[fork] base: GitHub-hosted CI plumbing

.github/client-overlay-ownership.json

@@ -0,0 +1,40 @@
+{
+  "overlays": [
+    {
+      "id": "desktop-links",
+      "branch": "t3-discord/f7d37879-desktop-deeplinks",
+      "pullRequest": 10,
+      "paths": [
+        "apps/desktop/src/app/DesktopApp.ts",
+        "apps/desktop/src/app/DesktopClerk.test.ts",
+        "apps/desktop/src/app/DesktopClerk.ts",
+        "apps/desktop/src/app/DesktopDeepLinks.test.ts",
+        "apps/desktop/src/app/DesktopDeepLinks.ts",
+        "apps/desktop/src/backend/DesktopBackendPool.test.ts",
+        "apps/desktop/src/electron/ElectronProtocol.ts",
+        "apps/desktop/src/main.ts",
+        "apps/desktop/src/window/DesktopApplicationMenu.test.ts",
+        "apps/desktop/src/window/DesktopWindow.test.ts",
+        "apps/desktop/src/window/DesktopWindow.ts",
+        "scripts/build-desktop-artifact.ts"
+      ]
+    },
+    {
+      "id": "discord",
+      "branch": "fork/discord",
+      "pullRequest": 80,
+      "paths": [
+        "apps/discord-bot/**",
+        "docs/integrations/discord-bot.md",
+        "docs/architecture/discord-browser-automation.md",
+        "docs/examples/project-aliases.yaml"
+      ]
+    },
+    {
+      "id": "vscode",
+      "branch": "fork/vscode",
+      "pullRequest": 79,
+      "paths": ["apps/vscode/**", ".vscode/launch.json", ".vscode/tasks.json"]
+    }
+  ]
+}

.github/pr-stack.json

@@ -0,0 +1,92 @@
+{
+  "upstreamRemote": "upstream",
+  "upstreamBranch": "main",
+  "forkChangesBranch": "fork/changes",
+  "integrationBranch": "fork/integration",
+  "pullRequests": [
+    {
+      "number": 255,
+      "branch": "fork/base"
+    },
+    {
+      "number": 1,
+      "branch": "fork/tim"
+    },
+    {
+      "number": 27,
+      "branch": "fork/candidates"
+    },
+    {
+      "number": 2,
+      "branch": "fork/changes"
+    }
+  ],
+  "integrationOverlays": [
+    {
+      "number": 254,
+      "branch": "t3-discord/f7d37879-desktop-deeplinks"
+    },
+    {
+      "number": 174,
+      "branch": "fork/discord"
+    },
+    {
+      "number": 175,
+      "branch": "fork/vscode"
+    },
+    {
+      "number": 250,
+      "branch": "fork/identity"
+    }
+  ],
+  "conflictResolutions": [
+    {
+      "branch": "fork/integration",
+      "commit": "*",
+      "path": "pnpm-lock.yaml",
+      "strategy": "theirs"
+    },
+    {
+      "branch": "fork/integration",
+      "commit": "286efa51172d3cbf46684c9923ca9d2b003d0967",
+      "path": "pnpm-lock.yaml",
+      "strategy": "theirs"
+    },
+    {
+      "branch": "fork/integration",
+      "commit": "*",
+      "path": "AGENTS.md",
+      "strategy": "ours"
+    },
+    {
+      "branch": "fork/integration",
+      "commit": "46c3697f207ea2de04c0a9ef72ca867d4d9f01da",
+      "path": "AGENTS.md",
+      "strategy": "ours"
+    },
+    {
+      "branch": "fork/integration",
+      "commit": "*",
+      "path": "docs/fork-stack.md",
+      "strategy": "ours"
+    },
+    {
+      "branch": "fork/changes",
+      "commit": "*",
+      "path": "AGENTS.md",
+      "strategy": "theirs"
+    },
+    {
+      "branch": "fork/changes",
+      "commit": "206981716ef30b5fb58338e32653339ed958a7f7",
+      "path": "AGENTS.md",
+      "strategy": "theirs"
+    },
+    {
+      "branch": "fork/changes",
+      "commit": "*",
+      "path": ".github/workflows/ci.yml",
+      "strategy": "theirs"
+    }
+  ]
+}

.github/pull_request_template.md

@@ -19,12 +19,30 @@ we may close it without merging it, or never review it.
 
 <!-- Explain the problem being solved and why this approach is the right one. -->
 
+## Downstream Fork Relationship
+
+<!--
+For downstream-fork work, name the base branch, affected areas, and whether this depends on another
+open PR. Delete this section for upstream contributions.
+-->
+
+## External-Fork Provenance
+
+<!--
+For an external-fork import, list what was imported unchanged, adapted locally, intentionally
+excluded, and the fully qualified source links. Delete this section for original work.
+-->
+
 ## UI Changes
 
 <!-- If this PR changes UI, include clear before/after screenshots.
      If the change involves motion or interaction, include a short video.
      Delete this section if not applicable. -->
 
+## Verification
+
+<!-- List focused tests and checks run for this change. -->
+
 ## Checklist
 
 - [ ] This PR is small and focused

.github/upstream-candidates.json

@@ -0,0 +1,35 @@
+{
+  "version": 1,
+  "candidates": [
+    {
+      "upstreamPr": 4018,
+      "sourceSha": "de8fd65934768173819b93adcd6b92af3e8c7fc3",
+      "status": "active",
+      "purpose": "Bound server thread history and lazily page older web activity"
+    },
+    {
+      "upstreamPr": 3510,
+      "sourceSha": "034f4936d7a1435887bb62ac3f2db61f08928cbf",
+      "status": "active",
+      "purpose": "Page mobile history and bound stale subscription catch-up"
+    },
+    {
+      "upstreamPr": 4176,
+      "sourceSha": "56b6615afdfe3804a466e33cbab9056b8981f217",
+      "status": "active",
+      "purpose": "Bound long-lived orchestration, browser, preview, and VCS in-memory state"
+    },
+    {
+      "upstreamPr": 4506,
+      "sourceSha": "f7eaa00b99e67a9c1caf09e2fe6ff1f536f66b91",
+      "status": "active",
+      "purpose": "Show answered provider questions in the web thread timeline"
+    },
+    {
+      "upstreamPr": 4245,
+      "sourceSha": "6be48eb238cf310a60cc9571240601e774c7d381",
+      "status": "active",
+      "purpose": "Queue follow-up messages server-side during active turns with explicit steer controls"
+    }
+  ]
+}

.github/workflows/ci.yml

@@ -13,7 +13,7 @@ concurrency:
 jobs:
   check:
     name: Check
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - name: Checkout
@@ -59,7 +59,7 @@ jobs:
 
   test:
     name: Test
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - name: Checkout
@@ -91,7 +91,7 @@ jobs:
 
   mobile_native_static_analysis:
     name: Mobile Native Static Analysis
-    runs-on: blacksmith-6vcpu-macos-26
+    runs-on: macos-15
     timeout-minutes: 10
     steps:
       - name: Checkout
@@ -119,7 +119,7 @@ jobs:
 
   release_smoke:
     name: Release Smoke
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - name: Checkout

.github/workflows/compose-integration.yml

@@ -0,0 +1,113 @@
+# Fast ship path: rebase registered overlays onto current fork/changes when
+# needed, rebuild fork/integration from changes + every overlay tip, then
+# dispatch Fork CI. Does not rewrite main / fork/tim / fork/candidates.
+#
+# Runs only when:
+# - a PR is **merged** into fork/changes or a registered overlay base
+# - manual workflow_dispatch
+#
+# Deliberately does **not** run on branch pushes (force-push rebases, deploy-key
+# tip updates, compose's own overlay force-with-lease). Those must not attach a
+# "Compose and dispatch integration CI" check to permanent fork/* draft PRs or
+# make layer status look red. Layer green is Fork CI only (Check / Test / Mobile
+# Native Static Analysis / Release Smoke).
+#
+# Full upstream / Tim / candidates restacks stay local and manual
+# (`node scripts/rebase-pr-stack.ts sync --push`). Do not re-enable
+# rebase-pr-stack.yml automation.
+#
+# Overlay branch names below must stay in sync with integrationOverlays in
+# .github/pr-stack.json (workflow `on:` cannot load that file dynamically).
+name: Compose fork integration
+
+on:
+  # Only real merges into product bases — not every tip push / rebase.
+  pull_request:
+    types: [closed]
+    branches:
+      - fork/changes
+      # Registered integration overlays (keep in sync with .github/pr-stack.json)
+      - t3-discord/f7d37879-desktop-deeplinks
+      - fork/discord
+      - fork/vscode
+      - fork/identity
+  workflow_dispatch:
+
+concurrency:
+  # Serialize force-pushes to fork/integration (and overlay auto-rebase).
+  group: fork-integration-compose
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  actions: write
+  pull-requests: read
+
+jobs:
+  compose:
+    name: Compose and dispatch integration CI
+    # Merged PRs only (closed without merge is a no-op). Manual dispatch always runs.
+    # This job is an integration rebuild, not a product-layer quality gate — do not
+    # add it to required status checks for fork/changes or overlay draft PRs.
+    if: >
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request' && github.event.pull_request.merged == true)
+    runs-on: ubuntu-24.04
+    # Overlay rebase + lock regenerate can exceed a short window after large merges.
+    timeout-minutes: 60
+    steps:
+      - name: Checkout fork/changes (compose scripts + manifest)
+        uses: actions/checkout@v6
+        with:
+          ref: fork/changes
+          fetch-depth: 1
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: package.json
+
+      - name: Configure protected stack push key
+        env:
+          FORK_STACK_DEPLOY_KEY: ${{ secrets.FORK_STACK_DEPLOY_KEY }}
+        run: |
+          if [[ -z "${FORK_STACK_DEPLOY_KEY}" ]]; then
+            echo "error: FORK_STACK_DEPLOY_KEY secret is required to push fork/integration and overlays" >&2
+            exit 1
+          fi
+          key_path="${RUNNER_TEMP}/fork-stack-deploy-key"
+          printf '%s\n' "${FORK_STACK_DEPLOY_KEY}" > "${key_path}"
+          chmod 600 "${key_path}"
+          ssh-keyscan -H github.com >> "${RUNNER_TEMP}/github-known-hosts"
+          echo "GIT_SSH_COMMAND=ssh -i ${key_path} -o IdentitiesOnly=yes -o UserKnownHostsFile=${RUNNER_TEMP}/github-known-hosts" >> "${GITHUB_ENV}"
+          git remote set-url origin "git@github.com:${GITHUB_REPOSITORY}.git"
+
+      - name: Rebase registered overlays onto current fork/changes
+        run: |
+          set -euo pipefail
+          # No-op when already based. Force-with-lease updates stale overlay tips so
+          # compose no longer fails after ordinary merges to fork/changes.
+          # Real conflicts hard-fail with the overlay branch + paths (fix that
+          # overlay locally, then re-run this workflow).
+          # Overlay force-pushes here must not re-trigger this workflow (no push: on).
+          node scripts/rebase-integration-overlays.ts
+
+      - name: Compose registered integration overlays
+        env:
+          COMPOSE_WORK_ROOT: ${{ runner.temp }}/compose-work
+        run: |
+          set -euo pipefail
+          # Fetches origin/fork/changes + every registered overlay tip after the
+          # auto-rebase step. Still fails if an overlay has no commits above changes.
+          node scripts/compose-integration-overlays.ts
+          tip="$(git ls-remote origin "refs/heads/fork/integration" | awk '{print $1}')"
+          echo "integration_sha=${tip}" >> "${GITHUB_ENV}"
+          echo "Composed fork/integration tip: ${tip}"
+
+      - name: Dispatch integration CI
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          gh workflow run fork-ci.yml --repo "$GITHUB_REPOSITORY" --ref fork/integration
+          echo "Dispatched Fork CI for fork/integration (tip ${integration_sha:-unknown})."

.github/workflows/deploy-relay.yml

@@ -17,7 +17,8 @@ concurrency:
 jobs:
   deploy_relay:
     name: Deploy production relay
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    if: github.repository == 'pingdotgg/t3code'
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     environment:
       name: production