docs(pstack): port opening-a-pr, autopilot audit, and Record boundary - #238
Merged
Conversation
Co-authored-by: lauren <poteto@users.noreply.github.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit cba4b85. Configure here.
| 4. **Swarm-verify every merge-ready head before its merge.** At the owner's merge-ready head SHA, fan out parallel independent verifiers per the **swarm** skill and aggregate to one verdict. The fan-out mechanics live there; do not restate them. The lanes: re-run the gates at that SHA; prove the load-bearing behavior live on the real surface the change touches (`control-cli` or `control-ui` from `cursor-team-kit` as the change demands); audit the receipts and the diff, distrusting the PR body. The live lane is the floor, and a verdict without it is not clean. No merge without the root's clean verdict. Findings go back to the owner for fix-forward, and the new head gets a fresh swarm and a fresh verdict. | ||
| 5. **On a clean verdict the owner merges and takes the next item.** The owner merges only from a head freshly restacked on trunk. The merge-ready report is made at a trunk-current head, and the swarm verdict pins that SHA. If trunk moves again before the merge, the patch-id rule in `playbooks/shipping.md` governs re-verification; a new head voids the verdict unless the patch-id is unchanged. The owner squash-merges its own PR and picks up its next self-contained item from the queue. The operator's full-autonomy grant plus the root's clean verdict is the merge authorization that babysitting alone never has. Operator-named items stop at merge-ready and wait for her click. | ||
| 6. **Run the root layer.** A genuinely new raise of a pinned gate or budget value (a limit CI only lets tighten) needs your fresh countersign, granted only after verifier proof. Absorbing values that already landed on main is drift, not a raise. Run an audit tick over all owners roughly every 30 minutes, riding a cloud-sleeper wake chain (a sleeping cloud agent that re-arms its own wake). Each tick probes liveness via a cloud-agent status / liveness probe, audits both progress and protocol adherence, and collects the decision trails. When merges batch, run a retro pass and a post-merge bot-comment sweep. | ||
| 6. **Run the root layer.** A genuinely new raise of a pinned gate or budget value (a limit CI only lets tighten) needs your fresh countersign, granted only after verifier proof. Absorbing values that already landed on main is drift, not a raise. Run an audit tick over all owners roughly every 30 minutes. A local root arms each tick as a real terminal `/loop`. The loop uses a monitored-shell 30-minute sleep and emits an output-notification sentinel. A cloud root uses the existing cloud-sleeper wake chain instead. Never leave the cadence to memory or lossy completion notifications. At each tick, re-read this playbook from trunk with `git show origin/main:pstack/skills/poteto-mode/playbooks/autopilot-full.md`, then re-read the armed `/goal`. Audit the operation against both. Fix drift during that tick and treat it as urgent. Probe each owner with a generic liveness or status check, and collect the decision trails. Count only side effects as progress: commits, pushes, PR or check deltas, and store reports. Treat a lane that passes its expected runtime without a side effect as stuck. Stand it down and dispatch a replacement at once. Do not wait for a polite return. When merges batch, run a retro pass and a post-merge bot-comment sweep. |
There was a problem hiding this comment.
Trunk reread path breaks plugins
High Severity · Logic Bug
Audit ticks re-read the playbook with git show origin/main:pstack/skills/.... That path only exists in this plugins monorepo. On a normal consumer repo where /add-plugin pstack is installed, the command fails every ~30 minutes, so the urgent drift-fix pass cannot run and may derail the root.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit cba4b85. Configure here.
| 2. **Audit on the wake chain.** The root runs audit ticks roughly every 30 minutes on a cloud-sleeper wake chain: cloud-agent liveness per owner, progress, and protocol adherence. | ||
| 3. **Hold the operator gates.** State-then-wait, so a request to state the plan is not a go. On her stop, every owner takes an immediate zero-writes hold. | ||
| 2. **Audit on the wake chain.** The root runs an audit tick roughly every 30 minutes. A local root arms each tick as a real terminal `/loop`. The loop uses a monitored-shell 30-minute sleep and emits an output-notification sentinel. A cloud root uses the existing cloud-sleeper wake chain instead. Never leave the cadence to memory or lossy completion notifications. At each tick, re-read this playbook from trunk with `git show origin/main:pstack/skills/poteto-mode/playbooks/autopilot-stack.md`, then re-read the armed `/goal`. Audit the operation against both. Fix drift during that tick and treat it as urgent. Probe each owner with a generic liveness or status check. Count only side effects as progress: commits, pushes, PR or check deltas, and store reports. Treat a lane that passes its expected runtime without a side effect as stuck. Stand it down and dispatch a replacement at once. Do not wait for a polite return. | ||
| 3. **Hold the operator gates.** State-then-wait, so a request to state the plan is not a go. On her explicit go, arm a `/goal` with the full program objective. The goal continues across turns until the chain is done. On her stop, every owner takes an immediate zero-writes hold. |
There was a problem hiding this comment.
Goal armed after audit uses it
High Severity · Logic Bug
Step 2 tells the root to re-read the armed /goal on every audit tick, but step 3 is where /goal is armed on the operator's go. Poteto Mode copies numbered steps as ordered todos, so the audit loop depends on a goal that does not exist yet. autopilot-full arms /goal before audits; this sibling does not.
Reviewed by Cursor Bugbot for commit cba4b85. Configure here.
github-actions Bot
added a commit
to SmailG/claude-cursor-plugins
that referenced
this pull request
Aug 22, 2026
…ndary guidance (cursor#238) chore: sync with cursor/plugins — docs(pstack): port workflow and boundary guidance (cursor#238)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Align pstack's PR and autopilot playbooks with their current operating contract. The previous opening guide started a babysit as soon as a PR opened. That rule conflicts with Poteto Mode and the babysit playbook.
Scope
pstack/skills/poteto-mode/playbooks/opening-a-pr.mdwith Conventional Commit titles, structured descriptions, ready PRs, Graphite stacks, and a separate babysit pass./goal, local/loop, cloud wake, trunk reread, side-effect progress, and stuck-lane replacement rules to both autopilot playbooks.pstack/skills/typescript-best-practices/SKILL.mdsoRecord<string, unknown>stops at the parse into a named domain type.pstack/.cursor-plugin/plugin.jsonfrom0.14.1to0.14.2.Tradeoffs
The audit steps are longer because they state the wake and replacement contract in full. The edits keep the existing Graphite flow and public skill names.
Blast Radius
This PR changes pstack documentation and plugin metadata only. It changes instructions for pstack users and agents. It does not change runtime code or files outside
pstack/.Verification
pstack/skills/poteto-mode/playbooks/opening-a-pr.md: the focusedrgfound all five description headings, Conventional Commits, ready PRs, and the rule that opening a PR does not start a babysit. The leftover-termrgreturned no matches.pstack/skills/poteto-mode/playbooks/autopilot-full.md: the focusedrgfound/goalon explicit go, the local/loop, the cloud-sleeper fallback, the trunk and goal reread, side-effect progress, immediate stuck-lane replacement, and Graphite. The excluded-termrgreturned no matches.pstack/skills/poteto-mode/playbooks/autopilot-stack.md: the same focusedrgfound every required audit behavior and Graphite. The excluded-termrgreturned no matches.pstack/skills/typescript-best-practices/SKILL.md: the exact-rowrgfound the newRecord<string, unknown>boundary rule. A comparison withorigin/mainconfirmed that no other row changed.pstack/.cursor-plugin/plugin.json: the versionrgfound0.14.2, and JSON parsing passed.rgreturned no matches.git diff --check origin/main...HEADpassed. The name-status check found five modified files, all underpstack/, with no new or deleted file.