fix(pstack): support Codex setup and current CLI output

[AojdevStudio]

Closes #58.

Codex setup accepts current Claude JSON event arrays and Grok API-key authentication, with exact model matching. Optional Astra and explicitly loaded extension families retain the default four-family panel, supplied effort choices/caps, and compatible native Codex fork settings.

This remediation merges current upstream 1.4.1 (de67e6b) without reverting release metadata. Authenticated Grok responses that explicitly reject the model now exit 69 before execution. Setup rejects selections lacking two distinct providers before probing or writing, so its mandatory independent cross-judge is possible. The extension reference now specifies JSON syntax, argv placeholders, parsing rules and receipt evidence.

Verification on 861490b

• Regression failed before the preflight guard fix: exit 0 and model started. After: exit 69, one preflight, no model execution, unavailable-model receipt.
• 165 tests passed, 693 assertions. Fixture Git repositories used an isolated global configuration to avoid inheriting this Mac's GPG signing state; no persistent config was changed.
• Strict typecheck, static invariants, all four manifest parses and git diff checks passed.
• No merge conflicts remain against upstream de67e6b.

Required live gate: BLOCKED

The previous 1.3.0-codex.2 candidate's partial live probes do not validate this new head or complete installed setup. Its recorded Grok execution returned HTTP 402 because Grok Build capacity was exhausted. No provider credentials, billing, model sheets, harness configuration or installed plugins were changed in this round.

Before readiness: install this exact candidate and complete the changed setup flow from both real Codex and Claude Code surfaces, including optional-family/extension routes, selected probes, write/readback and independent mixed-panel smoke. Record installed version, action and observed result. Obtain a new Gavel verdict on this exact head; the old failed status is not waived. Until then this PR remains draft under AGENTS.md.

No merge, auto-merge, deployment, release or upstream branch write occurred. Original changes by GPT-5.6 Sol and GPT-6 Astra; remediation by GPT-6.1 Sol via Codex.

[mergify]

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.

[greptile-apps]

Greptile Summary

This PR updates provider setup and dispatch guidance, adds optional Astra and extension-based model families, accepts current Claude event-array output, and recognizes Grok API-key authentication with exact model matching.

• Preserves the default four-family panel while permitting explicit family selection and removal.
• Adds native Codex model/effort overrides using history-free forks.
• Extends runner tests for Claude arrays and Grok authentication/model checks.
• Synchronizes the local candidate version across manifests and upstream metadata.
• The single-family setup path conflicts with the mandatory independent-judge smoke test, and the new extension interface needs an unambiguous format.

Confidence Score: 4/5

The PR is not yet safe to merge because an explicitly permitted single-family setup cannot satisfy the mandatory independent cross-judge smoke test.

The runner changes are well covered and no security defect was established, but the setup workflow contains one blocking contradiction; the extension interface also needs a concrete format to avoid inconsistent integrations.

Files Needing Attention: plugins/pstack/skills/setup-pstack/SKILL.md; plugins/pstack/skills/poteto-mode/references/provider-dispatch.md

Important Files Changed

Filename	Overview
plugins/pstack/skills/setup-pstack/SKILL.md	Generalizes setup to selected and extension families, but permits a one-family configuration that cannot satisfy its required independent cross-judge smoke.
plugins/pstack/skills/poteto-mode/references/provider-dispatch.md	Adds Astra, extension routing, effort-cap rules, and compatible Codex fork settings; the extension contract lacks a concrete interoperable format.
plugins/pstack/skills/poteto-mode/scripts/runner/parse-output.ts	Extracts the terminal Claude result from JSON event arrays while preserving existing object output handling.
plugins/pstack/skills/poteto-mode/scripts/runner/run.ts	Accepts Grok API-key authentication and checks model availability using escaped, token-bounded matching.
plugins/pstack/skills/poteto-mode/scripts/runner/model-matrix.test.ts	Updates matrix invariants for optional families while preserving the exact default quartet.
plugins/pstack/skills/poteto-mode/scripts/runner/parse-output.test.ts	Adds successful and fail-closed Claude event-array parsing coverage.
plugins/pstack/skills/poteto-mode/scripts/runner/run.test.ts	Adds coverage for Grok API-key authentication and exact model-token availability.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Load current model sheet] --> B[Load built-in matrix]
  A --> C{Dispatch extension configured?}
  C -->|Yes| D[Load extension families and routes]
  C -->|No| E[Use built-in families]
  B --> F[Apply additions, removals, efforts, and caps]
  D --> F
  E --> F
  F --> G[Probe every selected family]
  G -->|Any failure| H[Leave configuration unchanged]
  G -->|All pass| I[Render and confirm role map]
  I --> J[Write sheet and parent integration]
  J --> K[Run mixed-panel smoke]
  K --> L[Independent cross-judge]

Loading

_{Reviews (1): Last reviewed commit: "fix(pstack): support Codex model setup a..." | Re-trigger Greptile}

[ericlitman]

Gavel verdict: Request changes

1 blocking finding; 0 unconfirmed plausible findings; 0 killed by adjudication.

Quorum: 4/3 successful reviewers.
Continuity: 1 open · 0 resolved · 0 reopened.
Scope: initial full review.

Top findings

• MEDIUM plugins/pstack/skills/poteto-mode/scripts/runner/run.ts:383-385 RIGHT Reject unavailable-model Grok preflights — With API-key auth, an exit-0 response such as You are using XAI_API_KEY.\nmodel grok-4.6 is not supported sets authenticated, matches the model token, and makes unavailableStatus return unavailable-model. This condition rejects only unauthenticated, so the runner launches a model the preflight explicitly rejected instead of returning exit 69 without model execution. Require a non-error status or explicitly reject unavailable-model.

Non-blocking findings

• LOW plugins/pstack/skills/setup-pstack/SKILL.md:61 RIGHT Complete the required installed setup live passes — This adds parent-specific Astra and extension setup behavior, but the recorded real-surface runs never complete the changed setup flow: the Codex six-family attempt stops on Grok's HTTP 402 and leaves the sheet unactivated, while the Claude check only invokes the existing native Opus agent without running setup. The repository's mandatory merge gate therefore remains unmet; run the installed /setup-pstack flow successfully in both affected harnesses while exercising the optional-family/extension route and record the observed results.

---

Gavel run panel:60f1547dcef598b9d919052d036a0e116596055e:mFoboxqhtAw:svlOQZ9o7qw · Commit 60f1547dcef598b9d919052d036a0e116596055e
Judge: native (primary) openai/gpt-6-astra · tools: yes
Full record: GET /gavel/run/panel:60f1547dcef598b9d919052d036a0e116596055e:mFoboxqhtAw:svlOQZ9o7qw

[AojdevStudio]

@ericlitman PR59 is updated at 861490b. The Gavel preflight defect reproduced before the guard change and now exits 69 without model execution. Conflicts against upstream 1.4.1 are resolved; the single-provider smoke contradiction and extension syntax/evidence contract are addressed. All 165 tests, strict typecheck, static invariants and manifest parsing passed. Please obtain a new review-only Gavel verdict for this head; do not queue or merge it. The mandatory installed setup pass is still blocked: the last Grok execution returned HTTP402 with exhausted account capacity. This exact head needs full setup on both real harness surfaces before readiness. I have left it draft under AGENTS.md and made no billing, credential, model-sheet or installed-plugin changes.

[AojdevStudio]

The exact-head CI run is now action_required: https://github.com/ericlitman/open-pstack/actions/runs/36805208277 (head 861490b). A repository maintainer must approve this fork workflow run; it has not executed its checks yet. Local verification passed, but is not reported as hosted CI. This is additional to the installed setup and new Gavel verdict gates in the PR description. No approval gate was bypassed.

[ericlitman]

Thanks for this, @AojdevStudio. I appreciate the time you put into it. Open Pstack now accepts contributions as detailed issues rather than pull requests, so I'm closing this one. If it's still relevant, please open an issue describing the problem, how to reproduce it, and the change you'd suggest. I'll take it from there.

[ericlitman]

Sorry, your re-review and workflow-approval requests came in hours before the policy close and never got a reply. Both fixes stay tracked in #58, with this PR as prior art.