Keep upstream clean. Expect downstream conflicts.

Do not initialize this site directory and copy T3 Code into it. That would mix a static specification with the product monorepo and weaken upstream provenance.

Run this only with a new, empty writable product repository after its URL, approved upstream SHA, acceptance date, fork version, and branch-protection policy are decided. Replace all placeholders before execution.

# Clone upstream history, then assign conventional remote ownership.
git clone --single-branch --branch main \
  https://github.com/pingdotgg/t3code.git t3-trades
cd t3-trades
git remote rename origin upstream
git remote add origin https://github.com/<YOUR_ORG>/t3-trades.git

# Fetch only upstream main; make accidental upstream pushes fail.
git config remote.upstream.fetch \
  "+refs/heads/main:refs/remotes/upstream/main"
git remote set-url --push upstream DISABLED
git config remote.pushDefault origin
git fetch --prune upstream

# Create product main from the explicitly approved upstream baseline.
APPROVED_SHA="<FULL_APPROVED_UPSTREAM_SHA>"
ACCEPTANCE_DATE="<YYYY-MM-DD>"
FORK_VERSION="<T3_TRADES_FORK_VERSION>"
git cat-file -e "${APPROVED_SHA}^{commit}"
if ! git merge-base --is-ancestor "$APPROVED_SHA" upstream/main; then
  echo "Approved SHA is not an ancestor of upstream/main; stop." >&2
  exit 1
fi
BASE_SHORT_SHA="$(git rev-parse --short=8 "$APPROVED_SHA")"
BASE_TAG="upstream-base/${ACCEPTANCE_DATE}-${BASE_SHORT_SHA}"
git switch -C main "$APPROVED_SHA"

# Publish product main, then propose the canonical baseline record.
git push -u origin main
DOWNSTREAM_MAIN_SHA="$(git rev-parse main)"
git switch -c "feature/trading-baseline-${BASE_SHORT_SHA}" main
mkdir -p docs/upstream
printf '%s\n' \
  "# Accepted upstream baseline" \
  "" \
  "- Accepted upstream SHA: \`$APPROVED_SHA\`" \
  "- Downstream main SHA: \`$DOWNSTREAM_MAIN_SHA\`" \
  "- Accepted tag: \`$BASE_TAG\`" \
  "- Acceptance date: \`$ACCEPTANCE_DATE\`" \
  "- Fork version: \`$FORK_VERSION\`" \
  > docs/upstream/BASELINE.md
git add docs/upstream/BASELINE.md
git commit -m "Document initial accepted upstream baseline"
git push -u origin "feature/trading-baseline-${BASE_SHORT_SHA}"
# Stop. Review and accept this baseline-record PR before publishing the tag.

After the initial baseline record is accepted · fresh shell

Re-enter the approved values, verify that the reviewed record is now on origin/main, and only then publish the immutable tag.

set -eu
git fetch --prune origin \
  "+refs/heads/main:refs/remotes/origin/main"
APPROVED_SHA="<FULL_APPROVED_UPSTREAM_SHA>"
ACCEPTANCE_DATE="<YYYY-MM-DD>"
FORK_VERSION="<T3_TRADES_FORK_VERSION>"
BASE_SHORT_SHA="$(git rev-parse --short=8 "$APPROVED_SHA")"
BASE_TAG="upstream-base/${ACCEPTANCE_DATE}-${BASE_SHORT_SHA}"

if ! git merge-base --is-ancestor "$APPROVED_SHA" origin/main; then
  echo "Approved upstream SHA is not contained in origin/main; stop." >&2
  exit 1
fi
BASELINE_RECORD="$(git show origin/main:docs/upstream/BASELINE.md)"
printf '%s' "$BASELINE_RECORD" | grep -F -- "$APPROVED_SHA" >/dev/null
printf '%s' "$BASELINE_RECORD" | grep -F -- "$BASE_TAG" >/dev/null
printf '%s' "$BASELINE_RECORD" | grep -F -- "$FORK_VERSION" >/dev/null
if git rev-parse -q --verify "refs/tags/${BASE_TAG}" >/dev/null ||
   git ls-remote --exit-code --tags origin \
     "refs/tags/${BASE_TAG}" >/dev/null 2>&1; then
  echo "Accepted baseline tag already exists; stop rather than overwrite it." >&2
  exit 1
fi
git tag -a "$BASE_TAG" "$APPROVED_SHA" \
  -m "Accepted T3 Code baseline ${APPROVED_SHA} for ${FORK_VERSION}"
git push origin "$BASE_TAG"

The DISABLED push URL makes an accidental upstream push fail. Repository permissions remain the authoritative enforcement layer.

1. Observe.Fetch and record the previous accepted SHA, observed upstream/main SHA, commit range, release notes, migrations, and changed high-risk seams.
2. Verify.Confirm upstream/main descends from the prior accepted tag. Any rewritten or missing ancestry stops the batch for provenance review.
3. Isolate.Create sync/upstream-YYYY-MM-DD-<shortSHA> from local main; merge the captured upstream SHA—not the moving ref—with a merge commit.
4. Resolve.Named owners resolve textual conflicts and inspect semantic overlap even when Git reports no conflict.
5. Test.Run upstream build, typecheck, lint, and tests plus T3 Trades strategy, authority, signing, idempotency, reconciliation, recovery, and provider-conformance suites.
6. Accept or reject.Review the sync pull request into main. If accepted, review the canonical baseline-record update, then publish its immutable tag. If rejected, close the batch without changing either record or tag.

The exact packageManager, Node engine, and script definitions at the candidate accepted upstream SHA are authoritative. The commands below match the upstream observed on 28 July 2026; inspect the captured SHA before every batch and update the runbook when its repository scripts change.

Before the sync pull request

Capture and print the immutable upstream SHA. Copy it into the pull-request ledger; do not expect a shell variable to survive review.

set -eu
git fetch --prune upstream \
  "+refs/heads/main:refs/remotes/upstream/main"
git switch main
git pull --ff-only origin main

# Capture immutable endpoints before creating the review branch.
PREVIOUS_BASE_TAG="<CURRENT_UPSTREAM_BASE_TAG>"
PREVIOUS_BASE_SHA="$(git rev-list -n 1 "$PREVIOUS_BASE_TAG")"
OBSERVED_SHA="$(git rev-parse upstream/main)"
if ! git merge-base --is-ancestor "$PREVIOUS_BASE_SHA" "$OBSERVED_SHA"; then
  echo "Observed upstream does not descend from the accepted base; stop." >&2
  exit 1
fi

SYNC_DATE="$(date -u +%F)"
OBSERVED_SHORT_SHA="$(git rev-parse --short=8 "$OBSERVED_SHA")"
SYNC_BRANCH="sync/upstream-${SYNC_DATE}-${OBSERVED_SHORT_SHA}"
git switch -c "$SYNC_BRANCH"
git merge --no-ff "$OBSERVED_SHA"

# Resolve owned conflicts and update the patch ledger, then run both suites.
corepack enable
corepack install
pnpm install --frozen-lockfile
pnpm run typecheck
pnpm run lint
pnpm run test
# Run the T3 Trades conformance command selected in Phase 0.

git push -u origin "$SYNC_BRANCH"
printf 'Copy to the PR ledger:\nOBSERVED_SHA=%s\nSYNC_BRANCH=%s\n' \
  "$OBSERVED_SHA" "$SYNC_BRANCH"

After the sync pull request is accepted · fresh shell

Copy the full observed upstream SHA and the exact accepted sync merge commit SHA from the accepted pull request and its ledger. Do not infer either value from the current local HEAD.

set -eu
git fetch --prune origin \
  "+refs/heads/main:refs/remotes/origin/main"

# Paste immutable values from the accepted PR and ledger.
ACCEPTED_OBSERVED_SHA="<FULL_OBSERVED_UPSTREAM_SHA>"
ACCEPTED_SYNC_MERGE_SHA="<FULL_ACCEPTED_SYNC_MERGE_COMMIT_SHA>"
ACCEPTED_DATE="<YYYY-MM-DD>"
FORK_VERSION="<T3_TRADES_FORK_VERSION>"

git cat-file -e "${ACCEPTED_OBSERVED_SHA}^{commit}"
git cat-file -e "${ACCEPTED_SYNC_MERGE_SHA}^{commit}"
if ! git merge-base --is-ancestor \
  "$ACCEPTED_SYNC_MERGE_SHA" origin/main; then
  echo "Accepted sync merge is not contained in origin/main; stop." >&2
  exit 1
fi
if ! git merge-base --is-ancestor \
  "$ACCEPTED_OBSERVED_SHA" "$ACCEPTED_SYNC_MERGE_SHA"; then
  echo "Observed upstream SHA is not contained in the accepted merge; stop." >&2
  exit 1
fi

OBSERVED_SHORT_SHA="$(git rev-parse --short=8 "$ACCEPTED_OBSERVED_SHA")"
BASE_TAG="upstream-base/${ACCEPTED_DATE}-${OBSERVED_SHORT_SHA}"

# Propose the canonical provenance record before publishing its tag.
git switch --detach origin/main
git switch -c "feature/trading-baseline-${OBSERVED_SHORT_SHA}"
mkdir -p docs/upstream
printf '%s\n' \
  "# Accepted upstream baseline" \
  "" \
  "- Accepted upstream SHA: \`$ACCEPTED_OBSERVED_SHA\`" \
  "- Downstream main SHA: \`$ACCEPTED_SYNC_MERGE_SHA\`" \
  "- Accepted tag: \`$BASE_TAG\`" \
  "- Acceptance date: \`$ACCEPTED_DATE\`" \
  "- Fork version: \`$FORK_VERSION\`" \
  > docs/upstream/BASELINE.md
git add docs/upstream/BASELINE.md
git commit -m "Document accepted upstream baseline"
git push -u origin "feature/trading-baseline-${OBSERVED_SHORT_SHA}"
# Stop. Review and accept this baseline-record PR before publishing the tag.

After the updated baseline record is accepted · fresh shell

Re-enter the two accepted commit SHAs and the record metadata. Verify both ancestry relationships and the reviewed canonical record before publishing the tag.

set -eu
git fetch --prune origin \
  "+refs/heads/main:refs/remotes/origin/main"
ACCEPTED_OBSERVED_SHA="<FULL_OBSERVED_UPSTREAM_SHA>"
ACCEPTED_SYNC_MERGE_SHA="<FULL_ACCEPTED_SYNC_MERGE_COMMIT_SHA>"
ACCEPTED_DATE="<YYYY-MM-DD>"
FORK_VERSION="<T3_TRADES_FORK_VERSION>"

if ! git merge-base --is-ancestor \
  "$ACCEPTED_SYNC_MERGE_SHA" origin/main; then
  echo "Accepted sync merge is not contained in origin/main; stop." >&2
  exit 1
fi
if ! git merge-base --is-ancestor \
  "$ACCEPTED_OBSERVED_SHA" "$ACCEPTED_SYNC_MERGE_SHA"; then
  echo "Observed upstream SHA is not contained in the accepted merge; stop." >&2
  exit 1
fi
OBSERVED_SHORT_SHA="$(git rev-parse --short=8 "$ACCEPTED_OBSERVED_SHA")"
BASE_TAG="upstream-base/${ACCEPTED_DATE}-${OBSERVED_SHORT_SHA}"
BASELINE_RECORD="$(git show origin/main:docs/upstream/BASELINE.md)"
printf '%s' "$BASELINE_RECORD" | grep -F -- "$ACCEPTED_OBSERVED_SHA" >/dev/null
printf '%s' "$BASELINE_RECORD" | grep -F -- "$ACCEPTED_SYNC_MERGE_SHA" >/dev/null
printf '%s' "$BASELINE_RECORD" | grep -F -- "$BASE_TAG" >/dev/null
printf '%s' "$BASELINE_RECORD" | grep -F -- "$FORK_VERSION" >/dev/null
if git rev-parse -q --verify "refs/tags/${BASE_TAG}" >/dev/null ||
   git ls-remote --exit-code --tags origin \
     "refs/tags/${BASE_TAG}" >/dev/null 2>&1; then
  echo "Accepted baseline tag already exists; stop rather than overwrite it." >&2
  exit 1
fi
git tag -a "$BASE_TAG" "$ACCEPTED_OBSERVED_SHA" \
  -m "Accepted upstream ${ACCEPTED_OBSERVED_SHA} via ${ACCEPTED_SYNC_MERGE_SHA}"
git push origin "$BASE_TAG"

The author of a conflict resolution does not provide its only approval. Safety-critical and shared-contract changes require an independent reviewer.

Observed 28 July 2026 (Asia/Kolkata). The audited baseline is a direct ancestor of the then-current observed upstream head.

git merge-base --is-ancestor \
  55dd01612efc51e19de479da5a0e348cbe2521e3 \
  887dd6e455bb969c1a0c9659a6bdf2baceac030d

git rev-list --left-right --count \
  55dd01612efc51e19de479da5a0e348cbe2521e3...\
887dd6e455bb969c1a0c9659a6bdf2baceac030d
# Expected on 28 July 2026: 0  2