feat(pstack): support T3-owned delegation

.claude/skills/verify-open-pstack/features/registry.json

@@ -73,7 +73,7 @@
   ],
   "project": [
     ".claude/skills/verify-open-pstack/**", ".agents/skills/verify-open-pstack",
-    "AGENTS.md", "CLAUDE.md", "tests/skill-collision-repro.sh", ".github/workflows/ci.yml", "package.json",
+    "AGENTS.md", "CLAUDE.md", "tests/skill-collision-repro.sh", "tests/t3-e2e.py", ".github/workflows/ci.yml", "package.json",
     ".github/workflows/windows-hooks.yml"
   ],
   "nonRuntime": [

CHANGES.md

@@ -3,6 +3,10 @@
 Open Pstack lands on green: Mergify merges a ready PR to main once verify and exact-head live-gate pass and no review thread is unresolved, and a workflow resolves Unfret's own threads. A PR that touches `.github/` or the Mergify config also waits for Unfret, and workflow changes require operator queueing.
 This port applies the Cursor → Claude Code substitutions in skill bodies. Earlier drafts left them flagged; this revision resolves them. A later pass added a Codex build that shares the same skills; see [Codex port](#codex-port) below.
 
+## Local T3 host route, 2026-10-28
+
+Issue #253 adds compatibility with T3-owned delegation at the existing provider-dispatch boundary. The port-authored `runner/t3.ts` and `runner/pstack-t3` compile JSON intent into a native plan, a direct T3 request, or a named refusal, and normalize actual T3 responses into separate evidence records. They do not launch models or change the CLI runner. `tests/t3-e2e.py` exercises the executable and saves replayable JSONL evidence. Provider dispatch includes a real-host exercise recipe. Codex tool mappings, the six affected skill entrypoints, and directly related playbooks point to this host route. One shared skill tree, model defaults, versions, and standalone CLI receipts remain unchanged.
+
 ## 1.16.0 syncs to Cursor pstack 0.15.29
 
 Open Pstack 1.16.0 tracks Cursor pstack 0.15.29 at `88d47514b82e7c44f00f2b2a72ff6dd12158038c`. Sixteen upstream commits since 0.15.25 touch pstack. Nine change skill content, and all nine are applied with the port adaptations below. `a968159` names two skills after their folders: the port's `poteto-mode` already complies, and `make-bot-ui` stays out. Three add upstream's own Claude Code install and a docs check, which stay out apart from their README text. Three bump only the Cursor manifests and guide, which stay out. The release also fixes #46 and #235, and ships Claude Haiku 5.5 lanes (#223), foreground waits on Claude Code (#232, #233) and the comment sweep (#218), all merged after 1.15.0. Default roles and panels are unchanged.

NOTICE.md

@@ -47,13 +47,17 @@ Summary of structural changes:
 
 Per the MIT license, modifications are permitted. Skill bodies have been edited to substitute Cursor-specific primitives with their Claude Code equivalents (the full substitution table is in [CHANGES.md](CHANGES.md)). All upstream copyright notices in source files (where present) are preserved.
 
+Local addition, 2026-10-28, for compatibility with T3-owned delegation: the T3 host section in provider dispatch, its narrow shared-skill and playbook pointers, the JSON compiler and normalizer, and the process-boundary verification harness. These are independently authored port additions for #253.
+
 Files authored for this port (not derived from upstream):
 
 - `plugins/pstack/.claude-plugin/plugin.json`
 - `.claude-plugin/marketplace.json` (repo root)
 - `plugins/pstack/.codex-plugin/plugin.json`
 - `.agents/plugins/marketplace.json` (repo root)
 - `plugins/pstack/skills/poteto-mode/references/codex-tools.md`
+- `plugins/pstack/skills/poteto-mode/scripts/runner/t3.ts` and `runner/pstack-t3` (T3 request compilation and response normalization)
+- `tests/t3-e2e.py` (T3 process-boundary checks and replayable artifacts)
 - `plugins/pstack/skills/poteto-mode/scripts/bootstrap.test.ts`
 - `plugins/pstack/skills/poteto-mode/scripts/check-plan.test.ts`
 - `plugins/pstack/skills/poteto-mode/scripts/resolve-codex-transcript`, `resolve-codex-transcript.ts`, and `resolve-codex-transcript.test.ts` (Reflect's known-chat Codex transcript lookup, #140; behavior and test cases from Donncha O'Toole's contribution)

README.md

@@ -20,6 +20,7 @@ Compared with Lauren's pstack, Open Pstack adds:
 - **One skill tree for Claude Code and Codex.** Both apps read the same skills, and one [reference](plugins/pstack/skills/poteto-mode/references/codex-tools.md) maps how each app starts them. Lauren's pstack does not run in Codex. See [Claude Code and Codex](#claude-code-and-codex) below.
 - **Models from other providers.** Claude Code and Codex hand work to other providers' models through each provider's own command-line tool, started by one [runner](plugins/pstack/skills/poteto-mode/references/provider-dispatch.md). The runner supports nine providers. Claude, Codex and Grok run lanes that read or write files. Devin, DeepSeek Harness, Antigravity, OpenCode, Amp and Cursor CLI run read-only lanes. The model catalog's [routes table](plugins/pstack/skills/poteto-mode/references/model-catalog.md#routes) lists how each one starts. Each run leaves a receipt with the exact model flags and, where the provider reports it, the model that answered. Every provider except Claude and Codex gets only an allowlisted environment. A Claude lane that writes files runs in Claude Code's Bash sandbox, with writes to the shared Git directory denied. A model that cannot run fails visibly; the runner never switches to a weaker model.
 - **A checked model sheet.** [`setup-pstack`](plugins/pstack/skills/setup-pstack/SKILL.md) records each role as `provider:model@effort`, asks for one effort per model family, and probes each chosen model before it saves anything. A rerun that changes nothing keeps the sheet without asking again.
+- **T3-owned delegation.** Inside T3 Code, the [host route](plugins/pstack/skills/poteto-mode/references/provider-dispatch.md#t3-host-2026-10-28) keeps pstack's role and model choices while T3 launches and tracks agents. A JSON helper validates requests and records T3 results separately from CLI receipts. Unattested sandbox requirements refuse before launch.
 - **Three-model panels.** `arena`, `architect` and `interrogate` default to Opus, Sol and Grok. Lauren's pstack defaults to Opus 5.5 and Grok; Open Pstack keeps three ([UPSTREAM.md](UPSTREAM.md)).
 - **Changes tested where they run.** Before a change merges, the exact candidate is installed in each app it affects and the changed behavior is tested there. The pull request records the result ([AGENTS.md](AGENTS.md)).
 

package.json

@@ -3,7 +3,8 @@
   "private": true,
   "packageManager": "bun@1.4.0",
   "scripts": {
-    "test": "cd plugins/pstack/skills/poteto-mode/scripts && bun install --frozen-lockfile && bun run test",
+    "test": "bun run test:t3 && cd plugins/pstack/skills/poteto-mode/scripts && bun install --frozen-lockfile && bun run test",
+    "test:t3": "python3 tests/t3-e2e.py --helper plugins/pstack/skills/poteto-mode/scripts/runner/pstack-t3 --artifacts \"$(mktemp -d)\"",
     "typecheck": "cd plugins/pstack/skills/poteto-mode/scripts && bun install --frozen-lockfile && bun run typecheck",
     "static": "bun -e 'for (const path of process.argv.slice(1)) JSON.parse(await Bun.file(path).text())' .claude-plugin/marketplace.json .agents/plugins/marketplace.json plugins/pstack/.claude-plugin/plugin.json plugins/pstack/.codex-plugin/plugin.json && PSTACK_STATIC_ONLY=1 bash tests/skill-collision-repro.sh"
   }

plugins/pstack/skills/arena/SKILL.md

@@ -9,6 +9,8 @@ description: "Spawn N parallel candidates at the same task, pick a base, graft t
 
 Open a todolist with one entry per phase (Frame, Fan out, Cross-judge, Pick, Graft, Verify) before launching anything.
 
+On T3, the [host route](../poteto-mode/references/provider-dispatch.md#t3-host-2026-10-28) replaces the standalone launcher, worktree, background, and receipt instructions below. Use the compiled request and distinct T3 result records.
+
 ## Phase A: Frame
 
 Every candidate gets the same prompt, so the prompt is the contract.

plugins/pstack/skills/how/SKILL.md

@@ -9,6 +9,8 @@ Explore the codebase to answer "how does X work?" questions. Produce architectur
 
 **Dispatch contract.** Resolve every configured role through [`provider-dispatch.md`](../poteto-mode/references/provider-dispatch.md). Values are provider-qualified descriptors; the parent chooses native versus external execution. Every lane runs in `read-only` mode. Explorers use the `how explorer` descriptor, and every explainer uses the `how explainer` descriptor. When the sheet lacks either line, use that role's [role default](../poteto-mode/references/model-catalog.md#role-defaults). A native lane uses the parent subagent primitive; an external lane uses the launcher directly. On Codex, resolve remaining Claude tool names via [`codex-tools.md`](../poteto-mode/references/codex-tools.md). Pick each subagent's effort for the job, per the Subagents section of the **poteto-mode** skill.
 
+On T3, the [host route](../poteto-mode/references/provider-dispatch.md#t3-host-2026-10-28) replaces the standalone launcher, worktree, background, and receipt instructions below. Label no-edit intent as advisory. Required enforced read-only access refuses without attestation. Use the compiled request and distinct T3 result records.
+
 ## 1. Assess complexity
 
 If the scope is ambiguous, state your interpretation and explore. The user can redirect.

plugins/pstack/skills/interrogate/SKILL.md

@@ -9,6 +9,8 @@ Spawn one reviewer per configured model to adversarially review code changes. Th
 
 **Dispatch contract.** Read [`provider-dispatch.md`](../poteto-mode/references/provider-dispatch.md) before launching reviewers. Configured entries are provider-qualified descriptors; the parent starts native and external read-only lanes directly. On Codex, resolve remaining Claude tool names via [`codex-tools.md`](../poteto-mode/references/codex-tools.md).
 
+On T3, the [host route](../poteto-mode/references/provider-dispatch.md#t3-host-2026-10-28) replaces the standalone launcher, worktree, background, and receipt instructions below. Label no-edit intent as advisory. Required enforced read-only access refuses without attestation. Use the compiled request and distinct T3 result records.
+
 ## Step 1, Scope
 
 Identify what to review from context:

plugins/pstack/skills/poteto-mode/SKILL.md

@@ -91,6 +91,8 @@ Read the leaf skill in full for any principle you apply. Each entry names when i
 
 ## Subagents
 
+On T3, the [host route](references/provider-dispatch.md#t3-host-2026-10-28) takes precedence over the standalone defaults below. Compile the selected assignment, call the parent tools directly, and retain distinct T3 evidence. T3 creates worktrees and owns async completion. Required enforcement without attestation refuses. Do not retry a rejected effort or fall back to a CLI on this host.
+
 For `inherit-parent`, `auto`, or an unconfigured native ad-hoc helper, prefer `poteto-agent`. The chat that receives `/poteto-mode` runs the playbook. Never spawn a `poteto-agent` to run the playbook itself. A provider-qualified role instead follows provider dispatch: Claude's shipped frontier agent definitions select the model alias and requested effort, Codex passes both to `spawn_agent`, and external providers run through the deterministic launcher. Routed workflow skills set the task and access mode. Do not override their choices.
 
 **Defaults for every delegation.** Start independent lanes together, use file pointers rather than inlined dumps, preserve only the tools or MCPs the task needs, and assign every writer a worktree or unique output directory. `/setup-pstack` configures the descriptor per role. A role without a sheet line uses its [role default](references/model-catalog.md#role-defaults); the panel roles default to one model from each of three providers. Each code playbook's configured model comes from its line (`feature, refactoring`, `bug-fix`, `perf-issue`, or `hillclimb`), and the hardest changes read `hardest tasks`. Prose and judgment read `judgment and prose`. `inherit-parent` and `auto` use the parent model natively and reduce provider diversity when used in a panel.

plugins/pstack/skills/poteto-mode/playbooks/autopilot-full.md

@@ -1,5 +1,7 @@
 ### Autopilot-full
 
+On T3, follow [host dispatch](../references/provider-dispatch.md#t3-host-2026-10-28): the parent calls `delegate_task`, T3 prepares worktrees, and distinct T3 records replace CLI receipts. Use completion notifications instead of agent polling or audit loops, cancel with `task_cancel`, and create fresh review tasks. Do not create a child checkout in the shell or its brief.
+
 **You own the verdicts, never the PRs. One owner carries each PR from build to merge, and nothing merges until your swarm, which never wrote the code, has proven the code that lands.**
 
 A verdict covers one patch and green CI covers one head. Step 4 runs a full swarm once, and again only for a major change. The patch-id rule in `playbooks/shipping.md` can carry a lane's result, and every new head needs its own green CI.

plugins/pstack/skills/poteto-mode/playbooks/autopilot-stack.md

@@ -1,5 +1,7 @@
 ### Autopilot-stack
 
+On T3, follow [host dispatch](../references/provider-dispatch.md#t3-host-2026-10-28): the parent calls `delegate_task`, T3 prepares worktrees, and distinct T3 records replace CLI receipts. Use completion notifications instead of agent polling or audit loops, cancel with `task_cancel`, and create fresh review tasks. Do not create a child checkout in the shell or its brief.
+
 **You own the stack, never the landing. Hand the operator one linear stack of verified PRs to review and land.** **Autopilot-full** holds except for how verified work leaves. Each tick re-reads both playbooks from disk (`skills/poteto-mode/playbooks/autopilot-stack.md` and `autopilot-full.md` under the installed plugin), and this one wins where they differ.
 
 1. **Run Autopilot-full's owners, minus the landing.** Resolve the forge, `<base-repo>`, `<head-remote>`, `<head-url>`, and `<base-remote>` as Autopilot-full step 2 does; this playbook never merges. When the head repository is a fork, validate its identity and record its owner and repository name as `<fork-owner>` and `<head-name>`. Owners report STACK-READY with the exact head SHA in place of merge-ready. They never rebase onto another branch, trunk included, and never retarget, merge, close a PR, or arm auto-merge, because the root owns the chain's topology and the operator owns the landing. When an item depends on another, its owner branches from that item's branch, not from trunk. Nothing enters the stack before a clean verdict from Autopilot-full step 4.

plugins/pstack/skills/poteto-mode/playbooks/bug-fix.md

@@ -1,5 +1,7 @@
 ### Bug fix
 
+On T3, follow [host dispatch](../references/provider-dispatch.md#t3-host-2026-10-28): the parent calls `delegate_task`, T3 prepares worktrees, and distinct T3 records replace CLI receipts. Do not create a child checkout in the shell or its brief.
+
 **You own this task. Plan, review, verify.** Delegate investigation and the fix to subagents, stay in the lead. Pick each subagent's effort for the job, per the Subagents section.
 
 Be scientific. Every shipped line traces to runtime evidence. Belt-and-suspenders that "might help" is a hypothesis, not a fix. It does not ship. When evidence refutes a hypothesis, revert what it motivated. The smallest change the evidence justifies ships, nothing more.

plugins/pstack/skills/poteto-mode/playbooks/feature.md

@@ -1,5 +1,7 @@
 ### Feature
 
+On T3, follow [host dispatch](../references/provider-dispatch.md#t3-host-2026-10-28): the parent calls `delegate_task`, T3 prepares worktrees, and distinct T3 records replace CLI receipts. Do not create a child checkout in the shell or its brief.
+
 **You own the design. Plan, review, verify.** Delegate implementation. Stay in the lead.
 
 1. `how` over the affected subsystem.

plugins/pstack/skills/poteto-mode/playbooks/hillclimb.md

@@ -1,5 +1,7 @@
 ### Hillclimb
 
+On T3, follow [host dispatch](../references/provider-dispatch.md#t3-host-2026-10-28): the parent calls `delegate_task`, T3 prepares worktrees, and distinct T3 records replace CLI receipts. Do not create a child checkout in the shell or its brief.
+
 **You own the metric and the experiment's integrity. Supervise and review. Delegate the attempts.** For sustained, iterative improvement of one measurable thing against a target. A one-off fix is Bug fix or Perf issue. This is the loop.
 
 Core discipline: one change, one measurement, keep or revert. Never stack untested changes, and never claim a win from code inspection (the **prove-it-works** principle skill).

plugins/pstack/skills/poteto-mode/playbooks/multi-phase-plan.md

@@ -1,5 +1,7 @@
 ### Multi-phase or multi-PR plan
 
+On T3, follow [host dispatch](../references/provider-dispatch.md#t3-host-2026-10-28): the parent calls `delegate_task`, T3 prepares worktrees, and distinct T3 records replace CLI receipts. Do not create a child checkout in the shell or its brief.
+
 **You own the plan, not the code. The plan is a checklist an owner runs box by box and the operator audits from the evidence.** The plan is the deliverable. Do not implement.
 
 1. When the change is one or two files with an obvious approach, skip the plan. Say so and stop.

plugins/pstack/skills/poteto-mode/playbooks/orchestrate.md

@@ -1,5 +1,7 @@
 ### Orchestrate
 
+On T3, follow [host dispatch](../references/provider-dispatch.md#t3-host-2026-10-28): the parent calls `delegate_task`, T3 prepares worktrees, and distinct T3 records replace CLI receipts. Use completion notifications instead of agent polling or audit loops, cancel with `task_cancel`, and create fresh review tasks. Do not create a child checkout in the shell or its brief.
+
 **You own the program, never the code. Author briefs, drain the queue, keep the frontier green, decide.** For a whole project handed to one standing coordinator chat: multi-day, many stacked PRs, dozens to hundreds of subagents, the human checking in twice a day instead of every five minutes. One task driven to a predicate is Autonomous run. One ambitious run needing a bespoke workflow is figure-it-out. Route here when the work outlives any single agent. Work one agent could finish inside the session's budget is not a program.
 
 Ceremony must scale with the program. On cheap near-identical units, collapse it as each section directs.

plugins/pstack/skills/poteto-mode/playbooks/perf-issue.md

@@ -1,5 +1,7 @@
 ### Perf issue
 
+On T3, follow [host dispatch](../references/provider-dispatch.md#t3-host-2026-10-28): the parent calls `delegate_task`, T3 prepares worktrees, and distinct T3 records replace CLI receipts. Do not create a child checkout in the shell or its brief.
+
 **You own the measurement story. Plan, review, verify the numbers.** Tie every fix to a measurement, don't read source instead of measuring.
 
 1. Capture a baseline trace via the driver skill (`run` for CLIs/TUIs, `verify` for UIs). Vet the baseline, and each later number, with the **benchmark-checklist** skill.

plugins/pstack/skills/poteto-mode/references/codex-tools.md

@@ -2,6 +2,10 @@
 
 pstack skills retain Claude Code tool language (`Skill`, `Agent`, `AskUserQuestion`) in shared prose. On Codex the files are the same; only those tool names resolve differently. Model execution is not translated here. Read [`provider-dispatch.md`](provider-dispatch.md) for the parent-owned Claude/Codex/Grok route table and provider-qualified descriptors.
 
+## T3 host exceptions
+
+When the actual session is hosted in T3, follow [T3 host dispatch](provider-dispatch.md#t3-host-2026-10-28) before the standalone mappings below. Only unchanged inherited provider, model, and settings, shared isolation, and completion this turn use native `spawn_agent` and `wait_agent`, without overrides. Requested settings, cross-provider or cross-model choices, worktrees, and background tasks use the parent's direct T3 `delegate_task`. Missing tools refuse. T3 creates worktrees. Async completion notifications replace process-handle polling and standalone background/wait mappings. Retain distinct T3 records, follow `next`, cancel with `task_cancel`, and start fresh review tasks. Never invoke the CLI runner as a T3 fallback.
+
 ## Harness config homes
 
 Resolve the current parent's config home once: Claude Code uses nonempty `CLAUDE_CONFIG_DIR`, otherwise `$HOME/.claude`; Codex uses nonempty `CODEX_HOME`, otherwise `$HOME/.codex`. The equivalent quoted shell expressions are: