[amv146]

Problem

This personal fork stops updating when the latest published upstream nightly conflicts with fork features. Its existing nightly workflow deliberately fails rather than discarding fork changes, but nothing currently requests an agent repair.

Change

Emit bounded conflict metadata only after Git reports unmerged entries. A fork-only, read-only workflow_run notifier verifies the live failed sync job/log, exact fork base and published nightly tag/SHA, reproduces the conflict in its disposable checkout, and posts metadata to a private T3 Connect webhook. Successful syncs, build failures, stale events, clean merges and existing deterministic repair claims do not invoke an agent.

A persistent T3 task is now enabled, using the inherited agent subscription and isolated worktrees. Exact filters, replay/coalesce keys, maximum delivery age, independent GitHub verification and atomic repair-branch claims constrain future runs. The private endpoint is stored only in the fork's FORK_CONFLICT_WEBHOOK_URL Actions secret.

Configuration merged and task activated on 2026-11-08, after the owner explicitly authorized a configuration-only merge following validation. Both the notifier and Fork nightly are active. Future agents may open repair PRs, but the user must merge each ready repair PR to unblock nightly sync. No unattended repair merges, forced pushes, test/policy bypasses, external AI API subscriptions or paid review activation. Existing CodeRabbit/Macroscope settings and the open files-diff PR are unchanged. The repair agent retains the inherited full-access credentials: its no-main/no-merge boundary is durable agent guidance, not a new credential-level restriction.

Scope and approval

The fork owner explicitly requested implementing persistent upstream-nightly conflict repair and authorized this fork-only configuration PR. This connects the existing fork nightly workflow to existing T3 webhook scheduled tasks; it changes no product clients, upstream workflows, review plans or live host state.

Verification

• node --test .github\scripts\fork-nightly.test.cjs before the fix: failed as expected, because a real conflict emitted no trigger metadata.
• node --test .github\scripts\fork-nightly.test.cjs .github\scripts\fork-conflict-notify.test.cjs: passed, 10 tests. Real fixture merges preserve personal behavior and never push a conflicting sync; notifier cases cover exact routing, successful/non-conflict/stale inputs, claim deduplication, abort cleanup, dry-run with no delivery, private endpoint restrictions, stripped relay headers, offline queue receipts and explicit delivery failures.
• git --no-pager diff --check: passed.
• vp run check:changed origin/main: blocked locally by missing project dependencies. vp i attempted restoration but failed at the corporate proxy with @alchemy.run/test HTTP 404. No tests or policies were disabled. Hosted Fork PR validation subsequently passed on head b7247dac9eb48c7e951398cc65e6b58b9e20cdc1.
• Hosted vp run check:changed "$BASE" (base 5cb8de196102a53f209b6b5bbb403fa4b6c8ddc3): passed format, lint, both knip passes, affected/dependent typechecks, targeted tests and both Node fixture files. Run: https://github.com/amv146/t3code/actions/runs/42524298502. Automatic CodeRabbit check passed on the same head with no actionable findings. Upstream-only Blacksmith checks were queued/inaccessible; they are not required by this fork and were not disabled or bypassed.
• vp fmt .github\scripts\fork-nightly.cjs .github\scripts\fork-nightly.test.cjs .github\scripts\fork-conflict-notify.cjs .github\scripts\fork-conflict-notify.test.cjs .github\workflows\fork-conflict-repair.yml docs\operations\fork-nightly.md: blocked by the same missing Vite+ installation. The already-restored Oxfmt 0.74.0 CLI formatted and checked these six files successfully using the repository's applicable formatting options.
• A safe synthetic exact-shape event posted to the real, disabled private endpoint returned HTTP 409 / {"error":"hook_disabled"}. The task remained disabled with lastRunStatus: never; no coding agent was dispatched. GitHub's real sync job log endpoint was also verified to return text.
• gh pr merge 6 --repo amv146/t3code --merge --match-head-commit b7247dac9eb48c7e951398cc65e6b58b9e20cdc1: succeeded with owner authorization, merge commit 28fee9478de4c278f0196a4261eb95688f595cdd. The notifier workflow is present and active on main.
• T3 schedule_task update with enabled: true: succeeded. Read-only persistence verification confirmed origin/main, startFromOrigin: true, isolated worktrees/new threads, inherited acpRegistry_agency_context / gpt-6.1-sol, and the exact filters/dedupe/max-age configuration.
• Six safe synthetic requests to the active private endpoint: HTTP 202, each verified in the persisted delivery log as filtered, including success, wrong repository/workflow/ref and a repeated event. Task lastRunStatus remained never: zero coding agents dispatched.
• Activation and real filtering are verified; an actual future conflict repair is not claimed exercised because no production conflict was fabricated. Fixture routing/deduplication and the disabled exact-shape event provide safe positive-path proof. The relay does not forward the outcome header; a receipt is not proof of completed agent work. T3 Connect must remain available, and the host must return online within the configured 60-minute delivery-age window.

Implemented by GPT-6.1 Sol (gpt-6.1-sol) through GitHub Copilot's T3 Code acpRegistry harness.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The change adds conflict metadata to failed fork nightly syncs, verifies conflict evidence in a follow-up workflow, and sends eligible notifications through a restricted relay endpoint. It also updates tests and operations guidance for the conflict and repair process.

Changes: Fork nightly conflict flow

Layer / File(s)	Summary
Record and validate conflict metadata .github/scripts/fork-nightly.cjs, .github/scripts/fork-nightly.test.cjs, .github/scripts/fork-conflict-notify.cjs, .github/scripts/fork-conflict-notify.test.cjs	Failed merges with unmerged files now log the fork base and upstream commit and tag. The notifier validates metadata and SHA fields and constructs repair branch names. Tests cover metadata parsing, branch validation, and emitted conflict metadata.
Verify the failed run and merge conflict .github/scripts/fork-conflict-notify.cjs, .github/scripts/fork-conflict-notify.test.cjs	The probe checks workflow and job evidence, metadata, fork base, and upstream tag. It tests the merge and returns a payload only when a conflict remains and the fork base is unchanged. Tests cover eligibility, clean merges, and mismatched upstream SHAs.
Route and report eligible notifications .github/scripts/fork-conflict-notify.cjs, .github/scripts/fork-conflict-notify.test.cjs, .github/workflows/fork-conflict-repair.yml, docs/operations/fork-nightly.md	The workflow runs the conflict tests and invokes the notifier for eligible failed runs. The notifier validates the relay endpoint and delivery receipt, and reports the outcome. Operations guidance documents webhook setup and repair constraints.

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant ForkNightly as fork-nightly.cjs
  participant RepairWorkflow as fork-conflict-repair workflow
  participant Notifier as notifyForkConflict
  participant Probe as probeForkConflict
  participant GitHub as GitHub API
  participant Relay as relay.t3.codes
  ForkNightly->>ForkNightly: Log conflict metadata when merge has unmerged files
  RepairWorkflow->>Notifier: Invoke with webhook URL after failed run
  Notifier->>Probe: Check conflict eligibility
  Probe->>GitHub: Read workflow run and job evidence
  Probe-->>Notifier: Return payload or reason
  Notifier->>Relay: Post eligible conflict payload
  Relay-->>Notifier: Return delivery receipt

Loading

Merge Risk: Minimal · up to b7247

This change adds a gated, fork-only notification path for failed nightly sync conflicts. Successful and unrelated runs are not affected, and no concrete defect was found. Production activation of the relay and the repair task is still pending, but that is an operational step rather than a code risk.

Security architecture risk: Low · up to b7247

The notification path is narrowly scoped, independently verifies conflicts, and uses read-only repository permissions. Risk remains low rather than minimal because the external repair service’s authorization, duplicate suppression, and recovery behavior cannot be verified from this change.

Retained concerns

• Low · security · observed: End-to-end repair ownership and authority depend on external configuration: the notifier checks whether a deterministic branch exists, while atomic claiming, replay suppression, independent verification, and repair write limits are delegated to a task whose enforcement is unavailable for review. This is an activation assurance gap, not a verified authorization bypass.

Security review details

Security Blast Radius

• inferred — The demonstrated producer exposure is limited to one fork’s conflict metadata and webhook capability; its GitHub permissions cannot push a repair. The intended downstream scope is fork-only repair PRs, but the external task’s actual credentials, sandbox boundaries, and maximum writable scope were not supplied and cannot be bounded by the sender’s permissions.

Trust Boundaries and Controls

• observed — Event and log contents are not sufficient authorization for delivery: repository identity, workflow path, allowed trigger type, run attempt, failed merge step, current base, published tag, fetched commit, and persistent conflict are checked independently. Checkout uses fork main rather than a pull-request head, and the payload contains metadata rather than repository text or executable instructions.

Resilience and Maintainability Implications

• observed — Source tests cover stale or ineligible events, existing claims, merge cleanup, endpoint restrictions, receipt outcomes, and transport-error redaction. Receiver outcomes are mocked, so these tests do not establish concurrent atomic claiming, replay enforcement, or recovery after uncertain remote acceptance. Tests were inspected, not executed.

Hardening Proposals

• proposed — Before enabling automated repair, verify the external task’s effective credential scope, independent GitHub validation, atomic create-ref ownership, and replay behavior across duplicate delivery, timeout-after-acceptance, concurrent execution, and interrupted claims. Confirm that direct-main writes and unattended merges are technically restricted where supported, rather than relying solely on task instructions.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title "feat(ci): request agent repair for fork nightly conflicts" matches the main change. The PR adds a fork-only workflow_run notifier that sends conflict metadata to a T3 webhook so an agent ca…
Description check		The description follows the template. It has Problem, Change, Scope and approval, and Verification sections, and the template comment is kept. Problem and Change are filled in clearly. Scope cites the…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "feat(ci): request agent repair for fork nightly conflicts" matches the main change. The PR adds a fork-only workflow_run notifier that sends conflict metadata to a T3 webhook so an agent can repair nightly sync conflicts. It is a conventional commit title in plain language and stays concise.

Full details: Description check

Explanation

The description follows the template. It has Problem, Change, Scope and approval, and Verification sections, and the template comment is kept. Problem and Change are filled in clearly. Scope cites the fork owner's explicit request and states what the PR does not change. Verification lists focused test runs, the blocked repo-wide checks with reasons, the disabled-endpoint check, and what is not yet proven. The template asks for a link to a triaged issue or discussion, but the description cites only the owner's request, not a linked issue or approval comment. The Scope section also needs a reference for the approval. The agent model line is present.

Resolution

Consider adding a link to the triaged issue or the discussion that records the owner's approval, as the Scope and approval section asks. Otherwise the description is complete.

Finishing Touches

Generate docstrings

• Commit to this branch
• Create a new PR

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: amv146/t3code
• Branch: fork/upstream-conflict-automation
• File: .coderabbit.config.ts
• Commit: b7247da
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5539a710-3d3f-4046-9fcc-e801a8f573f8

Commits

Reviewing files that changed from the base of the PR and between 5cb8de1 and b7247da.

Files selected for processing: 6

• .github/scripts/fork-conflict-notify.cjs
• .github/scripts/fork-conflict-notify.test.cjs
• .github/scripts/fork-nightly.cjs
• .github/scripts/fork-nightly.test.cjs
• .github/workflows/fork-conflict-repair.yml
• docs/operations/fork-nightly.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 4 remain after this review.