Consolidate harness boundaries and remove architectural drift

[thisguymartin]

Make pstack-flex a portable shared skill system with explicit harness integration boundaries. This cleanup accompanies #33 and preserves the independently merged OpenRouter and project-model work.

• Keep upstream skill bodies and one shared skills tree.
• Centralize parent capabilities, model-sheet paths, child markers and journal identity; keep lane/provider execution separate.
• Remove duplicated host setup recipes and routing prose; preserve global/project replacement and exact requested model/effort behavior.
• Consolidate current docs and delete completed plans, stale probe logs and unused compatibility artifacts.
• Run baseline/head behavior comparisons, full checks, packaging validation and adversarial review.
• Consolidate Separate shared pstack workflows from harness and lane adapters #33 plus cleanup into one commit on main b49b15d without squashing upstream/OpenRouter history.

Installed user-surface verification stays a separate mandatory gate. No merge, tag, release or rollout until the exact candidate passes in each affected harness. Missing evidence leaves #33 draft.

[thisguymartin]

Intent

Keep a single upstream-derived skill system, with explicit parent-harness,
configuration, lane-provider, and distribution boundaries. Preserve working
Claude/Codex behavior and independent upstream/OpenRouter history.

Reviewers

• Fable 5.1 @ max: 17 grouped findings; complete, model-verified receipt.
• GPT-6 Astra @ high: 3 original findings; final frozen-SHA confirmation.
• Grok 4.7 @ xhigh: dropout, CLI unavailable; no replacement.
• Opus 5.5 @ max: 14 grouped findings; complete, model-verified receipt.

Act on (fixed)

• Ambient permissions and Git shell escapes (A/B/D): fresh OpenCode agent
  names, no shell in either mode, and actual installed hostile-config tests.
• False lab diversity and wrapped router IDs (B/D; router A/D): reject routers,
  report unknown makers as null, and normalize catalog author prefixes.
• Preflight status derived from rendered prose and brittle catalog parsing
  (A/D): one typed verdict, compact/pretty metadata parsing, malformed-listing
  failure distinct from a missing model.
• Setup unable to inspect broken sheets (D): --paths-only resolves paths before
  setup selects or repairs a scope; executable regression test.
• Provider refusal duplicated across sheet/CLI boundaries (D): shared helper.
• Harness provider strings and child-owned typecheck (A/D): typed rows and one
  scripts-level project; receipt-proof rules stay with output parsing.
• Bare versus namespaced opt-in names (D): one harness-neutral instruction.
• Lost verification ledger and auth caveat (A/D): issue36 owns older debt;
  live gate links it; reference names the Keychain blind spot and project opt-in.
• Git diagnostic locale and accidental test environment inheritance (A/D):
  deterministic Git diagnostics and isolated configuration fixtures.
• Untested provider-error status names (A): runner tests for auth/model errors.
• PR base already merged (A): retargeted to main.
• Moving review packet (A/D): final commit frozen at 63e4b33,
  reviewed without edits; Astra reran 29 focused checks with no remaining defect.
• Foreground timeout phrasing (D): OpenCode's two minutes described as a default.

Consider

• Full provider-adapter registry (A/D): the repeated refusal and preflight
  semantics were extracted. A universal runtime would exceed the demonstrated
  need; existing CLI/parser switches remain explicit provider boundaries.
• Runner-enforced task requirements (D): the parent inspector rejects configured
  shell requirements; low-level OpenCode writers remain useful for file edits.
  The runner cannot infer a natural-language task's verification needs. The beta
  contract and real-session gate make the limitation visible.
• Provider-not-found ambiguity (D): missing credentials and a misspelled provider
  share the vendor result. Evidence retains that text; no guessed fallback.

Noted

• Configuration errors could include row/line context (A): useful polish, no
  correctness failure or new error taxonomy needed.
• Effective permissions depend on OpenCode (A/D): actual CLI tests exercise both
  wildcard and specific ambient allows; CI skips explicitly when CLI is absent.
  Candidate-level live verification remains required on supported versions.
• Documentation repeats human-readable sheet paths (D): the code row is
  authoritative; a small lookup table serves users diagnosing installations.

Dismissed

• Restore literal prose mirrors (A/D): equivalent executable descriptor, scope,
  routing, worktree, and CLI contracts replace them. Default/model/source and
  critical transactional instruction invariants remain.
• Runner must be independently copied without its shared harness dependency
  (A/D): the shipped unit is the skill package; its test now copies that shape.
  The type-only provider reference creates no runtime import cycle.
• Negative parser fixtures must satisfy active-model pin scans (A/D): production
  configuration remains scanned; invalid fixture descriptors are intentional.
• AGENT is an unconfirmed OpenCode marker (A): observed in the actual parent
  environment and retained from the feature's isolation contract.
• UUID agent names should be deterministic (A): unpredictability prevents an
  ambient agent-key collision; argv and environment are generated together once.
• Exit-zero OpenCode auth event must be assumed (A): current official run source
  sets nonzero exit status on session errors. Malformed output still fails closed.
• Strip all custom OpenCode config sources (A/D): would hide configured provider
  connections. Fresh-agent precedence is verified against every supported config
  layer, without deep-merging plan/build policies.

Agreement map

Astra, Fable, and Opus agreed on the OpenCode permission risks. Fable and Opus
also agreed on typed preflight failures, configuration repair, model routing,
and ownership cleanup. The fixed SHA has no substantive outstanding finding.
Installed parent setup/write/rollback and mixed-panel evidence is still incomplete;
PR33 remains draft. Local checks and partial smoke tests do not satisfy that gate.