# Mattermost Push Proxy Upstream

`services/push-proxy/` is derived from the mattermost-push-proxy repository.

- Source: `https://github.com/mattermost/mattermost-push-proxy.git`
- Branch: `master`
- Snapshot commit: `7852e23b8f7786d7ff1ad5062aa0a9424babd84f`
- Snapshot date: `2026-05-30`
- Snapshot source: `.upstream/mattermost/mattermost-push-proxy/`
- Snapshot target: `services/push-proxy/`

## Current Baseline Choice

`services/push-proxy` is tracked as a source snapshot mirror, not as image-only
metadata. Nexo runtime images are built from this source snapshot and recorded
separately as deployment evidence.

Image-only tracking is allowed only after a separate roadmap decision when no
local source build, patch, config packaging, or smoke diagnosis needs the
source snapshot.

## Patch Boundary

Keep nexo-specific changes outside this snapshot where possible. Prefer compose
configuration, docs, wrapper scripts, and small explicit compatibility patches.

Do not absorb push-proxy into `services/core`, rename upstream-owned packages in
bulk, or reshape the repository without a separate fork decision and rollback
path.

## Update Gate

A push-proxy snapshot update must stay separate from core and Mattermost mobile
app updates. Before a merge request, record the selected upstream commit,
review the snapshot diff, run the relevant push-proxy or compose smoke, and
classify any failure as `push-proxy`, `server`, `SDK contract`, or `infra`.

When runtime images change, keep image tag and digest evidence in
`docs/runtime-image-validation.md`; the source baseline remains this file.