feat(runner): writers for external providers and a Muse Code provider (#263, #258) by ericlitman · Pull Request #268 · ericlitman/open-pstack

ericlitman · 2026-11-06T13:02:36Z

Why

Interrogate's adversaries now prove findings by running code (1.17.0), so they need writer lanes, and six external providers were read-only. This gives every external provider a writer where one can be measured: confined writers by default, unconfined ones only behind a per-provider model-sheet opt-in. It also adds Meta's Muse Code as a provider. Closes #263, closes #258.

Summary

model sheet
  <provider> writer sandbox: bounded | full-access     # one line per provider, codex's line unchanged
parent (provider-dispatch.md#writer-sandbox)
  provider lists isolated-write            -> writes, no line needed (confined)
  provider lists only isolated-write-full-access
    line says full-access                  -> --writer-sandbox full-access
    otherwise                              -> runner refuses before launch
setup
  asks once per such provider a writer role uses, warns, probes one writer

Provider	CLI	Writer	Decided by
devin	3000.11.234	confined, shell-only (`--sandbox`); opt-in `dangerous`	`--sandbox`: inside writes and a Python run work; sibling, main checkout, shared `.git`, home, symlinks and `/tmp` get `Operation not permitted`
dsh	0.2.1-rc.2	confined (`workspace-write`)	every outside target denied except `/tmp` and `$TMPDIR`
opencode	1.19.1	opt-in	shell wrote into sibling, main checkout, shared `.git`, home, `/tmp`
agy	1.5.2	opt-in	`--dangerously-skip-permissions` wrote everywhere; `--mode auto` unavailable for the account
cursor	2026.10.22	opt-in	agent-mode edits wrote into sibling, main checkout, shared `.git`, home
muse	1.4.14	opt-in, sandbox on	edits confined, but the shell wrote into shared `.git` and `/tmp`
amp	0.0.1792123242	read-only	not logged in on the measuring host; no writer measured

All measurements ran through the real runner on pro14 (macOS) against a linked worktree of a disposable repository, with fixtures outside /tmp so a /tmp allowance could not mask an escape.

Evidence

writers verifier feature (new, runs only when named): one writer case per changed provider; each child runs a Python command that writes the SHA-256 of a per-run nonce to result.txt, which the model cannot produce without running it. Plus muse-writer and a muse-reader that must return a per-run marker.
Muse facts from recorded runs (fixtures under runner/fixtures/muse/): preflight muse usage; final text in run.terminal.completed; usage from run.usage; unknown model exits 1; SIGINT 130 and SIGTERM 143; run.model.configured only echoes the request, so model proof is pinned argv.
Live gate: pending (see Not verified).

Merge Danger

Door: two-way

Blast Radius: opt-in

No default role changes. A sheet with no new setting lines gains only Devin and dsh writers, which are confined. Unconfined writers run only after the operator writes full-access for that provider; setup warns that nothing stops a stray write, including into the main repository's shared .git.

Acceptance criteria

#263:

"Each provider's catalog notes record its measured write mode, with the CLI version and the escape test" — done, model-catalog.md provider notes.
"The runner accepts isolated-write by the rules above, and refuses the opt-in-only providers without the sheet line" — done; adapter suite tests.
"/setup-pstack asks about and warns on the opt-in line" — done, setup-pstack/SKILL.md step 2; it probes opt-in writers in a disposable worktree.
"A live gate on pro14 runs one writer lane per provider" — pending; Amp has no writer to run.

#258:

"Every flag in the adapter comes from the real muse --help and muse exec --help" — done; recorded under runner/fixtures/muse/.
"Read-only and write modes are measured with an escape test" — done (table).
"Model proof follows provider-dispatch.md… no default role changes" — done; pinned argv, no family registered.
"A live gate runs one read-only lane and one writer lane" — pending.

Gate results

On 0087ba6: bun run test 0 (508 pass, 0 fail), bun run typecheck 0, bun run static 0, claude plugin validate plugins/pstack 0. no-comments pass: one comment deleted (muse.ts).

Not verified

Live gate. The writers cases need pro14's provider CLIs, and every Muse turn on pro14 fails authorization since its Muse config was changed to route through a proxy on 2026-11-06 07:26.
Amp's writer: needs amp login on pro14.
Muse: whether META_API_KEY works, MCP and plugin suppression, workspace switching, and whether --reasoning-effort beats per-model effort in Muse's settings.json.
dsh 0.2.1-rc.2: SIGTERM, .env handling and session-log upload were not rechecked.
agy 1.5.2 ignores the read-only lane agent's tools list (writes are still denied); noted in the catalog, not changed here.

🤖 Generated with Claude Code

Recorded on pro14: `muse --help`, `muse exec --help`, `muse usage` logged in and logged out, and `muse exec --json` streams for a read-only lane, a writer lane, an unknown model and a SIGINT cancellation. The writer stream drops the streamed `run.output.delta` records; the SIGINT stream keeps its first 40 records. Refs #258 Refs #263 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

A model sheet may hold one `<provider> writer sandbox: bounded|full-access` line per provider. The parent passes `--writer-sandbox full-access` only to an external isolated-write lane of the provider whose line says full-access. A provider whose route lists only `isolated-write-full-access` writes only with that line. Setup keeps every setting line, asks once about Codex and about each opt-in-only provider a writer role uses, warns that nothing stops a stray write, probes such a writer with a create-and-run task, and refuses a writer role on a provider that cannot write. The catalog renders each provider's child environment for every access kind it supports. Refs #263 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Measured on pro14 with a linked worktree beside its main repository and a sibling directory, under the home directory: - devin (3000.11.234): bounded isolated-write under --sandbox, a confined shell-only writer; opted-in full access runs --permission-mode dangerous. - dsh (0.2.1-rc.2): bounded isolated-write under a workspace-write policy, confined except the system temporary folders. The version guard moves to 0.2.1-rc.2, whose disabled credentials row the patch now enables. - opencode (1.19.1), agy (1.5.2), cursor (2026.10.22-27dcf5f), muse (1.4.14): writes escaped the worktree, including into the shared .git, so each writer is opt-in only (isolated-write-full-access). - amp stays read-only: its login had expired, so no writer was measured. The Muse adapter runs `muse exec --json` read-only with writes and the shell disabled, or as an opted-in writer with the sandbox on. Its parser reads the terminal event, maps an unknown model to unavailable-model and exits 130/143 to cancelled, and proves the model by pinned argv. No family is registered. Refs #263 Refs #258 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…alled harness A new `writers` feature, reachable when a provider adapter changes and run only when named, dispatches one sheet-driven writer per changed provider (devin and dsh bounded; opencode, agy and cursor with their full-access line) into a linked worktree. Each writer runs a command that writes the SHA-256 of a per-run nonce, so the case proves execution, not a model claim. Muse gets a writer and a reader case on launcher arguments, because no Muse family is registered. The sheet filters recognize every provider's writer sandbox line. The setup cases move off Devin, which can now write: `read-only-provider` and `writer-refusal` use OpenCode, whose writer needs the opt-in line. Refs #263 Refs #258 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1.17.0 shipped before this change, so its entries move to a new 1.18.0 section and the version strings follow. Refs #263 Refs #258 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Refs #258 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

mergify · 2026-11-06T13:03:14Z

Merge Protections

🟢 All 2 merge protections satisfied — ready to merge.

Show 2 satisfied protections

🟢 Queue ready pull requests

Automatically queue non-draft pull requests targeting main after verify and live-gate pass on the head and every review thread is resolved.

#review-threads-unresolved = 0
-draft
check-success=live-gate
check-success=verify

🟢 🚦 Auto-queue

When all merge protections are satisfied and these conditions match, this pull request will be queued automatically.

-files~=^\.github/
base = main

greptile-apps · 2026-11-06T13:10:14Z

[High impact] The PR expands write access in configured external-provider lanes.

Fix the setup check before merging; it rejects valid saved provider settings.

Findings

Valid settings fail verification ▶
Notes name the wrong agent ▶

Summary

Adds bounded Devin and dsh writers, full-access opt-ins for other external writers, and a Muse provider. Default role choices stay unchanged.

External provider lanes can now write under provider-specific rules.
Muse Code can now run through the external provider runner.

Acknowledged or deferred by ericlitman:

Full-access writers can write outside their worktree; the per-provider opt-in is intentional. Bounded writers' temporary-folder allowances are disclosed.
The live gate is pending. It needs pro14's CLIs, and Muse turns there fail authorization after a proxy configuration change.
Amp stays read-only until its writer can be measured after amp login.
Muse's META_API_KEY, MCP/plugin suppression, workspace switching, and effort-setting precedence remain unverified.
dsh's SIGTERM behavior, .env loading, and session-log upload were not rechecked on the new version.
Antigravity 1.5.2 ignoring the agent's tools list is known; its read-only approval policy still denies writes.

_{Reviews (1) · Last reviewed commit: "chore(runner): drop a comment that repea..." · Reviewed by Greptile}

unfret-eal · 2026-11-06T13:17:34Z

🛑 6 blocking findings

🟡 Medium · configure case fails when the sheet has another provider's writer line

🟡 Medium · Setup accepts full-access lines for bounded-only providers

🟡 Medium · Writer recipes are unreachable for recipe-only changes

🟡 Medium · Empty XDG_CONFIG_HOME loses the existing Muse login

🔵 Low · Agy notes still invoke the old agent

🔵 Low · Correct agy's unconditional tool-restriction disclosure

Walkthrough

This PR (1.18.0) gives the external-runner providers writer lanes and adds Meta's Muse Code as a new provider. Devin (sandboxed, shell-only) and dsh (`workspace-write`) get confined writers that need no setting. OpenCode, Antigravity, Cursor, Muse, and Devin's unsandboxed `dangerous` mode write only when the model sheet holds a per-provider `<provider> writer sandbox: full-access` line. Setup asks about that line, warns, and probes. Amp stays read-only. The PR also generalizes the old Codex-only writer sandbox rule, bumps dsh to 0.2.1-rc.2, and adds a named `writers` verifier feature. It adds adapter tests and recorded Muse fixtures; the author reports the live gate on pro14 as not yet run.

Area	What changes	Review notes
Provider adapters	Devin, dsh, OpenCode, agy and Cursor gain writer `argv/config` by access mode; new `muse.ts` adapter parses `muse exec --json` streams, preflights via `muse usage`, and uses pinned-argv proof.	Agy notes still invoke the old agent Correct agy's unconditional tool-restriction disclosure
Dispatch and setup rules	provider-dispatch's Writer sandbox section and setup-pstack now handle one setting line per provider, refuse writer roles on providers that cannot write, and probe opt-in writers in a disposable worktree.	Setup accepts full-access lines for bounded-only providers
Verifier harness	Adds `writers` recipes (nonce-hash execution check per provider plus Muse `reader/writer),` links the operator's Muse config into run-owned homes, and moves setup refusal cases from devin to opencode.	configure case fails when the sheet has another provider's writer line Writer recipes are unreachable for recipe-only changes Empty XDG_CONFIG_HOME loses the existing Muse login
Docs and versioning	Version bump to `1.18.0,` regenerated model catalog with measured escape results, and `CHANGES/UPSTREAM/README` updates.

Advisories (2)

🔵 Low · Muse model failures discard their reason and session · plugins/pstack/skills/poteto-mode/scripts/runner/providers/muse.ts:57
The captured unknown-model response is a well-formed failed terminal, but this branch returns `malformed` without metadata. With its actual exit code 1, run.ts consequently writes `sessionId: null` and `error.message: "child exited with status 1"`, losing the parsed session and provider reason from the receipt fields promised by provider-dispatch. Reproduced using `unknown-model.jsonl`; the status remains unavailable-model and the details remain in raw stdout, limiting the impact to diagnostics. Also reported for this defect: - Muse unavailable-model drops session and reason (plugins/pstack/skills/poteto-mode/scripts/runner/providers/muse.ts:57): For a well-formed failed terminal whose reason matches unavailable-model, parse returns `malformed` without the parsed metadata. A child-failed terminal keeps `metadata: found`. The receipt therefore loses the Muse session ID. The runner substitutes its generic nonzero-exit message for the provider's reason, contrary to provider-dispatch's rule to keep the reason and the reported session for failures. The status remains unavailable-model, and the raw stdout sidecar keeps the details, so the impact is bounded. - Preserve Muse metadata on unavailable models (plugins/pstack/skills/poteto-mode/scripts/runner/providers/muse.ts:57): For a well-formed unavailable-model terminal, this branch returns `malformed` instead of a metadata-bearing provider failure. The runner consequently emits its generic nonzero-exit diagnostic and omits the parsed Muse session ID and terminal reason from the receipt, even though both are present in the captured stream; the lane is still rejected, but its failure receipt is wrong and less actionable. - Preserve Muse's unavailable-model failure details (plugins/pstack/skills/poteto-mode/scripts/runner/providers/muse.ts:57): The captured unknown-model terminal is well formed, but this branch returns `malformed`, discarding its parsed metadata. With that fixture and exit 1, runLane produces `sessionId: null` and `error.message: "child exited with status 1"`; its bounded evidence also omits the terminal reason. This violates the documented failure-receipt detail contract. The status remains unavailable-model and raw stdout retains the details, so the confirmed impact is limited to diagnostics.
Not blocking because: The receipt loses convenient access to the reason and session ID, but still reports unavailable-model and rejects the lane. Both details remain in retained raw stdout, bounding the confirmed effect to diagnostic inconvenience.; Failure receipts omit the convenient session and provider-reason fields, while unavailable-model classification and rejection remain correct. Retained raw stdout preserves the missing details, so the impact is limited to diagnostics.; The structured failure diagnostic is less actionable, but the lane is still rejected with unavailable-model and no successful output is accepted. The retained raw stdout contains the provider reason and session for investigation.; The receipt's convenient diagnostics omit details, but failure classification still rejects the lane and raw stdout retains the full terminal and session. The established effect is diagnostic inconvenience, not an incorrect acceptance decision.
🔵 Low · Technical reference retains the previous release version · docs/reference.md:5
This current-distribution introduction incorporates the new provider count but still advertises version 1.17.0. The three manifests, README and UPSTREAM.md identify this distribution as 1.18.0. Readers therefore receive inconsistent release identification; installation is unaffected because it uses the manifests. Also reported for this defect: - Update the reference's current distribution version (docs/reference.md:5): The distribution manifests, README and UPSTREAM.md now identify 1.18.0, but this updated introduction still presents the distribution as 1.17.0 while describing its new providers. Readers consulting the technical reference receive a stale release identifier. Installation does not consume this prose, so the impact is limited to documentation. - Reference still reports version 1.17.0 (docs/reference.md:5): The distribution manifests, README, CHANGES, and UPSTREAM are updated to 1.18.0, but this changed introduction still identifies the current distribution as 1.17.0. Readers of the technical reference therefore receive a stale release identifier even though the sync commit remains correct. - Reference intro still names version 1.17.0 (docs/reference.md:5): This line was edited in this PR for the provider count, but it still says "Version 1.17.0 is synced to Cursor pstack v0.15.36". All manifests, README and UPSTREAM.md now say 1.18.0. The current-distribution introduction shows a stale release identifier.
Not blocking because: The introduction displays a stale distribution version, but manifests and the linked sync record correctly identify 1.18.0. Installation and release selection do not use this prose; the confirmed impact is reader confusion.; Only the introductory release label is stale. The manifests and linked upstream record contain 1.18.0, so installation and release selection remain correct and the effect is limited to reader confusion.; Readers see an inconsistent introductory version, but installation uses the correctly updated manifests and the linked sync record is accurate. The confirmed consequence stays within descriptive documentation.; The stale 1.17.0 label can confuse reference readers, but the manifests and linked sync record identify 1.18.0 correctly. This prose does not control installation, deployment or release selection.

Since the last review

Still open: Agy notes still invoke the old agent
Still open: configure case fails when the sheet has another provider's writer line
New: Correct agy's unconditional tool-restriction disclosure
Still open: Setup accepts full-access lines for bounded-only providers
Still open: Writer recipes are unreachable for recipe-only changes
New: Empty XDG_CONFIG_HOME loses the existing Muse login

Repair prompt

Read the Unfret check run for ericlitman/open-pstack#268 at head eefdd1f6b01649bea52735eb779b0e8b7190c3f6 (run panel:eefdd1f6b01649bea52735eb779b0e8b7190c3f6:NaDB96VoyM2:p1xiLBFFAfM, check). Use the check's App id and GET /repos/ericlitman/open-pstack/check-runs/127981534454; its output.text contains the structured result. Compare it with the current code and head, verify that each listed mandatory finding still applies, repair only those that do, honor the repository constraints, and validate the changes. Leave advisories and accepted risks alone. A manually resolved thread is not a waiver.

Details

Lane / stage	Model	Effort	Outcome	Duration
broad-gpt-5.6-sol-xhigh / review	openai/gpt-5.6-sol → gpt-5.6-sol · primary	xhigh	succeeded	5 min 0 s
broad-opus-5.5-max / review	anthropic/claude-opus-5-5 → claude-opus-5-5 · primary	max	succeeded	10 min 16 s
focal-gpt-5.6-sol-xhigh copy / review	openai/gpt-6.1-sol → gpt-6.1-sol · primary	xhigh	succeeded	14 min 9 s
focal-gpt-5.6-sol-xhigh copy 2 / review	openai/gpt-6.1-sol → gpt-6.1-sol · primary	xhigh	succeeded	17 min 39 s
judge / judge	openai/gpt-6-astra → gpt-6-astra · primary	high	succeeded	4 min 51 s

Reviewed the whole pull request.
4 reviewers finished.
Commit eefdd1f.
Check run.
Run: GET /unfret/run/panel:eefdd1f6b01649bea52735eb779b0e8b7190c3f6:NaDB96VoyM2:p1xiLBFFAfM.

_{@unfret review · @unfret status · @unfret help}

unfret-eal

🛑 4 blocking findings
🟡 Medium · configure case fails when the sheet has another provider's writer line
🟡 Medium · Reject full-access settings for bounded-only providers
🟡 Medium · Make writers reachable for changes to its own recipes
🔵 Low · agy notes still name the old agent and a wrong tool surface
Check

ericlitman · 2026-11-06T14:49:56Z

Live evidence: Open Pstack

Candidate SHA: 0087ba6ff2b15a5ffd4354c2a56b053566639b23
Base SHA: 2d92c535f2183cf0c74ffff5763209be9b242690
Result: FAILED — verification did not complete; rerun required
Self-test: required in both harnesses
Planned sessions: 11 (limit 12)
Publisher revision: 0087ba6ff2b15a5ffd4354c2a56b053566639b23
Evidence-set SHA-256: a7c816334fdec757314f6dae27a72a30968ca4224d5e7b11bbca92c4fa7984dc
Policy: every new head requires a fresh run; this verifier does not change PR state, queue, or merge.

ericlitman · 2026-11-06T15:02:35Z

Live evidence: Open Pstack

Candidate SHA: 0087ba6ff2b15a5ffd4354c2a56b053566639b23
Base SHA: 2d92c535f2183cf0c74ffff5763209be9b242690
Result: FAILED — verification did not complete; rerun required
Self-test: required in both harnesses
Planned sessions: 11 (limit 12)
Publisher revision: 0087ba6ff2b15a5ffd4354c2a56b053566639b23
Evidence-set SHA-256: 512771f7a2e86cba050d527662f9267b16ee83e90df07673dce397989ccad8ec
Policy: every new head requires a fresh run; this verifier does not change PR state, queue, or merge.

Refs #258 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ericlitman · 2026-11-06T15:21:19Z

Live evidence: Open Pstack

Candidate SHA: 0e3d85b2366b6c145538cc93d7a815035e631cef
Base SHA: 2d92c535f2183cf0c74ffff5763209be9b242690
Result: FAILED — verification did not complete; rerun required
Self-test: required in both harnesses
Planned sessions: 11 (limit 12)
Publisher revision: 0e3d85b2366b6c145538cc93d7a815035e631cef
Evidence-set SHA-256: 9188183efee6a51bde31bcbb94ce95963b1c19f7b4cac84e6be18408c7ccbb06
Policy: every new head requires a fresh run; this verifier does not change PR state, queue, or merge.

Refs #258 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ericlitman · 2026-11-06T15:46:55Z

Live evidence: Open Pstack

Candidate SHA: eefdd1f6b01649bea52735eb779b0e8b7190c3f6
Base SHA: 2d92c535f2183cf0c74ffff5763209be9b242690
Result: PASSED — named features verified
Self-test: completed in both harnesses
Planned sessions: 11 (limit 12)
Publisher revision: eefdd1f6b01649bea52735eb779b0e8b7190c3f6
Evidence-set SHA-256: cdffaa8947a830c40a80dfc04c9fdc1abfcf983fd132d0364bf75fddff04d017
Installation (claude): CLI 2.1.318 (Claude Code), plugin 1.18.0, candidate eefdd1f6b01649bea52735eb779b0e8b7190c3f6, tree 30992800a46340fa0ae6961bd3e887b845cadefe669cb81e25f550971babd519.
Installation (codex): CLI codex-cli 0.167.0, plugin 1.18.0, candidate eefdd1f6b01649bea52735eb779b0e8b7190c3f6, tree 30992800a46340fa0ae6961bd3e887b845cadefe669cb81e25f550971babd519.
Observation (claude / writers): surface claude -p stream-json with the candidate plugin-dir; action recipe writers: devin-writer, dsh-writer, opencode-writer, agy-writer, cursor-writer, muse-writer, muse-reader; result passed 40 assertions; ids retained privately; 40 assertions machine-checked; transcript SHA-256 8db597ed9a1ee67ac6433023aef487c5d27d45d3ef450b5fa528f6a25314c985; artifact-set SHA-256 e92aaf7dda262c3ca37f48225c8ab1e6cf19f28827b65cd79f0d70a7b1c8d09c.
Observation (claude / project-skill): surface claude -p stream-json with the candidate plugin-dir; action recipe project-skill: doctor; result passed: doctor:exit-0 doctor:skill-loaded doctor:doctor-ran doctor:doctor-canonical-pass; 4 assertions machine-checked; transcript SHA-256 4c0dae73f2da847448cae7c0deb3d4fedbecbb3b92a6bd356b3b4c1fc087bea3; artifact-set SHA-256 cdfd5f8ad3718173f6d1e73213ff58a4413a6fb4b895db782361b2ad168329e7.
Observation (codex / catalog): surface codex exec --json with the run-owned candidate installation; action recipe catalog: consume-sheet, consume-sheet-bounded; result passed 24 assertions; ids retained privately; 24 assertions machine-checked; transcript SHA-256 834fb3a6ca84cb0cfb2adf5fad3d763aa7ac5b8272ca172111d37c1ff2d21f43; artifact-set SHA-256 2029beac8c37b8563e0e633b3e2d80672fb64eea5375eca72eb529e209de9541.
Observation (codex / project-skill): surface codex exec --json with the run-owned candidate installation; action recipe project-skill: doctor; result passed: doctor:exit-0 doctor:skill-loaded doctor:doctor-ran doctor:doctor-canonical-pass; 4 assertions machine-checked; transcript SHA-256 982654d505d88a18a789a80a942d6d24407faa9794d2e1b5194858a8ec31a64c; artifact-set SHA-256 d707cd3bf7fe0a8730084e22d3f31946cc371cc2597ee39981bd9e118e926a80.
Policy: every new head requires a fresh run; this verifier does not change PR state, queue, or merge.

mergify · 2026-11-06T15:48:49Z

unfret-eal

🛑 6 blocking findings
🟡 Medium · configure case fails when the sheet has another provider's writer line
🟡 Medium · Setup accepts full-access lines for bounded-only providers
🟡 Medium · Writer recipes are unreachable for recipe-only changes
🟡 Medium · Empty XDG_CONFIG_HOME loses the existing Muse login
🔵 Low · Agy notes still invoke the old agent
🔵 Low · Correct agy's unconditional tool-restriction disclosure
Check

fix: three verdict-changing findings from PR #268 (#270)

ericlitman and others added 6 commits November 6, 2026 07:58

chore: release the provider writers and Muse as 1.18.0

994fb2a

1.17.0 shipped before this change, so its entries move to a new 1.18.0 section and the version strings follow. Refs #263 Refs #258 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

chore(runner): drop a comment that repeats muse's preflight code

0087ba6

Refs #258 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

This was referenced Nov 6, 2026

Add isolated-write to the external providers, with an opt-in for unconfined ones #263

Closed

Support Meta Muse Code (muse) as an external provider #258

Closed

greptile-apps Bot reviewed Nov 6, 2026

View reviewed changes

Comment thread .claude/skills/verify-open-pstack/features/recipes.ts Resolved

Comment thread plugins/pstack/skills/poteto-mode/scripts/runner/providers/agy.ts Resolved

unfret-eal Bot reviewed Nov 6, 2026

View reviewed changes

This was referenced Nov 6, 2026

Measure Amp's writer once Amp is logged in on pro14 #269

Closed

Fix the four blocking findings from PR #268's review #270

Closed

Support T3-owned delegation in pstack provider dispatch #253

Closed

fix(runner): pass META_API_KEY to Muse lanes and accept its preflight

0e3d85b

Refs #258 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(verify): link the operator's Muse config into the run state

eefdd1f

Refs #258 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

mergify Bot merged commit 1d0a0b0 into main Nov 6, 2026
7 of 8 checks passed

unfret-eal Bot reviewed Nov 6, 2026

View reviewed changes

Comment thread plugins/pstack/skills/poteto-mode/scripts/runner/providers/agy.ts Resolved

Comment thread .claude/skills/verify-open-pstack/scripts/isolation.ts Resolved

ericlitman mentioned this pull request Nov 6, 2026

fix: three verdict-changing findings from PR #268 (#270) #271

Merged

mergify Bot added a commit that referenced this pull request Nov 6, 2026

Merge pull request #271 from ericlitman/fix/270-pr268-findings

b411250

fix: three verdict-changing findings from PR #268 (#270)

Conversation

ericlitman commented Nov 6, 2026

Why

Summary

Evidence

Merge Danger

Acceptance criteria

Gate results

Not verified

Uh oh!

mergify Bot commented Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Protections

🟢 Queue ready pull requests

🟢 🚦 Auto-queue

Uh oh!

greptile-apps Bot commented Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Findings

Summary

Uh oh!

Uh oh!

Uh oh!

unfret-eal Bot commented Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛑 6 blocking findings

Uh oh!

unfret-eal Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ericlitman commented Nov 6, 2026

Live evidence: Open Pstack

Uh oh!

ericlitman commented Nov 6, 2026

Live evidence: Open Pstack

Uh oh!

ericlitman commented Nov 6, 2026

Live evidence: Open Pstack

Uh oh!

ericlitman commented Nov 6, 2026

Live evidence: Open Pstack

Uh oh!

Uh oh!

mergify Bot commented Nov 6, 2026

✅ Merged into main as 1d0a0b0 at 15:48 UTC

Uh oh!

unfret-eal Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

mergify Bot commented Nov 6, 2026 •

edited

Loading

greptile-apps Bot commented Nov 6, 2026 •

edited

Loading

unfret-eal Bot commented Nov 6, 2026 •

edited

Loading

✅ Merged into `main` as `1d0a0b0` at 15:48 UTC