[ericlitman]

Summary

This is the fix-forward PR for the merged head of #286 (e4537f0). It replaces the verifier's exact-path Grok reach list with permission taken from the registry's runtime ownership. The step-back exchange chose this design after two consecutive verdicts each found a path missing from that list: v1:1f3cdb66 and v1:ccdebf5c on #284, then v1:427364ab on #286.

 classify(path)
-  for feature, reach in GROK_REACH: if path in reach: add feature      # exact-path inventory
   asset            -> consumer feature                       (no Grok)
   version-only     -> <harness>:hook:startup, continue       (no Grok)
-  catalog          -> catalog, setup, runner
+  catalog          -> catalog, setup, runner                 + grok:dispatch, grok:setup
-  shared           -> skills, setup, runner, tools, hook
+  shared           -> skills, setup, runner, tools, hook     + grok:dispatch, grok:setup
-  setup|runner|tools|project ownership -> that feature
+  setup|runner|tools|project ownership -> that feature      + grok:dispatch, grok:setup
-  skill content | transcript resolver  -> skill
+  skill content | transcript resolver  -> skill             + grok:dispatch, grok:setup
   unmapped         -> throw

Reach is permission only. verify.ts still runs just the named features plus project-skill under --self-test, so no Grok session runs unless an operator names it.

Introduced by: #286. Closes #287.

Evidence

• Before: classify([{filename: '.claude/skills/verify-open-pstack/scripts/io.ts'}]) permitted no Grok feature, and the earlier misses had the same cause.
  After: the new core.test.ts case "every runtime ownership permits naming both Grok features; assets, version-only manifests and non-runtime paths do not" covers 16 paths. They include the seven paths found on feat(grok): Grok as a parent harness (#281) #284, scripts/io.ts, a new verifier helper and a new skill reference, and each permits exactly grok:dispatch and grok:setup. In the same test, assets/logo.png, a version-only Claude manifest and .mergify.yml permit none, and an unknown plugin path still throws Unmapped path.
• The exact-set tests that assert other features keep their assertions, now with the two Grok permissions added where the path is runtime.
• The step-back record is in the operator's docs records: records/2026-11-08-batch-281/stepback-286/, covering the opening, the advisor's opening and closing, the rebuttal and the artefact.

Merge Danger

Door: two-way

Blast Radius: verifier-only

The change widens only which features an operator may name. Run selection, recipes, T3 classification and publication are unchanged.

Acceptance criteria (#287)

1. The exact-path list is gone. GROK_REACH, its loop and GROK_TRANSPORT are deleted from scripts/core.ts.
2. Every runtime ownership branch permits both Grok features. classify() calls grok() in the catalog, shared and shared-recipe, setup, runner, tools, project, skill-content and transcript-resolver branches. The 16-path test covers it.
3. The narrow cases stay narrow. Asset-only, version-only and non-runtime changes gain no Grok feature, and unmapped paths still fail. The same test covers it.
4. The tests match. Self-test adds no Grok session: the existing requiredHarnesses assertions are unchanged.
5. The docs match. features/grok.md now states the ownership rule and its exceptions instead of listing files.

Gate results (head b43e759)

Check	Exit
bun run test	0
bun run typecheck	0
bun run static	0
claude plugin validate plugins/pstack	0
grok plugin validate plugins/pstack	0

Not verified

• live-gate is pending. It runs from this candidate head because the PR changes the verifier: grok:dispatch with --self-test. That run exercises the changed classification on this PR's own paths.

🤖 Generated with Claude Code

[mergify]

Merge Protections

🟢 All 2 merge protections satisfied — ready to merge.

Show 2 satisfied protections

🟢 Queue ready pull requests

Automatically queue non-draft pull requests targeting main after verify and live-gate pass on the head and every review thread is resolved.

• #review-threads-unresolved = 0
• -draft
• check-success=live-gate
• check-success=verify

🟢 🚦 Auto-queue

When all merge protections are satisfied and these conditions match, this pull request will be queued automatically.

• -files~=^\.github/
• base = main

[ericlitman]

Live evidence: Open Pstack

• Candidate SHA: b43e75933139b60e310977615fa37c829141a918
• Base SHA: d1766d5113e33107c782b323d9d7bcf5fc3e69c0
• Result: PASSED — named features verified
• Self-test: completed in both harnesses
• Planned sessions: 3 (limit 12)
• Publisher revision: b43e75933139b60e310977615fa37c829141a918
• Evidence-set SHA-256: 7b68d91e6627764b988b6b9e2fd1ca73fecb9d468f879c8977a4db904c1670c9
• Installation (claude): CLI 2.1.319 (Claude Code), plugin 1.20.0, candidate b43e75933139b60e310977615fa37c829141a918, tree 367d0e808e4e3a1df50dc5c2cbf472630ff9f4adc6eca5d00c6ce3f51669599c.
• Installation (codex): CLI codex-cli 0.167.0, plugin 1.20.0, candidate b43e75933139b60e310977615fa37c829141a918, tree 367d0e808e4e3a1df50dc5c2cbf472630ff9f4adc6eca5d00c6ce3f51669599c.
• Installation (grok): CLI grok 1.0.77 (50ca579fa996) [stable], plugin 1.20.0, candidate b43e75933139b60e310977615fa37c829141a918, tree 367d0e808e4e3a1df50dc5c2cbf472630ff9f4adc6eca5d00c6ce3f51669599c.
• Observation (claude / project-skill): surface claude -p stream-json with the candidate plugin-dir; action recipe project-skill: doctor; result passed: doctor:exit-0 doctor:skill-loaded doctor:doctor-ran doctor:doctor-canonical-pass; 4 assertions machine-checked; transcript SHA-256 7071f5937bcfdfd05d86eb7a87aa270071eae29843a0b5d7b15fa6f1cecb1637; artifact-set SHA-256 1f6e3db1e9b738b635091ed863db3371e856b628a00aefffbe69d5c648ece72b.
• Observation (codex / project-skill): surface codex exec --json with the run-owned candidate installation; action recipe project-skill: doctor; result passed: doctor:exit-0 doctor:skill-loaded doctor:doctor-ran doctor:doctor-canonical-pass; 4 assertions machine-checked; transcript SHA-256 bdd5072a345c959909386fbfd7262b62851e2038248f8578c1891d14179b266a; artifact-set SHA-256 e48b37a131364c84e675f1bede919ce8df27aa806f9b2bbe2e51e1edb95df755.
• Observation (grok / dispatch): surface grok agent stdio (ACP) with the candidate plugin-dir; action recipe dispatch: dispatch; result passed 7 assertions; ids retained privately; 7 assertions machine-checked; transcript SHA-256 22f9afbbc3b6498c1a77ca02ff1c002be0368ecedba3d77d3beab9ddb93ac4e1; artifact-set SHA-256 3b373260a50518c656a2b0b761cfb4d26170dd095fae399f04ff98df3251dd9e.
• Policy: every new head requires a fresh run; this verifier does not change PR state, queue, or merge.

[mergify]

✅ Merged into main as 7c3afcd at 20:03 UTC

Less than a minute in the queue, with no time running CI.

So far

• ✅ Entered the queue Sun 8 Nov, 20:03 · rule default · triggered by merge protections
• ✅ Checks skipped · PR is already up-to-date
• ✅ Merged 20:03 · 7c3afcd · merge

8 merge conditions met

• github-review-approved · required by GitHub repository ruleset rule Protect main
• #review-threads-unresolved = 0 · required by Merge Protections rule Queue ready pull requests
• -draft · required by Merge Protections rule Queue ready pull requests
• check-success=live-gate · required by Merge Protections rule Queue ready pull requests
• check-success=verify · required by Merge Protections rule Queue ready pull requests
• any of · required by GitHub repository ruleset rule Protect main:
  • check-success = @github-actions/verify
  • check-neutral = @github-actions/verify
  • check-skipped = @github-actions/verify
• any of · required by GitHub repository ruleset rule Protect main:
  • check-success = live-gate
  • check-neutral = live-gate
  • check-skipped = live-gate
• any of · required by GitHub repository ruleset rule Review gate:
  • check-success = @mergify/Mergify Merge Protections
  • check-neutral = @mergify/Mergify Merge Protections
  • check-skipped = @mergify/Mergify Merge Protections

_{Times in UTC · dashboard · how the merge queue works}

[unfret-eal]

✅ No blocking findings

Walkthrough

This PR changes how the verifier decides which paths permit naming the Grok live-gate features. Previously a hand-maintained exact-path list (`GROK_REACH`) controlled this, and it kept missing files. Now every path the registry owns as runtime code or instructions permits both `grok:dispatch` and `grok:setup`. That covers catalog, shared and shared-recipe, setup, runner, tools, project, skill content and the transcript resolver. Assets, version-only manifest bumps and non-runtime paths gain nothing, and unmapped paths still throw. This only widens what an operator may name: `verify.ts` still runs just the named features. The PR adds a 16-path test for the new rule, updates the existing exact-set expectations to include the Grok permissions, and rewrites `features/grok.md` to state the ownership rule instead of listing files. Per the author, the live-gate run is still pending.

Area	What changes
Classification	`core.ts` removes `GROK_REACH` and `GROK_TRANSPORT`. A `grok()` helper adds both Grok features in every runtime-ownership branch of `classify()`.
Tests	Adds a test that runtime paths, including new helpers and references, permit exactly both Grok features, while assets, version-only manifests and `.mergify.yml` permit none. Existing expectations are wrapped with `withGrok`.
Docs	`grok.md` replaces the file list with the ownership rule and its asset and version-only exceptions.

Details

Lane / stage	Model	Effort	Outcome	Duration
broad-gpt-5.6-sol-xhigh / review	openai/gpt-5.6-sol → gpt-5.6-sol · primary	xhigh	succeeded	1 min 20 s
broad-opus-5.5-max / review	anthropic/claude-opus-5-5 → claude-opus-5-5 · primary	max	succeeded	3 min 30 s
focal-gpt-5.6-sol-xhigh copy / review	openai/gpt-6.1-sol → gpt-6.1-sol · primary	xhigh	succeeded	6 min 2 s
focal-gpt-5.6-sol-xhigh copy 2 / review	openai/gpt-6.1-sol → gpt-6.1-sol · primary	xhigh	succeeded	7 min 22 s

First review of this pull request.
4 reviewers finished.
Commit b43e759.
Check run.
Run: GET /unfret/run/panel:b43e75933139b60e310977615fa37c829141a918:XQkY2bmorxq:yNVP0ounpmA.

_{@unfret review · @unfret status · @unfret help}

[unfret-eal]

✅ No blocking findings
Check