Summary

Lays the foundation for three linked pieces of ROADMAP work without any functional change:

• packages/bcode-browser/ — empty Level-1 package (decisions.md §1d). This is where all substantial BrowserCode code lives: vendored harness (A2), browser_execute body (A4), FetchUse.Service (B1), cloud integrations (Phase D). Integration into packages/opencode stays Level 2 (one-line hooks).
• UPSTREAM.md at repo root — single source of truth for (1) modification zones (red/yellow/green policy) and (2) sync log across both upstreams (anomalyco/opencode and browser-use/browser-harness). Append a row here every time you pull.
• script/check-upstream.sh — reads the last To SHA from UPSTREAM.md and reports drift. Current output: 72 commits behind upstream/dev since 3e8abac6 (baseline/pre-rename).

Verification

• bun install clean (38 resolved, no breakage).
• bun run dev --help still renders the BROWSERCODE banner + full bcode command list.
• script/check-upstream.sh runs end-to-end against the real upstream.

Next

After this lands:

• A2 will populate packages/bcode-browser/harness/ from browser-use/browser-harness and fill in the first row of the harness sync-log table.
• F4 adds @browser-use/bcode-browser to the browsercode-packages turbo filter.
• F7 begins the core-CLI phone-home triage, logging each modification in EXCEPTIONS.md.

Notes

• Branch and npm name both bcode-browser to disambiguate from the Browser Use brand / npm org / OSS library. "browser-use broke" is ambiguous; "bcode-browser broke" is not.
• Upstream default branch is dev, not main — UPSTREAM.md records this; our default stays main.
• .gitkeep in harness/ so the empty dir tracks; will be deleted when the harness lands in A2.