lgarceau768 · Oct 8, 2026 · Oct 8, 2026 · Oct 8, 2026 · Oct 8, 2026 · Oct 8, 2026
diff --git a/.github/upstream-sync-accept-upstream.txt b/.github/upstream-sync-accept-upstream.txt
@@ -0,0 +1,16 @@
+# Paths where taking upstream's version during a sync is CORRECT, and
+# scripts/upstream-sync.sh verify should therefore not treat it as a dropped
+# Flexion change.
+#
+# One path per line, exact match against a repository-relative path. Comments
+# start with #. Keep this list short: every entry is a Flexion change you are
+# agreeing to lose, so each one needs a reason next to it and should be removed
+# again once it no longer applies.
+#
+# Add a path here only in the same PR that takes upstream's version, so the
+# decision shows up in review as a visible diff instead of a silent revert.
+
+# Lock files are regenerated, never hand-merged. Upstream's is the right base;
+# if flex changed dependencies, regenerate after the sync.
+package-lock.json
+uv.lock
diff --git a/.github/workflows/upstream-sync-verify.yml b/.github/workflows/upstream-sync-verify.yml
@@ -0,0 +1,49 @@
+name: Upstream Sync Verify
+
+# The gate that was missing. "Upstream Sync" prepares a merge; a human then
+# resolves conflicts and pushes. Until now nothing re-checked that result —
+# backend.yaml/frontend.yaml only run on main and dev, so a sync PR into `flex`
+# had no CI at all, and two Flexion features reached `flex` silently deleted.
+#
+# This runs scripts/upstream-sync.sh verify on every push to an upstream-sync PR,
+# so the no-silent-drop and no-conflict-marker checks apply to what a human
+# actually ends up merging, not only to what the bot first produced.
+
+on:
+  pull_request:
+    branches: [flex]
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    if: startsWith(github.head_ref, 'upstream-sync/')
+    runs-on: ubuntu-latest
+    env:
+      FLEX_REF: origin/flex
+      OUT_DIR: ${{ runner.temp }}/upstream-sync
+    steps:
+      - name: Checkout the PR head with full history
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Fetch upstream tags
+        run: |
+          git remote add upstream https://github.com/open-webui/open-webui.git
+          git fetch upstream --tags --prune --force
+
+      - name: Verify
+        # The target tag and the flex tip the sync was cut from are read from the
+        # merge commit's trailers, so this needs no inputs and cannot drift from
+        # what the merge actually did.
+        run: scripts/upstream-sync.sh verify
+
+      - name: Upload verify log
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: upstream-sync-verify
+          path: ${{ runner.temp }}/upstream-sync
+          if-no-files-found: ignore