[zpyoung]

	Files	Added	Deleted	Net
Test	1120	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​82489	$\color{#cf222e}{\Huge{\mathbf{−}}}$​29597	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​52892
Prod	1880	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​149346	$\color{#cf222e}{\Huge{\mathbf{−}}}$​64912	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​84434

ELI5

This brings the fork up to upstream's newest stable release, v1.4.230. It's built on top of the still-open v1.4.227 sync (#120), so merging this lands both, and #120 then closes as merged.

v1.4.230 is much bigger than a normal sync. It was cut from upstream main after ~1,400 commits, and it deletes the SSH relay the fork's SSH features ran on. As decided by the repo owner, the fork drops its SSH-relay code paths and keeps every feature's local behavior.

What Changed

• Target: v1.4.230 at b2879bd5aa, merged onto sync: absorb upstream v1.4.227 #120's head (d3dfc479b8, which carries v1.4.227). Resolution: auto-ours+tree (43 delete/modify tree conflicts, resolved by the two mechanical rules, then by the manifest).
• Fork commits: all 669 are still reachable at their original SHAs.
• Backup: origin/backup/main-20261019-102904Z at c923f8e30a.
• Ownership classifier: 13,855 paths reset to the tag, 2,732 removed, 183 exceptions restored, 2,102 merge-review paths. 80 exceptions moved upstream and were three-way merged against v1.4.227.

SSH relay retired (owner decision). Upstream replaced the relay with a managed orcad on every SSH host. The fork deleted src/relay/** and the SSH git/pty providers, and plain ssh: hosts now report "not served".

• native-chat-relay keeps its renderer half (local paging and live tail) under a narrowed purpose. Its SSH transport is gone; remote chats use upstream's orcad nativeChat.* RPC.
• hosted-review-sitter, heimdall-objective, project-ledger, terminal-dock, artifact-passwords and session-handoff are now local-only. An SSH target answers "unavailable" or counts as lost contact.
• Each lost capability is filed as an orca ledger deferred item to re-home onto orcad RPC later.

Module splits re-homed. Upstream dissolved the orca-runtime-*.ts modules, the sidebar grouping files, web-session-tabs-sync, ipc/runtime-environment-* and others. Every fork seam moved to the new home. Stale fork copies of deleted files are gone. Where upstream already did the same thing, the fork seam was dropped.

Native chat. The fork's input-quarantine delta (bug-1) is re-applied on upstream's settings-free send path (stablyai#27279). All 15 tier-2 forked copies now point at v1.4.230. Hidden-pane read gating, which the fork had dropped only for relay reconnects, is restored.

New upstream ratchets adopted in fork code, with no baseline lines added:

• focus-read and deprecated-runtime-owner: fork code now routes by the resource's owner instead of the "Active Server" setting, copying upstream's own migration. Behavior changes:
  • a workspace two hosts publish now refuses instead of reading as local (ledger panel, session info, sitter panel, handoff);
  • a group created from a worktree takes the worktree's host;
  • a dock's ConPTY verdict and automation model retirement no longer borrow the focused server.
• layout-writer: the dock mint no longer adds a second layout write in headless-tab-properties.ts.
• text-[11px] → text-2xs in the plugin-attribution picker seam, and one import() type annotation.

CI.

• pr.yml, release-cut.yml and release-mac-build.yml are rebuilt as v1.4.230 plus the fork's own delta (fork ownership guard, macOS-only release, no Windows PR lanes, file-based changed-paths).
• Upstream moved PR CI to Blacksmith runners, which this fork has never used, so those jobs map back to GitHub-hosted runners.
• The guard stays inside verify.needs. Upstream's aggregate-gate tests learn about it through a new config/scripts/fork-ownership-guard/ module plus two seams.
• The guard job now skips drafts, like upstream's other entry jobs.

Release-branch workflows. Upstream's 597425845e swapped 9 release-branch workflows for main's without updating the tag's tests, so 8 of the tag's own config tests are red against it. As in #120, the 8 upstream-owned ones take 597425845e^. The next tag resets them.

Retired exceptions:

• the two relay workflow-inventory tests and bug-2's ssh-remote-commands.test.ts: upstream now passes or matches;
• the skill release-history files: upstream deleted them;
• verify-skill-update-roundtrip.mjs and max-lines-baseline.txt: identical to upstream;
• the git-exec-mutation, relay-test and SSH-provider exceptions: relay retired;
• relay-windows-process-tree.yml and a stale deleted entry.

Sandbox runner. It now ships src/packages and the native workspace manifests, because upstream moved src/shared/child-process into @orca/process-host.

Why

Taking v1.4.230 means taking the relay deletion. Keeping a fork-owned copy of the whole relay (480 files plus the SSH providers) would be permanent upstream-shaped ownership. Re-homing onto orcad in the same sync would have doubled its size and risk. Retiring the SSH halves keeps every local behavior and stays reviewable. The re-home is tracked in the ledger.

Linked Issue

N/A. This is an upstream sync.

Visual Proof

N/A. This is an upstream merge, and the fork's UI changes are routing-only. Nothing has been checked in a running app yet.

Testing

• Local gate: all of these pass.

  • pnpm install --frozen-lockfile
  • --verify-seams (1,211 lines / 605 files) and --verify-residuals v1.4.230 (548 files)
  • check-fork-ownership.mjs on the committed head
  • typecheck:node, typecheck:web and typecheck:cli, run one after another
  • full pnpm lint

• config/scripts + .github tests on the remote sandbox: 4,763 passed and 5 failed.

  • All 5 failures are sandbox-only: the image skips Bun's postinstall (--ignore-scripts), installs a pnpm older than the pin, and ships git 2.43 without reftable. None can fail on GitHub-hosted runners.

• The full unit suite is left to this PR's CI.

• I manually tested these changes locally

• Automated tests added/updated, or explained why not below

Review

Agent skill upstream boundary

• Not applicable, or this change copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

Notes

• Wire parity: projectGroup.delete and repo.rm stay in the uncatalogued RPC list, because project-ledger extends them with main-side schemas.
• Untested Heimdall verdict: the "unverifiable host read" verdict lost its only tests with the relay, so a test-gap is filed.
• Dock state and the layout store: it is declared unwritten in upstream's dark layout-owner store, so shipped builds are unaffected. A deferred item is filed for before that build switch ships.
• Free-form fork copy: fork-heimdall/orchestration/federation-sync.ts uses a free-form copy header, so tier-2 replay can't see it.
• Unreleased upstream work not taken: 0 commits on upstream/main past this head as of the fetch.

Checklist

• This PR is small and focused
• I explained what changed and why (ELI5, the user-facing before/after, the mechanism, and why over the alternatives)
• Before/after screenshots or videos attached for UI changes, or N/A with reason
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
• pnpm lint, pnpm typecheck, pnpm test, and pnpm build pass (or CI will cover; local preferred)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.