feat: add strict Conductor orchestration to Poteto Mode - #52
Conversation
Greptile SummaryThis PR adds an opt-in Conductor orchestration route for Poteto Mode, including strict policy and receipt validation, isolated worker workspaces, durable attempt state, uncertain-create reconciliation, scoped cleanup, shared skill routing, and contract-focused tests.
Confidence Score: 2/5The PR is not safe to merge until durable runs remain resumable after later attempts, ambiguous workspaces can be cleaned up, and lock recovery preserves exclusive ownership. A later attempt can remain hidden under a completed run, ambiguous uncertain creates permanently leak their workspaces, and stale-lock races can admit concurrent state writers. Files Needing Attention: plugins/pstack/skills/poteto-mode/scripts/conductor/store.ts, plugins/pstack/skills/poteto-mode/scripts/conductor/cli.ts
|
| Filename | Overview |
|---|---|
| plugins/pstack/skills/poteto-mode/scripts/conductor/store.ts | Implements durable run state, budgets, reconciliation, locking, and cleanup, but mishandles new attempts after completion, ambiguous cleanup candidates, and lock ownership races. |
| plugins/pstack/skills/poteto-mode/scripts/conductor/cli.ts | Provides the strict command boundary for policy and attempt operations; its active-only implicit resume exposes the inconsistent completed-run state. |
| plugins/pstack/skills/poteto-mode/scripts/conductor/boundary.ts | Strictly parses Conductor responses, binds receipts, and accepts attempt-scoped assistant results; production transcript callers enforce session ownership. |
| plugins/pstack/skills/poteto-mode/scripts/conductor/policy.ts | Strictly parses the versioned project policy and validates configured targets against the live catalog. |
| plugins/pstack/skills/poteto-mode/references/conductor-dispatch.md | Documents coordinator ownership, isolated dispatch, observation, uncertain-create recovery, and scoped cleanup. |
| plugins/pstack/skills/setup-pstack/SKILL.md | Routes Conductor-enabled projects through strict validation and an isolated marker smoke while preserving portable model sheets. |
| plugins/pstack/skills/poteto-mode/scripts/conductor/store.test.ts | Covers state transitions and sequential lock behavior but misses post-terminal planning, ambiguous cleanup, and concurrent stale-lock recovery. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Claude or Codex coordinator] --> B[Validate project policy and live catalog]
B --> C[Start or resume durable run]
C --> D[Plan isolated worker attempt]
D --> E[Persist creating state]
E --> F[Create Conductor workspace]
F --> G[Validate post-create receipt]
G --> H[Record dispatch cursor and send stable message]
H --> I[Observe status, transcript, and post-run receipt]
I -->|Valid result| J[Complete attempt]
I -->|Failure| K[Record dropout]
F -->|Uncertain response| L[Reconcile workspace and session]
J --> M[Emit scoped cleanup targets]
K --> M
L --> H
Reviews (1): Last reviewed commit: "docs: teach Poteto Mode Conductor orches..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| return { | ||
| ...run, | ||
| workers: [ | ||
| ...run.workers, | ||
| { | ||
| state: "planned", | ||
| request, | ||
| dispatchMessageId: input.dispatchMessageId, | ||
| followUps: [], | ||
| }, | ||
| ], | ||
| }; | ||
| } |
There was a problem hiding this comment.
When all current workers become terminal, the run is marked complete. If the coordinator then plans a retry or later attempt, planAttempt appends the worker without restoring the run to active. After a coordinator restart, implicit resume ignores this completed run and creates a new one, orphaning the pending or running attempt.
Knowledge Base Used:
| if ( | ||
| attempt.state !== "queued" && | ||
| attempt.state !== "working" && | ||
| attempt.state !== "complete" && | ||
| attempt.state !== "dropout" && | ||
| attempt.state !== "cancelled" | ||
| ) { | ||
| continue; | ||
| } |
There was a problem hiding this comment.
When uncertain-create reconciliation finds multiple exact-name workspaces, it records their IDs but leaves the attempt in unknown. Cleanup excludes unknown attempts, so the only permitted cleanup-target command can never return these workspaces. They are therefore leaked, and changing the attempt to a dropout also discards the recorded candidate IDs.
| if (!(await recordedOwnerIsDead())) { | ||
| throw new RunStateError(`Conductor run store is locked: ${lockPath}`); | ||
| } | ||
| await unlink(lockPath).catch(() => undefined); | ||
| try { | ||
| await writeFile(lockPath, `${process.pid}\n`, { flag: "wx", mode: 0o600 }); |
There was a problem hiding this comment.
Stale-lock recovery checks the recorded PID and later unlinks the lock path without confirming that the file still belongs to that owner. If two processes recover the same stale lock, one can create and start using a new lock before the other performs its delayed unlink. That unlink removes the live lock and allows concurrent writers to modify durable run state. close() has the same ownership-blind unlink behavior.
Knowledge Base Used: Poteto-mode automation
|
Release preparation update: the candidate is now versioned 1.4.0 at |
|
Superseded: Savari will own this customized Conductor mode inside Savari-LLC/savari-monorepo rather than changing the upstream project. |
1 participant
Closes #51
Depends on #50. Because #50 uses a fork-only head branch, GitHub cannot select it as this upstream PR base. This draft temporarily includes its one preload commit and will shrink to only the Conductor commits after #50 merges.
What changed
.conductor/poteto-mode.jsonroute shared by Claude Code and Codex.The implementation follows the current Conductor contract.
whoamiis combined withget_session_statusbecausewhoamidoes not expose the current session ID. Uncertain workspace recovery also callslist_workspace_sessionsbecause workspace listings do not expose session IDs.Verification
Completed locally:
bun test conductor: 47 pass, 0 fail.bun run typecheck: pass.bash tests/conductor-mode-repro.sh: pass.PSTACK_STATIC_ONLY=1 bash tests/skill-collision-repro.sh: pass.git diff --check: pass.Known baseline outside this change:
bun run test: 204 pass, 1 fail.runLane > spends one explicit deadline across preflight and model executioninrunner/run.test.ts. It failed identically before this branch work began. Expected preflight status ispassed; observed istimed-out.Live evidence:
Not run. This T3/Codex harness has no Conductor MCP connection. Keep this PR draft until the exact candidate runs from real Claude and Codex Conductor coordinator sessions, including Cursor/Grok 4.6 at xhigh with fast mode disabled. Do not merge, tag, release, or roll it out before that gate passes.