[3metaJun]

The repository was pinned to pstack 11713c6, leaving 45 adapted upstream commits and the latest Harness CLI behavior undocumented. This PR advances the pstack pin to eb4db2b, adds the five new upstream skills including statechart and formal verification, refreshes adapted guides and provenance manifests, and records the current Codex, Claude Code, OpenCode, pi, Antigravity, and Grok versions.

Validation:

• npm test (718 passed, 1 skipped)
• npm run check-upstream -- --source <pstack> --strict
• git diff --check

---

Agent: GPT-6 via Codex

[grok-review-bot]

Review: pstack eb4db2b sync

The new skills, the skills.json entries, and the version bumps look right. The problems are in the guide pages. They were synced from upstream text that still has Cursor-specific content, and some of them describe upstream skill changes this PR did not port.

Root cause. profiles/upstream-manifest.json bumps the source hash for setup-mstack, principle-attack-the-premise, and principle-test-behavior-not-implementation but keeps the target hash. That records "upstream changed, local unchanged". For the two principles that is correct: the upstream bodies match ours byte for byte. For setup-mstack it hides a dropped port. Upstream pstack/skills/setup-pstack/SKILL.md gained ### 8. Offer a formal verification skill (optional), and skills/setup-mstack/SKILL.md has no such step. check-upstream --strict passes because the hash was accepted, not because the content was ported.

Findings (details inline):

1. High. docs/guide/01-setup.md:16 tells Claude Code users to install mstack@cursor-plugins, which doesn't exist. It also links ../harness/claude-code.md, which this repo doesn't have.
2. High. docs/guide/01-setup.md:42 says /setup-mstack offers /create-formal-verification-skill. It doesn't (see root cause above). Either port step 8 into setup-mstack and update its target hash, or remove the paragraph.
3. Medium. docs/guide/06-verify-and-ship.md:61 changes the harness-neutral output path to .cursor/skills/verify-<app>/. That reverts the earlier adaptation.
4. Medium. docs/guide/07-overnight.md:76 describes the upstream "one fresh verifier for a rebase or minor fix" rule. Our skills/meta-mode/playbooks/autopilot-full.md step 4 still requires a fresh swarm on every push that changes the patch. The guide and the playbook disagree.
5. Low. skills/statechart/scripts/test/statechart.test.mjs:838 fails on Windows: expected fix/C.tla, got fix\C.tla. npm test doesn't run this file, so CI won't catch it. Local run: 58 tests, 26 pass, 31 skipped, 1 fail. Since the README says the live checks run on Windows, either normalize the separator in statechart.mjs's rel() or record this as a known upstream limitation.

Suggestion. Add a check that fails when a manifest entry's source hash changes while its target hash stays the same, unless the entry is explicitly marked as reviewed with no port needed. That would have caught finding 2. A grep for cursor/plugins, .cursor/skills, and ../harness/ under docs/guide would catch findings 1 and 3.

Checked against the pstack tree at eb4db2b and the PR head 4079487.

[grok-review-bot]

Follow-up review: 92cb2c7

The upstream check still fails, and I can name the cause. skill-baseline --check reports OutputFolder.cfg, OutputFolder.tla, sync.mmd, and upload.mmd as changed. Their sourceDigest values were recorded from a Windows checkout of cursor/plugins with core.autocrlf=true. contentDigest() in scripts/skill-baseline-lib.mjs strips CR only for paths that match textExtensions, and .cfg, .tla, and .mmd aren't on that list, so the CRLF bytes went into the hash. CI checks out upstream with LF and gets different digests.

I reproduced it locally against eb4db2b:

• LF checkout (core.autocrlf=false): 4 baseline changes, Skill integrity check failed, the same four files as CI.
• autocrlf checkout: 0 baseline changes, All skill files match.

For each of the four files, the LF hash of the upstream file equals the recorded targetDigest. Example: OutputFolder.cfg hashes to 08529388… with CRLF and 8b9662ab… with LF. So the content is identical and only the recorded source digest is wrong.

Suggested fix: add cfg|mmd|tla to textExtensions in scripts/skill-baseline-lib.mjs and re-record the baseline. That also stops the next Windows sync from making the same mistake. Re-recording from an LF checkout alone fixes CI, but the next sync can break it again.

The rest of this commit looks right:

• Bumping the validate.yml pin to eb4db2b matches profiles/upstreams.json.
• Replacing the check-plan.test.ts rewrite with a skeleton smoke test is reasonable. Upstream's cases assert upstream markers (/loop 1h, Ten lanes on `x` at the PR head) that mstack's adapted check-plan.mjs doesn't use. I ran upstream's dropped fence edge cases against mstack's checker on top of the bundled skeleton: trailing space or tab after a closer, a backtick info string that contains a backtick, a suffixed inner closer, and a tilde info string with a backtick. All five behave as upstream expects. check-plan.test.mjs already covers fences (24/24 pass), and bun test check-plan.test.ts passes (1/1).

Still open from the previous review: none of the five inline findings has a change or a reply. They are the Cursor install line and broken link in 01-setup.md:16, the unported setup-mstack formal-verification step behind 01-setup.md:42, the .cursor/skills path in 06-verify-and-ship.md:61, the mismatch between 07-overnight.md:76 and autopilot-full.md, and the Windows path separator in statechart.test.mjs:838.

[grok-review-bot]

Follow-up review: 6af31cf..f0bd454

All six earlier findings are fixed. I found no new blocking issues.

Finding	Fix	Checked
01-setup.md:16: Cursor install line and broken link	Points to the installer and ../harness-adapters.md	The link target exists
01-setup.md:42: setup-mstack had no formal-verification offer	Ported as ## Offer a formal verification skill (optional). The target hash is updated in both manifests.	The step matches upstream step 8 and comes after the verification-skill offer, as the guide says
06-verify-and-ship.md:61: .cursor/skills path	Restored the project-skill-root wording and the harness-paths.md link	Done
07-overnight.md:76: guide disagreed with the playbook	Now describes a fresh round per patch-changing push, with patch-id evidence reuse	Matches step 4 of autopilot-full.md
statechart.test.mjs:838: Windows path separator	rel() now normalizes to /	Windows run: 58 tests, 27 pass, 0 fail, 31 skipped (the skips need TLC)
upstream job: CRLF source digests	cfg, mmd, and tla added to textExtensions. The four source digests were re-recorded as LF hashes.	skill-baseline --check against an LF checkout of eb4db2b and mattpocock/skills@49dd158: 0 baseline changes. The CI upstream job passes.

All required checks pass on f0bd454.

One optional nit: 5f16b2f and f0bd454 have the same subject line, and f0bd454 only touches upstream-manifest.json. Consider squashing them, or rewording f0bd454 to something like fix(upstream): refresh guide target hashes, so the history is easier to read.

Nothing else from me on this PR.

[grok-review-bot]

Approving f0bd454. All findings from earlier rounds are fixed and verified, and the required checks pass. See the previous review for details.