main merged

[praxstack]

Note

Medium Risk
Wide changes to CI gates and agent-facing skill instructions affect merge policy and behavior across hosts; scope is tooling/docs rather than auth or data paths.

Overview
Merges the pstack-generic fork work: portable plugin identity, repo validation gates, and host-neutral skill rewrites, plus agent/spec evidence for the verification program.

The marketplace and pstack manifest are rebranded to pstack-generic with updated metadata and PORTABILITY.md acceptance criteria. Root package.json, bun.lock, and npm scripts make validate-plugins runnable; CI installs with bun install --frozen-lockfile and runs plugin validation plus portability and skill reference checks on pstack/** changes.

Across 44 skills and docs, Cursor-centric assumptions are replaced with host adapters: ~/.config/pstack/models.md, native delegation/subagents, explicit capability fallbacks (including gate-5 fixes in verification skills), and metadata.pstack-explicit-invocation instead of portable disable-model-invocation on many coordinators. scripts/check-pstack-references.mjs adds a ≥44 skills floor and CRLF normalization so the reference gate cannot vacuously pass.

Also adds fork agent routing (AGENTS.md, CLAUDE.md, docs/agents/*, SPEC.md) and extensive .agent/.scratch evidence from the gated ship/review loop—not runtime product code.

^{Reviewed by Cursor Bugbot for commit 465182b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

Autofix Details

Bugbot Autofix prepared fixes for all 3 issues found in the latest run.

• ✅ Fixed: README requires Graphite workflows
  • Updated README table rows plus shipping and autopilot-stack playbooks to use gh by default, Origin when available, and never require Graphite.
• ✅ Fixed: Mode skill discovery misses Cursor paths
  • automate-me step 0 and placement now search workspace .cursor/skills/, user ~/.cursor/skills/, and plugin ~/.cursor/plugins/ before Agent Skills fallbacks.
• ✅ Fixed: Coordinators lost invocation lock
  • Restored disable-model-invocation: true in poteto-mode, architect, and how frontmatter alongside existing metadata.

Or push these changes by commenting:

@cursor push 41b7498d96

Preview (41b7498d96)

diff --git a/.agent/evidence/code-review-findings.md b/.agent/evidence/code-review-findings.md
new file mode 100644
--- /dev/null
+++ b/.agent/evidence/code-review-findings.md
@@ -0,0 +1,31 @@
+# Code review record — cumulative diff `main...chore/skill-setup-and-pstack-gates`
+
+Two independent fresh-context reviewers: Standards/Correctness axis + Spec/Validator axis.
+Spec validator independently re-ran AC1–AC6 commands; all reproduced green
+(44-skill portability exit 0 · validate-plugins exit 0 · references exit 0 ·
+bun test 52/52 · audit spot-check matched · evidence file real).
+
+## Findings and dispositions
+
+| # | Sev | Finding | Disposition |
+|---|-----|---------|-------------|
+| 1 | MAJOR | Four triage labels missing from tracker vs docs claims | **Resolved by verification** — `gh label list` confirms needs-triage/needs-info/ready-for-agent/ready-for-human/wontfix all exist; earlier "missing" was a truncated listing on both sides |
+| 2 | MINOR | CI installed ajv unpinned via `npm install --no-save`, ignoring lockfile | **Fixed** — workflow now `bun install --frozen-lockfile` |
+| 3 | MINOR | New references gate unwired (no alias, no CI, absent from CLAUDE.md gates) | **Fixed** — alias added; CI runs all three gates; path filter includes `pstack/**`; CLAUDE.md updated |
+| 4 | MINOR | `decodeURIComponent` throws on malformed escapes, crashing whole run | **Fixed** — try/catch, reported as unresolved reference |
+| 5 | NIT | Commit message says "pinning"; ranges are caret | **Accepted as-is** — bun.lock is the pin; not rewriting pushed-stack history for prose |
+| 6 | NIT | Checker edge cases (Windows seps, reference-style links, fences, hyphen placeholders) | **Partially fixed** — hyphenated placeholders exempted; rest documented as known limits in header comment |
+| 7 | NIT | `skillRootOf` bogus probe when md sits directly at skills root | **Won't fix** — second probe covers it; no such file exists (44 skill dirs) |
+| 8 | NIT | `.scratch` ticket location; two doc commits could be one | **Won't fix** — `.scratch/<feature>/` is the setup-matt-pocock canonical convention; history preserved |
+| D1 | Drift | Gate-5 audit's re-audit grep read like a failing gate | **Fixed** — reworded to classify expected absences |
+
+## Unrelated-changes check
+
+CLAUDE.md + docs/agents/* (~160 lines) sit outside the SPEC Objective text but are
+covered by recorded Assumption 1 (user-mandated skill-setup scope, branch name).
+Retained with this note as reviewer sign-off context.
+
+## Parked
+
+PORTABILITY gate 4 remainder (Cursor GUI + second non-Cursor host clean-session smoke):
+requires human-launched sessions. Unblock recorded in SPEC Assumption 2 and issue #6.

@@ -0,0 +1,31 @@
+# Code review record — cumulative diff `main...chore/skill-setup-and-pstack-gates`
+
+Two independent fresh-context reviewers: Standards/Correctness axis + Spec/Validator axis.
+Spec validator independently re-ran AC1–AC6 commands; all reproduced green
+(44-skill portability exit 0 · validate-plugins exit 0 · references exit 0 ·
+bun test 52/52 · audit spot-check matched · evidence file real).
+
+## Findings and dispositions
+
+| # | Sev | Finding | Disposition |
+|---|-----|---------|-------------|
+| 1 | MAJOR | Four triage labels missing from tracker vs docs claims | **Resolved by verification** — `gh label list` confirms needs-triage/needs-info/ready-for-agent/ready-for-human/wontfix all exist; earlier "missing" was a truncated listing on both sides |
+| 2 | MINOR | CI installed ajv unpinned via `npm install --no-save`, ignoring lockfile | **Fixed** — workflow now `bun install --frozen-lockfile` |
+| 3 | MINOR | New references gate unwired (no alias, no CI, absent from CLAUDE.md gates) | **Fixed** — alias added; CI runs all three gates; path filter includes `pstack/**`; CLAUDE.md updated |
+| 4 | MINOR | `decodeURIComponent` throws on malformed escapes, crashing whole run | **Fixed** — try/catch, reported as unresolved reference |
+| 5 | NIT | Commit message says "pinning"; ranges are caret | **Accepted as-is** — bun.lock is the pin; not rewriting pushed-stack history for prose |
+| 6 | NIT | Checker edge cases (Windows seps, reference-style links, fences, hyphen placeholders) | **Partially fixed** — hyphenated placeholders exempted; rest documented as known limits in header comment |
+| 7 | NIT | `skillRootOf` bogus probe when md sits directly at skills root | **Won't fix** — second probe covers it; no such file exists (44 skill dirs) |
+| 8 | NIT | `.scratch` ticket location; two doc commits could be one | **Won't fix** — `.scratch/<feature>/` is the setup-matt-pocock canonical convention; history preserved |
+| D1 | Drift | Gate-5 audit's re-audit grep read like a failing gate | **Fixed** — reworded to classify expected absences |
+
+## Unrelated-changes check
+
+CLAUDE.md + docs/agents/* (~160 lines) sit outside the SPEC Objective text but are
+covered by recorded Assumption 1 (user-mandated skill-setup scope, branch name).
+Retained with this note as reviewer sign-off context.
+
+## Parked
+
+PORTABILITY gate 4 remainder (Cursor GUI + second non-Cursor host clean-session smoke):
+requires human-launched sessions. Unblock recorded in SPEC Assumption 2 and issue #6.

diff --git a/.agent/evidence/gate5-fallback-audit.md b/.agent/evidence/gate5-fallback-audit.md
new file mode 100644
--- /dev/null
+++ b/.agent/evidence/gate5-fallback-audit.md
@@ -0,0 +1,64 @@
+# Gate 5 audit — bounded fallback for unavailable capabilities
+
+Scope: all 44 skills under `pstack/skills/` (SKILL.md plus references/playbooks).
+Contract: `pstack/PORTABILITY.md` portable core — "degrade explicitly when a
+capability is unavailable"; acceptance gate 5.
+
+> **Revision 2 (2026-08-22, post-merge review of PR #8).** Revision 1 claimed
+> "15/44 direct hits" and "44/44 audited after fix; zero open gaps." Both claims
+> were wrong or unreproducible: the stated grep yields **13** direct hits on
+> SKILL.md files; three skills (`bro`, `tdd`, `unslop`) were absent from the
+> verdict table; one non-hitting `principle-*` skill was miscounted (19 claimed,
+> 20 actual); and `create-verification-skill` was labeled COVERED despite having
+> no capability-degradation clause for its core drive dependency. This revision
+> replaces those claims with reproducible counts and fixes both gaps found.
+
+## Method (reproducible)
+
+1. Direct-hit grep over SKILL.md files only:
+
+   ```sh
+   grep -rilE 'unavailable|fallback|degrade|not available' pstack/skills/*/SKILL.md
+   ```
+
+   → **13 skills**: arena, automate-me, figure-it-out, how, interrogate,
+   no-comments, principle-guard-the-context-window, recall, reflect,
+   setup-pstack, show-me-your-work, swarm, why.
+
+   (An all-markdown variant returns 34 files; per-skill classification below is
+   authoritative because coverage lives in whichever file binds the capability.)
+
+2. For the remaining **31** skills: sweep capability terms
+   (`subagent|delegate|spawn|host|tracker|browser|playwright|network`) per skill
+   directory, then read the cited lines to separate real bindings from prose.
+
+## Verdicts — 44/44 classified (13 direct + 31 swept)
+
+| Skill / group | n | Verdict | Evidence |
+|---|---|---|---|
+| Direct hits (listed above) | 13 | COVERED | explicit degradation language in SKILL.md |
+| architect | 1 | COVERED | SKILL.md L16 "If no tracker is available, keep the same short checklist"; L36 "Otherwise run independent candidates on the parent model … Never invent a model identifier" |
+| blast-radius | 1 | COVERED | SKILL.md step 6: "Use distinct confirmed models when available; otherwise inherit the parent model and do not claim cross-model evidence." |
+| poteto-mode | 1 | COVERED | references/plan.md L5 tracker fallback; L26–27 role/model fallbacks ("Otherwise launch a general delegate …", "Otherwise inherit the parent model and never invent an identifier") |
+| maintain-verification-skill | 1 | GAP → FIXED (`badf6ac`) | serial self-execution fallback added; bounded with batching discipline in revision 2 |
+| create-verification-skill | 1 | GAP → FIXED (this branch) | revision 1 missed it entirely: no degradation existed for an undriveable app; added explicit stop-and-report clause in §1 Drive |
+| teach | 1 | COMPLIANT (vacuous) | zero capability-term hits |
+| technical-writing | 1 | COMPLIANT (benign) | L93 "the client and the host" is prose-style guidance, not a capability binding |
+| typescript-best-practices | 1 | COMPLIANT (benign) | "model variants" = TypeScript union modeling |
+| tdd | 1 | COMPLIANT (benign) | L28 lists browser automation etc. as optional regression-check examples ("Examples include"), no hard binding |
+| bro | 1 | COMPLIANT (vacuous) | restatement task; zero capability-term hits (absent from revision 1's table) |
+| unslop | 1 | COMPLIANT (vacuous) | prose-style edits; zero capability-term hits (absent from revision 1's table) |
+| principle-* without direct hits | 20 | COMPLIANT (vacuous) | only conditional mentions remain: build-the-lever L3/L20 ("When you fan work out to subagents…" — optional), make-operations-idempotent L20 ("respawns cleanly" metaphor); guard-the-context-window is among the 13 direct hits |
+
+Count check: 13 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 20 = 44 ✓
+
+## Residual
+
+After both fixes, every skill carries an explicit verdict above and the counts
+reconcile to 44. Two gaps were found and fixed in total across revisions:
+`maintain-verification-skill` (badf6ac, bounded here) and
+`create-verification-skill` (this branch). No skill remains unclassified.
+Revision 1's "15/44 · zero open gaps" statement was false as written — it was
+not reproducible from the stated method, omitted three skills, miscounted the
+principle group by one, and mislabeled create-verification-skill COVERED. It is
+superseded by this document, not amended in place.

@@ -0,0 +1,64 @@
+# Gate 5 audit — bounded fallback for unavailable capabilities
+
+Scope: all 44 skills under `pstack/skills/` (SKILL.md plus references/playbooks).
+Contract: `pstack/PORTABILITY.md` portable core — "degrade explicitly when a
+capability is unavailable"; acceptance gate 5.
+
+> **Revision 2 (2026-08-22, post-merge review of PR #8).** Revision 1 claimed
+> "15/44 direct hits" and "44/44 audited after fix; zero open gaps." Both claims
+> were wrong or unreproducible: the stated grep yields **13** direct hits on
+> SKILL.md files; three skills (`bro`, `tdd`, `unslop`) were absent from the
+> verdict table; one non-hitting `principle-*` skill was miscounted (19 claimed,
+> 20 actual); and `create-verification-skill` was labeled COVERED despite having
+> no capability-degradation clause for its core drive dependency. This revision
+> replaces those claims with reproducible counts and fixes both gaps found.
+
+## Method (reproducible)
+
+1. Direct-hit grep over SKILL.md files only:
+
+   ```sh
+   grep -rilE 'unavailable|fallback|degrade|not available' pstack/skills/*/SKILL.md
+   ```
+
+   → **13 skills**: arena, automate-me, figure-it-out, how, interrogate,
+   no-comments, principle-guard-the-context-window, recall, reflect,
+   setup-pstack, show-me-your-work, swarm, why.
+
+   (An all-markdown variant returns 34 files; per-skill classification below is
+   authoritative because coverage lives in whichever file binds the capability.)
+
+2. For the remaining **31** skills: sweep capability terms
+   (`subagent|delegate|spawn|host|tracker|browser|playwright|network`) per skill
+   directory, then read the cited lines to separate real bindings from prose.
+
+## Verdicts — 44/44 classified (13 direct + 31 swept)
+
+| Skill / group | n | Verdict | Evidence |
+|---|---|---|---|
+| Direct hits (listed above) | 13 | COVERED | explicit degradation language in SKILL.md |
+| architect | 1 | COVERED | SKILL.md L16 "If no tracker is available, keep the same short checklist"; L36 "Otherwise run independent candidates on the parent model … Never invent a model identifier" |
+| blast-radius | 1 | COVERED | SKILL.md step 6: "Use distinct confirmed models when available; otherwise inherit the parent model and do not claim cross-model evidence." |
+| poteto-mode | 1 | COVERED | references/plan.md L5 tracker fallback; L26–27 role/model fallbacks ("Otherwise launch a general delegate …", "Otherwise inherit the parent model and never invent an identifier") |
+| maintain-verification-skill | 1 | GAP → FIXED (`badf6ac`) | serial self-execution fallback added; bounded with batching discipline in revision 2 |
+| create-verification-skill | 1 | GAP → FIXED (this branch) | revision 1 missed it entirely: no degradation existed for an undriveable app; added explicit stop-and-report clause in §1 Drive |
+| teach | 1 | COMPLIANT (vacuous) | zero capability-term hits |
+| technical-writing | 1 | COMPLIANT (benign) | L93 "the client and the host" is prose-style guidance, not a capability binding |
+| typescript-best-practices | 1 | COMPLIANT (benign) | "model variants" = TypeScript union modeling |
+| tdd | 1 | COMPLIANT (benign) | L28 lists browser automation etc. as optional regression-check examples ("Examples include"), no hard binding |
+| bro | 1 | COMPLIANT (vacuous) | restatement task; zero capability-term hits (absent from revision 1's table) |
+| unslop | 1 | COMPLIANT (vacuous) | prose-style edits; zero capability-term hits (absent from revision 1's table) |
+| principle-* without direct hits | 20 | COMPLIANT (vacuous) | only conditional mentions remain: build-the-lever L3/L20 ("When you fan work out to subagents…" — optional), make-operations-idempotent L20 ("respawns cleanly" metaphor); guard-the-context-window is among the 13 direct hits |
+
+Count check: 13 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 20 = 44 ✓
+
+## Residual
+
+After both fixes, every skill carries an explicit verdict above and the counts
+reconcile to 44. Two gaps were found and fixed in total across revisions:
+`maintain-verification-skill` (badf6ac, bounded here) and
+`create-verification-skill` (this branch). No skill remains unclassified.
+Revision 1's "15/44 · zero open gaps" statement was false as written — it was
+not reproducible from the stated method, omitted three skills, miscounted the
+principle group by one, and mislabeled create-verification-skill COVERED. It is
+superseded by this document, not amended in place.

diff --git a/.agent/evidence/pr9-merge-2026-08-22/qa-summary.svg b/.agent/evidence/pr9-merge-2026-08-22/qa-summary.svg
new file mode 100644
--- /dev/null
+++ b/.agent/evidence/pr9-merge-2026-08-22/qa-summary.svg
@@ -0,0 +1,30 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="880" height="420" viewBox="0 0 880 420" font-family="Menlo, Consolas, monospace">
+  <rect width="880" height="420" fill="#0d1117"/>
+  <rect x="24" y="24" width="832" height="64" rx="8" fill="#161b22" stroke="#30363d"/>
+  <text x="44" y="52" fill="#58a6ff" font-size="20" font-weight="bold">pstack-generic · PR #9 QA evidence</text>
+  <text x="44" y="76" fill="#8b949e" font-size="13">post-merge upstream reconciliation · branch fix/post-merge-review-findings @ 215edb0 · 2026-08-21T22:11Z</text>
+
+  <rect x="24" y="112" width="404" height="130" rx="8" fill="#161b22" stroke="#3fb950"/>
+  <text x="44" y="142" fill="#3fb950" font-size="16" font-weight="bold">✔ GATE 1 · validate-plugins.mjs</text>
+  <text x="44" y="168" fill="#c9d1d9" font-size="12">All plugins validated successfully.</text>
+  <text x="44" y="190" fill="#8b949e" font-size="12">exit 0 · incl. pstack-generic manifest + ajv devDeps</text>
+  <text x="44" y="222" fill="#3fb950" font-size="12">AC2 PASS</text>
+
+  <rect x="452" y="112" width="404" height="130" rx="8" fill="#161b22" stroke="#3fb950"/>
+  <text x="472" y="142" fill="#3fb950" font-size="16" font-weight="bold">✔ GATE 2 · check-pstack-portability.mjs</text>
+  <text x="472" y="168" fill="#c9d1d9" font-size="12">44 skills portable, no host or model coupling.</text>
+  <text x="472" y="190" fill="#8b949e" font-size="12">exit 0 · PORTABILITY.md acceptance contract gate 1</text>
+  <text x="472" y="222" fill="#3fb950" font-size="12">AC1 PASS</text>
+
+  <rect x="24" y="266" width="404" height="130" rx="8" fill="#161b22" stroke="#3fb950"/>
+  <text x="44" y="296" fill="#3fb950" font-size="16" font-weight="bold">✔ GATE 3 · check-pstack-references.mjs</text>
+  <text x="44" y="322" fill="#c9d1d9" font-size="12">Checked 100 markdown files under pstack/skills.</text>
+  <text x="44" y="344" fill="#c9d1d9" font-size="12">All skill references resolve. exit 0</text>
+  <text x="44" y="376" fill="#3fb950" font-size="12">AC3 PASS · floor-guard ≥44 + CRLF tolerance active</text>
+
+  <rect x="452" y="266" width="404" height="130" rx="8" fill="#161b22" stroke="#3fb950"/>
+  <text x="472" y="296" fill="#3fb950" font-size="16" font-weight="bold">✔ GATE 4 · bun test pstack</text>
+  <text x="472" y="322" fill="#c9d1d9" font-size="12">52 pass · 0 fail · 206 expect() calls · 4 files</text>
+  <text x="472" y="344" fill="#c9d1d9" font-size="12">889 ms · exit 0</text>
+  <text x="472" y="376" fill="#3fb950" font-size="12">AC4 PASS</text>
+</svg>

@@ -0,0 +1,30 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="880" height="420" viewBox="0 0 880 420" font-family="Menlo, Consolas, monospace">
+  <rect width="880" height="420" fill="#0d1117"/>
+  <rect x="24" y="24" width="832" height="64" rx="8" fill="#161b22" stroke="#30363d"/>
+  <text x="44" y="52" fill="#58a6ff" font-size="20" font-weight="bold">pstack-generic · PR #9 QA evidence</text>
+  <text x="44" y="76" fill="#8b949e" font-size="13">post-merge upstream reconciliation · branch fix/post-merge-review-findings @ 215edb0 · 2026-08-21T22:11Z</text>
+
+  <rect x="24" y="112" width="404" height="130" rx="8" fill="#161b22" stroke="#3fb950"/>
+  <text x="44" y="142" fill="#3fb950" font-size="16" font-weight="bold">✔ GATE 1 · validate-plugins.mjs</text>
+  <text x="44" y="168" fill="#c9d1d9" font-size="12">All plugins validated successfully.</text>
+  <text x="44" y="190" fill="#8b949e" font-size="12">exit 0 · incl. pstack-generic manifest + ajv devDeps</text>
+  <text x="44" y="222" fill="#3fb950" font-size="12">AC2 PASS</text>
+
+  <rect x="452" y="112" width="404" height="130" rx="8" fill="#161b22" stroke="#3fb950"/>
+  <text x="472" y="142" fill="#3fb950" font-size="16" font-weight="bold">✔ GATE 2 · check-pstack-portability.mjs</text>
+  <text x="472" y="168" fill="#c9d1d9" font-size="12">44 skills portable, no host or model coupling.</text>
+  <text x="472" y="190" fill="#8b949e" font-size="12">exit 0 · PORTABILITY.md acceptance contract gate 1</text>
+  <text x="472" y="222" fill="#3fb950" font-size="12">AC1 PASS</text>
+
+  <rect x="24" y="266" width="404" height="130" rx="8" fill="#161b22" stroke="#3fb950"/>
+  <text x="44" y="296" fill="#3fb950" font-size="16" font-weight="bold">✔ GATE 3 · check-pstack-references.mjs</text>
+  <text x="44" y="322" fill="#c9d1d9" font-size="12">Checked 100 markdown files under pstack/skills.</text>
+  <text x="44" y="344" fill="#c9d1d9" font-size="12">All skill references resolve. exit 0</text>
+  <text x="44" y="376" fill="#3fb950" font-size="12">AC3 PASS · floor-guard ≥44 + CRLF tolerance active</text>
+
+  <rect x="452" y="266" width="404" height="130" rx="8" fill="#161b22" stroke="#3fb950"/>
+  <text x="472" y="296" fill="#3fb950" font-size="16" font-weight="bold">✔ GATE 4 · bun test pstack</text>
+  <text x="472" y="322" fill="#c9d1d9" font-size="12">52 pass · 0 fail · 206 expect() calls · 4 files</text>
+  <text x="472" y="344" fill="#c9d1d9" font-size="12">889 ms · exit 0</text>
+  <text x="472" y="376" fill="#3fb950" font-size="12">AC4 PASS</text>
+</svg>

diff --git a/.agent/evidence/pr9-merge-2026-08-22/qa-summary.svg.png b/.agent/evidence/pr9-merge-2026-08-22/qa-summary.svg.png
new file mode 100644

diff --git a/.agent/evidence/pr9-rerun-post-merge-2026-08-22/pr-body.md b/.agent/evidence/pr9-rerun-post-merge-2026-08-22/pr-body.md
new file mode 100644
--- /dev/null
+++ b/.agent/evidence/pr9-rerun-post-merge-2026-08-22/pr-body.md
@@ -0,0 +1,36 @@
+## Summary
+
+Re-raise of the post-merge review remediation that was closed unmerged as #245 (opened against the wrong default base — upstream instead of this fork; branch content was correct). Supersedes #245. Closes #11 (T7), closes #12 (T8); refs #13.
+
+The branch carries three remediation commits plus a clean merge of current main:
+
+- `a4eaaf1` fix(pstack): gate-5 degradation fixes and spec carve-out
+- `d6b4292` fix(scripts): floor guard and CRLF tolerance in reference checker
+- `12935ba` docs(evidence): reconcile gate-5 audit; fix dead evidence citations
+- `215edb0` Merge upstream tip (4612556) — absorbs docs(pstack) workflow/boundary port (#238); `git merge-tree` dry-run showed zero conflicts
+
+## What changed, honestly
+
+1. **Reference gate hardening** (`scripts/check-pstack-references.mjs`): floor guard and CRLF tolerance so the gate degrades predictably instead of mis-reporting on Windows-style line endings or empty match sets.
+2. **Gate-5 degradation fixes** under `pstack/`: bounded fallback behavior when subagents are unavailable, with spec carve-out documented rather than silently absorbed.
+3. **Evidence truthfulness**: dead evidence citations repaired; gate-5 audit wording now matches what the code actually does.
+4. **Reconciliation**: main absorbed; all gates proven against current upstream content, not a stale base.
+
+## QA evidence (fresh, at HEAD `215edb0`, 2026-08-22)
+
+| Gate | Command | Result |
+|---|---|---|
+| Portability (gate 1) | `npm run check-pstack-portability` | exit 0 |
+| References (gate 3) | `npm run check-pstack-references` | exit 0 |
+| Marketplace validation | `npm run validate-plugins` | exit 0 |
+| Runtime tests | `bun test pstack` | 52 pass / 0 fail, exit 0 |
+
+Raw logs: `.agent/evidence/pr9-rerun-post-merge-2026-08-22/` (`.log` files are gitignored by repo policy; substance mirrored above and in `.scratch/pstack-generic-gates/T7`/`T8`).
+
+**Known unrelated failure (not introduced here):** bare `bun test` at repo root discovers 139 tests across 32 files including `orchestrate/*`, which errors on missing optional deps (`@slack/web-api`, `zod/v3`). `orchestrate/` is byte-identical to `origin/main` (verified via diff), so this is pre-existing upstream state — filed separately as #13 with repro and suggested directions.
+
+## Process notes
+
+- Tickets: T7 → #11, T8 → #12 (markdown mirrors in `.scratch/pstack-generic-gates/`).
+- Fresh-context code review ran over `origin/main..HEAD` before this PR was raised; findings and verdict recorded in `.agent/evidence/code-review-findings.md`.
+- Review-only PR: raised by the authoring agent, intentionally **not merged** — merge approval stays human.

@@ -0,0 +1,36 @@
+## Summary
+
+Re-raise of the post-merge review remediation that was closed unmerged as #245 (opened against the wrong default base — upstream instead of this fork; branch content was correct). Supersedes #245. Closes #11 (T7), closes #12 (T8); refs #13.
+
+The branch carries three remediation commits plus a clean merge of current main:
+
+- `a4eaaf1` fix(pstack): gate-5 degradation fixes and spec carve-out
+- `d6b4292` fix(scripts): floor guard and CRLF tolerance in reference checker
+- `12935ba` docs(evidence): reconcile gate-5 audit; fix dead evidence citations
+- `215edb0` Merge upstream tip (4612556) — absorbs docs(pstack) workflow/boundary port (#238); `git merge-tree` dry-run showed zero conflicts
+
+## What changed, honestly
+
+1. **Reference gate hardening** (`scripts/check-pstack-references.mjs`): floor guard and CRLF tolerance so the gate degrades predictably instead of mis-reporting on Windows-style line endings or empty match sets.
+2. **Gate-5 degradation fixes** under `pstack/`: bounded fallback behavior when subagents are unavailable, with spec carve-out documented rather than silently absorbed.
+3. **Evidence truthfulness**: dead evidence citations repaired; gate-5 audit wording now matches what the code actually does.
+4. **Reconciliation**: main absorbed; all gates proven against current upstream content, not a stale base.
+
+## QA evidence (fresh, at HEAD `215edb0`, 2026-08-22)
+
+| Gate | Command | Result |
+|---|---|---|
+| Portability (gate 1) | `npm run check-pstack-portability` | exit 0 |
+| References (gate 3) | `npm run check-pstack-references` | exit 0 |
+| Marketplace validation | `npm run validate-plugins` | exit 0 |
+| Runtime tests | `bun test pstack` | 52 pass / 0 fail, exit 0 |
+
+Raw logs: `.agent/evidence/pr9-rerun-post-merge-2026-08-22/` (`.log` files are gitignored by repo policy; substance mirrored above and in `.scratch/pstack-generic-gates/T7`/`T8`).
+
+**Known unrelated failure (not introduced here):** bare `bun test` at repo root discovers 139 tests across 32 files including `orchestrate/*`, which errors on missing optional deps (`@slack/web-api`, `zod/v3`). `orchestrate/` is byte-identical to `origin/main` (verified via diff), so this is pre-existing upstream state — filed separately as #13 with repro and suggested directions.
+
+## Process notes
+
+- Tickets: T7 → #11, T8 → #12 (markdown mirrors in `.scratch/pstack-generic-gates/`).
+- Fresh-context code review ran over `origin/main..HEAD` before this PR was raised; findings and verdict recorded in `.agent/evidence/code-review-findings.md`.
+- Review-only PR: raised by the authoring agent, intentionally **not merged** — merge approval stays human.

diff --git a/.agent/evidence/t10-port-ledger.md b/.agent/evidence/t10-port-ledger.md
new file mode 100644
--- /dev/null
+++ b/.agent/evidence/t10-port-ledger.md
@@ -0,0 +1,50 @@
+# T10 port ledger — upstream pstack 0.14.2 → pstack-generic
+
+Source: upstream/main 4612556 · Target: fix/port-upstream-pstack-0142
+Rule: every semantic upstream addition is either ported in host-neutral phrasing
+or omitted with a recorded reason. Identity files stay ours (SPEC non-goals).
+
+## autopilot-full.md
+
+| Upstream addition | Decision |
+|---|---|
+| `/goal` arming on operator go, persists across turns | PORTED — "persistent program goal … host's native goal or plan mechanism when it has one, otherwise a recorded objective every audit tick re-reads" |
+| Terminal `/loop` audit cadence + monitored-shell sleep | PARTIAL PORT — cadence stays on the existing host-neutral sentence ("event, wait, or recurring-work feature … bounded polling"); Cursor's terminal-/loop and cloud-sleeper mechanics are host-specific and omitted |
+| Output-notification sentinel per tick | PORTED verbatim-in-meaning |
+| Never leave cadence to memory / lossy completion notifications | PORTED |
+| Re-read playbook from trunk via `git show origin/main:<path>` + re-read armed goal | PORTED (path adjusted to this file) |
+| Fix drift during tick, treat as urgent | PORTED |
+| Liveness/status probe per owner | PORTED (replaces vaguer "probes delegated-work status") |
+| Count only side effects as progress (commits/pushes/PR-check deltas/store reports) | PORTED |
+| Stuck-lane stand-down + immediate replacement, "do not wait for a polite return" | PORTED |
+| Bugbot pass counters / `cursor-team-kit` deslop / control-cli-control-ui names | OMITTED — already generalized in ours ("skeptical automated-review triage", "installed deslop equivalent", "installed CLI or UI control skill"); naming the Cursor plugin would re-couple the generic variant |
+| Cloud-sleeper wake chain | OMITTED — Cursor cloud concept; ours' bounded-polling fallback covers it |
+
+## autopilot-stack.md
+
+| Upstream addition | Decision |
+|---|---|
+| `/goal` arming on explicit go | PORTED (same neutral phrasing as full) |
+| Audit-tick hardening block (sentinel, trunk re-read, side-effects progress, stuck stand-down) | PORTED (path adjusted) |
+| `gt` restack/submit mechanics, Graphite UI delivery | OMITTED — ours keeps source-control-host adapter phrasing ("whatever stacking tool the team uses", "active source-control adapter"); semantics preserved, tool coupling dropped |
+| Cloud-agent division-of-labor framing | OMITTED — host-specific |
+
+## opening-a-pr.md
+
+| Upstream addition | Decision |
+|---|---|
+| Per-invocation worktree isolation for sequential writers (`fetch && reset --hard origin/<branch>`) | PORTED |
+| `/technical-writing` layers except Diátaxis + one-word-per-action / keep articles / avoid `-ing` | PORTED (skill referenced generically) |
+| Conventional Commits title spec (types, scope examples, imperative subject, real symbol, no trailing period) | PORTED |
+| Sectioned description template Why/Scope/Tradeoffs/Blast Radius/Verification + drop-when-empty + media after sections | PORTED |
+| Boilerplate ban extended from "small PRs" to all PRs | PORTED (stronger form adopted; duplicate clause removed) |
+| Open ready never draft + ready-command fallback + verify via PR viewer | PORTED (host-neutral wording; absorbs ours' viewer sentence) |
+| Babysit reversal: opening ≠ babysit; separate pass only on request post-stack; stalls-build rationale | PORTED — replaces ours' auto-babysit line (upstream semantics win; recorded here) |
+| `gt` stacking specifics | OMITTED — team-tool neutrality retained |
+
+## plugin.json
+
+| Upstream change | Decision |
+|---|---|
+| name/displayName/description/publisher/homepage/repository/keywords/tags | OMITTED — identity is human-owned and intentionally generic (`pstack-generic`, praxstack) |
+| version 0.14.2 | PORTED AS `0.14.2-generic.1` — signals upstream-content parity of carried guidance while keeping the generic identity scheme |

@@ -0,0 +1,50 @@
+# T10 port ledger — upstream pstack 0.14.2 → pstack-generic
+
+Source: upstream/main 4612556 · Target: fix/port-upstream-pstack-0142
+Rule: every semantic upstream addition is either ported in host-neutral phrasing
+or omitted with a recorded reason. Identity files stay ours (SPEC non-goals).
+
+## autopilot-full.md
+
+| Upstream addition | Decision |
+|---|---|
+| `/goal` arming on operator go, persists across turns | PORTED — "persistent program goal … host's native goal or plan mechanism when it has one, otherwise a recorded objective every audit tick re-reads" |
+| Terminal `/loop` audit cadence + monitored-shell sleep | PARTIAL PORT — cadence stays on the existing host-neutral sentence ("event, wait, or recurring-work feature … bounded polling"); Cursor's terminal-/loop and cloud-sleeper mechanics are host-specific and omitted |
+| Output-notification sentinel per tick | PORTED verbatim-in-meaning |
+| Never leave cadence to memory / lossy completion notifications | PORTED |
+| Re-read playbook from trunk via `git show origin/main:<path>` + re-read armed goal | PORTED (path adjusted to this file) |
+| Fix drift during tick, treat as urgent | PORTED |
+| Liveness/status probe per owner | PORTED (replaces vaguer "probes delegated-work status") |
+| Count only side effects as progress (commits/pushes/PR-check deltas/store reports) | PORTED |
+| Stuck-lane stand-down + immediate replacement, "do not wait for a polite return" | PORTED |
+| Bugbot pass counters / `cursor-team-kit` deslop / control-cli-control-ui names | OMITTED — already generalized in ours ("skeptical automated-review triage", "installed deslop equivalent", "installed CLI or UI control skill"); naming the Cursor plugin would re-couple the generic variant |
+| Cloud-sleeper wake chain | OMITTED — Cursor cloud concept; ours' bounded-polling fallback covers it |
+
+## autopilot-stack.md
+
+| Upstream addition | Decision |
+|---|---|
+| `/goal` arming on explicit go | PORTED (same neutral phrasing as full) |
+| Audit-tick hardening block (sentinel, trunk re-read, side-effects progress, stuck stand-down) | PORTED (path adjusted) |
+| `gt` restack/submit mechanics, Graphite UI delivery | OMITTED — ours keeps source-control-host adapter phrasing ("whatever stacking tool the team uses", "active source-control adapter"); semantics preserved, tool coupling dropped |
+| Cloud-agent division-of-labor framing | OMITTED — host-specific |
+
+## opening-a-pr.md
+
+| Upstream addition | Decision |
+|---|---|
+| Per-invocation worktree isolation for sequential writers (`fetch && reset --hard origin/<branch>`) | PORTED |
+| `/technical-writing` layers except Diátaxis + one-word-per-action / keep articles / avoid `-ing` | PORTED (skill referenced generically) |
+| Conventional Commits title spec (types, scope examples, imperative subject, real symbol, no trailing period) | PORTED |
+| Sectioned description template Why/Scope/Tradeoffs/Blast Radius/Verification + drop-when-empty + media after sections | PORTED |
+| Boilerplate ban extended from "small PRs" to all PRs | PORTED (stronger form adopted; duplicate clause removed) |
+| Open ready never draft + ready-command fallback + verify via PR viewer | PORTED (host-neutral wording; absorbs ours' viewer sentence) |
+| Babysit reversal: opening ≠ babysit; separate pass only on request post-stack; stalls-build rationale | PORTED — replaces ours' auto-babysit line (upstream semantics win; recorded here) |
+| `gt` stacking specifics | OMITTED — team-tool neutrality retained |
+
+## plugin.json
+
+| Upstream change | Decision |
+|---|---|
+| name/displayName/description/publisher/homepage/repository/keywords/tags | OMITTED — identity is human-owned and intentionally generic (`pstack-generic`, praxstack) |
+| version 0.14.2 | PORTED AS `0.14.2-generic.1` — signals upstream-content parity of carried guidance while keeping the generic identity scheme |

diff --git a/.agent/evidence/verification-evidence.md b/.agent/evidence/verification-evidence.md
new file mode 100644
--- /dev/null
+++ b/.agent/evidence/verification-evidence.md
@@ -0,0 +1,96 @@
+# pstack-generic verification evidence
+
+Run: autonomous session 2026-08-21 · branch `chore/skill-setup-and-pstack-gates` · node v24.19.0 / bun 1.3.14
+
+## Gate 1 — portability contract (AC1)
+```
+pstack portable core: 44 skills, no host or model coupling detected
+```
+
+## Marketplace validation incl. pstack-generic manifest (AC2)
+```
+All plugins validated successfully.
+```
+
+## Gate 2 — runtime tests, full poteto-mode suite (AC4)
+```
+
+ 52 pass
+ 0 fail
+ 206 expect() calls
+Ran 52 tests across 4 files. [863.00ms]
+```
+
+## Gate 3 — skill reference resolution (AC3)
+```
+Checked 100 markdown files under pstack/skills.
+All skill references resolve.
+```
+
+## Gate 5 — bounded-fallback audit (AC5)
+
+See [gate5-fallback-audit.md](gate5-fallback-audit.md). Verdict (revision 2): 44/44 classified — 13 explicit-coverage hits + 31 classified-by-sweep; **two** gaps found and fixed (maintain-verification-skill `badf6ac`; create-verification-skill, post-merge review branch). Revision 1's "zero open gaps" claim was wrong and is superseded.
+
+## Smoke — live host evidence (AC6, partial)
+- This session executes installed pstack-generic skills (recall, setup-pstack, reflect, swarm, interrogate, how, why, poteto-mode, principle-*) on opencode — one non-Cursor host, live.
+- Remaining hosts (Cursor GUI + second non-Cursor): parked; unblock = human launches a clean session in each and confirms skill loading.
+
+## Post-merge remediation (follow-up to PR #8)
+
+Branch `fix/post-merge-review-findings` off `a7320ed`. Fresh-context adversarial
+review of the merged branch (subagent panel — see session log for the council
+substitute disclosure) produced findings F1–F8; dispositions:
+
+| Finding | Severity | Disposition |
+|---|---|---|
+| F1 gate-5 audit false completeness claim | **Major** | FIXED — audit rewritten as revision 2 with reproducible counts; create-verification-skill gap found and fixed |
+| F2 missing npm alias for references gate | Minor | already fixed by `1ad5f3f` before review completed |
+| F3 ticket mirrors cite gitignored `.log` evidence | Minor | FIXED — citations now point at this file's sections |
+| F4 SPEC non-goals vs badf6ac conflict | Minor | FIXED — SPEC.md non-goals records the gate-5 capability-binding carve-out |
+| F5 "bounded" fallback had no bound | Minor | FIXED — batching discipline added to maintain-verification-skill |
+| F6 vacuous-green at zero markdown files | Minor | FIXED — floor guard (≥44 skills, >0 md files), proven by fault injection |
+| F7 caret "pinning" overstated | Minor | NO ACTION — lockfile is the pin; already acknowledged upstream in code-review-findings.md #5 |
+| F8 latent CRLF frontmatter false-failure | Minor | FIXED — CRLF normalized before matching, proven by fault injection |
+
+### Hardened gate 3 — fault-injection proofs
+
+```
+== A: floor (1-skill fixture)
+FLOOR: expected >=44 skills (SKILL.md each) and >0 markdown files;
+       found 1 skills, 1 markdown files.
+exit=1   (expected 1)
+
+== B1: CRLF-valid file inside full 44-skill tree
+All skill references resolve.
+exit=0   (expected 0)
+
+== B2: CRLF file with broken relative link appended
+UNRESOLVED: pstack/skills/recall/SKILL.md -> nope-missing.md
+Reference check failed with 1 unresolved reference(s).
+exit=1   (expected 1)
+```
+
+### Fresh runs at remediation tip (2026-08-21T~18:00Z capture)
+
+```
+AC1  pstack portable core: 44 skills, no host or model coupling detected   exit=0
+AC2  All plugins validated successfully.                                   exit=0
+AC3  Checked 100 markdown files under pstack/skills.                       exit=0
+     All skill references resolve.
+AC4  52 pass / 0 fail / 206 expect() calls across 4 files                  exit=0
+```
+Raw capture: `post-merge-gates-2026-08-21.log` (gitignored; substance inlined here).
+
+### Anomalies on record
+
+- The feature branch moved during review (concurrent run committed `1ad5f3f`,
+  `b355261` and merged PR #8 while the reviewer held the old tip). All findings
+  were re-verified against merged `a7320ed` before fixing.
+- Clock skew: local machine timestamps say 2026-08-21/22; GitHub recorded PR #8's
+  merge as 2026-02-09. Local clock appears ~6 months fast. Timestamps in these
+  docs inherit the local clock and should be read as locally-consistent only.
+
+
+### Clock-skew retraction (measured 2026-08-22T00:00Z)
+
+Earlier in this document the local clock was reported ~6 months fast based solely on PR #8's mergedAt showing 2026-02-09. Direct re-measurement falsifies that claim: local `date -u` = 2026-08-22T00:00:20Z vs api.github.com Date header = 2026-08-22T00:00:01Z — 19 seconds apart, in sync. PR #16 mergedAt (2026-08-21T23:57:48Z) is likewise consistent with local time. The skew claim above is RETRACTED; the Feb-09 timestamp on PR #8 remains a single unexplained data point, not evidence of a clock problem. No timestamps in this repo needed correction.

@@ -0,0 +1,96 @@
+# pstack-generic verification evidence
+
+Run: autonomous session 2026-08-21 · branch `chore/skill-setup-and-pstack-gates` · node v24.19.0 / bun 1.3.14
+
+## Gate 1 — portability contract (AC1)
+```
+pstack portable core: 44 skills, no host or model coupling detected
+```
+
+## Marketplace validation incl. pstack-generic manifest (AC2)
+```
+All plugins validated successfully.
+```
+
+## Gate 2 — runtime tests, full poteto-mode suite (AC4)
+```
+
+ 52 pass
+ 0 fail
+ 206 expect() calls
+Ran 52 tests across 4 files. [863.00ms]
+```
+
+## Gate 3 — skill reference resolution (AC3)
+```
+Checked 100 markdown files under pstack/skills.
+All skill references resolve.
+```
+
+## Gate 5 — bounded-fallback audit (AC5)
+
+See [gate5-fallback-audit.md](gate5-fallback-audit.md). Verdict (revision 2): 44/44 classified — 13 explicit-coverage hits + 31 classified-by-sweep; **two** gaps found and fixed (maintain-verification-skill `badf6ac`; create-verification-skill, post-merge review branch). Revision 1's "zero open gaps" claim was wrong and is superseded.
+
+## Smoke — live host evidence (AC6, partial)
+- This session executes installed pstack-generic skills (recall, setup-pstack, reflect, swarm, interrogate, how, why, poteto-mode, principle-*) on opencode — one non-Cursor host, live.
+- Remaining hosts (Cursor GUI + second non-Cursor): parked; unblock = human launches a clean session in each and confirms skill loading.
+
+## Post-merge remediation (follow-up to PR #8)
+
+Branch `fix/post-merge-review-findings` off `a7320ed`. Fresh-context adversarial
+review of the merged branch (subagent panel — see session log for the council
+substitute disclosure) produced findings F1–F8; dispositions:
+
+| Finding | Severity | Disposition |
+|---|---|---|
+| F1 gate-5 audit false completeness claim | **Major** | FIXED — audit rewritten as revision 2 with reproducible counts; create-verification-skill gap found and fixed |
+| F2 missing npm alias for references gate | Minor | already fixed by `1ad5f3f` before review completed |
+| F3 ticket mirrors cite gitignored `.log` evidence | Minor | FIXED — citations now point at this file's sections |
+| F4 SPEC non-goals vs badf6ac conflict | Minor | FIXED — SPEC.md non-goals records the gate-5 capability-binding carve-out |
+| F5 "bounded" fallback had no bound | Minor | FIXED — batching discipline added to maintain-verification-skill |
+| F6 vacuous-green at zero markdown files | Minor | FIXED — floor guard (≥44 skills, >0 md files), proven by fault injection |
+| F7 caret "pinning" overstated | Minor | NO ACTION — lockfile is the pin; already acknowledged upstream in code-review-findings.md #5 |
+| F8 latent CRLF frontmatter false-failure | Minor | FIXED — CRLF normalized before matching, proven by fault injection |
+
+### Hardened gate 3 — fault-injection proofs
+
+```
+== A: floor (1-skill fixture)
+FLOOR: expected >=44 skills (SKILL.md each) and >0 markdown files;
+       found 1 skills, 1 markdown files.
+exit=1   (expected 1)
+
+== B1: CRLF-valid file inside full 44-skill tree
+All skill references resolve.
+exit=0   (expected 0)
+
+== B2: CRLF file with broken relative link appended
+UNRESOLVED: pstack/skills/recall/SKILL.md -> nope-missing.md
+Reference check failed with 1 unresolved reference(s).
+exit=1   (expected 1)
+```
+
+### Fresh runs at remediation tip (2026-08-21T~18:00Z capture)
+
+```
+AC1  pstack portable core: 44 skills, no host or model coupling detected   exit=0
+AC2  All plugins validated successfully.                                   exit=0
+AC3  Checked 100 markdown files under pstack/skills.                       exit=0
+     All skill references resolve.
+AC4  52 pass / 0 fail / 206 expect() calls across 4 files                  exit=0
+```
+Raw capture: `post-merge-gates-2026-08-21.log` (gitignored; substance inlined here).
+
+### Anomalies on record
+
+- The feature branch moved during review (concurrent run committed `1ad5f3f`,
+  `b355261` and merged PR #8 while the reviewer held the old tip). All findings
+  were re-verified against merged `a7320ed` before fixing.
+- Clock skew: local machine timestamps say 2026-08-21/22; GitHub recorded PR #8's
+  merge as 2026-02-09. Local clock appears ~6 months fast. Timestamps in these
+  docs inherit the local clock and should be read as locally-consistent only.
+
+
+### Clock-skew retraction (measured 2026-08-22T00:00Z)
+
+Earlier in this document the local clock was reported ~6 months fast based solely on PR #8's mergedAt showing 2026-02-09. Direct re-measurement falsifies that claim: local `date -u` = 2026-08-22T00:00:20Z vs api.github.com Date header = 2026-08-22T00:00:01Z — 19 seconds apart, in sync. PR #16 mergedAt (2026-08-21T23:57:48Z) is likewise consistent with local time. The skew claim above is RETRACTED; the Feb-09 timestamp on PR #8 remains a single unexplained data point, not evidence of a clock problem. No timestamps in this repo needed correction.

diff --git a/.agent/progress-pr9.txt b/.agent/progress-pr9.txt
new file mode 100644
--- /dev/null
+++ b/.agent/progress-pr9.txt
@@ -0,0 +1,13 @@
+# progress.txt — PR#9 remediation continuation 2026-08-21T22:06:43Z
+
+[2026-08-22] CONTEXT: session resumed after lost user msg; goal goal-a6380447 armed.
+[2026-08-22] STATE: branch fix/post-merge-review-findings @12935ba == origin; origin/main moved to 4612556 (upstream sync incl docs(pstack)); PR#9 CONFLICTING.
+[2026-08-22] ATOM A1: merge origin/main, resolve conflicts preserving both our remediation and upstream pstack updates.
+[2026-08-22T22:12Z] ATOM A1 DONE: merge 215edb0 committed; conflicts resolved ours(generic)+upstream(additive).
+[2026-08-22T22:12Z] GATES POST-MERGE @215edb0: validate EXIT=0 | portability 44 skills EXIT=0 | references 100 files EXIT=0 | bun tests 52/52,206 expects EXIT=0. Evidence: .agent/evidence/pr9-merge-2026-08-22/
+[2026-08-22] ATOM A2 START: fresh-context code-review over git diff origin/main..HEAD (PR #9 surface); findings -> fix Majors.
+
+[2026-08-22 ~03:50] RESUMED by ox-alpha session (goal goal-0e43b9f0 armed).
+[2026-08-22] T7 VERIFIED: merge 215edb0 (by prior session) already absorbed origin/main 4612556; merge-tree dry-run zero conflicts. Gates re-run @ HEAD post-merge: portability=0 references=0 validate=0, bun test pstack = 52 pass / 0 fail EXIT=0 -> .agent/evidence/pr9-rerun-post-merge-2026-08-22/. NOTE: bare `bun test` (unscoped) discovers 139 tests incl. orchestrate/* failures on missing optional deps (@slack/web-api, zod/v3); orchestrate/ identical to origin/main => pre-existing upstream state, filed as its own issue.
+[2026-08-22] Tickets filed: T7=#11 T8=#12 (markdown mirrors in .scratch/pstack-generic-gates/).
+[2026-08-22] NEXT: fresh-context code review -> push -> PR via gh pr create --repo praxstack/cursor-plugins --base main --head fix/post-merge-review-findings (NEVER upstream; never self-merge).

@@ -0,0 +1,13 @@
+# progress.txt — PR#9 remediation continuation 2026-08-21T22:06:43Z
+
+[2026-08-22] CONTEXT: session resumed after lost user msg; goal goal-a6380447 armed.
+[2026-08-22] STATE: branch fix/post-merge-review-findings @12935ba == origin; origin/main moved to 4612556 (upstream sync incl docs(pstack)); PR#9 CONFLICTING.
+[2026-08-22] ATOM A1: merge origin/main, resolve conflicts preserving both our remediation and upstream pstack updates.
+[2026-08-22T22:12Z] ATOM A1 DONE: merge 215edb0 committed; conflicts resolved ours(generic)+upstream(additive).
+[2026-08-22T22:12Z] GATES POST-MERGE @215edb0: validate EXIT=0 | portability 44 skills EXIT=0 | references 100 files EXIT=0 | bun tests 52/52,206 expects EXIT=0. Evidence: .agent/evidence/pr9-merge-2026-08-22/
+[2026-08-22] ATOM A2 START: fresh-context code-review over git diff origin/main..HEAD (PR #9 surface); findings -> fix Majors.
+
+[2026-08-22 ~03:50] RESUMED by ox-alpha session (goal goal-0e43b9f0 armed).
+[2026-08-22] T7 VERIFIED: merge 215edb0 (by prior session) already absorbed origin/main 4612556; merge-tree dry-run zero conflicts. Gates re-run @ HEAD post-merge: portability=0 references=0 validate=0, bun test pstack = 52 pass / 0 fail EXIT=0 -> .agent/evidence/pr9-rerun-post-merge-2026-08-22/. NOTE: bare `bun test` (unscoped) discovers 139 tests incl. orchestrate/* failures on missing optional deps (@slack/web-api, zod/v3); orchestrate/ identical to origin/main => pre-existing upstream state, filed as its own issue.
+[2026-08-22] Tickets filed: T7=#11 T8=#12 (markdown mirrors in .scratch/pstack-generic-gates/).
+[2026-08-22] NEXT: fresh-context code review -> push -> PR via gh pr create --repo praxstack/cursor-plugins --base main --head fix/post-merge-review-findings (NEVER upstream; never self-merge).

diff --git a/.agent/sessions/2026-08-22-pr9-upstream-reconciliation.md b/.agent/sessions/2026-08-22-pr9-upstream-reconciliation.md
new file mode 100644
--- /dev/null
+++ b/.agent/sessions/2026-08-22-pr9-upstream-reconciliation.md
@@ -0,0 +1,78 @@
+# Session log — PR #9 upstream reconciliation on praxstack/cursor-plugins
+
+Session: ox-alpha · continuation of 2026-08-22-t6-review-remediation · goal
+goal-a6380447 · began 2026-08-21 ~22:00Z (local 2026-08-22).
+
+## Task (verbatim intent)
+
+User reported their previous message was lost; re-issued standing orders:
+(3) classify the work category, (4) use installed skill sets; before that set up
+every skill pack in the local fork (gstack, pstack, matt pocock, gbrain,
+memory-leak-debugging — "set all, no exception"); then spec-driven loop with
+code-review, unslop, plan-eng-review, plan-design, qa, to-spec, to-tickets
+(markdown + GitHub on the local fork); fully autonomous via autonomous-agent /
+autonomous-orchestrion-v6: implement → code-review → qa → design-qa →
+systematic-debugging → improve-architecture → raise review with production QA
+logs + images → only then PR.
+
+## State found at resume
+
+- PR #8 (gates + skill setup) already MERGED last session; PR #9 (post-merge
+  remediation) already OPEN on fix/post-merge-review-findings @12935ba.
+- PR #9 reported CONFLICTING; codex-connector review body empty (no findings);
+  CodeRabbit skipped (<10 stars).
+- Root cause: origin/main had been FORCE-SYNCED to fresh upstream history
+  (4612556, linear upstream commits incl. PRs #228/#231/#238). a7320ed (PR #8
+  merge) is NOT an ancestor → the fork's main-only history (port + gates) was
+  wiped from the main branch. Merge base fell back to 60c641e.
+
+## ANOMALY (surfaced, not resolved unilaterally)
+
+Main was reset to upstream by an actor outside this session (human or concurrent
+agent). Consequence: merging PR #9 now also re-delivers the pstack-generic port
+and all three gates onto main. This is unavoidable given the branch's content
+and is documented in the merge commit + PR body. Rollback remains the SPEC.md
+pointer (force-push 60c641e or a7320e-lineage refs still exist locally and as
+PR refs).
+
+## Decisions + rejected alternatives
+
+- Conflict resolution (4 files: plugin.json + 3 poteto playbooks): OURS
+  (generic port). Rejected take-theirs: would revert merged PR #8 work on what
+  becomes main again; rejected hand-merging upstream prose into generic text
+  inline: invents behavior, violates no-invented-behavior rule → ticketed as
+  T7 / GitHub #10 instead.

_{You can send follow-ups to the cloud agent here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Stale patch-id merge gate
  • Replaced the merge checklist item that treated unchanged patch-id after rebase as sufficient with a gate requiring matching verdict base/head SHAs or a fresh swarm per shipping.md.

Or push these changes by commenting:

@cursor push a666bdbc7c

Preview (a666bdbc7c)

diff --git a/pstack/skills/poteto-mode/playbooks/multi-phase-plan.md b/pstack/skills/poteto-mode/playbooks/multi-phase-plan.md
--- a/pstack/skills/poteto-mode/playbooks/multi-phase-plan.md
+++ b/pstack/skills/poteto-mode/playbooks/multi-phase-plan.md
@@ -128,7 +128,7 @@
 
 - [ ] Root's clean verdict at the exact head SHA.
 - [ ] Bugbot triage done.
-- [ ] Rebased onto current trunk after the verdict, patch-id unchanged.
+- [ ] Verdict base and head SHAs match the PR's current base and head, or fresh swarm per `playbooks/shipping.md`.
 - [ ] <The owner squash-merges its own PR, or the root appends it to the base-branch stack and the operator lands it bottom-up.>
 
 ## Close the program

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 465182b. Configure here.}

[cursor]

Stale patch-id merge gate

Medium Severity · Logic Bug

The rewritten verdict rule now requires a fresh verification whenever the base or head SHA changes, and treats patch-id as a lookup hint only. The multi-phase-plan.md merge checklist still treats a trunk rebase with an unchanged patch-id as sufficient, so agents following that list can skip re-verification after a rebase.

 

^{Reviewed by Cursor Bugbot for commit 465182b. Configure here.}