release: sync Cursor pstack 0.15.1 as Open Pstack 1.4.1

[ericlitman]

Closes #63

Linear: MOB-1460

What changed

Open Pstack 1.4.1 now tracks Cursor pstack 0.15.1 at f8abeddd1862dc73704e3d719dd73df0d51b8c71. The shared poteto-mode skill requires every claim to carry its evidence or an explicit measured, inferred, or guess label in the same sentence, and it tells the agent to run checks it can run instead of handing them to the user.

The three version-bearing manifests, UPSTREAM.md, README.md, docs/reference.md, CHANGES.md, and NOTICE.md now agree on Open Pstack 1.4.1 and Cursor pstack 0.15.1. No playbook, model-matrix, runtime, dependency, or package-lock content changed.

Verification

• Bun tests, strict typecheck, manifest parsing, static invariants, and plugin validation pass.
• The exact 1.4.1 candidate is installed in every affected harness.
• The changed behavior passes from each real user surface.
• The installed version, action, and observed result appear below.

Live evidence on exact candidate commit bc01b4ec3f1c3d167c8843cab5bf783907885168:

• Codex: the installed local-marketplace package moved from 1.4.0 to candidate 1.4.1 through codex plugin add pstack@open-pstack. The 1.4.1 cached poteto-mode skill matches the candidate source hash. A fresh Codex CLI session loaded that 1.4.1 skill, read UPSTREAM.md, and returned PSTACK_0151_CODEX_OK while labeling the 1.4.1, pstack 0.15.1, and f8abedd claim measured.
• Claude Code: a fresh authenticated Claude CLI session loaded the exact 1.4.1 candidate from a detached Studio2 worktree with --plugin-dir, invoked pstack:poteto-mode, read UPSTREAM.md, and returned PSTACK_0151_CLAUDE_OK while labeling the same claim measured.

Local validation on the same head passed with 158 Bun tests and 652 assertions, strict TypeScript checking, all four JSON manifests parsed, static package invariants passed, both Claude plugin validators passed, and git diff --check passed. The fetched Cursor tree has no pstack changes after f8abedd.

The earlier Gavel package-version finding is incorporated in this head as the 1.4.1 release.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge because the package manifests, release documentation, and upstream synchronization metadata are mutually consistent and no actionable new defect was identified.

Summary

• Updates the Claude marketplace, Claude plugin, and Codex plugin manifests to version 1.4.1.
• Aligns current upstream references with pstack 0.15.1 at commit f8abeddd1862dc73704e3d719dd73df0d51b8c71.
• Adds the upstream poteto-mode evidence-labeling and agent-run-check guidance.
• Records the release changes and upstream provenance.

_{Reviews (2) · Last reviewed commit: "release: sync Cursor pstack 0.15.1 as Op..."}

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[ericlitman]

Gavel verdict: Request changes

1 blocking finding; 0 unconfirmed plausible findings; 0 killed by adjudication; 1 confirmed non-blocking.

Quorum: 4/3 successful reviewers.
Continuity: 1 open · 0 resolved · 0 reopened.
Scope: initial full review.

Top findings

• HIGH UPSTREAM.md:15 RIGHT Publish the sync under a new package version — 1.4.0 is already the published marketplace version, and its tagged skill does not contain this rule. Claude's versioned marketplace contract only gives users updates when the marketplace version changes, so an existing 1.4.0 installation that updates after this merge remains on the old skill despite this sentence claiming 1.4.0 imports 0.15.1. Publish the sync under a new Open Pstack version and update this row plus the three version-bearing manifests together.

Non-blocking findings

• LOW UPSTREAM.md:12 RIGHT Update the user-facing sync records — After this row declares 0.15.1 current, README.md:156 and docs/reference.md:5 still identify the distribution with 0.15.0 at 71ed0d1, while the newest CHANGES.md entry omits the 0.15.1 evidence rule. Consumers consulting those documented entry points receive contradictory provenance and behavior information. Refresh the README and reference metadata and add the corresponding change entry.

---

Gavel run panel:5dcf3bd87ea1f7c23e7b7ff7c7b604a8af938363:Oty01Tlz0sQ:1QLfJqCCcMw · Commit 5dcf3bd87ea1f7c23e7b7ff7c7b604a8af938363
Judge: native (primary) openai/gpt-6-astra · tools: yes
Full record: GET /gavel/run/panel:5dcf3bd87ea1f7c23e7b7ff7c7b604a8af938363:Oty01Tlz0sQ:1QLfJqCCcMw

[ericlitman]

Gavel verdict: Request changes

1 blocking finding; 0 unconfirmed plausible findings; 0 killed by adjudication.

Quorum: 4/3 successful reviewers.
Continuity: 1 open · 0 resolved · 0 reopened.
Scope: full review (basis-not-ancestor).

Top findings

• HIGH UPSTREAM.md:15 RIGHT Publish the skill change under a new package version — An existing 1.4.0 installation that runs the normal marketplace update after this merge will be skipped because the distribution still advertises 1.4.0, leaving that user on the old skill without the new evidence rule. This sentence documents the mismatch but does not fix the supported upgrade path. Bump the Open Pstack version and update every version-bearing manifest together.

---

Gavel run panel:d9322429b354de7c37b7be3471eb0d31a2536b6b:Ou6mvsvZ7fZ:D0uPJamZxS4 · Commit d9322429b354de7c37b7be3471eb0d31a2536b6b
Judge: native (primary) openai/gpt-6-astra · tools: yes
Full record: GET /gavel/run/panel:d9322429b354de7c37b7be3471eb0d31a2536b6b:Ou6mvsvZ7fZ:D0uPJamZxS4

[ericlitman]

Gavel verdict: Approve

0 blocking findings; 0 unconfirmed plausible findings; 1 killed by adjudication.

Quorum: 4/3 successful reviewers.
Continuity: 0 open · 1 resolved · 0 reopened.
Scope: full review (basis-not-ancestor).

Top findings

No blocking findings.

---

Gavel run panel:bc01b4ec3f1c3d167c8843cab5bf783907885168:Fv6NYiksE44:jd6CaEcZd9g · Commit bc01b4ec3f1c3d167c8843cab5bf783907885168
Judge: native (primary) openai/gpt-6-astra · tools: yes
Full record: GET /gavel/run/panel:bc01b4ec3f1c3d167c8843cab5bf783907885168:Fv6NYiksE44:jd6CaEcZd9g