feat(pstack): sync portable workflows and selected Codex fork additions

.github/workflows/ci.yml

@@ -51,3 +51,5 @@ jobs:
         run: |
           bun install --frozen-lockfile
           bun test orch watch-pr
+          bun run typecheck
+          node --test check-plan.test.mjs worktree-audit.test.mjs ../../show-me-your-work/scripts/log.test.mjs

CHANGELOG.md

@@ -3,6 +3,28 @@
 All notable changes to pstack-codex are documented here. Release versions and
 notes are calculated from Conventional Commits and verified by semantic-release.
 
+## 1.1.0 (2026-10-07)
+
+### Features
+
+- Classify and sync the portable pstack 0.14.5 to 0.15.5 workflow changes.
+- Add eight skills, including selected maintainer, team, correction, benchmark,
+  help, and principle workflows from ScriptedAlchemy's Codex fork.
+- Add a pinned source inventory and read-only upstream comparison command.
+- Strengthen revision-bound verification, fair measurements, and stack shipping.
+
+### Bug Fixes
+
+- Preserve Codex-native setup, parent inheritance, and all five agent roles.
+- Replace Cursor runtime assumptions with native scheduling and explicit isolation.
+- Keep decision logs append-only and remove obsolete How critique resources.
+- Preserve untracked worktree data and avoid private session scans during cleanup.
+
+### Validation
+
+- Add executable plan, decision-log, and worktree-audit regression coverage.
+- Run helper typechecking and new behavior tests in pull-request CI.
+
 ## 1.0.0 (2026-08-31)
 
 ### Features

CONTRIBUTORS.md

@@ -16,3 +16,5 @@
 Contributor identities are derived from the public Git history of the exact
 upstream source paths and this repository. Upstream work remains under the MIT
 license recorded in [`LICENSE`](LICENSE).
+
+Selected Codex workflows and helper-test adaptations from [ScriptedAlchemy/pstack-codex](https://github.com/ScriptedAlchemy/pstack-codex) at `c25afa251f1513b0b28cc089294d468c5e350444`, distributed under MIT.

README.md

@@ -9,7 +9,7 @@ Codex-safe fork of `poteto/noodle`'s adversarial-review skill.
 
 This repository contains:
 
-- all 45 pstack skills and their bundled resources;
+- all 53 pstack skills and their bundled resources;
 - the two upstream pstack subagents, converted to Codex custom-agent TOML;
 - three additional read-only adversarial reviewer agents;
 - the standalone `adversarial-review` skill;
@@ -66,7 +66,7 @@ python3 -m unittest discover -s plugins/pstack-codex/scripts -p 'test_*.py'
 python3 plugins/pstack-codex/scripts/smoke_agents.py
 ```
 
-The structural validator fails closed unless all 45 pstack skills, all five
+The structural validator fails closed unless all 53 pstack skills, all five
 agents, required upstream resources, Codex frontmatter, port-contract
 references, and validation evidence are present. The smoke command is the live
 terminal gate: every named agent must be discovered and successfully spawned.
@@ -96,9 +96,14 @@ order, or trading authority.
 ## Provenance
 
 - pstack source: `cursor/plugins` commit
-  `fd878692de15a3069c21c8f429eb0b9f2fe178fa`, version `0.14.5`.
+  `12d587dfb20741cafc376c42c696c5f6e2a64487`, version `0.15.5`.
 - adversarial-review source: `poteto/noodle` commit
   `82d2921c52370f23f29086de81ccfb600939c037`.
 - upstream licensing: MIT. See [`LICENSE`](LICENSE).
 
 This is an independent port, not an official Cursor or OpenAI repository.
+
+## Source sync
+
+See [SYNC.md](SYNC.md) for the bounded upstream delta, selected ScriptedAlchemy
+additions, preserved Codex boundaries, and validation commands.

SYNC.md

@@ -0,0 +1,51 @@
+# Classified pstack sync
+
+The baseline is Cursor pstack 0.15.5 at `12d587dfb20741cafc376c42c696c5f6e2a64487`, compared with the previous imported 0.14.5 commit `fd878692de15a3069c21c8f429eb0b9f2fe178fa`. This is a classified workflow sync, not byte-for-byte source parity. `UPSTREAM.json` records all 104 changed source paths and their decisions.
+
+## Bounded upstream changes
+
+| Affected paths under plugins/pstack-codex | Behavior | Validation |
+| --- | --- | --- |
+| skills/show-me-your-work/{SKILL.md,scripts/log.sh} | Append headers without truncating an existing trail; sanitize spreadsheet cells; supersede incorrect rows; audit only the current run's stretches. | log.test.mjs checks append preservation, empty-file headers, spaces, and formula escaping. |
+| skills/swarm/SKILL.md | Results bind to exact target SHAs and measurement methods; retry a missing receipt once; remaining gaps cannot count as pass. | Native forward evaluation checks missing receipts and concurrency waves. |
+| skills/poteto-mode/playbooks/{autopilot-full,autopilot-stack,shipping,babysit,opening-a-pr}.md | Code-ready fix rounds, independent live/audit verification, current patch verdicts, bottom-first stack preparation, confirmed merges, and forge-specific state. | Native scenario evaluation checks unauthorized merges, shared worktrees, stale patch verdicts, pending checks, and build-noise reuse. |
+| skills/poteto-mode/playbooks/{multi-phase-plan,performance}.md and scripts/check-plan.mjs | Live evidence and fair trunk/head measurement; concrete perf budgets when trunk lacks the feature; plan checks accept inherited or configured worker models. | check-plan.test.mjs populates the actual shipped skeleton and rejects missing gates, evidence, placeholders, and cadence. |
+| skills/principle-{attack-the-premise,test-behavior-not-implementation}/SKILL.md | Challenge a repeatedly failed premise; test observable behavior. | Structural skill discovery and native scenario evaluation. |
+| skills/architect/references/*, skills/why/*, skills/blast-radius/SKILL.md, skills/technical-writing/SKILL.md | Schema-first design, decision lineage, downstream impact, and concise evidence-aware explanations. | Structural resource validation and relative-link review. |
+| skills/how/references/{critic-prompt,critique-rubric}.md | Remove obsolete critique resources and validator expectations. The native How entrypoint already avoids critique. | Structural validator expects nine required upstream resources. |
+
+## Selected ScriptedAlchemy additions
+
+Source revision `c25afa251f1513b0b28cc089294d468c5e350444` is pinned separately. Later Cursor changes are not implied to be fully imported.
+
+| Addition | Selection |
+| --- | --- |
+| automate-maintainer, automate-team | Mine repository-scoped public or authorized evidence into convention modes, retain attribution and uncertainty, and validate generated workflows. |
+| benchmark-checklist, principle-explain-the-number | Keep benchmark methodology and units explicit; ground numerical choices in evidence. |
+| correct | Verify a suspected mistaken premise before preserving or changing it. |
+| poteto-help | New native help entrypoint inspired by the fork, matching this repository's actual skills and five-agent setup. |
+| worktree-audit.sh | Port read-only cached-ref auditing, space-safe paths, conservative ancestry classification, and preservation of untracked data. Omit private session scanning. |
+| check-plan.test.mjs, log.test.mjs | Adapt runnable behavior tests to this layout and the 0.15.5 cadence. |
+
+The fork's loopback Codex bridge and Benny ledger are not installed. They add separate services, state, dependencies, and setup obligations without a demonstrated requirement here. Its model defaults, two global-agent installation, global role document, and guides that describe that setup are also excluded.
+
+## Codex boundaries
+
+The five existing agent TOMLs remain intact. Setup continues to enumerate live model and effort support, inherit parent configuration by default, and require all five live smoke probes. Optional budget preferences apply only to explicit supported overrides and preserve uncapped choices for reruns.
+
+Cursor Task flags, automatic cloud VM isolation, Cursor role rules, and built-in goal/loop commands are replaced with native agents, explicit worktree ownership, recorded objectives, and actual available automation capabilities. Future scheduling requires an explicit request. Trail recovery uses run-scoped conversation evidence or TraceDecay, never a private session crawl. Merge and draft-state changes follow existing user and repository authorization.
+
+## Repeatable validation
+
+```sh
+python3 -m unittest discover -s plugins/pstack-codex/scripts -p 'test_*.py'
+python3 plugins/pstack-codex/scripts/validate_port.py
+python3 plugins/pstack-codex/scripts/check_upstream.py /path/to/cursor-plugins
+node --test plugins/pstack-codex/skills/poteto-mode/scripts/check-plan.test.mjs plugins/pstack-codex/skills/poteto-mode/scripts/worktree-audit.test.mjs plugins/pstack-codex/skills/show-me-your-work/scripts/log.test.mjs
+cd plugins/pstack-codex/skills/poteto-mode/scripts
+bun install --frozen-lockfile
+bun test orch watch-pr
+bun run typecheck
+```
+
+Run `smoke_agents.py` from a trusted checkout in a fresh native Codex task. A passing historical receipt is not proof that another installation has loaded the agents. Plugin updates become available after installation/update and a new task reload.