Offer explicit recovery choices during setup

[arjitj2]

Closes #108.

What changed

Setup now offers automatic backend recovery, usage exhaustion only, or no automatic fallback on first setup and reruns. It asks separately about bounded same-model continuation, reuses explicit answers, preserves custom policies until accepted, and shows both settings before saving. Disabling fallback saves an empty trigger list; disabling continuation removes its separate declaration.

The existing policy engine is unchanged. The package candidate is 1.10.3. Verification recipes cover the new conversation and persistence cases.

Verification

• 765 Bun tests pass with the bundled Node runtime; strict typecheck, static invariants, plugin validation, manifest parsing, documentation checks and maintenance tests pass.
• Candidate 1.10.3 loaded from a separate local validation marketplace in Codex and a session-local plugin directory in Claude Code; plugin file hashes match the candidate.
• Changed setup behavior passes from both affected user surfaces.
• Evidence names the candidate, action, result and limits below.

Live evidence:

• Final candidate commit 21586358e02bf2a657409e3a39d827ca18cda8fa; packaged tree b514175f6a3250b765693041d18f543104808cfb.
• Claude Code CLI 2.1.285, session-local candidate 1.10.3: invoked /pstack:setup-pstack against disposable native-only targets. Observed the real Skill invocation, inherited native marker probe, all three fallback modes, an independent continuation question, a two-total-execution explanation, and unchanged targets before confirmation. Seven live turns covered broad, quota-only and disabled fallback; independent continuation opt-in and removal; byte-identical custom-policy preservation; first-run recommendation and target absence before confirmation; and confirmed first-run save/readback. Five save/keep runs each passed a native marker probe, a smoke candidate, and a separate native reviewer. The final saved sheets and integration files were independently read back; each retained the requested settings. All aliases use the parent, so no external provider was probed.
• Codex app-bundled CLI 0.159.0, candidate 1.10.3 installed from the isolated setup-recovery-108 marketplace: ran the actual installed setup skill using gpt-6.1-sol at high effort. Live conversations covered all three fallback modes; independent continuation opt-in and removal; exact custom-policy preservation; and first-run choices with both targets absent before confirmation. Five save/keep flows passed actual inherited native marker probes, policy-artifact workers and distinct native reviewers. Independently checked saved sheet/integration bytes. Host session transcripts retain the actual native launch and completion events, with model and effort overrides omitted for inherited lanes.
• The initial model rejection came from standalone Codex CLI 0.158.0. App-bundled 0.159.0 accepted the same model and effort; no substitution or global CLI upgrade was used.
• Initial local test failures came from Homebrew Node's missing libsimdjson.29.dylib; all 765 tests passed after selecting the bundled Node runtime. Strict typecheck also passed using Bun's Node compatibility launcher.
• Maintenance tests: 27 fork-maintenance, 8 session-start, and 16 documentation tests passed; ledger coverage validated.

Evidence is retained outside the checkout at /Users/arjitjaiswal/open-pstack-verification-setup-recovery/. The real policy CLI additionally passed 48 decisions against explicitly synthetic outcomes across four modes and two parents. These inputs do not establish real provider failure or continuation; the runtime engine is unchanged.

Copilot’s one finding was corrected in a86941b: the new behavioral cases are 16 and 17, and the feature recipe matches. The reply is published, the thread is resolved, and there are no pending owner reviews. GitHub verify passes on the final head.

Cleanup removed only the temporary Codex candidate installation and archived the validation parent sessions. Claude used a session-local plugin directory. The personal 1.10.2 installation was not replaced.

Documentation impact

The owning setup skill and provider-dispatch reference describe the choices and disabled-policy semantics. The model-setup verification recipe and behavioral cases cover reproducible validation. Version mirrors and changelog identify candidate 1.10.3.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Required live conversation and persistence validation remains incomplete in both affected parent harnesses.

Review effort: Balanced
Findings: 1

Open (1)

• Behavioral case numbering skips case 16 · New

What changed in this PR

Adds explicit setup choices for fallback recovery and same-route continuation while preserving existing policies until confirmed.

Changes:

• Adds three fallback modes and independent continuation configuration.
• Adds verification scenarios for setup and persistence.
• Bumps the package candidate to 1.10.3 with changelog updates.

File	Description
UPSTREAM.md	Records version 1.10.3.
CHANGELOG.md	Documents the candidate release.
.claude-plugin/​marketplace.json	Updates marketplace version.
plugins/​pstack/​.claude-plugin/​plugin.json	Updates Claude plugin version.
plugins/​pstack/​.codex-plugin/​plugin.json	Updates Codex plugin version.
plugins/​pstack/​skills/​setup-pstack/​SKILL.md	Defines recovery and continuation choices.
plugins/​pstack/​skills/​poteto-mode/​references/​provider-dispatch.md	Documents empty fallback semantics.
tests/​setup-selected-providers.md	Adds behavioral verification cases.
.agents/​skills/​verify-open-pstack/​features/​setup.md	Adds installed-parent verification coverage.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.