echoomegaprime · echoomegaprime · Aug 15, 2026
diff --git a/config/qcoder-powerpack.json b/config/qcoder-powerpack.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "checkedAt": "2026-08-09T13:32:30-05:00",
+  "checkedAt": "2026-08-15T15:10:32-05:00",
   "policy": {
     "allowedLicenses": ["MIT", "Apache-2.0"],
     "defaultNetwork": "deny",
@@ -13,7 +13,7 @@
       "id": "qwen-code",
       "repository": "QwenLM/qwen-code",
       "source": "https://github.com/QwenLM/qwen-code",
-      "commit": "55e20db328248436ae65743986906ff1fbc5ea58",
+      "commit": "3119d53e4d922f1f906535f6f70c155ea44df875",
       "branch": "main",
       "license": "Apache-2.0",
       "licensePath": "LICENSE",
@@ -49,7 +49,7 @@
       "id": "serena",
       "repository": "oraios/serena",
       "source": "https://github.com/oraios/serena",
-      "commit": "946ad9817875cbf46b308423296c33eb65e3e728",
+      "commit": "93ec043105f5ee4f5ff64ea0158041500d2cdc65",
       "branch": "main",
       "license": "MIT",
       "licensePath": "LICENSE",
@@ -67,7 +67,7 @@
       "id": "ast-grep",
       "repository": "ast-grep/ast-grep",
       "source": "https://github.com/ast-grep/ast-grep",
-      "commit": "e8c70a7c7a6f8b73827e507b65201da8cea0ab79",
+      "commit": "55ff25956754931189d84672cefdf9bb5c7d362c",
       "branch": "main",
       "license": "MIT",
       "licensePath": "LICENSE",
@@ -93,7 +93,7 @@
       "id": "goose",
       "repository": "aaif-goose/goose",
       "source": "https://github.com/aaif-goose/goose",
-      "commit": "064244e6bddf641876676f054a006b7da1da5182",
+      "commit": "3810898a7447ec3299be72e223d3570a7aabf0ab",
       "branch": "main",
       "license": "Apache-2.0",
       "licensePath": "LICENSE",
@@ -105,7 +105,7 @@
       "id": "openhands-agent-sdk",
       "repository": "OpenHands/software-agent-sdk",
       "source": "https://github.com/OpenHands/software-agent-sdk",
-      "commit": "684ea6a07041b8d049813e375675821a57fdf5ed",
+      "commit": "23ee276f1c68f08123349d103754380f627d20c8",
       "branch": "main",
       "license": "MIT",
       "licensePath": "LICENSE",
@@ -134,7 +134,7 @@
       "id": "browser-use",
       "repository": "browser-use/browser-use",
       "source": "https://github.com/browser-use/browser-use",
-      "commit": "32601887cfbc9f4f1e3cad3e2b678e56aeaeaae4",
+      "commit": "f3298c559aabb327a61cf6a9caef5ea3462f45de",
       "branch": "main",
       "license": "MIT",
       "licensePath": "LICENSE",
@@ -164,7 +164,7 @@
       "id": "spec-kit",
       "repository": "github/spec-kit",
       "source": "https://github.com/github/spec-kit",
-      "commit": "684b3d8e05263a7c1948d3d0699ab1cb4f77c3d5",
+      "commit": "bf88c9f9a82fa370c7a7257aa2b3cf10b457b65c",
       "branch": "main",
       "license": "MIT",
       "licensePath": "LICENSE",
@@ -196,7 +196,7 @@
       "id": "pr-agent",
       "repository": "qodo-ai/pr-agent",
       "source": "https://github.com/qodo-ai/pr-agent",
-      "commit": "064a305c8aac1543edf63b5a6baadcdd942831ac",
+      "commit": "7550d0aebb81c2210f4cb7bf040778d969df297b",
       "branch": "main",
       "license": "MIT",
       "licensePath": "LICENSE",
@@ -208,7 +208,7 @@
       "id": "superpowers",
       "repository": "obra/superpowers",
       "source": "https://github.com/obra/superpowers",
-      "commit": "44c9b2d6e889982ac18c27d05a19fefe335194e1",
+      "commit": "b36e0829c6d0140e93cfef2ca599b1b07d4a7797",
       "branch": "main",
       "license": "MIT",
       "licensePath": "LICENSE",
@@ -224,7 +224,7 @@
       "id": "nuclei",
       "repository": "projectdiscovery/nuclei",
       "source": "https://github.com/projectdiscovery/nuclei",
-      "commit": "dfdfa5fd65503a3884f2098a1c9d4d5f28bf1756",
+      "commit": "265b3a3dec374741614e342f813c10f8b38d2bb7",
       "branch": "dev",
       "license": "MIT",
       "licensePath": "LICENSE.md",
@@ -240,7 +240,7 @@
       "id": "garak",
       "repository": "NVIDIA/garak",
       "source": "https://github.com/NVIDIA/garak",
-      "commit": "cafbe992780df70015de7295ca026b70c4629ada",
+      "commit": "bb1cc47a0cd6ae49971598b879914fbdc04227d0",
       "branch": "main",
       "license": "Apache-2.0",
       "licensePath": "LICENSE",
@@ -257,7 +257,7 @@
       "id": "promptfoo",
       "repository": "promptfoo/promptfoo",
       "source": "https://github.com/promptfoo/promptfoo",
-      "commit": "49c0f6d77496c022c6d32e362522993bb0d72d42",
+      "commit": "fded938b65a81e12070a66e90ca4ad2d42a8062e",
       "branch": "main",
       "license": "MIT",
       "licensePath": "LICENSE",

diff --git a/docs/UPSTREAM_REVIEW_20260815.md b/docs/UPSTREAM_REVIEW_20260815.md
@@ -0,0 +1,60 @@
+# QCoder upstream review — 2026-08-15
+
+This review covers every upstream head change detected by
+`node scripts/validate-powerpack.mjs --online` before the manifest pins were
+advanced. GitHub's compare and contents APIs were queried against each exact
+old/new commit pair.
+
+## Decision boundary
+
+- All 12 target commits are linear descendants of their recorded pins
+  (`status=ahead`, `behind_by=0`).
+- Every license file at the exact target commit has the same SHA-256 digest as
+  the manifest's reviewed MIT or Apache-2.0 license.
+- This change advances provenance commits only. Exact installable package
+  versions are unchanged, so no new upstream source is installed or executed.
+- QCoder, SOL, workspace, network, credential, and authorized-security gates
+  remain authoritative. A repository pin grants no runtime authority.
+- GitHub's compare response caps file details at 300 paths. The Qwen Code and
+  Goose file counts below therefore mean `300+`; their risk classification also
+  uses commit subjects and posture, not a claim of exhaustive file inspection.
+
+## Reviewed changes
+
+| Upstream                       |    Posture | Commits | Files | License              | Risk and decision                                                                                                                                                                              |
+| ------------------------------ | ---------: | ------: | ----: | -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `QwenLM/qwen-code`             | integrated |     180 |  300+ | Apache-2.0 unchanged | Elevated source churn across CLI, SDK, browser, channels, review tooling, and CI. Accept as a provenance head only; keep `@qwen-code/qwen-code@0.21.8` exact and preserve QCoder/SOL controls. |
+| `oraios/serena`                | integrated |      12 |    18 | MIT unchanged        | Low-moderate: dependency cleanup, Dart notification handling, and prompt synchronization. Accept provenance head; keep `serena-agent==1.6.1` exact and the bounded tool allowlist.             |
+| `ast-grep/ast-grep`            | integrated |       7 |     7 | MIT unchanged        | Low-moderate: dependency bumps, embedded-language outline support, and broken-pipe behavior. Accept provenance head; keep `@ast-grep/cli@0.45.1` exact.                                        |
+| `aaif-goose/goose`             |  reference |      76 |  300+ | Apache-2.0 unchanged | Moderate: OAuth transport, MCP registration, agent-loop, and adversary-inspection changes. Accept as non-executing reference material only.                                                    |
+| `OpenHands/software-agent-sdk` |  reference |      29 |    98 | MIT unchanged        | Moderate: shell AST/security semantics, routed-model metadata, profile validation, and automation callbacks. Accept as non-executing reference material only.                                  |
+| `browser-use/browser-use`      |  reference |      22 |    34 | MIT unchanged        | Low-moderate: MCP server and generated-skill changes plus dependency maintenance. Accept as non-executing reference material only.                                                             |
+| `github/spec-kit`              |  reference |      60 |   126 | MIT unchanged        | Moderate: workflow validation, catalog additions, and release changes. Accept as non-executing spec-pattern reference only.                                                                    |
+| `qodo-ai/pr-agent`             |  reference |       6 |    19 | MIT unchanged        | Low: documentation corrections, reasoning fallback, and model support. Accept as non-executing review-pattern reference only.                                                                  |
+| `obra/superpowers`             |  reference |       1 |    40 | MIT unchanged        | Moderate: a broad v6.3.0 release adds agent integrations and workflow changes. Accept as non-executing workflow reference only.                                                                |
+| `projectdiscovery/nuclei`      |    sidecar |      11 |    13 | MIT unchanged        | Moderate: raw request semantics, proxy behavior, parser state, and Go dependencies. Accept provenance head; execution remains a separately authorized sidecar action.                          |
+| `NVIDIA/garak`                 |    sidecar |      36 |    25 | Apache-2.0 unchanged | Low-moderate: detector robustness, analysis metrics, and plugin cache changes. Accept provenance head; keep `garak==0.16.0` exact and separately authorized.                                   |
+| `promptfoo/promptfoo`          |  reference |      62 |   234 | MIT unchanged        | Moderate: MCP client, dependency/lockfile, examples, and CI changes. Accept as reference only; installation remains withheld by the existing high-transitive-audit policy.                     |
+
+## Exact reviewed targets
+
+```text
+qwen-code              3119d53e4d922f1f906535f6f70c155ea44df875
+serena                 93ec043105f5ee4f5ff64ea0158041500d2cdc65
+ast-grep               55ff25956754931189d84672cefdf9bb5c7d362c
+goose                  3810898a7447ec3299be72e223d3570a7aabf0ab
+openhands-agent-sdk    23ee276f1c68f08123349d103754380f627d20c8
+browser-use            f3298c559aabb327a61cf6a9caef5ea3462f45de
+spec-kit               bf88c9f9a82fa370c7a7257aa2b3cf10b457b65c
+pr-agent               7550d0aebb81c2210f4cb7bf040778d969df297b
+superpowers            b36e0829c6d0140e93cfef2ca599b1b07d4a7797
+nuclei                 265b3a3dec374741614e342f813c10f8b38d2bb7
+garak                  bb1cc47a0cd6ae49971598b879914fbdc04227d0
+promptfoo              fded938b65a81e12070a66e90ca4ad2d42a8062e
+```
+
+## Verification
+
+The updated manifest must pass the offline validator, the online drift/license
+validator, both npm audits, the full regression suite, and the complete release
+verification before publication.
diff --git a/scripts/autonomy-tick.mjs b/scripts/autonomy-tick.mjs
@@ -111,7 +111,7 @@ function main() {
   const summary = {
     schemaVersion: 1,
     checkedAt: new Date().toISOString(),
-    repository: "ECHO-OMEGA-PRIME/echo-qcoder",
+    repository: "echoomegaprime/echo-qcoder",
     ...summarizeChecks(checks),
   };
   mkdirSync(dirname(options.output), { recursive: true });

diff --git a/scripts/tests/autonomy-tick.test.mjs b/scripts/tests/autonomy-tick.test.mjs
@@ -53,6 +53,12 @@ test("scheduled workflow reconciles one persistent autonomy issue", () => {
   assert.match(dependabot, /package-ecosystem: "github-actions"/u);
 });
 
+test("autonomy evidence identifies the canonical repository", () => {
+  const tick = readFileSync(resolve(root, "scripts/autonomy-tick.mjs"), "utf8");
+  assert.match(tick, /repository: "echoomegaprime\/echo-qcoder"/u);
+  assert.doesNotMatch(tick, /repository: "ECHO-OMEGA-PRIME\/echo-qcoder"/u);
+});
+
 test("HAMMER fallback installs a six-hour bounded task with issue reconciliation", () => {
   const installer = readFileSync(resolve(root, "scripts/install-autonomy-task.ps1"), "utf8");
   const runner = readFileSync(resolve(root, "scripts/run-autonomy-tick.ps1"), "utf8");