upstream-sync

Reviewing upstream framework updates involves fetching remote changes, summarizing categorized diffs into JSON, and explaining modifications in plain English for explicit approval. The process prevents unexpected modifications by never auto-merging and requiring user confirmation before applying anything.

An npm audit security gate runs at a moderate severity threshold during the update process and blocks the merge if vulnerabilities are found. This ensures upstream changes containing known security issues cannot be applied to your framework.

No, automatic syncing without manual approval is not supported. The process is strictly approval-gated, meaning it only applies updates when you explicitly confirm them, preventing unexpected changes to the framework.

After an upstream merge is applied, post-merge verification ensures builds and tests pass and reports the results. This includes reporting any implications for template or bootstrap files affected by the framework update.

Yes, operational safeguards respect configured day_mode_start and day_mode_end times to avoid applying changes during night mode windows. This prevents disruptive framework updates during off-hours.