framework-upstream-auto-update

Automating upstream framework updates safely fetches upstream/main, classifies commits, and applies only bugfix, docs, or chore changes. Feature-level changes and guardrail-touching paths route to the Orchestrator for human approval to prevent breaking changes.

Commit classification during upstream sync categorizes new commits into bugfix, docs/chore, or feature/mixed types. This ensures only safe updates auto-merge while feature work escalates for manual review.

Build verification runs npm install, npm audit at moderate+, npm run build, and npm test automatically before reporting results. This safety gate activates only when CORTEXTOS_CONFIRM_UPSTREAM_MERGE equals yes.

Daily git upstream checks run via cron and enforce hard path guardrails to never auto-apply changes to environment or agent config files. Any guardrail-touching commit routes to the Orchestrator.

Feature-level upstream commits should route to an orchestrator instead of auto-merging when they introduce new functionality or mixed changes. This escalation also triggers for any build, test, or npm audit failure.

When npm test or npm run build fails during an automated upstream update, the Skill halts the auto-merge and sends a summary to the Orchestrator. This prevents broken upstream changes from entering your main branch.