Sync upstream paradigmxyz/centaur:main - #52
Draft
darkmatter[bot] wants to merge 166 commits into
Draft
Conversation
* fix(workflows): shut down Python host cleanly * fix(workflows): accept large host messages
* feat: scope company context reader user sources * fix: retain Google subject context authorization * test: strengthen company context reader RLS guards
* fix(console): restore inline markdown links * fix(console): parse markdown placeholder indexes * fix(console): preserve restored markdown fragments * test(console): generalize markdown link regression
* feat(console): promote principal identity fields * refactor(console): normalize principal identifiers * revert(console): remove normalized principal identifiers * fix(console): infer principal kinds from foreign IDs * fix(console): require scoped Slack DM identifiers * refactor(console): keep principal identity out of labels * refactor(console): simplify principal label aliases * fix(console): validate principal identity fields * fix(console): support Slack enterprise identity scopes * test: cover principal identity reconciliation * fix: preserve principal identity compatibility * fix: narrow principal kind backfill * fix: validate reconciled Slack identities * refactor: centralize principal identity promotion * fix: validate MCP Slack identities * fix: show principal identity labels in console
* feat: add default role assignments * fix: preserve default roles when settings omit them
* feat(console): promote console user identity fields * fix(console): reference console users by database id * fix(console): allow stale console user references * refactor(console): centralize principal identity labels
* fix(chart): require console * refactor(api-rs): always enable iron-proxy * fix(chart): ignore removed enable values
Co-authored-by: Perry Dime <260989497+svc-paradigm@users.noreply.github.com>
Selects the awscliv2 package matching the image's dpkg architecture (x86_64/aarch64), following the same pattern already used for kubectl and Nushell in this Dockerfile.
Co-authored-by: Perry Dime <260989497+svc-paradigm@users.noreply.github.com>
* fix(docsend): encode browserbase session metadata * refactor(docsend): use base64 session metadata * refactor(docsend): require encoded session metadata * refactor(docsend): simplify base64 decoding --------- Co-authored-by: Perry Dime <260989497+svc-paradigm@users.noreply.github.com>
* feat(slackbotv2): decouple response metadata from Console * feat(slackbotv2): split response metadata controls * chore(chart): bump release to 0.1.110 * feat(slackbotv2): add response metadata modes --------- Co-authored-by: Liam Horne <liam@lihorne.com>
_serialize_message builds a fixed dict from the Slack payload and drops everything it doesn't name, including the reactions array. Every read path funnels through it (get_channel_history_page, get_thread_replies_page, and the search fallback fetch), so no caller of the serialized shape can see reaction signal at all. That's a real blind spot in channels where people answer by reacting rather than replying. A message with 12 check-marks and no replies serializes to reply_count 0, which reads as "nobody responded" when the opposite is true. An agent working off that shape either reports the reply count as the roster or has to admit it can't answer. The data is already on the wire and needs no new OAuth scope. reactions:read gates the reactions.* methods, while the reactions array on a conversations.history payload rides along with channels:history, which this tool already requires. feedback.py:372 has been reading them straight off the raw responses this way for its thumbsup/thumbsdown signal. Only the serializer was throwing them away. Consistent across both read paths: the API server proxy hands back an untyped serde_json::Value, so reactions survive it and the proxy and direct fetches agree. Defaults to [] like reply_users so callers can index without a guard. Slack caps the per-reaction users array, so count can exceed len(users); anyone needing a complete reactor list on a heavily reacted message still wants reactions.get and the reactions:read scope it requires. The comment says so at the call site. Co-authored-by: Aadharsh Pannirselvam <19518661+oddharsh@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
…ebhooks (paradigmxyz#1248) * feat(githubbot): produce durable workflow events from CI and review webhooks Add a workflow-event producer module, independent of the owned-PR manager: lifecycle webhooks are translated into curated durable events on api-rs (POST /api/workflows/events) that workflows suspend on via ctx.wait_for_event. Emission runs before any owned-PR gating, because workflow waiters are not bot-owned PRs. - ci-completed (<owner>/<repo>:<head_sha>, payload {failed, failing}) fires once every check for the sha has settled. The settled evaluation reads GitHub's GraphQL statusCheckRollup — the same aggregate gh pr checks uses, covering check runs and commit statuses including EXPECTED — because fine-grained PATs get an ungrantable 403 on the REST check-runs list. An unreadable rollup is unknown, never settled, and a settled-green rollup is confirmed by one delayed re-read before emission: a push can read SUCCESS moments before the real suite registers. - review-submitted (<owner>/<repo>:pr-<n>:<head_sha>:<reviewer>, payload {review_id, state}) fires on every submitted review. Author-scoped correlations give each reviewer an independent row, so a waiter keys on exactly the author it cares about with no emission-side config. Durable events are immutable per correlation (first write wins), which forces two curation rules documented in the module header: an event must be semantically complete when emitted (the settled gate), and anything a waiter filters on belongs in the correlation. Correlations are computable from data the waiter already has and are lowercased so case drift between a PR URL slug and repository.full_name can never miss. The manager shares the settled evaluation so an owned PR is not evaluated twice per CI event. Off by default (githubbot.workflowEvents / GITHUBBOT_WORKFLOW_EVENTS); the api-rs URL and service token are already wired for the session API. * fix(githubbot): harden workflow event delivery * refactor(githubbot): simplify workflow event code
…e in the ruby-dependencies group (paradigmxyz#1259) chore(deps): bump solid_queue Bumps the ruby-dependencies group in /services/console with 1 update: [solid_queue](https://github.com/rails/solid_queue). Updates `solid_queue` from 1.5.0 to 1.6.0 - [Release notes](https://github.com/rails/solid_queue/releases) - [Commits](rails/solid_queue@v1.5.0...v1.6.0) --- updated-dependencies: - dependency-name: solid_queue dependency-version: 1.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ruby-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* feat: add OpenAI workflow dependency * fix: require OpenAI SDK 2.53
Co-authored-by: Liam Horne <1933029+snario@users.noreply.github.com>
Co-authored-by: Perry Dime <260989497+svc-paradigm@users.noreply.github.com>
darkmatter
Bot
force-pushed
the
sync/upstream-main
branch
from
August 20, 2026 16:02
a38dfe8 to
bc72622
Compare
* feat: persist Slack bot channel catalog * refactor: share Slack API retry handling * refactor: remove Slack catalog configuration digest * refactor: simplify Slack catalog synchronization * docs: remove Slack catalog documentation * refactor: collapse Slack channel catalog services * fix: handle unavailable Slack channel imports * fix: discover all visible Slack channels * perf: increase Slack membership sync batch
* feat: add console workflow authorship * feat: add Slack channel picker to workflows * feat: simplify workflow schedule settings * feat: enrich authored workflow table * fix: remove timezone from workflow table * refactor: simplify authored workflow updates * refactor: resolve workflow principal in controller * refactor: transform workflow form attributes explicitly * fix: make console workflow retries replay-safe * fix: truncate console workflow Slack output * fix: simplify console workflow metadata * refactor: rename authored workflows to scheduled tasks * feat: add scheduled tasks page * feat: authorize scheduled task Slack delivery * refactor: derive Slack delivery from memberships * test: isolate scheduled task channel result * fix: resolve scheduled task Slack identity * chore: reorder scheduled tasks migration * feat: simplify scheduled task delivery * fix: preserve dots in principal lookups * fix: parse final console workflow response * fix: require structured scheduled task results * refactor: use canonical agent turn result * refactor: let Slack resolve DM recipients
* fix: format scheduled task results for Slack * fix: thread long scheduled task DMs * fix: thread long scheduled task messages
darkmatter
Bot
force-pushed
the
sync/upstream-main
branch
from
August 21, 2026 11:02
14fab00 to
94efc4a
Compare
* fix: repair execution tracing semantics * fix: close dangling tool spans on execution end * fix: associate all Codex spans with sessions * refactor: simplify harness telemetry ownership * chore: format harness telemetry test * fix: identify Centaur CLI tool spans * feat: gate telemetry transcript capture * feat: add transcript capture chart value * chore: bump chart version to 0.1.125 * docs: document opt-in transcript capture * feat: include commands in captured telemetry * fix: retain codex model for telemetry cost * fix: price gpt-5.6-sol telemetry usage * fix: price gpt-5.6 telemetry family
…lients (paradigmxyz#1452) Native MCP clients receive the OAuth callback on a private-use URI scheme (RFC 8252 §7.1), e.g. Cursor's cursor://anysphere.cursor-mcp/oauth/callback, but allowed_redirect_uri? only accepted https and loopback http, so dynamic client registration 400s and those clients can never connect. Accept custom schemes for public clients: no wildcard, no fragment, and matched by exact string equality only (the loopback port flexibility stays http-only); PKCE protects the authorization code if another app claims the same scheme.
* feat: manage scheduled tasks from centaur-console * fix: allow all users to manage scheduled tasks
* feat: improve scheduled task picker * fix: restrict scheduled task creation contexts
Co-authored-by: Perry Dime <260989497+svc-paradigm@users.noreply.github.com>
darkmatter
Bot
force-pushed
the
sync/upstream-main
branch
from
August 22, 2026 09:57
7df50fc to
46bebdf
Compare
darkmatter
Bot
force-pushed
the
sync/upstream-main
branch
from
August 22, 2026 12:12
60c7968 to
79b5819
Compare
darkmatter
Bot
force-pushed
the
sync/upstream-main
branch
from
August 22, 2026 12:27
79b5819 to
11e1856
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
. updated with new blob OIDs and filenames.
Fork invariants preserved
Validation
SQLx: migration versions are monotonic relative to origin/main.
Rails console: migration versions are monotonic relative to origin/main. — passes (no duplicates, monotonic, lock matches)
Prompted by: darkmatter[bot]
BODY
)