chore: reconcile origin/main into dev (14 out-of-band commits)#1302
Merged
Conversation
…ion (#1139) (#1192) (#1193) Replace Polyform Noncommercial 1.0.0 with the verbatim Apache License 2.0 (copyright 2025-2026 Ability AI) and update every license reference: - LICENSE: verbatim Apache 2.0 text, appendix copyright line filled in - NOTICE: added per Apache 2.0 convention - README.md: badge -> Apache 2.0, tagline reframed from source-available to open source, License section rewritten (commercial-licensing paragraph reframed around enterprise modules) - CONTRIBUTING.md: inbound-contribution terms now Apache 2.0 Section 5 - AGENTS.md, docs/onboarding/00-welcome.md: license mentions updated - src/mcp-server/package.json: license MIT -> Apache-2.0 - src/cli/pyproject.toml + src/cli/README.md: license MIT -> Apache-2.0 (same inconsistency class as the MCP server, found during audit) grep -ri "polyform|noncommercial" returns no stale references. Fixes #1139 Co-authored-by: Eugene Vyborov <eugene@beingluminous.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
) (#1226) The in-app Help chat widget (HelpChatWidget.vue) fetches the public docs Q&A Cloud Function, but the prod and dev Content-Security-Policy connect-src directives only allowed 'self' ws: wss: — so the browser blocked every request with "Refused to connect ... violates CSP" and the widget failed with TypeError: Failed to fetch. Add the specific Cloud Function origin (narrow allowlist, no wildcard) to connect-src in both CSP sources: - src/frontend/security-headers.conf (prod nginx) - src/frontend/vite.config.js (dev server) ws:/wss: preserved, so WebSocket real-time delivery is unaffected. Verified the endpoint returns permissive CORS (ACAO: *, POST/OPTIONS, Content-Type) and answers HTTP 200 to the widget's {question} schema, so no CORS preflight surfaces as a follow-on blocker. Fixes #1224 Co-authored-by: Eugene Vyborov <eugene@beingluminous.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
#1222) Both checks were required on `dev` but path-filtered via `on.pull_request.paths`, so they never posted a status on PRs that don't touch DB/docker paths — leaving the required context "expected" forever and freezing the entire dev merge queue (admin override blocked too via enforce_admins). Move the path filter from the workflow trigger to a cheap `changes` detector (dorny/paths-filter) + job-level `if:`. A job skipped via `if:` still posts a check run (conclusion: skipped), which branch protection counts as passing — so the required context is always present, while the heavy job runs only when the relevant surface changes. Intent preserved: schema-parity still blocks real schema drift on `src/backend/db/**`; verify-non-root still blocks root/socket regressions on `docker/**`. Self-merging: this PR edits both workflow files (each filter includes its own path), so both real jobs run here and post all four required contexts — no branch-protection change or admin override needed. Fixes #1222 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…im-main fix(ci): gate required schema-parity & verify-non-root via changes job (#1222) — main
Swap the README explainer image for the refreshed Trinity Explainer thumbnail (same 1280x720 path docs/assets/trinity-explainer.gif). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
docs(readme): update trinity-explainer demo gif
Bumps [hono](https://github.com/honojs/hono) from 4.12.11 to 4.12.25. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.11...v4.12.25) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.25 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(deps): Dependabot auto-merge for low-risk PRs + grouping (#1243) Adds .github/workflows/dependabot-auto-merge.yml — zero-touch merge for Dependabot semver patch/minor only (all majors held). Gates on build + pytest in-workflow; a machine PAT (DEPENDABOT_AUTOMERGE_TOKEN, stored as a Dependabot secret) supplies the required approval since GITHUB_TOKEN can't, then --auto --squash (CodeQL still enforced by branch protection). dependabot.yml: group github-actions bumps into one weekly PR; cover the previously-uncovered /tests/git-sync npm dir (source of esbuild alert #152). Refs #1243 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci(deps): scope main PR to dependabot.yml only — drop auto-merge workflow (review #1244) Per dolho's review and the conscious decision on #1243: auto-merge is dev-only. main must NOT carry zero-touch merge machinery (a security PR to main could auto-publish trinity-cli to PyPI unattended). This PR now ships only the dependabot.yml grouping + /tests/git-sync coverage, which must live on main since Dependabot reads config from the default branch. The (dev-guarded) workflow reaches main later via the normal release, inert for main PRs. Refs #1243 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Eugene Vyborov <eugene@beingluminous.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) to 8.0.16 and updates ancestor dependency [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). These dependencies need to be updated together. Updates `vite` from 5.4.21 to 8.0.16 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) Updates `vitest` from 3.2.6 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/vitest) --- updated-dependencies: - dependency-name: vite dependency-version: 8.0.16 dependency-type: indirect - dependency-name: vitest dependency-version: 4.1.9 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
) Bumps [undici](https://github.com/nodejs/undici) from 7.24.7 to 7.28.0. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.24.7...v7.28.0) --- updated-dependencies: - dependency-name: undici dependency-version: 7.28.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
) Bumps [hono](https://github.com/honojs/hono) from 4.12.18 to 4.12.25. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.18...v4.12.25) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.25 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [form-data](https://github.com/form-data/form-data) from 4.0.5 to 4.0.6. - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) --- updated-dependencies: - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
) Bumps [dompurify](https://github.com/cure53/DOMPurify) from 3.4.8 to 3.4.11. - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.8...3.4.11) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.11 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Remove imports that are imported but unused (ruff F401): - docker (imported but unused) - pathlib.Path (imported but unused) - services.docker_service.docker_client (imported but unused) - services.docker_utils.container_reload (imported but unused) - services.docker_utils.volume_get (imported but unused) - services.docker_utils.volume_remove (imported but unused) - services.image_generation_prompts.AVATAR_EMOTIONS (imported but unused) - services.git_service (imported but unused) - services.agent_service.get_agents_by_prefix (imported but unused) - services.agent_service.get_next_version_name (imported but unused) - services.agent_service.get_latest_version (imported but unused) - services.agent_service.check_shared_folder_mounts_match (imported but unused) - services.agent_service.check_api_key_env_matches (imported but unused) - services.agent_service.recreate_container_with_updated_config (imported but unused) Fixes #984 Co-authored-by: chrisyangxiaoqi <chrisyangxiaoqi@github.com> Co-authored-by: Eugene Vyborov <1073874+vybe@users.noreply.github.com>
…ity bumps, CI shims, license, CSP) # Conflicts: # .github/workflows/container-security.yml # .github/workflows/schema-parity.yml # src/frontend/security-headers.conf # src/frontend/vite.config.js # tests/git-sync/package-lock.json # tests/git-sync/package.json
vybe
enabled auto-merge
June 22, 2026 09:02
webmixgamer
approved these changes
Jun 22, 2026
webmixgamer
left a comment
webmixgamer
left a comment
Contributor
There was a problem hiding this comment.
Approved via /validate-pr — clean main→dev reconciliation.
Net diff (5 files): security dep bumps resolving the HIGH npm advisories in #1300 (hono 4.12.25, undici 7.28.0, form-data 4.0.6, dompurify 3.4.11) + the verified-safe #984 unused-import cleanup in routers/agents.py.
Verified: all 12 removed symbols have 0 usages in the merged file; merged agents.py compiles; new top-level heartbeat_service import creates no cycle; all 6 conflict resolutions confirmed (dev supersedes — CSP supersets #1224, schema-parity/container-security keep the #1223 self-skip). All 16 CI checks green.
Merging with a merge commit (NOT squash) so main's 14 commits become ancestors of dev and origin/dev..origin/main drops to 0.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reconcile
origin/mainintodev(release pre-req)origin/mainhad drifted 14 commits ahead ofdev— out-of-band work pushed directly tomainthat was never back-merged. The nextdev → mainrelease PR would have conflicted on these. This PR brings all 14 ontodevso the release path is clean.What main contributed (now on dev)
undici7.24.7 → 7.28.0 (mcp-server, chore(deps): bump undici from 7.24.7 to 7.28.0 in /src/mcp-server #1289)form-data4.0.5 → 4.0.6 (frontend, chore(deps): bump form-data from 4.0.5 to 4.0.6 in /src/frontend #1254)dompurify3.4.8 → 3.4.11 (frontend, chore(deps): bump dompurify from 3.4.8 to 3.4.11 in /src/frontend #1291)hono→ >=4.12.25 (mcp-server, chore(deps): bump hono from 4.12.11 to 4.12.25 #1220/chore(deps): bump hono from 4.12.18 to 4.12.25 in /src/mcp-server #1255)vite/vitestbumps in/tests/git-sync(chore(deps): bump vite and vitest in /tests/git-sync #1248)schema-parity/verify-non-root(bug(ci): path-filtered checks made required freeze the dev merge queue #1222)connect-src(bug: Help chat (Ask Trinity) blocked by CSP — connect-src omits ask-trinity Cloud Function #1224)Conflict resolution (6 files, all → dev's version)
Every conflict was a case where main made an earlier/lesser change and dev already had the later/superset version, so all six resolved to dev (HEAD) — main's unique value (the dep bumps + license + import cleanup above) came in via clean auto-merge, not the conflicts:
schema-parity.yml,container-security.yml— dev's inlinegit diffself-skip rewrite (#1223) supersedes main's earlierdorny/paths-filterversion of the same bug(ci): path-filtered checks made required freeze the dev merge queue #1222 fix (taking dev's avoids a Frankenstein job graph)security-headers.conf,vite.config.js— dev's CSP already supersets main's (has bothcloudfunctions.netandintake.abilityai.dev)tests/git-sync/package.json+ lockfile — dev's deps are strictly newer and include thevitest ^4.1.9main wantedMerge with a merge commit — do NOT squash. A squash gives main's content a new SHA, leaving the SHA-based
origin/dev..origin/maindivergence check still firing at release time. A merge commit makes main's actual commits ancestors ofdevand drives the divergence to zero.No release is being cut here — this is reconciliation only.