chore: integrate upstream orchestration V2 into J5

[Jacksondr5]

What Changed

Integrates the frozen upstream orchestration V2 target 62aef8587c0263bed5ae2b26c38d6d138a0676f6 from upstream/t3code/codex-turn-mapping, carrying J5's Squadron ownership, A2A messaging, reversible lifecycle, remote routing and product identity through the server and client changes.

• Reconciles known historical migration sequences with the upstream V2 schema while preserving J5's migration lane.
• Adopts the reviewed upstream tool subset, routes attachments through J5 messaging, registers forks through one shared server boundary, and replaces archive_agent with the adapted organize tool.
• Preserves Squadron creation/scope, human archive preflight, artifacts and environment-qualified identities across the adopted web, desktop and mobile changes.
• Prevents environment balancing from moving a selected Squadron draft. Fixes command-palette identity collisions when two environments have the same raw thread ID.
• Adds Connect → Providers → Projects → Squadrons onboarding. Each selected folder gets one Squadron choice for its imported conversations. People can create additional Squadrons after setup. Retries preserve created identities, established homes stay unchanged, and the landing draft carries the selected Squadron.

Why

This integration is available for maintainer testing. The upstream target is deliberately pinned; this is not a merge of today's upstream main.

Base status: refreshed against J5 5c163724fe (September 23), including the crew/persona stack and artifact corrections. Resolves Bryant's review: crews retain the internal archive engine, spawn provenance and shared runtime services; organize enforces the crew-seat archive rule; Fleet reuses the exported runtime-status helper. The retired archive_agent and t3_thread_wait tools stay absent. Persona settings, crew gates, and mobile outbox behavior are preserved. Carries PR246’s split CI jobs with the vendored-gitlink cleanup retained in every checkout job.

Validation

• Focused migration, orchestration/provider, A2A, MCP registration and client suites passed during the integration milestones. Known-history upgrades were checked on isolated database copies, including rollback and schema comparisons.

• Server, web, desktop and mobile scoped typechecks passed; the web production build passed. Scope-specific lint/format checks passed with existing upstream warnings.

• Latest ownership revision: 145 tests passed. Latest palette correction: 32 tests passed, independently repeated by Fable. Fable reviewed each milestone and approved the final candidate for human testing.

• Real Chromium smoke with two isolated servers: Squadron filtering, new threads and live Codex replies, Files/Artifacts panels, archive/unarchive, owner-only mutation with colliding raw thread IDs, balancing refusal, remote fork registration, and connection removal/re-pairing. The corrected palette selected each same-ID thread on its proper environment without duplicate-key warnings.

• Onboarding update 42a4b9115: 168 focused web tests and 18 backend/client seam tests passed in the final runs; server/web typechecks and scoped format/lint passed (four existing wizard warnings). Separate Fable backend and UI reviews approved the final revision.

• Fresh local Chromium onboarding: Back through all stages preserves choices with no writes before final import; two folders/four conversations received the selected homes. Reimport was idempotent, kept-home results remained visible, injected assignment failure recovered via Retry, and a committed-but-lost create response recovered through explicit Existing selection without a duplicate create. The landing draft completed a live Codex turn. Desktop and narrow layouts were checked after correcting focus-induced clipping.

• Corrected the previous CI TypeScript failure in a fork-owned Codex schema test (dee34dfeb): one as const preserves fixture literals. Six focused tests and that package’s typecheck pass; no runtime/schema change.

• Final setup revision e8bfdbaff: one Squadron per selected folder, with the maintainer’s exact explanatory copy. Independent Fable review verified the single-Squadron implementation; 14 focused onboarding tests passed. Fresh desktop/narrow browser checks confirmed one input per folder, no additional-row controls, unchanged counts on Existing reimport, correct landing home, and no page errors.

• September 20 main refresh: focused server, migration, provider, MCP and client suites pass, with separate Fable backend/UI reviews. Scoped server/web/mobile/client-runtime/shared typechecks pass, and the web production build passes. The independent reviewer ran 337 client tests and 36 backend tests; these overlap the builder/coordinator runs.

• A current-main database snapshot upgraded through the production initializer and reopened successfully: 51 active upstream migration records, all 59 original records retained in the compatibility archive, 13 J5 migration records, SQLite integrity OK and no foreign-key violations. The live install was never written.

• Corrected SSH runner diagnostic fixtures to use the retained J5 executable identity; all 19 runner-process tests pass. No production launcher change.

• Refreshed live Chromium smoke: created a Squadron in a disposable folder, selected Scout, completed a real Codex turn with its read-only persona/model, observed the single missing-handoff reminder and successful ContextBrief artifact, opened that artifact, pinned the thread, archived/restored it with the same identity/home, and loaded the Agents settings/usage/library panel. No authenticated-pass page or console errors. This pass used one local environment; native mobile, cross-environment persona routing, machine delivery and @mention delegation were not exercised live.

• September 23 crew/persona refresh: focused server crew launch, archive, cascade, proposal, lifecycle, MCP registration, persona and migration tests pass; server/web/mobile/client-runtime typechecks pass. Independent Fable client review ran 430 tests and approved the integration. Independent Fable backend review ran 153 tests (one skipped) and approved the resolved merge after correcting obsolete archive-tool guidance. Latest CI status is separate.

• A fresh current-main database snapshot (17 J5 migrations) passed the production initializer twice, integrity and foreign-key checks. All 22 preexisting J5 tables were compared by full-row hashes and remained unchanged. All 59 upstream history rows were retained in the compatibility archive; the active upstream history is 51 by design.

• This refresh has no new browser/native/provider smoke pass; earlier live evidence above applies to its stated revisions.

This is smoke-test evidence, not full acceptance. Native desktop/mobile execution, relay/DPoP refresh, and integrated live attachment delivery, open-Exchange archive notices, deletion, Stop races and merge-back remain untested in this pass. CI/full-suite status is separate.

UI Changes

The browser pass exercised the Squadron scope/picker, ownership refusal controls, panel surfaces and archive view. The built-in preview failed before app load, so the pass used local Chromium. The earlier merge-smoke screenshots are no longer retained. New onboarding before/after evidence is retained locally, including desktop/narrow Squadrons screens and retry/kept results; GitHub images still need attaching because no authenticated asset-upload capability is available in this session. No screenshots or scratch artifacts are committed.

Run locally

Use the repository's pinned Node/package-manager toolchain. From an existing clone:

git fetch origin j5/upstream-sync-20260911
git worktree add ../j5code-upstream-test origin/j5/upstream-sync-20260911
cd ../j5code-upstream-test
vp i
vp run dev --home-dir "$PWD/.j5code"

The explicit home keeps test state in the new worktree. Open the pairing URL printed by the dev runner. On a fresh home, follow the four-stage wizard and assign each selected import folder a Squadron, or skip import and create a Squadron for a disposable folder. Reopen /welcome to test setup on an existing home.

Suggested manual checks: Squadron switching and creation; send/Stop/follow-up; panels; archive and restore with an open question; fork and merge-back; two-environment creation/routing with balancing enabled. The previous test servers and sharing setup are not needed.

Follow-ups: #133–#137 (deferred tools and HTTP integration), #138 (Linux capture identity), #139 (additional balancing transition coverage), #154 (cross-environment draft-chip selection), #179 (archive racing a thread’s first home registration, shared with join_squadron).

Implementation: GPT-6 in the Codex harness; onboarding and main-refresh UI by Fable agents in the Claude Agent harness. Independent milestone reviews: a separate Fable reviewer.

[Jacksondr5]

Pushed Squadron onboarding as 42a4b9115. Reopen /welcome after pulling to exercise Connect → Providers → Projects → Squadrons.

Fable built the UI; the separate reviewer approved backend and final UI after the stale-selection and focus/scroll corrections. Final local checks:168 web tests,18 backend/client seam tests, server/web typechecks, scoped format/lint. Live Chromium verified first import, Back-state preservation, idempotent reimport, immutable-home exception results, assignment retry, lost-create-response recovery without duplication, desktop/narrow layout, and a new live Codex turn under the landing Squadron. No shared-state writes.

Images remain local and need GitHub attachment; this session has no authenticated asset-upload capability. Native desktop/mobile and live remote/relay onboarding were not exercised.

Draft/base conflicts remain unchanged. J5 CI is running on this head. The separate PR-size job failed with spawnSync git ENOBUFS while collecting this large merge diff; tracked in #180. Shared first-home/archive race remains tracked in #179.

Implementation: GPT-6 / Codex, Fable UI builder / Claude Agent; independent Fable reviewer.

[bryantderosier]

Persona and crew impact review

I had this PR reviewed specifically for whether it breaks the J5 persona and crew implementation. Head 3a1ac8c8a against j5/main at 889197681. Read-only review: nothing on the branch was edited.

Verdict

This PR cannot merge as it stands, and after its conflicts are resolved it breaks crews in five concrete places unless the rebaser makes specific fixes. Personas survive.

The root cause is a stale base, not a hostile change. The branch forked from j5/main at 240728c50 (2026-09-20), before all 13 crew and persona commits landed (#145, #146, #147, #148, #149, #150, #151, #152, #183, #185, #191, #192, #219). On this branch there is no crew server code, no crew or fleet UI, no migrations 014 to 017, no persona spawn path, and none of propose_crew, request_crew_member, list_personas, stop_crew, archive_crew. A three-dot diff never shows them because they were never here.

GitHub reports mergeable=CONFLICTING. git merge-tree --write-tree origin/j5/main origin/j5/upstream-sync-20260911 yields 20 conflicted files.

Breaks that survive a mechanical conflict resolution

#	Severity	Break	Where	Fix
H1	High	archive_crew loses its engine. PR deletes ArchiveAgentService.ts and the archive_agent tool in favor of t3_thread_organize. Main's ArchiveCrewService.ts (:17-22, :259, :310, :406), CrewCaptainArchiveCascade.ts:10, CrewArchiveHttp all depend on it.	apps/server/src/j5/a2a/ArchiveAgentService.ts (modify/delete conflict)	Keep ArchiveAgentService as an internal service, drop only the MCP tool. Or port ArchiveCrewService onto the lifecycle path.
H2	High	Crew seat spawn no longer type-checks. PR changes RecordSpawnFactsInput from spawnedByParticipantId to provenance: ParticipantProvenance. Main's CrewLaunchService.ts:469-477 uses the old shape.	apps/server/src/j5/a2a/SpawnCompositionService.ts:15-23 on PR	Pass provenance: { kind: "spawned-by", spawnedByParticipantId, source: "j5_spawn" }, as PR handlers.ts:557-561 already does for spawn_agent.
H3	High	Runtime layer graph re-plumb. PR moves spawn composition, participant placement, and home registration into makeJ5SquadronCreationLayer and removes spawnCompositionProvided plus the trailing placement provision from the auxiliary layer. Main's six crew layers depend on those.	apps/server/src/j5/a2a/runtimeLayer.ts (conflict)	Crew layers must take SpawnCompositionService and ParticipantPlacementService from the creation layer. Tests that build OrchestrationV2LayerLive alone may also need J5SquadronCreationLayer merged in, as the PR's DelegatedCompletionDelivery.test.ts now does.
H4	High	New archive door bypasses the lone-seat rule (Crews AC16). PR's t3_thread_organize dispatches thread.archive and thread.delete through ThreadManagementService with only a same-Squadron check. Main's lone-seat refusal lives in ws.ts (makeCrewSeatArchiveGuard, FORK case 37) and in the removed archive_agent handler.	apps/server/src/j5/a2a/mcp/threadTools.ts:88-134 on PR	Call the crew seat archive guard from the organize handler, or from the ThreadLineage dispatch decorator that sees every door.
P1	High (build)	Client-runtime export removed. PR makes threadRunStatusIsActive module-private (models.ts:72). Main's apps/web/src/j5/crew/crewState.ts:1 imports it (used :5, :40); FleetPage.tsx:29-34 depends on it. No conflict on either file, so the merged tree fails to load. Reproduced: SyntaxError: The requested module '@t3tools/client-runtime/state/models' does not provide an export named 'threadRunStatusIsActive'.	packages/client-runtime/src/state/models.ts:72 on PR	Restore the export, or switch crewState.ts to the exported threadRuntimeIsActive with a matching input shape.
H5	High (docs)	FORK.md numbering collision. Both sides claim "38 cases: 1 to 37 plus 15b" with different contents. Main added 36 (event logger seat ids), 37 (lone-seat guard), the personas table, and the crews paragraph. PR added 35 (fork and merge-back registration), 36 (first-run import homes), moved machine-sender to 37, rewrote 2, 8, 33. PR line 173's archive ruling contradicts main's cascade comment.	FORK.md (conflict)	Renumber PR cases to 38 and 39; keep every main persona and crew paragraph.

Medium

• M1 Orchestration instructions. apps/server/src/provider/T3OrchestrationInstructions.ts conflicts. Main (feat(crews): compose crews in chat and coordinate directly #191) added Crew and Captain paragraphs and the delegate_task versus spawn_agent wording. PR added the ACP prompt wrapper, browser-tool text, and lazy-catalog text. Both are needed; dropping the crew paragraph means Captains never learn propose_crew.
• M2 Allowlists. Main's claudeAllowedTools.ts and codexToolApproval.ts enumerate every J5 verb including archive_agent; tools.test.ts:102-111 asserts the Claude list equals the J5Toolkit names. Both lists must drop archive_agent. PR's new destructive tools (t3_thread_organize, fork, merge_back) are not pre-approved for read-only personas, which is acceptable but means a read-only Captain persona cannot archive via organize.
• M3 registration test. PR still expects t3_thread_wait; main removed it deliberately (Captain starvation ruling). Resolve to main's list minus archive_agent plus the crew tools.
• M4 ws.ts. Main's makeCrewSeatArchiveGuard construction and the j5CrewSeatArchiveGuard(command) call in dispatchCommand, plus the artifact RPC handlers spread, must survive.
• M5 Effect bump 4.0.0-beta.103 to 4.0.0-rc.112. No main-only crew or persona file uses Schema.TaggedErrorClass (crew code uses Data.TaggedError), but only a typecheck of the resolved merge proves compilation.

Client-side conflict map (all mechanical)

• ChatView.tsx: CrewRosterGate JSX auto-survives (merged :9483-9486). Only the import block conflicts; union it.
• SettingsSidebarNav.tsx, settingsSearch.ts: keep Personas, add PR's SnapShot entries; do not restore the old Agents route.
• routeTree.gen.ts: Fleet import and route auto-survive, as do FleetRailEntry and HumanInboxBell in SidebarChrome. Regenerate from combined routes (Personas plus PR's Projects and SnapShot).
• packages/client-runtime/src/j5/state.ts: only the type import conflicts; union it. Crew and Fleet request bodies coexist with assignImportedThreads.
• packages/contracts/src/rpc.ts: auto-merge retains both group merges. Keep J5ArtifactRpcGroup, one ProviderInstanceId import, and PR's ProviderInstanceMutation. j5.artifacts.subscribeChanges does not collide with upstream's artifact method.
• apps/mobile/src/features/threads/use-project-actions.ts: accept the PR's deletion. Main only changed a comment. Persona id flows through PR's persistent outbox (NewTaskFlowProvider, thread-outbox-model, drain, projectThreadStartTurn).
• MessagesTimeline: merged call retains threadRef and markdownCwd, so crew notices keep environment-qualified seat links.

Verified safe on this branch

• J5 MCP surface still registered and merged into McpHttpServer.ts:709-722 (FORK case 2). Contracts of send_message, list_participants, spawn_agent, stop_agent, join_squadron, list_squadrons, clear_own_ask unchanged.
• McpInvocationScope fields unchanged; McpSessionRegistry grants orchestration to every credential; identity resolves via HomeRegistrar.
• delegate_task: agentDelegation.ts and agentInvocation.ts untouched, so main's persona parameter auto-merges. DelegatedCompletionDelivery extended additively. The @persona: mention path on web and mobile inserts text through the shared helper and never calls delegate_task directly.
• Migrations: Sqlite.ts:41-42 still runs upstream then J5 lane; J5 Migrations.ts unchanged, so crew 014 to 017 auto-merge; no upstream object named j5_agent_crew_*; a main database collapses cleanly to upstream 051.
• Persona seams: Orchestrator.ts still imports makeAgentPersonaGuards and carries agentPersonaAssignment in shell and detail projections; Claude and Codex adapters keep persona prompt and allowlist imports. CrewSeatFinishNotifier upstream deps all exist.
• Fleet keying (scopedThreadKey), roster filtering, retired reads (includeRetired:true), and crew stop and archive HTTP routes all independent of the removed archive_agent tool.
• Tool presentation: crew and persona tools were already generic on both sides, never mislabeled as thread or organize tools.

Tests run

• Server side: 14 files, 71 tests passed at PR head (registration, tools, handlers, orchestratorSurface, joinSquadron, codexToolApproval, runtimeLayer, SpawnCompositionService, agentDelegation, agentPersonaLaunch.integration, agentInvocation, DelegatedCompletionDelivery, UpstreamMigrationCompatibility, worktree registration).
• Client side: 21 files, 236 tests passed at PR head (persona contracts, orchestrator and threadMetadata contracts, tool presentation, client persona, mentions, http, state, commands, entities, web persona mention, settings, A2A bell, renderer, thread home, draft scope, mobile picker, project launch, outbox, drain).
• Main's crew tests cannot run on this checkout because that code is absent here. The P1 build break was reproduced by linking the actual merge-tree source.

My call

Do not merge as is. Merge j5/main into this branch, resolve the 20 conflicts using the map above, then apply the five non-conflicting fixes (H1, H2, H3, H4, P1) and the FORK.md renumbering (H5). After that, run the crew and persona focused suites and a server plus web typecheck on the resolved merge before requesting review.

Review by a two-seat crew: Claude Fable 5.1 on the server side, GPT-6-Astra on contracts and clients.

Addendum from the server-side import trace

A scripted sweep resolved every import in the 73 main-only files against the PR head and diffed exports across all 958 PR-changed files (210 lost or privatized an export). It confirmed the list above and added two rebaser traps:

• Crew archive failure contract rides on deleted schemas. PR tools.ts deletes J5ArchiveAgentOpenExchangeFact, J5ArchiveAgentRunningTurnFact, and J5ArchiveAgentFailure. Main tools.ts:376-392 builds J5ArchiveCrewMemberFacts and J5ArchiveCrewFailure on the first two, and main handlers.ts:92-160 projects them. Both files conflict, so taking the PR's deletions wholesale silently drops archive_crew's failure contract. Keep the two fact schemas, renamed crew-neutral if archive_agent goes.
• handlers.ts resolution details. Main moved the spawn id helpers into spawnIds.ts; drop the PR's local copies and import them. The PR narrows requireCallerSquadron to stop_agent only; main needs stop_agent | archive_crew | stop_crew. Keep the spawn_agent crew-membership preflight (main :740-748) and the five crew handlers (main :885-1160).

Also traced and confirmed unchanged for crew code: the thread.create, message.dispatch, thread.archive, and thread.delete command contracts (only optional fields added), the ThreadManagementService methods crew services call, ProjectionStoreThreadNotFoundError, and the shared J5 ledger, delivery, home registrar, and send services. There is no server analogue of the client-side export privatization.