feat(pstack): port skill updates and default to Opus 5.5 and Grok 4.7 - #414
Conversation
The internal punctuation pass split this colon into two sentences. pstack's own pass kept it, so this is the one line left from that pass.
log.sh wrote the header with `>` when `[ ! -f "$logfile" ]` passed. A network mount can fail that test for a log that exists, and `>` then wipes every row. Test with `-s` and append the header with `>>`, so the worst case is one stray header line.
An owner now reports a code-ready head SHA once the shipped code is final. The root starts a swarm round there and at each later push that changes the patch, so self-proof, CI, and babysit run in parallel with the swarm instead of before it. The merge needs a clean verdict from the round whose patch matches the merge-ready head. - Autopilot-full: the owner rebases once before the code-ready report and again only at merge prep, on a merge-tree conflict, or on a CI failure from trunk. Audit lanes split by focus. Proven findings go back in one fix-forward, with a red test for each defect. An approval that the grant covers is recorded against the root's countersign. - Autopilot-stack and multi-phase-plan follow the same rounds. - Shipping: the patch-id rule treats test, doc, and lint-only drift as noise when the builds show no real difference. - Swarm: verify and measure briefs name the exact SHAs and method, and a result that omits them is rerun once, then recorded as a gap. - The hub: under a full-autonomy grant, decide the calls the grant covers and report the defaults for calls only the operator can make.
An owner records each subagent's ID, expected runtime, and state in a `children.tsv` kept beside its `decisions.tsv`. Each tick runs the stuck test over the platform's agent list, where one exists, and over every owner's `children.tsv`. The root has stuck work recorded and replaced when it is still needed, and ends the tick only when no delegated work is left.
The multi-phase-plan tick prompt posted the full queue table every 30 minutes, whether or not anything changed. Post a short status message only for a change that no earlier message reported, and otherwise end the turn with no reply text. Log the tick's row either way.
Drop repeats and older-model scaffolding that Opus 5.5 follows without the text. Each cut removes a copy of a rule that stays in the same skill or in the skill that owns it, or a self-check that the model already runs. - bug-fix step 1 keeps one statement of "reproduce it yourself", the debug-protocol override, and the narrow ask-the-user exception. - feature step 2, pause-safely step 1, and figure-it-out drop restated rules. pause-safely no longer forbids the broken-tree `wip:` commit that its step 3 asks for. - prove-it-works and sequence-verifiable-units drop their Pattern recaps. show-me-your-work drops its illustration note and a third copy of the one-row rule. - tdd drops the nearby-validation step, which its Final Response section still asks for. technical-writing drops its review checklist, and unslop drops its self-audit step. - blast-radius drops two restatements of "mark an unproven fact unproven" and "Only the real ones."
Judgment, prose, the hardest code, the explainers, and the synthesizers move from `claude-fable-5-1-thinking-max` to `claude-opus-5-5-max`. The code delegates, explorers, investigators, and swarm workers move from `grok-4.6-fast-xhigh` to `grok-4.7-xhigh-fast`. The Opus 5 panel slot also moves to Opus 5.5, which repeats the first slot. Arena, architect, and interrogate now default to one runner each on Opus 5.5, Sol, and Grok 4.7, and interrogate drops Reviewer D. setup-pstack writes the same defaults, and its budget example uses the new slugs. check-plan.mjs and the multi-phase-plan skeleton name the same lane model.
The changelog starts at this release and lists what changes for a pstack user, including the rerun of /setup-pstack that an existing model rule needs.
…x-forward The port of the verification rounds dropped "against the PR" from the fix-forward sentence in Autopilot-full step 4. Without it, a failure the regression lane finds on trunk goes to the owner with a red-test request for code the PR did not write. Restore the scope that the source sentence has.
…uide The README playbook table and the overnight guide still said the root verifies each merge-ready head. Say that a round starts at the owner's code-ready head and again at each later push that changes the patch.
setup-pstack keeps a role whose value differs from the default by family, so a rerun keeps the Fable and Grok 4.6 lines an earlier rule wrote. The changelog now says to delete those role lines, or the file, instead of only rerunning setup.
| 5. **On a clean verdict the owner merges and takes the next item.** The owner merges only from a head freshly rebased onto trunk. The merge-ready report is made at a trunk-current head, and the swarm verdict pins that SHA. If trunk moves again before the merge, the patch-id rule in `playbooks/shipping.md` governs re-verification. A new head voids the verdict unless the patch-id is unchanged. The owner squash-merges its own PR through the resolved forge and picks up its next self-contained item from the queue. The operator's full-autonomy grant plus the root's clean verdict is the merge authorization that babysitting alone never has. Operator-named items stop at merge-ready and wait for the operator's click. | ||
| 6. **Run the root layer.** A genuinely new raise of a pinned gate or budget value (a limit CI only lets tighten) needs your fresh countersign, granted only after verifier proof. Absorbing values that already landed on main is drift, not a raise. Run an audit tick over all owners roughly every 30 minutes. A local root arms each tick as a real terminal `/loop`. The loop uses a monitored-shell 30-minute sleep and emits an output-notification sentinel. A cloud root uses the existing cloud-sleeper wake chain instead. Never leave the cadence to memory or lossy completion notifications. At each tick, re-read this playbook from trunk with `git show origin/main:pstack/skills/poteto-mode/playbooks/autopilot-full.md`, then re-read the armed `/goal`. Audit the operation against both. Fix drift during that tick. Probe each owner with a generic liveness or status check, and collect the decision trails. Count only side effects as progress: commits, pushes, PR or check deltas, and store reports. Treat a lane that passes its expected runtime without a side effect as stuck. Stand it down and dispatch a replacement at once. Do not wait for a polite return. When merges batch, run a retro pass and a post-merge bot-comment sweep. | ||
| 4. **Swarm-verify every round before its merge.** A round starts at the owner's code-ready head SHA and at each later push that changes the PR's patch. At that SHA, fan out parallel independent verifiers per the **swarm** skill and aggregate to one verdict. The merge needs a clean verdict from the round whose patch matches the merge-ready head. Audit the receipts in the merge-ready report before the verdict. The lanes: re-run the gates at that SHA. Prove the load-bearing behavior live on the real surface the change touches (with the matching control skill, such as `control-cli` or `control-ui` from `cursor-team-kit`, or a named driver where none exists). Audit the diff, distrusting the PR body. Run the audit as two or more review lanes with the full brief. Give each lane one main focus, such as consumer parity with trunk, lifetimes and races, or data and config safety. **Regression lane against trunk.** Run the same load-bearing scenario on current trunk. If trunk does not have the feature, record that fact and gate the behavior the diff adds plus the end state the user waits for instead of pretending trunk can produce it. The live lane is the floor, and a verdict without it is not clean. No merge without the root's clean verdict. When the lanes return, send every proven finding against the PR to the owner in one fix-forward. A defect that a lane filed as a note is a finding. For each behavior finding, ask for a red test that covers every site with the same defect. Where no test can show the defect, ask for a repro receipt instead. Add that defect to the next round's review brief. The new head gets a fresh swarm and a fresh verdict, except for lane results that stay valid under the patch-id rule in `playbooks/shipping.md`. | ||
| 5. **On a clean verdict the owner merges and takes the next item.** The owner merges only from a head freshly rebased onto trunk. Merge prep never comes before a round's lanes start, and it ends with a rebase onto current trunk right before the merge. The merge-ready report is made at a trunk-current head. If trunk moves again before the merge, the patch-id rule in `playbooks/shipping.md` governs re-verification. A new head voids the verdict unless the patch-id is unchanged. The owner squash-merges its own PR through the resolved forge and picks up its next self-contained item from the queue. The operator's full-autonomy grant plus the root's clean verdict is the merge authorization that babysitting alone never has. Operator-named items stop at merge-ready and wait for the operator's click. |
There was a problem hiding this comment.
Merge-ready rebase timing contradicts itself
Medium Severity · Logic Bug
Step 2 has the owner report merge-ready when babysit finishes and rebase again only at merge prep, while holding the fix-round merge base. Step 5 still says that report is made at a trunk-current head. Those timings cannot both hold, so an owner can rebase under an in-flight swarm or pin a verdict to a head the swarm never saw.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 2caf93c. Configure here.
There was a problem hiding this comment.
Addressed on 6ea9fcc: step 5 no longer claims the merge-ready report is at a trunk-current head. It now says that after the merge-prep rebase, the owner reports the new head SHA and the patch-id rule decides whether the round's verdict still holds — matching step 2 (merge-ready at babysit finish; rebase again only at merge prep).
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 6ea9fcc. Configure here.
| 5. **On a clean verdict the owner merges and takes the next item.** The owner merges only from a head freshly rebased onto trunk. The merge-ready report is made at a trunk-current head, and the swarm verdict pins that SHA. If trunk moves again before the merge, the patch-id rule in `playbooks/shipping.md` governs re-verification. A new head voids the verdict unless the patch-id is unchanged. The owner squash-merges its own PR through the resolved forge and picks up its next self-contained item from the queue. The operator's full-autonomy grant plus the root's clean verdict is the merge authorization that babysitting alone never has. Operator-named items stop at merge-ready and wait for the operator's click. | ||
| 6. **Run the root layer.** A genuinely new raise of a pinned gate or budget value (a limit CI only lets tighten) needs your fresh countersign, granted only after verifier proof. Absorbing values that already landed on main is drift, not a raise. Run an audit tick over all owners roughly every 30 minutes. A local root arms each tick as a real terminal `/loop`. The loop uses a monitored-shell 30-minute sleep and emits an output-notification sentinel. A cloud root uses the existing cloud-sleeper wake chain instead. Never leave the cadence to memory or lossy completion notifications. At each tick, re-read this playbook from trunk with `git show origin/main:pstack/skills/poteto-mode/playbooks/autopilot-full.md`, then re-read the armed `/goal`. Audit the operation against both. Fix drift during that tick. Probe each owner with a generic liveness or status check, and collect the decision trails. Count only side effects as progress: commits, pushes, PR or check deltas, and store reports. Treat a lane that passes its expected runtime without a side effect as stuck. Stand it down and dispatch a replacement at once. Do not wait for a polite return. When merges batch, run a retro pass and a post-merge bot-comment sweep. | ||
| 4. **Swarm-verify every round before its merge.** A round starts at the owner's code-ready head SHA and at each later push that changes the PR's patch. At that SHA, fan out parallel independent verifiers per the **swarm** skill and aggregate to one verdict. The merge needs a clean verdict from the round whose patch matches the merge-ready head. Audit the receipts in the merge-ready report before the verdict. The lanes: re-run the gates at that SHA. Prove the load-bearing behavior live on the real surface the change touches (with the matching control skill, such as `control-cli` or `control-ui` from `cursor-team-kit`, or a named driver where none exists). Audit the diff, distrusting the PR body. Run the audit as two or more review lanes with the full brief. Give each lane one main focus, such as consumer parity with trunk, lifetimes and races, or data and config safety. **Regression lane against trunk.** Run the same load-bearing scenario on current trunk. If trunk does not have the feature, record that fact and gate the behavior the diff adds plus the end state the user waits for instead of pretending trunk can produce it. The live lane is the floor, and a verdict without it is not clean. No merge without the root's clean verdict. When the lanes return, send every proven finding against the PR to the owner in one fix-forward. A defect that a lane filed as a note is a finding. For each behavior finding, ask for a red test that covers every site with the same defect. Where no test can show the defect, ask for a repro receipt instead. Add that defect to the next round's review brief. The new head gets a fresh swarm and a fresh verdict, except for lane results that stay valid under the patch-id rule in `playbooks/shipping.md`. | ||
| 5. **On a clean verdict the owner merges and takes the next item.** The owner merges only from a head freshly rebased onto trunk. Merge prep never comes before a round's lanes start, and it ends with a rebase onto current trunk right before the merge. After the merge-prep rebase, the owner reports the new head SHA, and the patch-id rule decides whether the round's verdict still holds. If trunk moves again before the merge, the patch-id rule in `playbooks/shipping.md` governs re-verification. A new head voids the verdict unless the patch-id is unchanged. The owner squash-merges its own PR through the resolved forge and picks up its next self-contained item from the queue. The operator's full-autonomy grant plus the root's clean verdict is the merge authorization that babysitting alone never has. Operator-named items stop at merge-ready and wait for the operator's click. |
There was a problem hiding this comment.
Merge-prep skips post-rebase CI
Medium Severity · Logic Bug
After the merge-prep rebase, step 5 only asks whether the patch-id keeps the round's verdict. The next sentence sends the owner to shipping.md only if trunk moves again. A matching patch-id can therefore lead straight to squash-merge on the new SHA without the mergeability and CI refresh that the patch-id rule requires.
Reviewed by Cursor Bugbot for commit 6ea9fcc. Configure here.
There was a problem hiding this comment.
Addressed on 88886d4: after the merge-prep rebase, step 5 now requires CI to pass on that head before the merge, then the patch-id rule decides whether the round's verdict still holds.
* Add Google Docs, Sheets, and Slides plugins with bundled skills Co-authored-by: Cursor <cursoragent@cursor.com> * Register docs, sheets, and slides plugins in the marketplace Co-authored-by: Cursor <cursoragent@cursor.com> * webull: require Cursor 3.22.0 (single-redirect DCR retry) and bump to 1.0.1 * feat(third_party): add Robinhood plugin * feat(third_party): add Coinbase plugin * fix(coinbase): drop client credential variables; document harness allowlist blocker * feat(third_party): add eToro Trading plugin * Add X Money plugin for Grok Bot * Set X Money plugin homepage * Point homepage at x.com/i/money * Add X Money guide skill * Rework X Money guide from server source * Drop single-use from plugin description * Update X Money plugin description * Remove backend mentions from skill * finance: pre-connect disclosure in the listing description (1.1.1) * finance: state that linked account data is synced and stored * Gate x-money marketplace entry to Grok Bot * finance: sync marketplace.json description with plugin.json * Update bundled skills * feat(pstack): port skill updates and default to Opus 5.5 and Grok 4.7 (cursor#414) Ports internal skill updates: Opus 5.5 / Grok 4.7 defaults, autopilot verification rounds, upgrade help for old model pins, and merge-prep CI wait. * fix(pstack): scrub old model names from public upgrade help (cursor#416) Replace the pre-0.15.3 model list in the pstack upgrade help with "the old default models". * docs(pstack): cut 19 more instructions Opus 5.5 does not need (cursor#419) Cut 19 more instructions that Opus 5.5 follows without the text, in interrogate, reflect, tdd, four principles, figure-it-out, and the feature, bug-fix, and refactoring playbooks. Bump pstack to 0.15.4. * feat: add Devin plugin manifests for every marketplace plugin (#1) Devin reads .devin-plugin/plugin.json (or .claude-plugin/plugin.json, root plugin.json) and ignores .cursor-plugin/plugin.json, so none of these plugins install in Devin. Adds a .devin-plugin manifest per plugin plus .mcp.json symlinks for the MCP-only third-party plugins. * feat: daily upstream sync that keeps Devin manifests current (#2) * feat: add daily upstream sync that keeps Devin manifests current * refactor: simplify manifest sync script and clarify workflow * chore: bump sync workflow actions to v7 (#3) * fix: move sync schedule off the top of the hour (#4) * fix: move sync schedule off the top of the hour so GitHub does not drop it Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * chore: schedule sync at 15:17 UTC (11:17 ET) Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * chore: schedule sync at 16:17 UTC (12:17 ET) Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * chore: schedule sync at 18:17 UTC (2:17 ET) Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix: land the upstream merge on the sync branch instead of main (#6) Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * chore: regenerate Devin plugin manifests for upstream HEAD Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: Jacob Sampson <jacob.sampson@cursor.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Jason <jasonsma27@gmail.com> Co-authored-by: Minu Palaniappan <mpalaniappan@x.ai> Co-authored-by: minu <minupal6@gmail.com> Co-authored-by: Minu Palaniappan <ericzakariasson@users.noreply.github.com> Co-authored-by: Asad Salman <asads@twitter.com> Co-authored-by: lauren <poteto@users.noreply.github.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>


Why
pstack last synced with the internal skill tree on Sep 7 (#329 and #331), and #341 and #362 carried two later changes. Since then the internal tree changed how autopilot verifies work and how its tick tracks subagents and posts status. It also cut 15 instructions that Opus 5.5 follows without the text. This PR ports those changes and moves the defaults from the previous defaults to Opus 5.5 and Grok 4.7.
A script ported each internal commit span by span into pstack's own wording, so pstack keeps its routing, its names, its forge-neutral PR flow, and its standalone bun scripts. Lines that pstack had reworded were ported by hand.
Scope
swarm. Verification rounds start at the code-ready head, owners track subagents inchildren.tsv, and the tick posts status only when a tracked item changed.poteto-mode,setup-pstack, arena, architect, interrogate, how, why, reflect, swarm, the code playbooks,check-plan.mjs, and the README. Panels go from four runners to three: Opus 5.5, Sol, and Grok 4.7.log.shno longer truncates an existing log. Version 0.15.3.The port covers each internal change since the last sync that applies to pstack. Two punctuation passes and two prose changes were already in pstack through #331, #341, and #362. Changes that touch only internal tooling or internal-only files are not ported.
Tradeoffs
Effort stays where it was:
claude-opus-5-5-maxandgrok-4.7-xhigh-fast. The Opus 5.5 prompting guide suggests starting at medium effort. The/setup-pstackbudget ask already lowers every role, so this PR changes the models and not the budget. Each panel keeps the Opus 5.5 slot atmaxand drops thexhighduplicate.Blast Radius
Every pstack user gets the new defaults on update. A
pstack-models.mdcrule from an earlier/setup-pstackpins the old slugs, and a rerun keeps them, sodocs/guide/01-setup.mdtells those users which lines to delete. The autopilot, shipping, and swarm changes touch only runs of those skills.Verification
node scripts/validate-plugins.mjspasses, andbun test orch watch-prpasses 52 of 52.check-plan.mjsaccepts the multi-phase-plan skeleton with the new lane model. The old checker rejects it on that line.log.shkeeps the rows of an existing log and still writes the header for a new or empty file./setup-pstackupgrade advice.What the eval did not test
The 15 cuts rest on an internal eval of Opus 5.5 candidates, with a small cross-check on the previous default model. It never ran Grok as a candidate, and pstack sends its code delegates to Grok. The cut lines a code delegate reads, such as tdd's nearby-validation step and the bug-fix repro sentence, are untested on Grok 4.7. The eval also did not cover the autopilot, shipping, and swarm changes or the new model defaults.
Note
Medium Risk
Changes default models and materially rewrite autopilot, shipping, and swarm behavior for anyone using those playbooks; existing
pstack-models.mdcoverrides persist until users follow the upgrade notes.Overview
pstack 0.15.3 ports internal skill-tree updates: new default models, tighter autopilot verification, and slimmer skill prose aimed at Opus 5.5.
Defaults and setup. Judgment and prose move from the previous defaults to
claude-opus-5-5-max; code delegates and swarm workers move from Grok 4.6 togrok-4.7-xhigh-fast. Arena, architect, and interrogate panels shrink from four models to three (Opus 5.5, Sol, Grok 4.7). README and setup docs explain that pre-0.15.3pstack-models.mdcrules still pin old slugs until users delete those lines or rerun/setup-pstack.Autopilot and shipping. Autopilot-full and autopilot-stack verify in rounds starting at the code-ready head and on every patch-changing push, with owners tracking subagents in
children.tsv, stricter merge-prep rebases, multi-lane audits, and fix-forward that treats lane notes as findings. Root ticks only post operator status when something tracked changed, and they probe platform agent lists pluschildren.tsvfor stuck work. Multi-phase-plan, shipping (patch-id noise handling), and swarm (SHA/method in briefs, aggregate reruns) align with the same model.Other skill edits. poteto-mode adds full-autonomy behavior for product forks without blocking the operator. Several skills drop redundant instructions (blast-radius, figure-it-out, prove-it-works, tdd, technical-writing, unslop, and others).
log.shappends the TSV header with>>so existing logs on flaky mounts are not truncated.Reviewed by Cursor Bugbot for commit 88886d4. Bugbot is set up for automated code reviews on this repo. Configure here.