Repository navigation
[MEDIUM] Update pstack and add formal verification skills - #2
Merged
fitziboy3-source merged 79 commits intoOct 20, 2026
Merged
Conversation
release: Open Pstack 1.8.0 with the model catalog and the Windows SessionStart fix (ericlitman#174)
…iclitman#54) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…riclitman#54) docs/reference.md and the README described the native agents as Fable and Opus only, using the rolling alias. Each Claude family in the catalog now ships agents, and a registered exact pin keeps its own model. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…riclitman#69) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…r, and widen the pin scan (ericlitman#54) The new-families setup case checked only the rewritten sheet, so a run that probed Sonnet or the pin through the rolling Opus agent still passed. It now requires the Claude Agent calls to pstack-opus-5-5-max and pstack-sonnet-max, and a complete runner receipt for each external probe in its own empty probes directory. The three setup cases that remove Codex's AGENTS.md mirror now check that setup wrote it back as the sheet's exact bytes. The Claude pin scan covers Sonnet, and it removes only the registered pin's token before matching, so another pin on the same line still fails. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…access (ericlitman#80) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… mirror exactly (ericlitman#54) Step back on head 2's probe check, which inferred setup's internal probes from transcripts and kept growing variants (nested or extensionless receipts, wrong effort, undrained background agents). It is gone. A catalog case on Claude now dispatches pstack-sonnet-max and pstack-opus-5-5-max, and each child writes a fixture nonce it read, with its tool calls recorded under its Agent call. The Codex mirror check follows setup's contract exactly: one marker pair, and the sheet's exact bytes after the begin marker's newline. The pin scan's exemption ends only at a character that cannot continue a model ID. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…l overrides, tighten the mirror and pin scans (ericlitman#54) The new-families setup case now feeds a versioned Sonnet, which this PR's setup migration must write as claude:sonnet. The native-agents case rejects an Agent call that overrides the model. The mirror check counts a stray begin marker even without its newline, and the second pin scan no longer depends on the file path having no colon. ericlitman#54's acceptance criteria are corrected: setup's probe routes are not this PR's change, and the new routes are proven by the native-agents and runner cases. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…onnet feat(registry): add GPT-6 Luna, Sonnet and the exact Opus 5.5 pin (ericlitman#54)
Brings in ericlitman#54's head 4. The read-only-provider setup case now follows the same rule as new-families: it checks the written sheet and, on Codex, the mirror block, and drops its command-text check that the session ran pstack-runner. The runner feature proves the Devin route. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Brings in PR ericlitman#182's merge commit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…and widen setup's writer roles (ericlitman#69) A Devin lane bypasses workspace trust, and Devin loads a project's .devin/config.json hooks and permissions and its .devin/mcp_config.json servers, with no key to turn them off. The runner now refuses a Devin lane whose cwd or any parent up to the git root holds .devin/, through an adapter-declared projectConfigDir checked before launch. An interruption is a cancellation only when Devin writes it as a system step. Setup refuses a read-only provider for every writer role: the four playbook roles, hardest tasks, arena runners and swarm workers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…he refusal live, and guard only .devin directories (ericlitman#69) Architect runs Arena with its own runners, which write to their own output locations, so setup's writer roles include architect runners. A new setup case assigns bug-fix to Devin and requires setup's refusal with no configuration change, so the live gate tests the new rule. The project-config guard refuses only a .devin directory; a plain file holds no Devin config. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat(runner): add a read-only Devin provider with SWE-2 and SWE-1.6 (ericlitman#69)
…riter Brings in ericlitman#69's heads 2 and 3: the .devin/ guard and projectConfigDir, the widened writer roles, and the writer-refusal setup case. The keep-setting case now checks the Codex mirror like every case that removes it, and the refusal case's role constant is renamed to REFUSED_ROLE beside ericlitman#80's WRITER_ROLE. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Brings in PR ericlitman#183's merge commit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…nts keep writers bounded unless opted in (ericlitman#80) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…s setting, and parse quoted paths with newlines (ericlitman#80) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…access-writer feat(runner): let a model-sheet setting give Codex writer lanes full access (ericlitman#80)
…iclitman#185) Unfret registers one check per root package.json script and runs it with the packageManager named there. open-pstack had no root package.json, so each focal review lane ran bun install and the tests through run_command. The root scripts are CI's verify steps: test, typecheck and static. CI now calls them, so the reviewers and CI run one definition, and setup-bun reads the Bun version from packageManager instead of a second pin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…tman#185) Both paths were unmapped, so a PR touching either failed closed before any install. CI now runs the root scripts, which include the verifier's own tests, so both are verifier enforcement like tests/skill-collision-repro.sh: a change to either selects project-skill and cannot pass as no runtime change. The fail-closed case for unregistered workflows keeps a new workflow path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…unset (ericlitman#185) Unfret runs a registered check with only PATH, HOME, TMPDIR and locale variables, so run_check static failed 23 verifier tests on isolatedEnv's "Real USER and LOGNAME are required". The test script now supplies the account from id -un when the environment has none. The live verifier's guard is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…-scripts build: add root check scripts so Unfret registers and shares open-pstack's checks (ericlitman#185)
… and Codex full access (ericlitman#190) Bumps the manifests, marketplace entry and version lines to 1.9.0 and adds the 1.9.0 CHANGES.md section, written from PRs ericlitman#182 (ericlitman#54), ericlitman#183 (ericlitman#69) and ericlitman#184 (ericlitman#80), with one line for PR ericlitman#186 (ericlitman#185). The Cursor sync point stays at pstack 0.15.20. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…itman#172) The host's global git config routes trace2 events to the git-ai daemon, which writes .git/ai and refs/notes/ai into each fixture repository after the git command exits. In provenance.test.ts that write recreated the fixture root after the test renamed it, so the symlink at line 132 failed with EEXIST. Fixture git calls in the provenance, harness and publisher tests now run with GIT_CONFIG_GLOBAL=/dev/null and GIT_CONFIG_NOSYSTEM=1. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…t-isolation test(verify): keep fixture git out of the host's global config (ericlitman#172)
release: Open Pstack 1.9.0 with Luna, Sonnet, the Opus 5.5 pin, Devin and Codex full access (ericlitman#190)
…25 (ericlitman#191, ericlitman#187) Upstream added two typed-only skills after the 0.15.20 sync point: in-your-own-words (7d8d909, reworded in dbf4981) and sharpen (79afd75). Both are verbatim at 0.15.25 and keep disable-model-invocation, like the port's other typed-only skills. This commit carries soulmachine's PR ericlitman#188 as written: the two skills, their poteto-help rows, the typed-only list, the recipes, the README and reference rows, and the verifier feature registry entries. Co-authored-by: soulmachine <soulmachine@gmail.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Applies the 17 upstream pstack commits from 1b6d44f to 99743e9 through scripts/upstream-audit.py and scripts/upstream-merge.py (11 verbatim, 11 clean merges, 28 hand-resolved, 3 unmapped and excluded). - poteto-mode takes ce649c0's "Match the model to the job" rule as upstream wrote it, adapted to the port's descriptors: the starting level is the role's configured effort, an unlisted effort moves to the row's nearest listed one, a configured ultra stays, and the speed sentences go because the port has no speed selector. Every routed skill and playbook points at the rule. provider-dispatch.md says the parent may move the effort per spawn and a child never does. - e5136d8's restated principles replace the port's local corrections to test-behavior-not-implementation, attack-the-premise and correct step 3. - Shipping keeps its nine landing steps and takes upstream's new rules and reasons. Autopilot-full takes upstream's seven steps with the port's guarded rebase and push in step 2, its step 5 merge prep, and the affirmative-failure stuck rule. Autopilot-stack takes upstream's four steps with the fork and topology rules folded into step 2. The landing invariants follow the moved text. - orch frontier reads the PR base chain instead of Graphite; watch-pr treats an owner-approval Code Review Gate as the gate; worktree-audit reads Origin PRs; ketchup, swarm, interrogate, the principles, and poteto-agent take upstream's cuts with the port's substitutions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…sals for the operator's setup (ericlitman#203) Eric's rule, 2026-10-16: a read-only runner lane means the read-only settings pstack passes to the provider CLI. The operator's host, account, repository and organization configuration applies as they set it up; the runner adds no refusal, guard or account check because of it, and the catalog notes disclose what it can do. A failure that needs such configuration to widen a lane is out of scope for review. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…st-operator-config docs(review): read-only means pstack's own CLI settings (ericlitman#203)
…usal (ericlitman#68) Read-only means the read-only settings pstack passes to OpenCode (ericlitman#203). OpenCode lanes no longer refuse a repository holding .opencode/ or a host whose merged configuration differs from the lockdown; the guard's tests and recorded fixtures go with it (approved by Eric, 2026-10-16). The catalog notes say what managed, remote, stored-login and repository configuration still load and what each was measured to do. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ences before ericlitman#202's review
…nner feat(runner): add OpenCode as a read-only external provider (ericlitman#68)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Restores the Amp adapter from 08556cd. A lane runs Amp's official deepseek-v4.1-flash mode with a run-owned settings file that enables only Read, private threads and ignored guidance files. Under ericlitman#203, it runs in any repository; the catalog notes say what plugins and managed, workspace and repository settings still load and what each was measured to do. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…tack-1.12.0 release: Open Pstack 1.12.0 with the OpenCode provider (ericlitman#206)
feat(runner): add Amp as a read-only external provider (ericlitman#158)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…tack-1.13.0 release: Open Pstack 1.13.0 with the Amp provider (ericlitman#209)
…tman#71) Restores the Cursor adapter from 08556cd with Composer 2.5 and Gemini 3.7 Flash (low, medium, high). A lane runs cursor-agent in ask mode with the sandbox on and a run-owned config that denies writes, shell and MCP calls. Under ericlitman#203, it runs in any repository; the catalog notes say what the language-server worker and enterprise, team, user and repository hooks still run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat(runner): add Cursor CLI as a read-only external provider (ericlitman#71)
…tack-1.14.0 release: Open Pstack 1.14.0 with the Cursor CLI provider (ericlitman#213)
…iclitman#204) Read-only means the read-only settings pstack passes to each CLI (ericlitman#203). Devin, agy and dsh lanes now run in any repository; the runner no longer refuses .devin/, .agents/ and its siblings, or a cwd .env, and the project-config walk and home-directory rule go with them. The catalog notes say what each CLI loads from a repository. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…oviders whose notes cover it (ericlitman#204) Unfret round 1 on ericlitman#215. The agy and Devin notes now say the CLI loads its config directories from the cwd and each parent up to the git root, or up to / outside a repository, so a lane under the home directory outside a repository also loads the home directory's own. docs/reference.md names the providers whose catalog notes describe the configuration they load. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ository-refusals refactor(runner): drop the Devin, agy and dsh repository refusals (ericlitman#204)
… refusals (ericlitman#216) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner
Author
|
Owner direction, October 19: merge this PR into Risk: MEDIUM. Two-way door; local agent workflows. Current head: The original GitHub failures exposed missing formal-skill coverage and a Windows fixture that did not enable the fork's existing front-door flag. Both are fixed. The verifier now maps the new skills and Codex invocation metadata, rejects unknown metadata, and publishes only to this fork. The Windows test proves both inactive and active behavior. Correction layer: verification mapping plus guard tests. Both current GitHub checks pass: CI and Windows hooks. Local static checks and typecheck also pass. No shipped plugin content changed in the follow-up commit; the independent installation evidence remains useful but is not an exact-head native-session verdict. The native-session gate is blocked before launch: its plugin-selection, replay, and hook-trust options are unsupported by the approved account router. No model sessions were launched outside that router, and no Where the work lives: committed and pushed to this draft PR. No merge, release, or Railway deployment. Keep the PR unmerged until the native gate can run and pass. |
Owner
Author
Live evidence: Open Pstack
|
Owner
Author
Live evidence: Open Pstack
|
Owner
Author
|
Merge record for pstack PR #2 into
Where the work lives: committed and pushed on this PR; merge will be pinned to the candidate above. Private raw evidence is retained locally. No Railway deployment. |
fitziboy3-source
marked this pull request as ready for review
October 20, 2026 00:23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The installed fork lacked formal verification skills. This updates its shared plugin to Open Pstack 1.15.0 plus Cursor pstack 0.15.28, including creation and maintenance of formal verification skills. The two upstream formal skill bodies remain byte-for-byte intact. Package version:
1.15.0-adam.20261019; provenance is inFORK.md.Native verification now runs each session through the account router's dedicated launcher. The maintenance test starts with a real capacity race and a stale passing model. It requires the skill to correct the model, reproduce the bug, preserve the checker and bounds, and advance its synchronization record. The creation test requires a generated skill, a caught and replayed mutation, and restoration of the original product and model. These are bounded checks of two one-shot callers at capacity one.
Risk tier: MEDIUM. The affected surface is local agent workflows and their verification. Account admission and cleanup are implemented separately in harness PR #94, whose runtime is installed locally. The fork's front-door hook and configured model roles remain.
Validation on
de9b4194985bac7554b47319feadde40f8143fa7: all 171 verifier tests and strict typecheck pass; both GitHub CI checks pass. The broader local runner suite has environment-sensitive Mac timing and process-permission failures, so it is not claimed as a local pass. Independent installation checks confirmed all six local profiles, both Claude project overrides, skill hashes, native discovery, enabled state, and preserved model/gate settings for the unchanged plugin payload.Native features selected in both Claude and Codex:
skill-invocation:create-formal-verification-skill,skill-invocation:maintain-formal-verification-skill,skill-invocation:poteto-mode,hook:startup, andproject-skill. The run includes the project-skill self-test and ten fresh native sessions.Native gate: PASS on the exact candidate, independently run with all ten selected native cases and both project-skill self-tests. All account confirmations matched the admitted subscription; all native sessions exited successfully and restored their temporary authentication linkage. Both formal maintenance cases advanced the actual skill synchronization record after reproducing the seeded bug. Adam approved the fixed, fixture-only native permission handler; the maintenance assertion remains intact. Cross-model review was explicitly waived by Adam for this update; it is not reported as a passed review. The earlier account-confirmation refusal was not reproduced; its underlying cause remains unconfirmed and the launcher now retains precise diagnostics without relaxing admission.
Where the work lives: merged into
adam/releaseas0eacabdd48477847ac6e88657a28805842aefad4, with a repository tree identical to the verified candidate. VERIFIED after merge: all six local profiles and both Claude project overrides are enabled at1.15.0-adam.20261019, trackadam/release, and match every tracked file of the merged plugin tree. Unrelated configuration was preserved. No Railway deployment. Harness support PR ericlitman#94 remains draft and unmerged; its runtime is installed locally.