[mdsmithaustin]

Why

PR #201's round-4 verdict left six arena follow-ups in #219. Some skill text sent agents to a directory that arena now deletes. Some made claims about Grok that rest on one probe. Two rules disagreed about what to do when git worktree add fails.

Closes #219.

What changed

• pstack-harness owns one writer placement rule. It makes worktrees one at a time and spawns every Grok writer with isolation: none. When git worktree add fails, a writer whose output the lead collects gets its own plain directory for each commit its brief names, or one directory when the brief names none, so a verify arm briefed with a parent and a head gets two. When it needs the project's files, the lead resolves each named commit to a SHA in the project with git rev-parse --verify and fetches a missing one. A commit still missing blocks the writer, with no directory seeded. Otherwise each directory is a git clone --shared of the project, checked out detached at its own SHA, or at HEAD. A writer whose work must land on the branch still runs in the checkout, one at a time.
• Arena makes candidate worktrees one at a time, passes isolation: none on Grok, and moves every candidate to a plain directory when any add fails. The Grok row lists Grok's linked, standalone, and git modes plus Grove, and names grok worktree rm in place of "gc reclaims it".
• Opening a PR tells the agent to post the swarm report or arena note as a PR comment, without findings that Shipping keeps off the PR, and link it. Architect commits the synthesis only without a checkpoint or after sign-off. PORTING records both upstream edits as substitution rows.

Scope

• Covers arena follow-ups from PR #201 round 4 #219 items 1 to 6.
• Leaves the oracle items in evals: oracle follow-ups from the #202 review #207 and evals: oracles should not FAIL or PASS on a killed run's missing evidence #208.
• The guide, README, and promise ledger needed no edits. Their sentences stay true.

Tradeoffs

• Arena keeps its own Grok sentence beside the harness rule, rewritten to pass isolation: none. No paid Grok run covers the rewritten wording. Grok 1.0.52's local docs back it.
• No retry-before-fallback rule. Parallel git worktree add did not fail here, so a retry would guard a failure nobody has reproduced.

Blast Radius

Skill text only. Agents now create arena worktrees one at a time, pass isolation: none on Grok, and run plain-directory writers in parallel when git worktree add fails. In Codex's sandbox, the harness used to send every writer, such as a verify arm, into the checkout one at a time. A writer whose output the lead collects now runs at the same time as others, in shared clones, one for each commit the brief names, so its gates and the verdict's Patch-id run there. A briefed commit the project cannot find blocks the writer.

Verification

• A model-free Codex sandbox probe (codex sandbox -P :workspace, no Codex session created) shows git worktree add exits 128 because .git is read-only, while mktemp -d directories are writable. The fallback as written ran in bash and zsh, in a throwaway repo and in this repo, on the host and in the sandbox. A brief naming parent and head gets two git checkouts at their SHAs. In the seeded head of this repo, tools/gate-check.sh lint passes and the Patch-id pipeline prints a value. A brief naming origin/main gets the project's origin/main, not the clone's main. A missing unfetchable commit reports blocked and leaves no directory. A brief naming no commit seeds HEAD. The checkout is unchanged, and removing the clones leaves nothing behind. The earlier git archive seeding fails 6 or 7 of the same checks, because its directories have no .git.
• Grok 1.0.52's local docs back the isolation order, the cwd argument, the cli.worktree_type modes, and the gc and rm keep rules. Parallel git worktree add failed 0 times in 1300 here, so serial creation stays as cheap insurance.
• tools/gate-check.sh lint and skill-ci check pass. The test tier passes except three NativeGit tests that fail the same way on main, because this host's pinned rg changed.

Validation

Risk Assessment

✅ Low: The change edits only agent-instruction prose. Each edit matches the stated intent items and recorded fix-forwards. The two PORTING substitution rows quote the new upstream-owned text exactly, and the clone-based seeding, SHA resolution, and fetch-then-block rules agree across pstack-harness, arena, and PORTING.

Testing

Inspected the complete diff and evaluation routes. All eight scenarios depend on agent interpretation, whose live evaluation is prohibited. No tests, static analysis, paid calls, or product evidence were produced; the previously declined limitation is not raised again as a finding.

• Live validation: ⚠️ no-surface - 0 of 8 scenarios driven live against the product

Scenario	Result	Live	Evidence
Open a performance PR, post the report without restricted findings, and link the comment in Verification.	⏸️ untested	no	Only natural-language instructions changed. No executable PR-comment implementation changed. Agent compliance requires model evaluation, forbidden by the no-paid-harness-calls constraint. Manually pos…
Create candidate worktrees serially and recover from a later creation failure with plain directories for every candidate.	⏸️ untested	no	No executable worktree controller changed. A disposable script implementing the instructions would test that script rather than agent compliance. The required agent evaluation is prohibited.
Spawn Grok writers with explicit isolation none and their assigned directory despite persona isolation defaults.	⏸️ untested	no	Only spawn instructions changed. No executable spawn implementation changed. Testing whether agents supply the required arguments needs prohibited model calls.
Dry-run and remove a stray Grok copy while preserving unsaved work unless force is requested.	⏸️ untested	no	The change documents third-party commands without modifying their implementation. Running Grok independently would not validate adherence to the changed instructions. Agent evaluation is prohibited.
Give a comparison writer separate Git checkouts at the project's resolved parent and head SHAs, preserving the checkout.	⏸️ untested	no	The clone and SHA-selection rules exist only as natural-language guidance. Manually cloning disposable repositories would validate Git operations rather than agent selection and compliance. No executa…
Fetch a missing requested commit, block without seeding when it remains unavailable, and use HEAD only when no commit is named.	⏸️ untested	no	No executable commit-resolution or blocking mechanism changed. A manually implemented probe would test its own decisions. Evaluating the changed agent instructions requires prohibited model calls.
Run independent directory writers concurrently and serialize writers whose changes must land on the checkout branch.	⏸️ untested	no	Scheduling is natural-language guidance with no changed runtime scheduler. Testing compliance requires agent evaluation, prohibited by the acceptance criteria.
Keep a checkpoint synthesis outside the project until sign-off, then allow its commit.	⏸️ untested	no	Only checkpoint instructions changed. No executable checkpoint mechanism exists to exercise without model interpretation. Live model evaluation is prohibited.

• Outcome: ⚠️ 1 warning across 1 run (1m2s)

Pipeline

Updates from git push no-mistakes

✅ **Intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

⚠️ **Test** - 1 warning

• ⚠️ this change has no live-validatable surface; proceed without live validation? (0 of 8 scenarios were driven live against the product); Open a performance PR, post the report without restricted findings, and link the comment in Verification.: Only natural-language instructions changed. No executable PR-comment implementation changed. Agent compliance requires model evaluation, forbidden by the no-paid-harness-calls constraint. Manually posting a comment would not validate these instructions.; Create candidate worktrees serially and recover from a later creation failure with plain directories for every candidate.: No executable worktree controller changed. A disposable script implementing the instructions would test that script rather than agent compliance. The required agent evaluation is prohibited.; Spawn Grok writers with explicit isolation none and their assigned directory despite persona isolation defaults.: Only spawn instructions changed. No executable spawn implementation changed. Testing whether agents supply the required arguments needs prohibited model calls.; Dry-run and remove a stray Grok copy while preserving unsaved work unless force is requested.: The change documents third-party commands without modifying their implementation. Running Grok independently would not validate adherence to the changed instructions. Agent evaluation is prohibited.; Give a comparison writer separate Git checkouts at the project's resolved parent and head SHAs, preserving the checkout.: The clone and SHA-selection rules exist only as natural-language guidance. Manually cloning disposable repositories would validate Git operations rather than agent selection and compliance. No executable consumer changed, and agent evaluation is prohibited.; Fetch a missing requested commit, block without seeding when it remains unavailable, and use HEAD only when no commit is named.: No executable commit-resolution or blocking mechanism changed. A manually implemented probe would test its own decisions. Evaluating the changed agent instructions requires prohibited model calls.; Run independent directory writers concurrently and serialize writers whose changes must land on the checkout branch.: Scheduling is natural-language guidance with no changed runtime scheduler. Testing compliance requires agent evaluation, prohibited by the acceptance criteria.; Keep a checkpoint synthesis outside the project until sign-off, then allow its commit.: Only checkpoint instructions changed. No executable checkpoint mechanism exists to exercise without model interpretation. Live model evaluation is prohibited.
• Live validation: ⚠️ no-surface - 0 of 8 scenarios driven live against the product

Scenario	Result	Live	Evidence
Open a performance PR, post the report without restricted findings, and link the comment in Verification.	⏸️ untested	no	Only natural-language instructions changed. No executable PR-comment implementation changed. Agent compliance requires model evaluation, forbidden by the no-paid-harness-calls constraint. Manually pos…
Create candidate worktrees serially and recover from a later creation failure with plain directories for every candidate.	⏸️ untested	no	No executable worktree controller changed. A disposable script implementing the instructions would test that script rather than agent compliance. The required agent evaluation is prohibited.
Spawn Grok writers with explicit isolation none and their assigned directory despite persona isolation defaults.	⏸️ untested	no	Only spawn instructions changed. No executable spawn implementation changed. Testing whether agents supply the required arguments needs prohibited model calls.
Dry-run and remove a stray Grok copy while preserving unsaved work unless force is requested.	⏸️ untested	no	The change documents third-party commands without modifying their implementation. Running Grok independently would not validate adherence to the changed instructions. Agent evaluation is prohibited.
Give a comparison writer separate Git checkouts at the project's resolved parent and head SHAs, preserving the checkout.	⏸️ untested	no	The clone and SHA-selection rules exist only as natural-language guidance. Manually cloning disposable repositories would validate Git operations rather than agent selection and compliance. No executa…
Fetch a missing requested commit, block without seeding when it remains unavailable, and use HEAD only when no commit is named.	⏸️ untested	no	No executable commit-resolution or blocking mechanism changed. A manually implemented probe would test its own decisions. Evaluating the changed agent instructions requires prohibited model calls.
Run independent directory writers concurrently and serialize writers whose changes must land on the checkout branch.	⏸️ untested	no	Scheduling is natural-language guidance with no changed runtime scheduler. Testing compliance requires agent evaluation, prohibited by the acceptance criteria.
Keep a checkpoint synthesis outside the project until sign-off, then allow its commit.	⏸️ untested	no	Only checkpoint instructions changed. No executable checkpoint mechanism exists to exercise without model interpretation. Live model evaluation is prohibited.

• git diff --stat ea8459bde2d7859526c82a6306333bfa1de0b8aa c5ac4bbb05d2c0d6fb077889ed6d7d63d35ba0e3
• git diff ea8459bde2d7859526c82a6306333bfa1de0b8aa c5ac4bbb05d2c0d6fb077889ed6d7d63d35ba0e3
• Inspected repository task configuration, README.md, evals/README.md, and evals/promises/README.md for executable validation routes.
• git status --short

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

Issues

Closes #219

[mdsmithaustin]

Verdict: FAIL
Head: 1942028
Patch-id: 9fa235e196ae8d68aaa1e866578c7b1d818f140a
Docs: pass

Round 1 swarm at this head: gates + literal replay + Grok docs (sonnet@high), directive review and documentation-impact review (opus@xhigh each; work on opus@high, so these may be same-family).

What holds: gates pass; a literal replay of one-at-a-time worktree creation with a forced third failure cleans up and falls back to seeded plain directories, and two consecutive runs leave only main; every Grok claim matches Grok 1.0.52's docs and live spawn schema (isolation: none default chain, cwd exclusive with isolation: worktree); documentation-impact review: pass, PORTING rows quote upstream exactly.

Fix-forward (in scope):

1. skills/poteto-mode/playbooks/opening-a-pr.md:26: "post the swarm report or the arena synthesis note as a PR comment" has no carve-out for the findings shipping.md step 1 and autopilot-full step 4 keep off the PR. A multi-phase-plan swarm mixes perf and audit lanes into one report (swarm/SKILL.md:48), so a security finding would be posted publicly. Add: leave out any finding that shipping.md step 1 keeps off the PR.
2. skills/pstack-harness/SKILL.md:64: the fallback seeds a verify arm's plain directory with git archive HEAD. A verify arm must test the head SHA its brief names; a lead whose checkout is on trunk would test trunk and could report PASS for a head it never ran, silently. Seed from the commit the brief names, HEAD only when it names none.

Notes (no change): "after you take its output" sits beside "Never take the writer's work back into the lead" and reads as a clash; the fallback's two cases omit a writer that owns its own branch; pstack-harness:95 says the schema hides subagent_type, but the 1.0.52 schema lists it; PR body says arena "keeps" the Grok sentence though the diff rewrites it.

[mdsmithaustin]

Verdict: FAIL
Head: 25f1b04
Patch-id: fcce13dddaf7fe5168c4113552c19f21cd810175
Docs: pass

Round 2 at this head: gates + seeding proof (sonnet@high), review + documentation-impact (opus@xhigh; work on sonnet@high). One review lane this round (two-clause delta). This is the second FAIL; a third stops the PR.

Both round-1 findings are fixed: opening-a-pr.md:26 leaves out the findings shipping.md step 1 keeps off the PR; pstack-harness:64 seeds the named commit (proof: the new text yields exactly the PR head's tree, the round-1 text yields trunk). PORTING rows match. Gates pass apart from known host and load noise; CI 7/7; merge clean.

Fix-forward (introduced by this PR's fallback):

1. skills/pstack-harness/SKILL.md:64: "the commit its brief names" assumes one commit, but verify and measure briefs name two (shipping.md:7 "parent versus head"; swarm/SKILL.md:28 "the exact SHAs"). On the fallback path the arm gets one seeded directory and is told to work only there, so the parent tree is never seeded and a verifier can PASS on head alone. Seed one directory per commit the brief names (HEAD only when it names none).
2. Same line: a named commit missing locally makes git archive fail while macOS tar exits 0 and leaves an empty directory. Check git cat-file -e <commit>^{commit} first; if it fails and the commit cannot be fetched, report the arm blocked and never seed another commit. Mirror both in PORTING.md:79.

[mdsmithaustin]

Verdict: FAIL
Head: 21c36e7
Patch-id: bf072315dd86da3f9583cdf25c05dd208179797a
Docs: pass

Round 3 at this head: gates + independent seeding proof in bash and zsh (sonnet@high), directive review and whole-PR review (opus@xhigh each; work on opus@high, so these may be same-family).

This is the third FAIL. Per the autopilot playbook the owner is stopped and the PR goes to the operator.

What holds: gates pass; all six #219 items hold together; both round-2 fixes are in and proven (one directory per named commit, check then fetch then block); "blocked" fails closed through swarm, shipping and arena; no security-class path reaches a public comment; documentation-impact review: pass.

Blocking (introduced by this PR's fallback): skills/pstack-harness/SKILL.md:64 seeds verify arms with git archive | tar, so their directories have no .git. Proven under codex sandbox -P :workspace: tools/gate-check.sh lint fails in the seeded directory (passes in a real checkout), and shipping step 1's Patch-id pipeline prints nothing, so a posted verdict block is malformed. Before this PR those arms ran in the checkout. Proven fix: seed with git clone -q --no-checkout --shared <project> <dir> && git -C <dir> checkout -q --detach <commit> (also fails loudly on a missing commit and keeps export-ignore files); mirror in PORTING.md:79.

[mdsmithaustin]

Fail-count reset: the operator approved one more round in chat, scoped to seeding fallback directories with a shared clone and detached checkout instead of git archive.

[mdsmithaustin]

Verdict: PASS+NOTES
Head: c5ac4bb
Patch-id: 95edf8ca2cabbc604b0f5f9b728081930da63a4d
Docs: pass

Round 4 (operator-granted, scoped to the round-3 seeding blocker) at this head: gates + independent sandbox proof (sonnet@high), review and documentation-impact review (opus@xhigh; work on opus@high, so it may be same-family).

The round-3 blocker is fixed: fallback directories are now --shared clones checked out detached at the SHA the project resolves. Proven in bash and zsh, on the host and under codex sandbox -P :workspace (no model call): parent and head land as real checkouts; tools/gate-check.sh lint passes inside a seeded copy of this repo and the Patch-id matches the project's; origin/main resolves to the project's commit; an unfetchable commit blocks with nothing seeded; removing the clones leaves the project's objects intact (fsck --full --strict clean). A shared clone breaks only after gc --prune=now, which no skill runs. Gates pass; CI 7/7; merge clean.

Notes (follow-ups): inside the clone origin/main is the project's local main, so an arm should use the named SHAs as its Patch-id base (merge-gate rejects a wrong one); gh pr view inside the clone needs -R; "the checkout" could say "the project checkout" since each arm's directory is now a checkout with a push path to the project.