@arbiterforge/ca-pi 0.10.10 → 0.10.12

package/README.md

@@ -10,7 +10,7 @@ project context. You decide. codeArbiter enforces.
 <img alt="Claude Code plugin" src="https://img.shields.io/badge/Claude_Code-plugin-d97757">
 <img alt="Codex plugin" src="https://img.shields.io/badge/OpenAI_Codex-plugin-10a37f">
 <img alt="Pi Feature Forge preview" src="https://img.shields.io/badge/ca--pi-Feature_Forge_preview-d97757">
-<img alt="version 2.17.9" src="https://img.shields.io/badge/version-2.17.9-2b7489">
+<img alt="version 2.17.10" src="https://img.shields.io/badge/version-2.17.10-2b7489">
 <img alt="core lanes" src="https://img.shields.io/badge/core_lanes-18-555">
 <img alt="skills" src="https://img.shields.io/badge/skills-23-555">
 <img alt="agents" src="https://img.shields.io/badge/agents-19-555">
@@ -117,7 +117,7 @@ Approve the normal plugin trust prompt, open the target repository, and continue
 
 ### Codex CLI
 
-The public GitHub-slug flow is **available now**. The repository currently ships `ca-codex 0.9.9`;
+The public GitHub-slug flow is **available now**. The repository currently ships `ca-codex 0.9.10`;
 the dated end-to-end public-install record discovered `ca-codex 0.2.4` from release `v2.8.13`.
 Current packaging and shared-core parity are continuously verified, while that dated live-install
 record stays labeled rather than being silently promoted to evidence for a newer adapter:
@@ -161,7 +161,7 @@ pi config
 Replace `<version>` with the numeric suffix from the chosen tag while retaining the full
 `ca-pi-v...` tag in the install source.
 
-Pi 0.80.5 and Pi 0.84.1 are the supported hosts for this release line. Generated aliases use `/ca-*`;
+Pi 0.84.1 is the supported host for this release line. Generated aliases use `/ca-*`;
 `/skill:ca-*` is the host-native fallback. Every `ca-pi-v*` tag is also published to npm as
 `npm:@arbiterforge/ca-pi` with provenance (ADR-0029); the pinned Git tag remains the reproducible
 install. The [Pi runbook](./docs/pi-parity-testing.md) covers isolated install, trust, verification,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.10.10",
+  "version": "0.10.12",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/plugins/ca-pi/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `ca-pi` are documented in this file.
 
 ## [Unreleased]
 
+## [0.10.12] - 2026-09-09
+
+### Fixed
+
+- Bind the reviewed Pi 0.84.1 npm configuration and lock bytes across Windows and POSIX checkouts, require CI to execute the integrity-checked install step, and reject the retired Pi 0.80.5 host explicitly.
+- Correct singleton Pi support wording and reconcile authenticated publication receipts for the already-published 0.10.11 release line.
+
+## [0.10.11] - 2026-09-08
+
+### Fixed
+
+- Resolve genuine append-only audit-log conflicts through a fail-closed helper that preserves both branch histories and records the immediate H-05 authorization, with shared audit-path locks and a locked mandatory-override writer preventing concurrent row loss.
+
 ## [0.10.10] - 2026-09-07
 
 ### Fixed

package/plugins/ca-pi/extensions/codearbiter-child.js

@@ -629,7 +629,7 @@ function resolvePythonCommand(platform = process.platform, probe = systemPythonP
 }
 
 // src/compatibility.ts
-var SUPPORTED_PI_VERSIONS = /* @__PURE__ */ new Set(["0.80.5", "0.84.1"]);
+var SUPPORTED_PI_VERSIONS = /* @__PURE__ */ new Set(["0.84.1"]);
 var MINIMUM_NODE = [22, 19, 0];
 var SEMVER_PREFIX = /^(\d+)\.(\d+)\.(\d+)(?:$|[-+])/u;
 function atLeast(version, minimum) {
@@ -644,7 +644,7 @@ function atLeast(version, minimum) {
 }
 function compatibilityDirection(input) {
   if (!SUPPORTED_PI_VERSIONS.has(input.piVersion)) {
-    return "codeArbiter requires Pi 0.80.5 or 0.84.1; install a supported Pi version and run /ca-doctor.";
+    return "codeArbiter requires Pi 0.84.1; install a supported Pi version and run /ca-doctor.";
   }
   if (!atLeast(input.nodeVersion, MINIMUM_NODE)) {
     return "codeArbiter requires Node >=22.19.0 for Pi; upgrade Node and run /ca-doctor.";

package/plugins/ca-pi/extensions/codearbiter.js

@@ -2,7 +2,7 @@
 var define_CODEARBITER_PI_PERMISSION_POLICY_SURFACES_default = { "ca-plan": "planning-write", codearbiter_background_bash: "background-launch" };
 
 // <define:__CODEARBITER_PI_SKILL_EXPANSION_FINGERPRINTS__>
-var define_CODEARBITER_PI_SKILL_EXPANSION_FINGERPRINTS_default = { "0.80.5": "12632f365440b07d5183cff871d889b796a3c711b6b49df20f95d9bc198d6c51", "0.84.1": "12632f365440b07d5183cff871d889b796a3c711b6b49df20f95d9bc198d6c51" };
+var define_CODEARBITER_PI_SKILL_EXPANSION_FINGERPRINTS_default = { "0.84.1": "12632f365440b07d5183cff871d889b796a3c711b6b49df20f95d9bc198d6c51" };
 
 // <define:__CODEARBITER_PI_TOOL_CLASSES__>
 var define_CODEARBITER_PI_TOOL_CLASSES_default = { bash: "EXEC", codearbiter_background_bash: "EXEC", codearbiter_dispatch: "EXEC", codearbiter_farm_preview: "EXEC", write: "WRITE", edit: "EDIT", read: "READ" };
@@ -16,7 +16,7 @@ import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL2 } from
 import { types as utilTypes9 } from "node:util";
 
 // src/compatibility.ts
-var SUPPORTED_PI_VERSIONS = /* @__PURE__ */ new Set(["0.80.5", "0.84.1"]);
+var SUPPORTED_PI_VERSIONS = /* @__PURE__ */ new Set(["0.84.1"]);
 var MINIMUM_NODE = [22, 19, 0];
 var SEMVER_PREFIX = /^(\d+)\.(\d+)\.(\d+)(?:$|[-+])/u;
 function atLeast(version, minimum) {
@@ -31,7 +31,7 @@ function atLeast(version, minimum) {
 }
 function compatibilityDirection(input) {
   if (!SUPPORTED_PI_VERSIONS.has(input.piVersion)) {
-    return "codeArbiter requires Pi 0.80.5 or 0.84.1; install a supported Pi version and run /ca-doctor.";
+    return "codeArbiter requires Pi 0.84.1; install a supported Pi version and run /ca-doctor.";
   }
   if (!atLeast(input.nodeVersion, MINIMUM_NODE)) {
     return "codeArbiter requires Node >=22.19.0 for Pi; upgrade Node and run /ca-doctor.";
@@ -6881,10 +6881,10 @@ async function collectPiDoctorInput(dependencies) {
 var REMEDIATION = {
   package: "Reinstall ca-pi from the approved pinned Git tag, then restart Pi.",
   trust: "Run /trust in Pi, inspect the project, grant trust only if you accept it, then start a new session.",
-  version: "Upgrade Pi to 0.80.5 or 0.84.1 and Node to >=22.19.0, then restart Pi.",
+  version: "Upgrade Pi to 0.84.1 and Node to >=22.19.0, then restart Pi.",
   python: "Upgrade or install Python 3, then run /ca-doctor again.",
   core: "Reinstall ca-pi to restore the generated shared core, then run /ca-doctor again.",
-  commands: "Remove conflicting command owners or run Pi 0.80.5/0.84.1, then restart Pi and run /ca-doctor.",
+  commands: "Remove conflicting command owners or run Pi 0.84.1, then restart Pi and run /ca-doctor.",
   bridge: "Reinstall ca-pi and Python 3, then run /ca-doctor again.",
   child: "Reinstall ca-pi if the hardened child artifact is missing or tampered, then run /ca-doctor again.",
   "ambient-marker": "Remove CODEARBITER_SUBAGENT from the parent environment and restart Pi.",
@@ -6913,7 +6913,7 @@ function diagnosePi(input) {
   const packageHealthy = input.package.declared && input.package.name === "@arbiterforge/ca-pi" && existsSync(input.package.root) && existsSync(input.package.extensionPath) && samePath2(input.package.extensionPath, expectedExtension) && canonicallyInside(input.package.extensionPath, input.package.root);
   const trustHealthy = input.trust.inspected && (!input.trust.required || input.trust.projectTrusted);
   const waitingForTrust = input.trust.required && !input.trust.projectTrusted;
-  const versionHealthy = ["0.80.5", "0.84.1"].includes(input.runtime.piVersion) && atLeast(input.runtime.nodeVersion, [22, 19, 0]);
+  const versionHealthy = input.runtime.piVersion === "0.84.1" && atLeast(input.runtime.nodeVersion, [22, 19, 0]);
   const piBelowMinimum = !atLeast(input.runtime.piVersion, [0, 80, 5]);
   const supportedExpansion = input.commands.expansionVerifiedVersions.includes(input.runtime.piVersion);
   const expectedDoctorSkill = resolve9(input.package.root, "skills", "ca-doctor", "SKILL.md");
@@ -7034,7 +7034,7 @@ function diagnosePi(input) {
     {
       id: "active-dispatch",
       state: "degraded",
-      message: "Supported Pi 0.80.5/0.84.1 public extension APIs cannot submit this deterministic self-test through the active dispatcher; the wrapper self-test does not exercise active dispatch.",
+      message: "Supported Pi 0.84.1 public extension APIs cannot submit this deterministic self-test through the active dispatcher; the wrapper self-test does not exercise active dispatch.",
       remediation: REMEDIATION["active-dispatch"]
     }
   ];
@@ -10588,7 +10588,7 @@ async function codeArbiterPi(pi) {
         activeTools: pi.getActiveTools(),
         allTools: pi.getAllTools(),
         expansionFingerprints,
-        childFingerprint: "c9573777b4c59abfb4adbe6879fc03de7f7962327d97c378c2fb71d300a4e22f"
+        childFingerprint: "22e5231b36a0af4a4202ced48a20e7dc9de435b6c6af985c6007bff96c5e04d1"
       });
       const wrapperSelfTest = await runPiWrapperSelfTest({
         enabled: enabledForDoctor,

package/plugins/ca-pi/hooks/_appendonlyconflictlib.py

@@ -0,0 +1,461 @@
+#!/usr/bin/env python3
+# codeArbiter - fail-closed resolution of genuine H-05 append-only conflicts.
+#
+# The public entry point is resolve-append-only-conflict.py.  This module keeps
+# Git inspection, byte validation, deterministic union construction, atomic
+# replacement, and explicit staging testable and host-neutral.
+#
+# Public API:
+#   resolve(target, reason, cwd=None) -> str  resolve and return repo-relative path
+#   main(argv=None) -> int                    CLI contract
+
+from __future__ import annotations
+
+import argparse
+from datetime import datetime, timezone
+import os
+from pathlib import Path
+import stat
+import subprocess
+import sys
+import tempfile
+
+from _hooklib import acquire_lock, audit_lock_key, release_lock
+from _gitexec import git_executable
+from _protectedlib import classify_protected
+
+
+BOM = b"\xef\xbb\xbf"
+MAX_REASON = 500
+SUPPORTED_AUDIT_PATHS = frozenset(
+    {".codearbiter/overrides.log", ".codearbiter/gate-events.log"}
+)
+
+
+class ResolutionError(RuntimeError):
+    """A surfaced, non-mutating refusal of the conflict-resolution contract."""
+
+
+class ConcurrentAppendError(ResolutionError):
+    """A displaced original inode changed and was restored before refusal."""
+
+    def __init__(self, path, restored, observed=None):
+        super().__init__(f"concurrent append detected while replacing '{Path(path).name}'")
+        self.path = Path(path)
+        self.restored = restored
+        self.observed = observed
+
+
+def _git(cwd, *args, input_bytes=None, check=True):
+    try:
+        result = subprocess.run(
+            [git_executable(), *args],
+            cwd=cwd,
+            input=input_bytes,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            check=False,
+        )
+    except OSError as error:
+        raise ResolutionError(f"git unavailable: {error}") from error
+    if check and result.returncode != 0:
+        detail = result.stderr.decode("utf-8", errors="replace").strip()
+        raise ResolutionError(f"git {' '.join(args)} failed: {detail or 'unknown error'}")
+    return result
+
+
+def _repository_root(cwd):
+    result = _git(cwd, "rev-parse", "--show-toplevel")
+    try:
+        raw = result.stdout.decode("utf-8", errors="strict").strip()
+    except UnicodeDecodeError as error:
+        raise ResolutionError("git returned an invalid UTF-8 repository root") from error
+    if not raw:
+        raise ResolutionError("git returned an empty repository root")
+    return Path(raw).resolve()
+
+
+def _relative_target(root, target):
+    candidate = Path(target)
+    if candidate.is_absolute():
+        raise ResolutionError("target must be a repository-relative supported append-only path")
+    normalized = Path(os.path.normpath(str(candidate)))
+    if normalized == Path(".") or ".." in normalized.parts:
+        raise ResolutionError("target must be a contained supported append-only path")
+    path = root / normalized
+    try:
+        resolved_root = os.path.realpath(root)
+        resolved_path = os.path.realpath(path)
+        common = os.path.commonpath((resolved_root, resolved_path))
+    except ValueError as error:
+        raise ResolutionError("target escapes the repository root") from error
+    if os.path.normcase(common) != os.path.normcase(resolved_root):
+        raise ResolutionError("target escapes the repository root")
+    relative = normalized.as_posix()
+    if relative not in SUPPORTED_AUDIT_PATHS or "audit" not in classify_protected(
+        str(path), str(root)
+    ):
+        raise ResolutionError(f"'{relative}' is not a supported append-only H-05 path")
+    try:
+        mode = path.lstat().st_mode
+    except OSError as error:
+        raise ResolutionError(f"cannot inspect '{relative}': {error}") from error
+    if not stat.S_ISREG(mode) or path.is_symlink():
+        raise ResolutionError(f"'{relative}' is not a regular non-link file")
+    return relative, path
+
+
+def _validate_bytes(label, raw):
+    if BOM in raw:
+        raise ResolutionError(f"{label} contains a UTF-8 BOM")
+    if b"\x00" in raw:
+        raise ResolutionError(f"{label} contains a NUL byte")
+    if b"\r" in raw:
+        raise ResolutionError(f"{label} is not canonical LF text")
+    try:
+        raw.decode("utf-8", errors="strict")
+    except UnicodeDecodeError as error:
+        raise ResolutionError(f"{label} is not valid UTF-8") from error
+    if raw and not raw.endswith(b"\n"):
+        raise ResolutionError(f"{label} does not end with LF")
+
+
+def _marker_run(line, marker):
+    if not line.endswith(b"\n"):
+        return 0
+    body = line[:-1]
+    size = 0
+    while size < len(body) and body[size : size + 1] == marker:
+        size += 1
+    if size < 7 or (len(body) > size and body[size : size + 1] != b" "):
+        return 0
+    return size
+
+
+def _validate_conflicted_worktree(raw, base, ours_suffix, theirs_suffix):
+    """Prove the worktree is only Git's rendering of the three index stages."""
+    # Git for Windows may render conflict markers and checked-out blob lines as
+    # CRLF even though every index blob is canonical LF. Normalize only complete
+    # CRLF pairs for comparison; lone CR remains invalid and the original bytes
+    # stay untouched for rollback.
+    normalized = raw.replace(b"\r\n", b"\n")
+    _validate_bytes("conflicted worktree", normalized)
+    if not normalized.startswith(base):
+        raise ResolutionError("conflicted worktree does not preserve the merge-base prefix")
+    lines = normalized[len(base) :].splitlines(keepends=True)
+    starts = [(index, _marker_run(line, b"<")) for index, line in enumerate(lines)]
+    starts = [(index, size) for index, size in starts if size]
+    if len(starts) != 1:
+        raise ResolutionError("conflicted worktree is not one recognized Git conflict rendering")
+    start, marker_size = starts[0]
+    separator_line = (b"=" * marker_size) + b"\n"
+    separators = [index for index, line in enumerate(lines) if line == separator_line]
+    ends = [
+        index
+        for index, line in enumerate(lines)
+        if _marker_run(line, b">") == marker_size
+    ]
+    base_markers = [
+        index
+        for index, line in enumerate(lines)
+        if _marker_run(line, b"|") == marker_size
+    ]
+    if len(separators) != 1 or len(ends) != 1 or len(base_markers) > 1:
+        raise ResolutionError("conflicted worktree has ambiguous Git conflict markers")
+    separator = separators[0]
+    end = ends[0]
+    base_marker = base_markers[0] if base_markers else None
+    ours_end = base_marker if base_marker is not None else separator
+    if not (start < ours_end <= separator < end):
+        raise ResolutionError("conflicted worktree has out-of-order Git conflict markers")
+    if base_marker is not None and b"".join(lines[base_marker + 1 : separator]):
+        raise ResolutionError("conflicted worktree has unexpected merge-base conflict bytes")
+
+    common_prefix = b"".join(lines[:start])
+    ours_body = b"".join(lines[start + 1 : ours_end])
+    theirs_body = b"".join(lines[separator + 1 : end])
+    common_suffix = b"".join(lines[end + 1 :])
+    if ours_suffix != common_prefix + ours_body + common_suffix:
+        raise ResolutionError("conflicted worktree differs from the current-branch index stage")
+    if theirs_suffix != common_prefix + theirs_body + common_suffix:
+        raise ResolutionError("conflicted worktree differs from the incoming-branch index stage")
+
+
+def _unmerged(root, relative, *, allow_resolved=False):
+    result = _git(root, "ls-files", "-u", "-z", "--", relative)
+    records = []
+    for item in result.stdout.split(b"\0"):
+        if not item:
+            continue
+        try:
+            metadata, encoded_path = item.split(b"\t", 1)
+            mode, oid, stage = metadata.decode("ascii").split(" ")
+            path = encoded_path.decode("utf-8", errors="strict")
+            records.append((mode, oid, int(stage), path))
+        except (ValueError, UnicodeDecodeError) as error:
+            raise ResolutionError("malformed unmerged index record") from error
+    if allow_resolved and not records:
+        return []
+    if len(records) != 3 or [record[2] for record in records] != [1, 2, 3]:
+        raise ResolutionError("target is not in a complete three-stage conflict")
+    if any(record[3] != relative for record in records):
+        raise ResolutionError("unmerged index path does not match the requested target")
+    if any(record[0] != "100644" for record in records):
+        raise ResolutionError("append-only conflict stages must all be regular 100644 blobs")
+    return records
+
+
+def _tracked_index(root, relative):
+    result = _git(root, "ls-files", "--stage", "-z", "--", relative)
+    records = []
+    for item in result.stdout.split(b"\0"):
+        if not item:
+            continue
+        try:
+            metadata, encoded_path = item.split(b"\t", 1)
+            mode, oid, stage = metadata.decode("ascii").split(" ")
+            path = encoded_path.decode("utf-8", errors="strict")
+            records.append((mode, oid, int(stage), path))
+        except (ValueError, UnicodeDecodeError) as error:
+            raise ResolutionError("malformed tracked index record") from error
+    return records
+
+
+def _blob(root, oid, label):
+    result = _git(root, "cat-file", "blob", oid)
+    raw = result.stdout
+    _validate_bytes(label, raw)
+    return raw
+
+
+def _authorization(root, reason):
+    reason = reason.strip()
+    if not reason:
+        raise ResolutionError("--reason must contain a non-empty reason")
+    if len(reason) > MAX_REASON or "|" in reason or "\n" in reason or "\r" in reason:
+        raise ResolutionError("--reason must be at most 500 characters with no pipes or newlines")
+    result = _git(root, "config", "--get", "user.email", check=False)
+    if result.returncode != 0:
+        raise ResolutionError("git config user.email is required for the attributed override")
+    try:
+        identity = result.stdout.decode("utf-8", errors="strict").strip()
+    except UnicodeDecodeError as error:
+        raise ResolutionError("git config user.email is not valid UTF-8") from error
+    if not identity or len(identity) > 254 or "|" in identity or "\n" in identity or "\r" in identity:
+        raise ResolutionError("git config user.email is not a valid override identity")
+    timestamp = datetime.now(timezone.utc).isoformat(timespec="seconds").replace("+00:00", "Z")
+    return f"[{timestamp}] | BY: {identity} | GATE: H-05 | REASON: {reason}\n".encode("utf-8")
+
+
+def _append_parts(root, records):
+    base = _blob(root, records[0][1], "merge base")
+    ours = _blob(root, records[1][1], "current branch")
+    theirs = _blob(root, records[2][1], "incoming branch")
+    if not ours.startswith(base):
+        raise ResolutionError("current branch is not append-only relative to the merge base")
+    if not theirs.startswith(base):
+        raise ResolutionError("incoming branch is not append-only relative to the merge base")
+    ours_suffix = ours[len(base) :]
+    theirs_suffix = theirs[len(base) :]
+    if not ours_suffix or not theirs_suffix:
+        raise ResolutionError("both conflict sides must append non-empty history")
+    return base, ours_suffix, theirs_suffix
+
+
+def _build_union(root, records):
+    base, ours_suffix, theirs_suffix = _append_parts(root, records)
+    merged = base + ours_suffix + theirs_suffix
+    _validate_bytes("resolved output", merged)
+    return merged
+
+
+def _sync_parent(path):
+    if os.name == "nt":
+        return False
+    flags = os.O_RDONLY
+    if hasattr(os, "O_DIRECTORY"):
+        flags |= os.O_DIRECTORY
+    parent_fd = os.open(path.parent, flags)
+    try:
+        os.fsync(parent_fd)
+    finally:
+        os.close(parent_fd)
+    return True
+
+
+def _write_bytes_atomic(path, raw, *, expected=None):
+    original_mode = stat.S_IMODE(path.stat().st_mode)
+    fd, temporary = tempfile.mkstemp(dir=path.parent, prefix=path.name + ".", suffix=".tmp")
+    witness = None
+    try:
+        with os.fdopen(fd, "wb") as handle:
+            handle.write(raw)
+            handle.flush()
+            os.fsync(handle.fileno())
+        os.chmod(temporary, original_mode)
+        if expected is not None:
+            witness_fd, witness = tempfile.mkstemp(
+                dir=path.parent, prefix=path.name + ".", suffix=".witness"
+            )
+            os.close(witness_fd)
+            os.remove(witness)
+            os.link(path, witness)
+            observed = Path(witness).read_bytes()
+            if observed != expected:
+                raise ConcurrentAppendError(path, restored=True, observed=observed)
+        os.replace(temporary, path)
+        temporary = None
+        _sync_parent(path)
+        if witness is not None:
+            displaced = Path(witness).read_bytes()
+            if displaced != expected:
+                restored = False
+                try:
+                    os.replace(witness, path)
+                    witness = None
+                    _sync_parent(path)
+                    restored = True
+                finally:
+                    raise ConcurrentAppendError(path, restored=restored, observed=displaced)
+            os.remove(witness)
+            witness = None
+    except Exception:
+        if temporary is not None:
+            try:
+                os.remove(temporary)
+            except OSError:
+                pass
+        if witness is not None:
+            try:
+                os.remove(witness)
+            except OSError:
+                pass
+        raise
+
+
+def _restore_index(root, relative, records):
+    removed = _git(root, "update-index", "--force-remove", "--", relative, check=False)
+    if removed.returncode != 0:
+        detail = removed.stderr.decode("utf-8", errors="replace").strip()
+        raise ResolutionError(f"could not clear staged resolution during rollback: {detail}")
+    index_info = b"".join(
+        f"{mode} {oid} {stage}\t{path}\n".encode("utf-8")
+        for mode, oid, stage, path in records
+    )
+    _git(root, "update-index", "--index-info", input_bytes=index_info)
+
+
+def resolve(target, reason, cwd=None):
+    root = _repository_root(cwd or os.getcwd())
+    relative, path = _relative_target(root, target)
+    records = _unmerged(root, relative)
+    authorization = _authorization(root, reason)
+    base, ours_suffix, theirs_suffix = _append_parts(root, records)
+    proposed = base + ours_suffix + theirs_suffix
+    _validate_bytes("resolved output", proposed)
+    changes = {relative: proposed}
+    paths = {relative: path}
+    originals = {relative: path.read_bytes()}
+    _validate_conflicted_worktree(originals[relative], base, ours_suffix, theirs_suffix)
+    index_records = {relative: records}
+    override_relative = ".codearbiter/overrides.log"
+    if relative == override_relative:
+        changes[relative] += authorization
+    else:
+        override_relative, override_path = _relative_target(root, override_relative)
+        if _unmerged(root, override_relative, allow_resolved=True):
+            raise ResolutionError("the override audit sink is itself unmerged")
+        for diff_args in (("diff", "--quiet"), ("diff", "--cached", "--quiet")):
+            clean = _git(root, *diff_args, "--", override_relative, check=False)
+            if clean.returncode != 0:
+                raise ResolutionError("the override audit sink must be clean before resolution")
+        override_raw = override_path.read_bytes()
+        _validate_bytes("override audit sink", override_raw)
+        changes[override_relative] = override_raw + authorization
+        paths[override_relative] = override_path
+        originals[override_relative] = override_raw
+        index_records[override_relative] = _tracked_index(root, override_relative)
+    try:
+        common_raw = _git(root, "rev-parse", "--git-common-dir").stdout.decode(
+            "utf-8", errors="strict"
+        ).strip()
+    except UnicodeDecodeError as error:
+        raise ResolutionError("git returned an invalid UTF-8 common directory") from error
+    if not common_raw:
+        raise ResolutionError("git returned an empty common directory")
+    common = Path(common_raw)
+    if not common.is_absolute():
+        common = root / common
+    lock = acquire_lock(str(common.resolve() / "codearbiter-append-only-conflict"))
+    if lock is None:
+        raise ResolutionError("another append-only conflict resolution holds the repository lock")
+    path_locks = []
+    try:
+        for changed_relative in sorted(changes):
+            path_lock = acquire_lock(audit_lock_key(root, paths[changed_relative]))
+            if path_lock is None:
+                raise ResolutionError(
+                    f"another writer holds the audit path lock for '{changed_relative}'"
+                )
+            path_locks.append(path_lock)
+        if _unmerged(root, relative) != records or path.read_bytes() != originals[relative]:
+            raise ResolutionError("conflict state changed during validation; retry from fresh evidence")
+        try:
+            for changed_relative, raw in changes.items():
+                if paths[changed_relative].read_bytes() != originals[changed_relative]:
+                    raise ResolutionError("protected state changed during validation; retry")
+                _write_bytes_atomic(
+                    paths[changed_relative], raw, expected=originals[changed_relative]
+                )
+            staged = _git(root, "add", "--", *changes.keys(), check=False)
+            if staged.returncode != 0:
+                detail = staged.stderr.decode("utf-8", errors="replace").strip()
+                raise ResolutionError(f"git add failed: {detail or 'unknown error'}")
+            if _unmerged(root, relative, allow_resolved=True):
+                raise ResolutionError("git add did not clear the three-stage conflict")
+            for changed_relative, raw in changes.items():
+                index_blob = _git(root, "show", f":0:{changed_relative}").stdout
+                if index_blob != raw:
+                    raise ResolutionError(
+                        f"staged blob does not match validated output for {changed_relative}"
+                    )
+        except Exception as error:
+            # The replacement is atomic; if staging or verification fails, put
+            # the exact conflict-marker worktree bytes and three index stages
+            # back.  This also covers a successful `git add` followed by a
+            # failed staged-blob verification.
+            for changed_relative, raw in originals.items():
+                if isinstance(error, ConcurrentAppendError) and paths[changed_relative] == error.path:
+                    if error.restored:
+                        continue
+                    if error.observed is not None:
+                        raw = error.observed
+                _write_bytes_atomic(paths[changed_relative], raw)
+            for changed_relative, prior_records in index_records.items():
+                _restore_index(root, changed_relative, prior_records)
+            raise
+    finally:
+        for path_lock in reversed(path_locks):
+            release_lock(path_lock)
+        release_lock(lock)
+    return relative
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(
+        description="Resolve one genuine H-05 append-only Git conflict without weakening the guard."
+    )
+    parser.add_argument("target", help="repository-relative protected append-only path")
+    parser.add_argument("--reason", required=True, help="specific immediate H-05 override reason")
+    args = parser.parse_args(argv)
+    try:
+        relative = resolve(args.target, args.reason)
+    except (OSError, ResolutionError) as error:
+        print(f"append-only conflict resolution refused: {error}", file=sys.stderr)
+        return 1
+    print(f"resolved and staged append-only conflict: {relative}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/plugins/ca-pi/hooks/_hooklib.py

@@ -96,6 +96,7 @@
 #                                         non-blocking + bounded LOCK_WAIT retry spin,
 #                                         fail-soft None on contention/timeout/OSError
 #   release_lock(handle) -> None          release + close; None handle is a no-op
+#   audit_lock_key(root, path) -> str     trusted Git-owned key for an audit path
 #   block(tag, msg) -> None              BLOCK tool call: print to stderr and exit 2
 #   remind(tag, msg) -> None             non-blocking nudge to stderr
 #   warn(msg) -> None                    loud degradation breadcrumb to stderr
@@ -105,6 +106,7 @@
 
 import datetime
 import errno
+import hashlib
 import json
 import os
 import re
@@ -216,8 +218,10 @@ from _sensitivelib import (  # noqa: F401
 )
 
 
-# Serialize same-process Windows writers before taking the cross-process lock.
-_GATE_EVENTS_WINDOWS_LOCK = threading.Lock()
+# Serialize same-process writers before taking the bounded cross-process lock.
+# POSIX flock and Windows byte-range locks are process-scoped, so sibling
+# threads can otherwise burn the shared wait budget contending with each other.
+_GATE_EVENTS_PROCESS_LOCK = threading.Lock()
 _WINDOWS_LOCK_TIMEOUT_SECONDS = 5.0
 _WINDOWS_LOCK_RETRY_SECONDS = 0.01
 _WINDOWS_CRT_EDEADLK = 36
@@ -409,6 +413,63 @@ def release_lock(handle):
             pass
 
 
+def audit_lock_key(root, path):
+    """Return a deterministic audit lock key beneath Git-owned metadata.
+
+    Audit paths and their siblings are repository-controlled, so an adjacent
+    lock can be a checked-out symlink that redirects acquire_lock's seed byte
+    outside the checkout. Linked worktrees resolve to their common Git
+    directory and therefore share one trusted key per repository-relative path.
+    """
+    root = os.path.abspath(os.fspath(root))
+    path = os.path.abspath(os.fspath(path))
+    try:
+        if os.path.normcase(os.path.commonpath((root, path))) != os.path.normcase(root):
+            raise ValueError
+    except (OSError, ValueError) as error:
+        raise OSError("audit lock target is outside the repository root") from error
+
+    dotgit = os.path.join(root, ".git")
+    if os.path.isdir(dotgit):
+        common = dotgit
+    elif os.path.isfile(dotgit):
+        try:
+            with open(dotgit, encoding="utf-8") as handle:
+                pointer = handle.read(4097)
+        except OSError as error:
+            raise OSError("cannot read linked-worktree Git metadata") from error
+        if len(pointer) > 4096 or not pointer.startswith("gitdir:"):
+            raise OSError("linked-worktree Git metadata is malformed")
+        gitdir = pointer[7:].strip()
+        if not gitdir:
+            raise OSError("linked-worktree Git directory is empty")
+        if not os.path.isabs(gitdir):
+            gitdir = os.path.join(root, gitdir)
+        commondir_file = os.path.join(gitdir, "commondir")
+        if os.path.isfile(commondir_file):
+            try:
+                with open(commondir_file, encoding="utf-8") as handle:
+                    relative_common = handle.read(4097).strip()
+            except OSError as error:
+                raise OSError("cannot read Git common-directory metadata") from error
+            if not relative_common or len(relative_common) > 4096:
+                raise OSError("Git common-directory metadata is malformed")
+            common = relative_common if os.path.isabs(relative_common) else os.path.join(
+                gitdir, relative_common
+            )
+        else:
+            common = gitdir
+    else:
+        raise OSError("repository Git metadata is unavailable for audit locking")
+
+    common = os.path.realpath(common)
+    if not os.path.isdir(common):
+        raise OSError("Git common directory is unavailable for audit locking")
+    relative = os.path.relpath(path, root).replace("\\", "/")
+    digest = hashlib.sha256(relative.encode("utf-8")).hexdigest()
+    return os.path.join(common, "codearbiter-audit-locks", digest)
+
+
 # The H-11 authoring-marker freshness window (issue #567) — the single
 # declaration every `marker_fresh(marker, minutes)` call site resolves by
 # import. Previously five independent `30` literals (pre-write.py,
@@ -469,17 +530,27 @@ def _log_gate_event(kind, tag, msg):
             host = "unknown"
         tag_part = f"[{tag}] " if tag else ""
         line = f"[{ts}] {kind} {tag_part}host={host} hook={hook} | {msg}\n"
+        log_path = os.path.join(cad, "gate-events.log")
         flags = os.O_APPEND | os.O_CREAT | os.O_WRONLY
         if hasattr(os, "O_BINARY"):
             flags |= os.O_BINARY
         process_lock_acquired = False
-        if os.name == "nt":
-            _GATE_EVENTS_WINDOWS_LOCK.acquire()
+        try:
+            _GATE_EVENTS_PROCESS_LOCK.acquire()
             process_lock_acquired = True
+            audit_lock = acquire_lock(audit_lock_key(root, log_path))
+        except Exception:
+            if process_lock_acquired:
+                _GATE_EVENTS_PROCESS_LOCK.release()
+            raise
+        if audit_lock is None:
+            if process_lock_acquired:
+                _GATE_EVENTS_PROCESS_LOCK.release()
+            return
         fd = None
         os_lock_acquired = False
         try:
-            fd = os.open(os.path.join(cad, "gate-events.log"), flags, 0o600)
+            fd = os.open(log_path, flags, 0o600)
             if os.name == "nt":
                 import msvcrt
                 os.lseek(fd, 0, os.SEEK_SET)
@@ -504,10 +575,15 @@ def _log_gate_event(kind, tag, msg):
                     msvcrt.locking(fd, msvcrt.LK_UNLCK, 1)
                 except Exception:  # noqa: BLE001 — outer sink remains fail-open
                     pass
-            if process_lock_acquired:
-                _GATE_EVENTS_WINDOWS_LOCK.release()
-            if fd is not None:
-                os.close(fd)
+            try:
+                if fd is not None:
+                    os.close(fd)
+            finally:
+                try:
+                    release_lock(audit_lock)
+                finally:
+                    if process_lock_acquired:
+                        _GATE_EVENTS_PROCESS_LOCK.release()
     except Exception:  # noqa: BLE001 — fail-open: the sink must never affect the gate
         pass
 

package/plugins/ca-pi/hooks/_host.py

@@ -11,7 +11,7 @@ import hostapi  # noqa: E402
 class PiHost(hostapi.Host):
     name = "pi"
     adapter_name = "@arbiterforge/ca-pi"
-    adapter_version = "0.10.10"
+    adapter_version = "0.10.12"
     update_target = "ca-pi"
     update_tag_prefix = "ca-pi-v"
     update_command = "pi update npm:@arbiterforge/ca-pi"

package/plugins/ca-pi/hooks/_modelib.py

@@ -25,7 +25,7 @@ import os
 import re
 
 from _activationlib import marker_root
-from _hooklib import write_text_atomic
+from _hooklib import acquire_lock, audit_lock_key, release_lock, write_text_atomic
 
 
 # ---------------------------------------------------------------------------
@@ -645,12 +645,21 @@ def _overrides_has_line(root, line):
 
 def _append_override_line(root, line):
     """Append one audit line to overrides.log. True on a confirmed write."""
+    lock = None
     try:
-        with open(_overrides_log_path(root), "a", encoding="utf-8") as f:
+        path = _overrides_log_path(root)
+        lock = acquire_lock(audit_lock_key(root, path))
+        if lock is None:
+            return False
+        with open(path, "a", encoding="utf-8") as f:
             f.write(line)
+            f.flush()
+            os.fsync(f.fileno())
         return True
-    except OSError:
+    except Exception:  # noqa: BLE001 — mode audit settlement remains fail-soft
         return False
+    finally:
+        release_lock(lock)
 
 
 def _dev_dropped_close_note(count, host_name=None):

package/plugins/ca-pi/hooks/_overrideappendlib.py

@@ -0,0 +1,154 @@
+#!/usr/bin/env python3
+"""Fail-closed, cooperatively locked append for mandatory override records."""
+
+from __future__ import annotations
+
+import argparse
+from datetime import datetime, timezone
+import os
+from pathlib import Path
+import re
+import stat
+import subprocess
+import sys
+
+from _gitexec import git_executable
+from _hooklib import acquire_lock, audit_lock_key, release_lock
+
+
+MAX_FIELD = 500
+GATE_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$")
+
+
+class OverrideAppendError(RuntimeError):
+    """The mandatory audit row could not be safely and durably appended."""
+
+
+def _git(cwd, *args):
+    try:
+        result = subprocess.run(
+            [git_executable(), *args], cwd=cwd, stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE, check=False,
+        )
+    except OSError as error:
+        raise OverrideAppendError(f"git unavailable: {error}") from error
+    if result.returncode != 0:
+        detail = result.stderr.decode("utf-8", errors="replace").strip()
+        raise OverrideAppendError(f"git {' '.join(args)} failed: {detail or 'unknown error'}")
+    return result.stdout
+
+
+def _root(cwd):
+    try:
+        raw = _git(cwd, "rev-parse", "--show-toplevel").decode("utf-8", errors="strict").strip()
+    except UnicodeDecodeError as error:
+        raise OverrideAppendError("git returned an invalid UTF-8 repository root") from error
+    if not raw:
+        raise OverrideAppendError("git returned an empty repository root")
+    return Path(raw).resolve()
+
+
+def _field(label, value):
+    if not value or len(value) > MAX_FIELD or any(char in value for char in "|\r\n"):
+        raise OverrideAppendError(
+            f"{label} must be non-empty, at most {MAX_FIELD} characters, and contain no pipe or newline"
+        )
+    return value
+
+
+def _identity(root):
+    try:
+        value = _git(root, "config", "user.email").decode("utf-8", errors="strict").strip()
+    except UnicodeDecodeError as error:
+        raise OverrideAppendError("git config user.email is not valid UTF-8") from error
+    _field("git config user.email", value)
+    if len(value) > 254 or any(char.isspace() for char in value):
+        raise OverrideAppendError("git config user.email is not a valid override identity")
+    return value
+
+
+def _validate_file_type(path):
+    try:
+        mode = path.lstat().st_mode
+    except OSError as error:
+        raise OverrideAppendError(f"cannot inspect overrides.log: {error}") from error
+    if not stat.S_ISREG(mode) or path.is_symlink():
+        raise OverrideAppendError("overrides.log is not a regular non-link file")
+
+
+def _validate_existing(path, raw):
+    _validate_file_type(path)
+    if raw.startswith(b"\xef\xbb\xbf") or b"\x00" in raw or b"\r" in raw:
+        raise OverrideAppendError("overrides.log is not canonical UTF-8 LF text")
+    try:
+        raw.decode("utf-8", errors="strict")
+    except UnicodeDecodeError as error:
+        raise OverrideAppendError("overrides.log is not valid UTF-8") from error
+    if raw and not raw.endswith(b"\n"):
+        raise OverrideAppendError("overrides.log does not end with LF")
+
+
+def append_override(*, gate=None, security_finding=None, reason, cwd=None):
+    root = _root(cwd or os.getcwd())
+    path = root / ".codearbiter" / "overrides.log"
+    _validate_file_type(path)
+    before = path.read_bytes()
+    _validate_existing(path, before)
+    identity = _identity(root)
+    reason = _field("reason", reason)
+    timestamp = datetime.now(timezone.utc).isoformat(timespec="seconds").replace("+00:00", "Z")
+    if gate is not None:
+        if not GATE_RE.fullmatch(gate):
+            raise OverrideAppendError("gate must be a compact gate identifier")
+        body = f"GATE: {gate}"
+    else:
+        body = f"SECURITY-OVERRIDE | FINDING: {_field('security finding', security_finding)}"
+    line = f"[{timestamp}] | BY: {identity} | {body} | REASON: {reason}\n".encode("utf-8")
+
+    lock = acquire_lock(audit_lock_key(root, path))
+    if lock is None:
+        raise OverrideAppendError("another writer holds the overrides.log audit path lock")
+    fd = None
+    try:
+        if path.read_bytes() != before:
+            raise OverrideAppendError("overrides.log changed during validation; retry")
+        flags = os.O_APPEND | os.O_WRONLY
+        if hasattr(os, "O_BINARY"):
+            flags |= os.O_BINARY
+        fd = os.open(path, flags)
+        offset = 0
+        while offset < len(line):
+            written = os.write(fd, line[offset:])
+            if written <= 0:
+                raise OverrideAppendError("override audit append made no progress")
+            offset += written
+        os.fsync(fd)
+    except OSError as error:
+        raise OverrideAppendError(f"override audit append failed: {error}") from error
+    finally:
+        try:
+            if fd is not None:
+                os.close(fd)
+        finally:
+            release_lock(lock)
+    return path
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description="Append one mandatory override audit row safely.")
+    kind = parser.add_mutually_exclusive_group(required=True)
+    kind.add_argument("--gate", help="gate identifier for an ordinary override")
+    kind.add_argument("--security-finding", help="specific acknowledged security finding")
+    parser.add_argument("--reason", required=True, help="specific justification")
+    args = parser.parse_args(argv)
+    try:
+        path = append_override(
+            gate=args.gate,
+            security_finding=args.security_finding,
+            reason=args.reason,
+        )
+    except (OSError, OverrideAppendError) as error:
+        print(f"override audit append refused: {error}", file=sys.stderr)
+        return 1
+    print(f"appended mandatory override audit row: {path}")
+    return 0

package/plugins/ca-pi/hooks/append-override.py

@@ -0,0 +1,8 @@
+#!/usr/bin/env python3
+"""CLI entry point for the locked mandatory override audit append."""
+
+from _overrideappendlib import main
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/plugins/ca-pi/hooks/hostapi.py

@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "2.17.9"
+    adapter_version = "2.17.10"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,

package/plugins/ca-pi/hooks/resolve-append-only-conflict.py

@@ -0,0 +1,8 @@
+#!/usr/bin/env python3
+# codeArbiter - sanctioned helper entry point for H-05 append-only conflicts.
+
+from _appendonlyconflictlib import main
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/plugins/ca-pi/includes/pi-host-notes.md

@@ -74,7 +74,7 @@ file maps those actions to Pi's extension API.
   operator-launched Pi CLI, imported module, package root, and reported version.
   It does not prove publisher authenticity. Verify the source separately with
   `pi list` and `pi config`.
-- Supported promotion targets are Pi 0.80.5 and Pi 0.84.1. The package is
+- The supported promotion target is exact Pi 0.84.1. The package is
   published as `npm:@arbiterforge/ca-pi` on every `ca-pi-v*` tag (ADR-0029);
   the pinned Git tag remains the reproducible install. A Pi-native embedded
   farm worker is a future spike, not an installed dependency.

package/plugins/ca-pi/skills/ca-doctor/SKILL.md

@@ -21,7 +21,7 @@ remediation.
    Pi bash wrapper. The exact shared-core `[H-03]` block is healthy and cannot stage files; execution
    or a different block is unhealthy. This self-test does not traverse Pi's active dispatcher. Do not
    rerun or respell it.
-4. Its `active-dispatch` row remains degraded because supported Pi 0.80.5/0.84.1 public extension
+4. Its `active-dispatch` row remains degraded because supported Pi 0.84.1 public extension
    APIs cannot submit that deterministic call through the active dispatcher. PI-AC-28 remains blocked
    until supported-version real-host promotion/CI evidence closes the gap.
 

package/plugins/ca-pi/skills/ca-override/SKILL.md

@@ -15,14 +15,40 @@ logged, always visible, never silent. Single identity, single confirm.
    vague reason ("just skip it") and ask for a specific one.
 2. Detect the operator identity from `git config user.email` only. If it is unset, ask the user once
    to state their identity for the log. (No platform ladder, no second confirmation.)
-3. Append one line to `<project-root>/.codearbiter/overrides.log`:
+3. For an ordinary override, use the private locked audit helper from the repository root:
+
+   ```sh
+   python3 "<plugin-root>/hooks/append-override.py" --gate "<gate bypassed>" --reason "<specific reason>"
+   ```
+
+   It appends one line to `<project-root>/.codearbiter/overrides.log`:
 
    ```
    [ISO-8601 timestamp] | BY: <email> | GATE: <gate bypassed> | REASON: <reason>
    ```
 
-   The log is append-only — never edited or deleted, committed as a permanent audit artifact.
-4. Proceed with the overridden action. Note in the response that the override is logged.
+   The log is append-only — never edited or deleted, committed as a permanent audit artifact. The
+   helper fails closed if another official writer or conflict resolver owns the audit-path lock; the
+   overridden action must not proceed unless the row lands. A guard-permitted raw append remains a
+   cooperative operator escape hatch, but it must not run concurrently with conflict resolution.
+4. A genuine three-stage Git conflict on an H-05 append-only path uses the dedicated helper instead
+   of the ordinary step 3 append. Run it once from the conflicted repository, with the specific
+   repo-relative path and the same reason:
+
+   ```sh
+   python3 "<plugin-root>/hooks/resolve-append-only-conflict.py" ".codearbiter/overrides.log" --reason "<specific reason>"
+   ```
+
+   The helper derives the same `git config user.email` identity, validates the merge-base and both
+   append suffixes, writes the attributed H-05 record, and explicitly stages only the validated
+   deterministic union. It refuses a missing or malformed three-stage conflict, any edit to prior
+   bytes, unsupported paths, invalid encoding, dirty audit sink, or replay after resolution. This is
+   scoped to the immediate action only; it creates no marker, standing exception, or general H-05
+   bypass. It takes canonical per-audit-path locks and supports only `overrides.log` and the
+   repository-owned `gate-events.log` sink; official writers share those locks. Conflict resolution
+   is an exclusive cooperative operation: do not start a raw append before or during it. Never
+   hand-resolve the protected log with Write, patch, checkout, or restore.
+5. Proceed with the overridden action. Note in the response that the override is logged.
 
 ## Security ceiling — heavier path for security-critical stops
 
@@ -40,8 +66,14 @@ Heavier path (all required, in order):
 2. **Explicit per-finding acknowledgement** — the user must acknowledge *that specific finding* in
    their own words (a bare "yes"/"go ahead"/"I trust you" is declined — this mirrors `decision-variance`).
    Detect identity from `git config user.email`; if unset, ask once.
-3. **Heavier log entry** — append a line tagged `SECURITY-OVERRIDE` that records the specific finding,
-   not just the gate name:
+3. **Heavier log entry** — use the same locked helper so the mandatory row cannot race conflict
+   resolution:
+
+   ```sh
+   python3 "<plugin-root>/hooks/append-override.py" --security-finding "<specific finding>" --reason "<reason>"
+   ```
+
+   It appends a line tagged `SECURITY-OVERRIDE` that records the specific finding, not just the gate name:
 
    ```
    [ISO-8601] | BY: <email> | SECURITY-OVERRIDE | FINDING: <specific finding> | REASON: <reason>
@@ -62,7 +94,9 @@ Under `/ca-sprint`, a security-critical override is a hard-gate STOP: it surface
 MUST write the log line before proceeding — it is not optional. MUST capture an operator identity —
 "codeArbiter" or "automated" are not valid. MUST include a justification. The override is scoped to
 the immediate action only; it creates no standing exception. MUST NOT edit or delete an existing
-`overrides.log` entry. MUST route a security-critical / crypto-secret / irreversible stop through the
+`overrides.log` entry. For an H-05 three-stage conflict, the dedicated helper's validated union and
+audit write are the single immediate action; do not pre-edit the conflicted file. MUST route a
+security-critical / crypto-secret / irreversible stop through the
 **Security ceiling** path — never the single-confirm flow — and MUST NOT auto-decide such an override
 under `/ca-sprint`.