[arjitj2]

Closes #157

Adopts Cursor's validating type-guard example for branded identifiers and moves its skill-name validation into this distribution's existing static checks. Existing skill names already match their folders. The generated Claude tree and conflicting storage/default-model rules remain excluded. README.md is unchanged.

Candidate 1.17.5 follows the standing patch policy because Cursor remains on 0.15.25. All 51 source decisions are final. The baseline advanced to 1b800800583ee8ff7f2676caf7a5cb7f0804be85 after the content candidate passed Linux CI and native-host controls.

Both native hosts loaded the candidate TypeScript guidance. Their generated parsers compile strictly, reject raw and mixed identifier types, and pass two valid plus twelve malformed-input controls each. Codex read the registered 1.17.5 cache; Claude used native Skill with a plugin-dir snapshot. All 238 packaged files match the final candidate. Native cases ran at cd233e6; only NOTICE changed afterward. Both disposable copies received that NOTICE update in place and were rehashed. The other 237 contracts retain exact-hash live proof. This was not a fresh installer transaction at the final head.

These are deterministic fixtures, not automatic skill selection, a causal comparison, or universal parser validation. Claude added prose outside the requested code block. The How worker reported out-of-scope scratch writes; they are retained as a contract deviation, not confinement proof.

The actual static checker passes valid metadata and rejects mismatched, uppercase and overlong names. Strict typing and static checks pass. Documentation, maintenance, hook, ledger and plugin checks also pass. The local Node 24 Bun suite failed with 991 passes, seven failures and six additional errors in unchanged fixtures. Content-candidate CI passed before baseline advancement. Final-head CI passed with 993 Bun passes, five platform skips and zero failures. Independent source and exact-head shipping reviews passed with notes. Personal model choices and installation state are captured and preserved during temporary checks.

Related catalog #156 and ongoing monitor #1. Fixture investigation remains separate in #141. No implicit timeout, model substitution, effort change or API spending is introduced.

Copilot review was requested through both supported identities but no request persisted. It is unavailable, not an approval.

[arjitj2]

Independent Opus 5.5 source review returned PASS+NOTES for immutable content snapshot c38f872. It confirmed source fidelity, portable naming validation, preserved frontmatter and excluded adapter policies.

Its outstanding finalization notes are resolved at fba49ec: all 51 ledger decisions are final with reasons and evidence; the changelog has the PR and release links; UPSTREAM and NOTICE record the decisions. Final Linux CI passes and verifies ledger coverage. The exact-head shipping review independently inspected these final files and raw host/compiler evidence. The source review is not represented as approval of a later head.

Non-blocking limits remain explicit. The name parser rejects malformed metadata with less polished diagnostics in some cases. Host cases are explicitly loaded deterministic fixtures. The local suite has retained failures under #141. README content is unchanged.

[arjitj2]

Independent Shipping verdict: PASS+NOTES

PR: #158

• Verdict head: fba49ec98eb4a8002ce3d8de1df313725be1a0a4
• Verdict base: dc6b74a244c2d387b0fb451d211784a6b13a3911
• Stable patch ID: 19a51d83b447b24e5e67ccabf6772fb896f6a986
• Package: 1.17.5, tree e678abcef184b3b6b05115eb2affe75b2bb94d14
• Cursor baseline: 1b800800583ee8ff7f2676caf7a5cb7f0804be85, version 0.15.25

I did not implement this patch. I read the prepared worker contract, installed Shipping playbook, complete 12-file patch, upstream diff and evidence. I made no repository or account mutations. This report is the only artifact I wrote. GitHub CLI was used; origin was not present on PATH. The origin fetch and push URLs both name arjitj2/open-pstack. The unrelated Eric remote was not used.

Scope and fidelity

The two TypeScript guidance changes adopt the upstream verifying type-guard rule and cast-free example. Existing portable frontmatter remains intact. The skill-name constraint is adapted into the existing static-only metadata boundary. The generated Claude tree, alternate model-sheet location, implicit session-model substitution and blanket skip/placeholder policy remain excluded. The hunk record covers all three source commits.

README is byte-identical to the base. AGENTS.md and its explicit README approval rule are unchanged. Provider dispatch, saved roles, efforts, recovery chains and spending policy have no patch changes. Version 1.17.5 follows the authorized patch rule for package changes without a Cursor version increment. I independently ran check-ledger: all 51 entries have coverage. Actual upstream-audit at the exact head reports no remaining changes against the recorded baseline. The exact-head preview reports no new Cursor commits to catalogue.

Installed copies and native evidence

I independently recomputed all 238 SHA-256 hashes at each of three locations: candidate source, registered disposable Codex cache and disposable Claude plugin directory. All match candidate.json. Both version manifests match 1.17.5. Codex installation and marketplace receipts identify that cache and fixture snapshot.

I also recomputed the 237 unchanged contract hashes from both native-case commit cd233e61b05d89bad198a4a862cde2c0f54a6f1c and the final head. All match carried-contracts.json. Only packaged NOTICE changed after the native cases. Both disposable copies were patched in place for NOTICE and rehashed. This is not a fresh final-head installer transaction.

The raw Codex JSONL shows successful reads of the registered TypeScript skill, linked type-system principle and patterns file, followed by turn completion. The raw Claude JSONL shows successful native Skill invocation pstack:typescript-best-practices, reads of the linked patterns and principle, and a successful terminal result. Both process exit records are zero. Their prompts explicitly requested loading the installed skill; automatic skill selection was not tested.

I inspected both returned libraries and the parent-generated controls before independently running them. The libraries use real format-checking guards without casts, dependencies, network or filesystem capabilities. In both cases, strict compilation succeeds. Separate raw-string and wrong-brand callers fail with TS2345. Runtime controls report 2 valid inputs and 12 malformed inputs rejected per host. I reran those compiler and runtime controls without emitting files. An initial verifier assertion incorrectly expected a particular nonzero compiler exit code; the diagnostic already showed the intended rejection. The corrected verifier checks nonzero plus TS2345 and passes. No product change was needed.

The exact documentation example compiles with a declared isUUID signature, and its raw-string caller fails. This proves the example's narrowing, not the runtime correctness of an unspecified isUUID implementation. These native cases are deterministic supplied-format fixtures, not a causal comparison or a universal model/parser guarantee. Claude added prose outside the requested single code block; that formatting deviation remains disclosed.

Static checks and CI

I inspected all five actual naming-control logs: valid and restored cases pass; mismatched name, uppercase/spaced name and overlong name fail at the new check. I independently ran the current static-only CLI successfully. The new check runs before the static-only return. Missing frontmatter fails closed, though its error is less polished than the normal mismatch diagnostic. Upstream and adapted parsers have small quote/empty-field parsing differences; no observed bad-name acceptance was found.

Final CI run https://github.com/arjitj2/open-pstack/actions/runs/39081105030 is SUCCESS for the frozen head. I queried GitHub and inspected its log: 993 Bun passes, 5 platform skips, 0 failures, 998 total tests; maintenance 27, hooks 8, docs 16, strict typecheck, static/manifests and all 51 ledger entries pass. The pull-request workflow tests GitHub's merge ref of this exact head into the recorded base. The earlier content-only CI is not substituted for this final run.

Local full Bun validation is FAILED: 991 passes, 7 failures and 6 additional errors. The retained logs show deadline-sensitive unchanged fixtures; their exclusive cause is unproven. They must not be reported as local green. Local strict, maintenance, hook, docs, static and plugin-validation exit records are zero. The separate issue 141 remains the place for reproduction and stabilization.

Independent review and safety notes

The Opus source report is PASS+NOTES for immutable pre-finalization snapshot c38, not a final-head release approval. Its pending-ledger, missing PR link, UPSTREAM exclusions and NOTICE concerns are now resolved in the complete final patch. I checked those final files and independently ran ledger coverage. Its host-evidence limitation remains accurate for that source reviewer; this Shipping review inspected raw native transcripts, returned code and compiler/runtime results. The comment reviewer found zero eligible changed code comments.

The How worker reported unassigned scratch writes under /tmp. That legacy prompt-contract deviation is retained. I did not execute those artifacts, and neither the report nor this verdict claims OS confinement. Receipt apiSpend is deny; its billing preflight remains unverified, so no stronger billing-route proof is claimed.

All five captured personal-file hashes currently equal personal-before.json, including model assignments, personal AGENTS, Claude settings, registry and marketplace metadata. All 238 files of the user's existing Codex 1.17.4 package also remain unchanged before intentional rollout. This is a hash comparison against this unit's capture, not a claim about every unrelated account setting.

GitHub currently reports this exact PR head and main base, with autoMergeRequest and mergeQueueEntry both null. The worktree is clean. The parent must refresh head/base/checks/queue immediately before its server-guarded merge and independently verify the merged checkpoint, immutable release and intentional Codex rollout. This verdict authorizes none of those account operations by this worker. It does not cover a different patch or future upstream commits.

No blocking finding remains for this frozen patch. Passing scope includes the evidence limits and retained local failures above. Issue 157 and catalog 156 require parent reconciliation after actual completion; issue 141 remains open and issue 1 continues monitoring.