sync: Cursor pstack 0.15.36 as Open Pstack 1.17.0 (#262)

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "pstack",
       "source": "./plugins/pstack",
       "description": "if you want to go fast, go deep first. pstack helps you write less, but higher quality code. rigorous agent workflows you can parallelize with confidence.",
-      "version": "1.16.0",
+      "version": "1.17.0",
       "author": {
         "name": "Lauren Tan (original)"
       },

.claude/skills/verify-open-pstack/features/README.md

@@ -22,7 +22,7 @@ A change to `plugins/pstack/.claude-plugin/plugin.json`, `.claude-plugin/marketp
 
 Asset ownership is consumer-driven, not blanket shared ownership. Inspect the exact candidate's plugin manifests. At present, `plugins/pstack/assets/logo.png` is referenced only by `plugins/pstack/.codex-plugin/plugin.json`, so a logo-only change selects the installed Codex asset surface and does not invent a Claude exercise. New shipped assets must be added to `assets` and must have a real manifest consumer; missing, ambiguous, or unknown consumption fails closed.
 
-`bootstrap.ts` belongs to `tools`; exercise its actual consumers, `orch` and `watch-pr`, including dependency bootstrapping rather than the unrelated external runner.
+`bootstrap.ts` belongs to `tools`; exercise its actual consumer, `watch-pr`, including dependency bootstrapping rather than the unrelated external runner.
 
 Catalog paths take precedence over `shared` and over the skill match, so `references/model-catalog.md` and the generated agents select only `catalog`, `setup`, and `runner`. Each generated agent is listed by exact path; a new one is unmapped until it is added to `catalog`. Skill-owned `SKILL.md`, `references/**`, and `playbooks/**` select their skill. poteto-mode's `SKILL.md` also reaches Claude's `agent-preload:poteto-agent`, because poteto-agent preloads it. Additional executable paths must be registered explicitly. `core.ts` assigns the Codex transcript resolver, `poteto-mode/scripts/resolve-codex-transcript.ts`, and its launcher, `poteto-mode/scripts/resolve-codex-transcript`, to `reflect` by their exact paths, so a change to it selects `skill-invocation:reflect` rather than the unrelated shipped-tool recipe. Shared consumed mappings select every dependent skill conservatively. The coverage test inventories tracked plugin files; new unmapped files block CI and runs. Deleted skill surfaces cannot silently disappear from evidence: choose a surviving documented entry point demonstrating the intended removal, or report blocked.
 
@@ -33,7 +33,7 @@ The feature documents below define sub-features, user entry points, driving inst
 - `isolation.md`: existing native logins, Codex auth symlink, and private run state.
 - `runner.md`: parent-to-child provider dispatch and receipts.
 - `catalog.md`: the generated model catalog and native agents, read by a parent resolving roles from a model sheet.
-- `shipped-tools.md`: orchestration, watch, plan checks, audit, and evidence logging.
+- `shipped-tools.md`: watch, plan checks, audit, statechart, and evidence logging.
 - `assets.md`: manifest-declared installed assets on actual consuming harnesses.
 - `hooks.md`: the SessionStart hook's context reaching a new session (`hook:startup`), and the Windows runner beside it.
 - `recipes.ts`: the headless cases and machine-checked assertions for every selectable feature. A named feature without one fails the run as `missing-recipe` before any session starts. A recipe proves a lookup or a read with a fixture value the model cannot derive from the prompt, such as a per-run `crypto.randomUUID()` marker, compared in the structured result. A command's text can show which tool the parent called, but it never proves what that tool read or produced, so do not add command-text or tool-output pattern checks for that.

.claude/skills/verify-open-pstack/features/recipes.ts

@@ -139,6 +139,8 @@ async function sumRepairRecognized(_record: SessionRecord, f: Fixture): Promise<
   return { assertions: ['recognized-repair:sum.mjs', 'test-unchanged:sum.test.mjs'], files: [join(f.dir, 'sum.mjs'), join(f.dir, 'sum.test.mjs')] };
 }
 
+const BROKEN_SUM = TASK['sum.mjs'];
+
 const overrides: Record<string, Case> = {
   'fix-ci': skillCase('fix-ci', 'There is no pull request or remote. The failing CI check is the local command `sh ci.sh` in $DIR. Fix it locally and do not push.', ciFixed),
   babysit: skillCase('babysit', 'The pull request is the local `main` branch of the repository at $DIR; there is no remote. Its one failing check is the local command `sh ci.sh`. Do exactly one babysit pass: fix the failing check locally, push nothing, change nothing remote, then stop instead of watching.', ciFixed),
@@ -153,6 +155,18 @@ const overrides: Record<string, Case> = {
     await writeFile(join(f.dir, 'README.md'), '# Fixture\n\nA tiny sum module.\n'); await git(f, 'commit', '-qam', 'fix typo');
     await writeFile(`${f.dir}.head`, await git(f, 'rev-parse', 'feature'));
   }),
+  interrogate: skillCase('interrogate', 'The scope is the last commit of the repository at $DIR (`git diff HEAD~1`). Its intent: sum(a, b) returns the sum of a and b.', async (_record, f) => {
+    if (await readFile(join(f.dir, 'sum.mjs'), 'utf8') !== BROKEN_SUM) throw new Error('scope-modified:sum.mjs');
+    if ((await git(f, 'status', '--porcelain', '--untracked-files=no')).trim()) throw new Error('scope-checkout-modified');
+    return { assertions: ['scope-unmodified'], files: [join(f.dir, 'sum.mjs')] };
+  }, async f => {
+    await files(f.dir, { ...TASK, 'sum.mjs': 'export function sum(a, b) {\n  return a + b;\n}\n' });
+    await git(f, 'init', '-q', '-b', 'main');
+    await git(f, 'add', '.');
+    await git(f, 'commit', '-qm', 'Add sum module');
+    await writeFile(join(f.dir, 'sum.mjs'), BROKEN_SUM);
+    await git(f, 'commit', '-qam', 'Refactor sum');
+  }),
   'automate-me': {
     id: 'invoke',
     prompt: f => `${invoke(f.harness, 'automate-me', `My handle is fixture. There is no history to mine for this workspace, so skip mining. My answers to your questions: concise replies, and verify with tests before claiming done. Write the drafted skill to ${join(f.dir, '.claude/skills/fixture-mode/SKILL.md')}.`)} ${rules(f.dir)}`,

.claude/skills/verify-open-pstack/features/registry.json

@@ -3,7 +3,7 @@
     "architect", "arena", "automate-me", "babysit", "benchmark-checklist", "blast-radius", "bro", "correct",
     "create-formal-verification-skill", "create-verification-skill", "deslop", "figure-it-out",
     "fix-ci", "fix-merge-conflicts", "get-pr-comments", "how", "in-your-own-words", "interrogate",
-    "ketchup", "maintain-formal-verification-skill", "maintain-verification-skill",
+    "ketchup", "ketchup-video", "maintain-formal-verification-skill", "maintain-verification-skill",
     "make-pr-easy-to-review", "no-comments", "poteto-help", "poteto-mode",
     "principle-attack-the-premise", "principle-boundary-discipline", "principle-build-the-lever",
     "principle-encode-lessons-in-structure", "principle-exhaust-the-design-space",
@@ -15,7 +15,7 @@
     "principle-redesign-from-first-principles", "principle-separate-before-serializing-shared-state",
     "principle-sequence-verifiable-units", "principle-subtract-before-you-add",
     "principle-test-behavior-not-implementation", "principle-type-system-discipline",
-    "recall", "reflect", "setup-pstack", "sharpen", "show-me-your-work", "swarm", "tdd", "teach",
+    "recall", "reflect", "setup-pstack", "sharpen", "show-me-your-work", "statechart", "swarm", "tdd", "teach",
     "technical-writing", "thermo-nuclear-code-quality-review", "typescript-best-practices",
     "unslop", "what-did-i-get-done", "why"
   ],
@@ -62,14 +62,14 @@
   ],
   "tools": [
     "plugins/pstack/skills/poteto-mode/scripts/bootstrap.ts",
-    "plugins/pstack/skills/poteto-mode/scripts/orch/**",
     "plugins/pstack/skills/poteto-mode/scripts/watch-pr/**",
     "plugins/pstack/skills/poteto-mode/scripts/check-plan.mjs",
     "plugins/pstack/skills/poteto-mode/scripts/worktree-audit.sh",
     "plugins/pstack/skills/poteto-mode/scripts/package.json",
     "plugins/pstack/skills/poteto-mode/scripts/bun.lock",
     "plugins/pstack/skills/poteto-mode/scripts/check-plan.tsconfig.json",
-    "plugins/pstack/skills/show-me-your-work/scripts/log.sh"
+    "plugins/pstack/skills/show-me-your-work/scripts/log.sh",
+    "plugins/pstack/skills/statechart/scripts/**"
   ],
   "project": [
     ".claude/skills/verify-open-pstack/**", ".agents/skills/verify-open-pstack",
@@ -83,6 +83,7 @@
     ".gitignore", ".mergify.yml", ".github/workflows/unfret-threads.yml", "docs/**", "assets/**",
     "plugins/pstack/skills/poteto-mode/scripts/bootstrap.test.ts",
     "plugins/pstack/skills/poteto-mode/scripts/check-plan.test.ts",
+    "plugins/pstack/skills/poteto-mode/scripts/orch/**",
     "plugins/pstack/skills/poteto-mode/scripts/resolve-codex-transcript.test.ts", "scripts/release.py", "scripts/release_test.py"
   ]
 }

.claude/skills/verify-open-pstack/features/shipped-tools.md

@@ -2,22 +2,22 @@
 
 ## Sub-features
 
-`orch` state transitions, `watch-pr` observations, `check-plan` verdict boundaries, read-only worktree audit, and `show-me-your-work` logging. Exercise every tool and branch touched by selected paths; shared package changes select all tools.
+`watch-pr` observations, `check-plan` verdict boundaries, read-only worktree audit, `statechart` charts and reports, and `show-me-your-work` logging. Exercise every tool and branch touched by selected paths; shared package changes select all tools.
 
 ## How to get to it (user POV)
 
-Invoke the installed `poteto-mode` parent for orchestration/watch/plan/audit, or installed `show-me-your-work` for evidence logging, through each harness's native skill surface.
+Invoke the installed `poteto-mode` parent for watch/plan/audit, installed `statechart` for a chart and report, or installed `show-me-your-work` for evidence logging, through each harness's native skill surface.
 
 ## Driving it with verify-open-pstack
 
-Use the candidate's installed help and documented arguments. Create fixture state/output under the private run root; use an explicitly named safe test PR where remote reads are required. Have the native installed workflow drive the changed tool, then inspect its real structured output and persisted state. For the audit assert no mutation; for logging check the written TSV and escaping; for orchestration check the stored transition; for watch/plan preserve the observed result and verdict. Retain native transcripts and these state artifacts. Label any direct helper invocation `local CLI` separately. Name every touched tool and changed branch in the recipe.
+Use the candidate's installed help and documented arguments. Create fixture state/output under the private run root; use an explicitly named safe test PR where remote reads are required. Have the native installed workflow drive the changed tool, then inspect its real structured output and persisted state. For the audit assert no mutation; for logging check the written TSV and escaping; for statechart check the written chart and report; for watch/plan preserve the observed result and verdict. Retain native transcripts and these state artifacts. Label any direct helper invocation `local CLI` separately. Name every touched tool and changed branch in the recipe.
 
-`bootstrap.ts` changes require its real shipped-tool consumers, `orch` and `watch-pr`, including their clean dependency bootstrap path. They do not select the unrelated external runner.
+`bootstrap.ts` changes require its real shipped-tool consumer, `watch-pr`, including its clean dependency bootstrap path. They do not select the unrelated external runner.
 
 ## Gotchas
 
 A mock test is not live proof. Never perform PR writes from a candidate process or edit daily workflow state as a fixture. Do not infer a successful remote read from an empty response. Candidates retain real identity and reuse normal Claude login/config and Codex's symlinked daily auth as described in `isolation.md`; GitHub and temporary state remain run-owned. No credential contents are read or copied and no extra login is started. Candidates never receive publisher credentials. This does not claim OS denial of daily-home or Keychain access. Missing access fails the feature; preserve its private reason and publish only the bounded exact-SHA result, never after failed setup restoration.
 
 ## Headless
 
-The `shipped-tools` recipe in `recipes.ts` has the installed `show-me-your-work` workflow run its `log.sh` against a fixture TSV. It asserts the helper command ran from the installed plugin and the persisted row, including formula escaping. `orch`, `watch-pr`, `check-plan`, and the worktree audit have no case yet.
+The `shipped-tools` recipe in `recipes.ts` has the installed `show-me-your-work` workflow run its `log.sh` against a fixture TSV. It asserts the helper command ran from the installed plugin and the persisted row, including formula escaping. `watch-pr`, `check-plan`, the worktree audit, and `statechart` have no case yet.

.gitignore

@@ -9,3 +9,7 @@
 plugins/pstack/skills/poteto-mode/scripts/node_modules/
 
 .claude/skills/verify-open-pstack/node_modules/
+
+plugins/pstack/skills/statechart/scripts/node_modules/
+
+__pycache__/

CHANGES.md

@@ -3,6 +3,24 @@
 Open Pstack lands on green: Mergify merges a ready PR to main once verify and exact-head live-gate pass and no review thread is unresolved, and a workflow resolves Unfret's own threads. A PR that touches `.github/` or the Mergify config also waits for Unfret, and workflow changes require operator queueing.
 This port applies the Cursor → Claude Code substitutions in skill bodies. Earlier drafts left them flagged; this revision resolves them. A later pass added a Codex build that shares the same skills; see [Codex port](#codex-port) below.
 
+## 1.17.0 syncs to Cursor pstack 0.15.36
+
+Open Pstack 1.17.0 tracks Cursor pstack 0.15.36 at `2776ddd2355d6d6c8747d3964600f28daf62f049`. Twenty-three upstream commits since 0.15.29 touch pstack. Eighteen change skill content or scripts. Seventeen of those are applied with the port adaptations below, and the deletion of `scripts/orch/` supersedes `3c596e7`'s `orch` fix. Four bump only the Cursor manifests. `a0b0ad9` changes only the upstream README. Default roles and panels are unchanged.
+
+**New skills.** `/statechart` checks a TLA+ model of a system that moves between states and draws it as a Mermaid statechart, with the shortest path to each state that breaks a rule. Its first run installs TLC and Java with mise and needs the network. `/ketchup-video` catches you up like `/ketchup`, as a short subtitled video of slides with the waiting calls as text under it. Both run only when typed. `/create-formal-verification-skill` tells the skill it generates to read each TLA+ result with `statechart`.
+
+**Interrogate proves findings by running them.** Adversaries try to break the change, and a finding survives only when a run proves it. Each adversary runs as an `isolated-write` lane in its own worktree, which the parent prepares at the reviewed HEAD with the uncommitted changes copied in. A configured provider without an `isolated-write` route, such as the read-only providers, is a named dropout. The report lists the intent, each adversary or its dropout, the verified findings with their commands and output, and the dropped count per adversary. When no adversary completes, it says the coverage is incomplete.
+
+**Orchestrate is agentic.** The coordinator runs the program with its own tools: workers through provider dispatch in dedicated worktrees, state in `<config-home>/orchestrate/<project-slug>/notes.md`, and `watch-pr` waits. `scripts/orch/` is deleted. A worker is replaced only on affirmative failure evidence, and a tool error or an unavailable model is a named dropout, never a retry on another model.
+
+**Autopilot-stack is Autopilot-full without the merge.** It stops when each PR is verified and green, hands the PRs to the operator, and pushes nothing after the handoff without the operator's go. A PR stacks only on a PR it builds on, and each owner restacks its own branch through Autopilot-full step 2, which now holds the fork and split-remote rules.
+
+**Changed behavior.** Poteto-mode restates the user's goal in its first message, in each subagent brief, in each PR's `## Why`, and in each final report, and applies Explain the Number before measuring. The arena judge is never from the parent's provider; when no configured judge runs, Arena skips the judge and says so. Reflect never edits a skill in the plugin cache and copies it to the harness's project or user skill folder first. Autopilot-full and the multi-phase plan block a PR only for a problem a run or a wrong doc line shows, rebase when a known concurrent change to the same files lands, and push each finished unit. `watch-pr` ignores fork heads when it discovers a stack and caps each sleep at an explicitly set deadline. `check-plan` ignores punctuation inside multi-backtick code spans. `worktree-audit.sh` works with GNU `stat` and `date`.
+
+**Install note.** Claude Code leaves auto-update off for third-party marketplaces. The README says how to turn it on for `open-pstack` or update by hand.
+
+**Not applied.** See `UPSTREAM.md`: fallback chains on a rejected model slug and refilling a rejected arena seat with the parent model, which conflict with the named-dropout rule; `disable-model-invocation` on `interrogate` and `principle-explain-the-number`; Orchestrate's retry on a different model; and the Cursor manifests, guide edits and generated Claude Code tree.
+
 ## 1.16.0 syncs to Cursor pstack 0.15.29
 
 Open Pstack 1.16.0 tracks Cursor pstack 0.15.29 at `88d47514b82e7c44f00f2b2a72ff6dd12158038c`. Sixteen upstream commits since 0.15.25 touch pstack. Nine change skill content, and all nine are applied with the port adaptations below. `a968159` names two skills after their folders: the port's `poteto-mode` already complies, and `make-bot-ui` stays out. Three add upstream's own Claude Code install and a docs check, which stay out apart from their README text. Three bump only the Cursor manifests and guide, which stay out. The release also fixes #46 and #235, and ships Claude Haiku 5.5 lanes (#223), foreground waits on Claude Code (#232, #233) and the comment sweep (#218), all merged after 1.15.0. Default roles and panels are unchanged.