit integration scoring extension (#1990) | 1 | **deferred** — substantial rewrite (+214 LOC `scripts/harness-audit.js`, +192 LOC tests, +17 LOC `commands/harness-audit.md`). EGC has the script but the command lives in `.toml` form; needs adapter work | | ||
| | X:learning — `bc519e5` continuous-learning-v2 project registry maintenance | 1 | **deferred** — 757-line change. EGC has `observe.sh` + `instinct-cli.py` but no `detect-project.sh`; non-trivial adapter work | | ||
| | **Total** | **102** | | | ||
|
|
||
| ## Detailed dispositions (the non-skip subset) | ||
|
|
||
| | SHA | Subject | Disposition | | ||
| |---|---|---| | ||
| | `812d4d0` | `Delete skills/strategic-compact/suggest-compact.sh` | **portable** — EGC has the same leftover file at `skills/strategic-compact/suggest-compact.sh` (52 LOC `.sh`); EGC's actual runtime path uses `scripts/hooks/suggest-compact.js` (Node), referenced from `skills/strategic-compact/SKILL.md` and `tests/hooks/hooks.test.js`. The `.sh` is unused by any EGC code path — `rg suggest-compact.sh` returns zero hits outside the file itself. Clean candidate for a small follow-up PR (one-file delete + no test diff). | | ||
| | `922d2d8` | `Add Blender motion state inspection skill` | **deferred** — net-new community skill, same disposition as `uncloud` / `recsys-pipeline-architect` from round 5. Candidate for a future net-new-skills round. | | ||
| | `4d6fc19` | `fix: include blender skill in install manifest` | **paired with `922d2d8`** — defer together. | | ||
| | `af9b2c1` | `feat: extend harness audit integration scoring (#1990)` | **deferred** — scoring extension is genuinely useful (GitHub integration checks, CODEOWNERS coverage, dynamic applicable-category metadata) and EGC has `scripts/harness-audit.js`, but the commit assumes the ECC `.md` command-file shape that EGC has already translated to `.toml`. Port needs adapter work; better as a focused PR. | | ||
| | `bc519e5` | `fix(learning): add project registry maintenance` | **deferred** — large diff (706 additions / 51 deletions across 7 files). EGC's `continuous-learning-v2` skill is partially present (`observe.sh`, `instinct-cli.py`) but missing `detect-project.sh`. Adapter work non-trivial; defer to focused round. | | ||
| | `7004a66` `b2c2616` `98bd517` | `feat(install-targets): add claude-project adapter` + paired fix/test | **skip** — adapter installs ECC content into a per-project `.claude/` directory; EGC's install targets are Gemini CLI / Antigravity, never Claude Code. Permanent-skip absent a `gemini-project` analogue. | | ||
| | `cc62e89` `eb0d893` `80f6c27` `aa4ae86` | OpenAI / AstraFlow Python provider empty-choices guards | **skip** — `src/llm/providers/*.py` does not exist in EGC's port surface (EGC does not include the Python LLM-provider layer). | | ||
| | `386326d` | `fix: treat MCP HTTP 406 probes as reachable` | **skip** — `scripts/hooks/mcp-health-check.js` does not exist in EGC. | | ||
| | `04d4d81` | `fix: ignore defensive ioc deny rules` | **skip** — `scan-supply-chain-iocs.js` is not in EGC. | | ||
| | `6cb194a` | `fix(hooks): avoid escaped quotes in plugin bootstrap` | **skip** — touches `scripts/lib/resolve-ecc-root.js` and the inline `node -e` resolver embedded in `hooks/hooks.json`. EGC has neither `resolve-ecc-root.js` nor the embedded resolver pattern (EGC's hook commands shell out to script files directly). | | ||
| | `14d88e5` | `fix(gateguard): preserve quoted git introspection args` | **skip** — `scripts/hooks/gateguard-fact-force.js` is not in EGC's port surface (same as round 4's gateguard disposition). | | ||
| | `7911af4` | `security: scope release oidc publishing` | **skip** — ECC release workflow specific. | | ||
| | `9819626` | `Add release approval gate` | **skip** — ECC release machinery. | | ||
| | `bf17737` | `test: stabilize repair lifecycle on Windows` | **skip** — `tests/integration/repair-lifecycle.test.*` not in EGC. | | ||
|
|
||
|
coderabbitai[bot] marked this conversation as resolved.
Outdated
|
||
| ## Why no portable PR opens this round | ||
|
|
||
| Three patterns converge again: | ||
|
|
||
| 1. **The two high-value upstream-going fixes are already merged.** ECC PR #1982 (Unicode Tag) and #1983 (`writeBridgeAtomic` race) were EGC-authored against ECC's own surface — there is nothing left in those shapes to backport because the validator and the atomic-bridge writer do not exist in EGC. | ||
|
|
||
| 2. **The bulk of the window is operations log.** 78 of 102 commits are May 18–20 release readiness / billing readback / dashboard refresh / AgentShield / Linear roadmap evidence / video-suite chore / test-fixture refresh — internal ECC operations with no EGC analogue. | ||
|
|
||
| 3. **The remaining 24 commits are either EGC-authored upstream (9), out-of-surface fixes (9 across Claude-project install target, Python LLM providers, MCP health-check, gateguard, IOC scanner, plugin bootstrap resolver), or substantial enough to want a focused PR of their own (5 across harness-audit scoring, continuous-learning-v2 project registry, Blender skill bundle, the trivial `suggest-compact.sh` delete).** None of the substantial items fits a single sync-round PR. | ||
|
|
||
| The one trivial clean-delete (`812d4d0`) is portable and could be bundled with this baseline advance, but it is filed as a small follow-up so that a regression there does not block the baseline cycle. | ||
|
|
||
| ## Outcomes from this round | ||
|
|
||
| - **Baseline advanced** `3b7e0ba3` → `1e8c7e7`. Closes EGC tracker issue [#87](https://github.com/Jamkris/everything-gemini-code/issues/87) on the next `upstream-drift.yml` cron tick. | ||
| - **No new ECC PR opens from EGC this round.** Two EGC-authored PRs (#1982, #1983) merged during the window; both target ECC-only surface. | ||
| - **Net-new queue grows** with the Blender motion-state inspection skill and the harness-audit integration-scoring extension (#1990). | ||
| - **One trivial port candidate identified** (`812d4d0` clean-delete of `skills/strategic-compact/suggest-compact.sh`) — filed for a follow-up small PR. | ||
|
|
||
| ## Deferred net-new ECC features (carry forward) | ||
|
|
||
| New items added to the deferred queue this round: | ||
|
|
||
| - Blender motion-state inspection skill (community contribution) | ||
| - Harness-audit integration scoring extension (ECC PR #1990) — GitHub-integration checks, CODEOWNERS coverage, dynamic applicable-category metadata | ||
| - `continuous-learning-v2` project-registry maintenance — pending `detect-project.sh` decision in EGC | ||
|
|
||
| Carried over from prior rounds (still deferred): | ||
|
|
||
| - `uncloud` skill (community contribution, round 5) | ||
| - `recsys-pipeline-architect` skill (community contribution, round 5) | ||
| - Thai (`th`) README + docs locale (round 5) | ||
| - Japanese (`ja-JP`) full documentation translation (round 5) | ||
| - Installer `--locale` flag for selective translated-docs installation (round 5) | ||
| - TypeScript 6 + @types/node 25 toolchain bumps (round 5) | ||
| - Zed install target (round 5; most likely permanent-skip) | ||
| - All items still pending from rounds 1–4 | ||
|
|
||
| ## Baseline advance | ||
|
|
||
| - **Before**: `3b7e0ba3` (2026-05-18) | ||
| - **After**: `1e8c7e7` (2026-05-21) | ||
|
coderabbitai[bot] marked this conversation as resolved.
Outdated
cubic-dev-ai[bot] marked this conversation as resolved.
Outdated
|
||
|
|
||
| Baseline files updated in the same commit set: | ||
| - `upstream/.upstream-sync.json` — `lastSyncedSha` / `lastSyncedAt` / `notes` | ||
| - `upstream/README.md` — Baseline badge, last-synced commit link, last-synced date, round-notes pointer list | ||
|
|
||
| Localised mirrors (`upstream/ko-KR/`, `upstream/zh-CN/`) follow the same baseline. As with rounds 4 and 5, this round's per-commit disposition table is published in English only; a localised bucket-level summary can be added on request. | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.