@arbiterforge/ca-pi 0.10.12 → 0.14.6

package/plugins/ca-pi/hooks/_standuplib.py

@@ -116,12 +116,17 @@ def _strip_trailing_sep(path):
 def parse_worktrees(porcelain_text, repo_root):
     """Parse `git worktree list --porcelain` output.
 
-    Returns a list of {"path": str, "branch": str|None, "is_main": bool}. Records
-    are separated by blank lines; each starts with a `worktree <path>` line and may
-    carry a `branch refs/heads/<name>` line (absent / `detached` => branch None).
-    The main worktree is the record whose path equals `repo_root` (trailing
-    separator tolerated). Parses faithfully; staleness/merge classification is a
-    later task's job.
+    Returns a list of {"path": str, "branch": str|None, "is_main": bool,
+    "head": str|None, "detached": bool, "locked": bool, "locked_reason": str|None}.
+    Records are separated by blank lines; each starts with a `worktree <path>`
+    line and may carry a `HEAD <oid>` line, a `branch refs/heads/<name>` line
+    (absent / `detached` => branch stays None), and a `locked` line (bare
+    `locked` or `locked <reason>`). The main worktree is the record whose path
+    equals `repo_root` (trailing separator tolerated). Parses faithfully;
+    merge-proof classification is a later task's job — this only surfaces what
+    Git itself reports, including the occupancy/protection state (locked,
+    detached, exact OID) that a caller needs to exclude a worktree honestly
+    rather than silently dropping it.
     """
     root = _strip_trailing_sep(repo_root or "")
     out = []
@@ -137,11 +142,25 @@ def parse_worktrees(porcelain_text, repo_root):
             if cur is not None:
                 out.append(cur)
             path = line[len("worktree "):].strip()
-            cur = {"path": path, "branch": None, "is_main": path == root}
-        elif line.startswith("branch ") and cur is not None:
+            cur = {"path": path, "branch": None, "is_main": path == root,
+                   "head": None, "detached": False, "locked": False,
+                   "locked_reason": None}
+            continue
+        if cur is None:
+            continue
+        if line.startswith("HEAD "):
+            cur["head"] = line[len("HEAD "):].strip() or None
+        elif line == "detached":
+            cur["detached"] = True
+        elif line.startswith("branch "):
             ref = line[len("branch "):].strip()
             cur["branch"] = ref[len("refs/heads/"):] if ref.startswith("refs/heads/") else ref
-        # HEAD / detached / bare / locked lines carry no fields we surface here.
+        elif line == "locked":
+            cur["locked"] = True
+        elif line.startswith("locked "):
+            cur["locked"] = True
+            cur["locked_reason"] = line[len("locked "):].strip() or None
+        # bare / other lines carry no fields we surface here.
     if cur is not None:
         out.append(cur)
     return out
@@ -175,12 +194,21 @@ def stale_worktree_candidates(worktrees, gone_or_merged_branches, path_exists=os
     tests (pass a fake predicate); production defaults to os.path.exists. This is a
     PURE classifier: it only IDENTIFIES candidates and removes/mutates nothing —
     the /ca:standup command removes a worktree only on explicit per-item user
-    confirmation, which is why the broad (gone OR missing) candidate rule is safe."""
+    confirmation, which is why the broad (gone OR missing) candidate rule is safe.
+
+    A LOCKED worktree (per `parse_worktrees`'s `locked` field) is NEVER a
+    candidate, regardless of its branch or path state — a lock is an explicit
+    Git-level protection signal (and `git worktree remove` itself refuses a
+    locked worktree), so surfacing one as a hygiene candidate would misrepresent
+    it as ordinary stale output rather than something the user deliberately
+    protected."""
     gone = gone_or_merged_branches or set()
     out = []
     for wt in worktrees or []:
         if wt.get("is_main"):
             continue
+        if wt.get("locked"):
+            continue
         branch = wt.get("branch")
         path = wt.get("path")
         is_stale = (branch in gone) or (not path_exists(path))

package/plugins/ca-pi/hooks/doctor.py

@@ -42,6 +42,14 @@ MCP_SCAN_MAX_DEPTH = 6
 results = []  # (level, line)
 
 
+class ArtifactDiagnosticError(RuntimeError):
+    """Bounded testable wrapper for an installation or engine diagnostic."""
+
+    def __init__(self, code):
+        self.code = str(code)[:80]
+        super().__init__(self.code)
+
+
 def ok(line):
     results.append(("OK", line))
 
@@ -170,6 +178,100 @@ def check_payload(root, host=None):
             pass
 
 
+def _artifact_client(plugin_root_path, repository_root):
+    """Construct the installation-pinned client without PATH or repo fallback."""
+    try:
+        from _artifactlib import ArtifactClient, helper_installation
+        return ArtifactClient(
+            repository_root or plugin_root_path,
+            helper_installation(__file__),
+        )
+    except Exception as error:  # noqa: BLE001 - doctor reports, never crashes
+        code = getattr(error, "code", "CAPABILITY_MISSING")
+        raise ArtifactDiagnosticError(code) from error
+
+
+def _artifact_contract():
+    """Read adapter-owned protocol constants without loading any schema."""
+    from _artifactlib import PROTOCOL, SCHEMA_VERSION
+    return PROTOCOL, SCHEMA_VERSION
+
+
+def _repository_has_html(root):
+    if not root:
+        return False
+    try:
+        for directory in ("specs", "plans"):
+            base = os.path.join(root, ".codearbiter", directory)
+            if os.path.isdir(base) and any(
+                name.endswith(".html") for name in os.listdir(base)
+            ):
+                return True
+    except OSError:
+        return True  # force the engine to produce the bounded path diagnostic
+    return False
+
+
+def check_artifact_capability(plugin_root_path, repository_root=None):
+    """Probe only capabilities, then validate existing HTML only when present.
+
+    This is an explicit doctor invocation, not startup loading. It never requests
+    the schema operation and never falls back to PATH, repository binaries, or
+    Markdown when an HTML authority exists.
+    """
+    try:
+        client = _artifact_client(plugin_root_path, repository_root)
+        capabilities = client.call("capabilities")
+        protocol, schema_version = _artifact_contract()
+    except Exception as error:  # noqa: BLE001 - bounded unhealthy result
+        code = str(getattr(error, "code", "CAPABILITY_MISSING"))[:80]
+        fail(
+            f"artifact capability unavailable ({code}) — repair or reinstall the "
+            "pinned artifact payload; new/existing HTML work is blocked, while "
+            "unrelated legacy Markdown remains usable"
+        )
+        return
+
+    required = {
+        "binary": "ca-artifact",
+        "protocol": protocol,
+        "schema_version": schema_version,
+    }
+    if (not isinstance(capabilities, dict)
+            or any(capabilities.get(key) != value for key, value in required.items())
+            or not isinstance(capabilities.get("platform"), str)):
+        fail(
+            "artifact capability unavailable (INVALID_RESPONSE) — repair or reinstall "
+            "the pinned artifact payload; new/existing HTML work is blocked, while "
+            "unrelated legacy Markdown remains usable"
+        )
+        return
+    if capabilities.get("repository_operations_available") is not True:
+        fail(
+            "artifact capability unavailable (UNSUPPORTED_PLATFORM) — repair or reinstall "
+            "a native-qualified pinned artifact payload; new/existing HTML work is blocked, "
+            "while unrelated legacy Markdown remains usable"
+        )
+        return
+    ok(
+        "artifact capability available: "
+        f"{capabilities['platform']}, schema {capabilities['schema_version']}"
+    )
+
+    if not _repository_has_html(repository_root):
+        return
+    try:
+        count = sum(1 for _ in client.index())
+    except Exception as error:  # noqa: BLE001 - bounded invalid-artifact result
+        code = str(getattr(error, "code", "INVALID_ARTIFACT"))[:80]
+        fail(
+            f"HTML artifact validation failed ({code}) — inspect the engine diagnostic "
+            "and run repair-preview before an explicit reviewed repair; HTML work is blocked"
+        )
+        return
+    ok(f"HTML artifact catalog validates: {count} artifact{'s' if count != 1 else ''}")
+
+
 def check_repo():
     """Returns the resolved repo root (for check_git_hook_freshness below), or
     None when this process isn't inside a git repository at all."""
@@ -423,6 +525,7 @@ def main():
     check_interpreters()
     check_payload(root, host)
     repo_root = check_repo()
+    check_artifact_capability(root, repo_root)
     check_git_hook_freshness(repo_root)
     check_mcp(host)
     if getattr(host, "has_statusline", True):

package/plugins/ca-pi/hooks/hostapi.py

@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "2.17.10"
+    adapter_version = "2.21.6"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,

package/plugins/ca-pi/hooks/pi-bridge.py

@@ -476,7 +476,11 @@ def _plan_file_response(result):
 
 def dispatch(request):
     if request["event"] == "plan_file":
-        result = _planfilelib.plan_file_operation(request["cwd"], _plan_file_request(request["input"]))
+        result = _planfilelib.plan_file_operation(
+            request["cwd"],
+            _plan_file_request(request["input"]),
+            require_legacy_pair=True,
+        )
         return {
             "version": 1,
             "outcome": "notice",

package/plugins/ca-pi/hooks/prompt-submit.py

@@ -64,6 +64,7 @@ import sys
 
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 import hostapi  # noqa: E402 — host seam (ADR-0011)
+import _approvallib  # noqa: E402 — host-owned artifact approval capture
 import _hooklib  # noqa: E402
 import _modelib  # noqa: E402 — mode plane core (T-06..T-16, Lane A)
 import _readinjectlib  # noqa: E402 — marker_path(prefix=) (T-30)
@@ -366,38 +367,47 @@ def _codex_allow_envelope(additional_context):
 # Injection (job 2), host-neutral core + per-host output
 # ---------------------------------------------------------------------------
 
-def _inject_claude(payload, host, root, session_id):
+def _inject_claude(payload, host, root, session_id, approval_context=""):
     mode, diag = _effective_mode(root, session_id, payload)
     if diag:
         sys.stderr.write("codeArbiter: " + diag + "\n")
     generation = _read_compaction_generation(root, session_id)
     if _already_injected(root, session_id, mode, generation):
+        if approval_context:
+            print(approval_context)
         return
     safety, body = _persona_for_mode(host.plugin_root(), mode)
     if _persona_unavailable(safety, body):
         sys.stderr.write("codeArbiter: persona sources incomplete for mode '{}' — "
                          "injecting nothing this turn rather than a body without its "
                          "safety floor.\n".format(mode))
+        if approval_context:
+            print(approval_context)
         return
     composed, _truncated = _compose_persona(safety, body)
-    print(composed)
+    print("\n\n".join(value for value in (approval_context, composed) if value))
     _record_injected(root, session_id, mode, generation)
 
 
-def _inject_codex(payload, host, root, session_id):
+def _inject_codex(payload, host, root, session_id, approval_context=""):
     mode, diag = _effective_mode(root, session_id, payload)
     generation = _read_compaction_generation(root, session_id)
     if _already_injected(root, session_id, mode, generation):
+        if approval_context:
+            print(json.dumps(_codex_allow_envelope(approval_context)))
         return
     safety, body = _persona_for_mode(host.plugin_root(), mode)
     if _persona_unavailable(safety, body):
         sys.stderr.write("codeArbiter: persona sources incomplete for mode '{}' — "
                          "injecting nothing this turn rather than a body without its "
                          "safety floor.\n".format(mode))
+        if approval_context:
+            print(json.dumps(_codex_allow_envelope(approval_context)))
         return
     composed, _truncated = _compose_persona(
         safety, body, limit_tokens=CODEX_ADDITIONAL_CONTEXT_LIMIT)
-    print(json.dumps(_codex_allow_envelope(composed)))
+    context = "\n\n".join(value for value in (approval_context, composed) if value)
+    print(json.dumps(_codex_allow_envelope(context)))
     _record_injected(root, session_id, mode, generation)
 
 
@@ -405,7 +415,7 @@ def _inject_codex(payload, host, root, session_id):
 # UserPromptSubmit dispatch (jobs 1 + 2)
 # ---------------------------------------------------------------------------
 
-def _handle_claude(payload, host, root, session_id, token):
+def _handle_claude(payload, host, root, session_id, token, approval_context=""):
     if token == _modelib.MODE_TOKEN_REPORT:
         mode, diag = _modelib.current_mode(session_id, root=root, payload=payload)
         sys.stderr.write(_report_stderr_line(mode, diag) + "\n")
@@ -415,11 +425,11 @@ def _handle_claude(payload, host, root, session_id, token):
                                 host_name=host.name)
         sys.stderr.write(_flip_stderr_line(token, result) + "\n")
         return 2
-    _inject_claude(payload, host, root, session_id)
+    _inject_claude(payload, host, root, session_id, approval_context)
     return 0
 
 
-def _handle_codex(payload, host, root, session_id, token):
+def _handle_codex(payload, host, root, session_id, token, approval_context=""):
     if token == _modelib.MODE_TOKEN_REPORT:
         mode, diag = _modelib.current_mode(session_id, root=root, payload=payload)
         msg = _report_stderr_line(mode, diag)
@@ -431,7 +441,7 @@ def _handle_codex(payload, host, root, session_id, token):
         msg = _flip_stderr_line(token, result)
         print(json.dumps(_codex_block_envelope(msg, msg)))
         return 0
-    _inject_codex(payload, host, root, session_id)
+    _inject_codex(payload, host, root, session_id, approval_context)
     return 0
 
 
@@ -444,9 +454,22 @@ def _handle_user_prompt_submit(payload, host):
     prompt = payload.get("prompt")
     prompt = prompt if isinstance(prompt, str) else ""
     token = _modelib.match_mode_token(prompt)
+    approval_context = ""
+    if token is None:
+        approval_context = _approvallib.consume_from_hook(
+            root=root,
+            plugin_root=host.plugin_root(),
+            prompt=prompt,
+            host=host.name,
+            session_id=session_id,
+        )
     if host.name == "codex":
-        return _handle_codex(payload, host, state_root, session_id, token)
-    return _handle_claude(payload, host, state_root, session_id, token)
+        return _handle_codex(
+            payload, host, state_root, session_id, token, approval_context
+        )
+    return _handle_claude(
+        payload, host, state_root, session_id, token, approval_context
+    )
 
 
 def _handle_precompact(payload, host):

package/plugins/ca-pi/hooks/releasehash.py

@@ -1,15 +1,17 @@
 #!/usr/bin/env python3
-# codeArbiter — pre-tag content-hash confirmation (A-2.10).
+# codeArbiter — executable release-command confirmation (A-2.10).
 #
-# A row's `pre-tag` commands are operator-authored shell that `/ca:release`
-# EXECUTES before composing a tag. `.codearbiter/release-targets.md` is
+# A row's `pre-tag` commands and optional `release-build` are operator-authored
+# shell that `/ca:release` EXECUTES before composing a tag.
+# `.codearbiter/release-targets.md` is
 # marker-gated under H-22, so changing those commands already costs a fresh
 # authoring marker — but that gate is about WRITING the file. Nothing made the
 # release lane notice that the commands it is about to run are not the ones
 # anybody last looked at.
 #
-# This closes that: the lane records a hash of a row's pre-tag content when an
-# operator confirms it, and refuses to run silently once that hash changes. A
+# This closes that: the lane records a hash of a row's executable release
+# commands when an operator confirms them, and refuses to run silently once
+# that hash changes. A
 # changed hash is not a block — it is a re-confirmation prompt. Per ADR-0010
 # this is COOPERATIVE-grade: an agent that skips the check is not stopped by
 # the operating system, only by the lane's own discipline. Stated plainly here
@@ -29,15 +31,15 @@
 # file.
 #
 # Public API:
-#   pre_tag_digest(commands) -> str
+#   pre_tag_digest(commands, release_build=None) -> str
 #   confirmation_path(root, target) -> str
 #   read_confirmation(root, target) -> str | None
 #   record_confirmation(root, target, digest) -> str
-#   confirmation_state(root, target, commands) -> str
+#   confirmation_state(root, target, commands, release_build=None) -> str
 #   main(argv) -> int
 #
 # CLI:
-#   releasehash.py digest <target>    print the current pre-tag digest
+#   releasehash.py digest <target>    print the executable-command digest
 #   releasehash.py check <target>     exit 0 confirmed, 1 changed, 2 never
 #                                     confirmed, 3/4 declared-file states
 #   releasehash.py record <target>    mint the confirmation (the sanctioned
@@ -63,8 +65,8 @@ NEVER = "never-confirmed"
 NO_COMMANDS = "no-commands"
 
 
-def pre_tag_digest(commands):
-    """A stable digest of a row's `pre-tag` command list.
+def pre_tag_digest(commands, release_build=None):
+    """A stable digest of a row's executable release command inputs.
 
     ORDER-SENSITIVE on purpose. The commands run in declared order and a
     reordering can change what a release checks — a check that ran after a
@@ -76,9 +78,13 @@ def pre_tag_digest(commands):
     change to this construction cannot be mistaken for a content change
     by an old recorded value.
 
-    Pure and non-raising: a non-list, or a list with non-string members,
-    degrades to the digest of an empty list rather than raising inside a
-    release lane.
+    Rows without `release-build` deliberately retain the exact v1 digest and
+    marker identity, so existing confirmations do not churn. A present build
+    command is appended with a typed, length-prefixed record, so changing only
+    that command invalidates the same per-target confirmation marker.
+
+    Pure and non-raising: malformed values degrade conservatively to their
+    absent forms rather than raising inside a release lane.
     """
     if not isinstance(commands, (list, tuple)):
         commands = []
@@ -87,6 +93,8 @@ def pre_tag_digest(commands):
         if not isinstance(command, str):
             continue
         parts.append(f"{len(command)}:{command}")
+    if isinstance(release_build, str) and release_build:
+        parts.append(f"release-build:{len(release_build)}:{release_build}")
     joined = "\n".join(parts)
     return hashlib.sha256(joined.encode("utf-8")).hexdigest()
 
@@ -141,30 +149,32 @@ def record_confirmation(root, target, digest):
     return path
 
 
-def confirmation_state(root, target, commands):
+def confirmation_state(root, target, commands, release_build=None):
     """One of `confirmed` / `changed` / `never-confirmed` / `no-commands`.
 
     `no-commands` is deliberately distinct from `confirmed`: a row that
-    declares no pre-tag commands has nothing to confirm, and reporting it
-    as confirmed would claim an operator approved something that does not
-    exist. The lane treats both as "proceed", but only one of them is a
-    statement about human review.
+    declares neither pre-tag commands nor release-build has nothing to
+    confirm, and reporting it as confirmed would claim an operator approved
+    something that does not exist. A release-build-only row still requires
+    confirmation. The lane treats `no-commands` and `confirmed` as
+    "proceed", but only one of them is a statement about human review.
     """
-    if not commands:
+    if not commands and not release_build:
         return NO_COMMANDS
     recorded = read_confirmation(root, target)
     if recorded is None:
         return NEVER
-    return CONFIRMED if recorded == pre_tag_digest(commands) else CHANGED
+    return (CONFIRMED if recorded == pre_tag_digest(commands, release_build)
+            else CHANGED)
 
 
-def _row_commands(target, targets_path=None):
+def _row_executable_inputs(target, targets_path=None):
     path = targets_path or _releaselib.default_targets_path()
     rows = _releaselib.load_targets(path)
     row = next((r for r in rows if r["target"] == target), None)
     if row is None:
         return None
-    return row.get("pre_tag") or []
+    return row.get("pre_tag") or [], row.get("release_build")
 
 
 def main(argv=None):
@@ -177,38 +187,42 @@ def main(argv=None):
     root = os.path.dirname(os.path.dirname(_releaselib.default_targets_path()))
 
     try:
-        commands = _row_commands(target)
+        executable_inputs = _row_executable_inputs(target)
     except _releaselib.ReleaseTargetsError as error:
         sys.stderr.write(f"{type(error).__name__}: {error}\n")
         return _releaselib._targets_error_exit_code(error)
-    if commands is None:
+    if executable_inputs is None:
         sys.stderr.write(f"unknown release target: {target}\n")
         return 2
+    commands, release_build = executable_inputs
 
     if command == "digest":
-        print(pre_tag_digest(commands))
+        print(pre_tag_digest(commands, release_build))
         return 0
 
     if command == "record":
-        path = record_confirmation(root, target, pre_tag_digest(commands))
-        print(f"recorded pre-tag confirmation for {target}: {path}")
+        path = record_confirmation(
+            root, target, pre_tag_digest(commands, release_build))
+        print(f"recorded executable-command confirmation for {target}: {path}")
         return 0
 
-    state = confirmation_state(root, target, commands)
+    state = confirmation_state(root, target, commands, release_build)
     print(state)
     if state in (CONFIRMED, NO_COMMANDS):
         return 0
     if state == CHANGED:
         sys.stderr.write(
-            f"releasehash: {target}'s pre-tag commands have CHANGED since they "
-            "were last confirmed. Read them, and re-confirm with "
+            f"releasehash: {target}'s executable release commands have CHANGED "
+            "since they were last confirmed. Read every pre-tag and release-build "
+            "command, and re-confirm with "
             f"`releasehash.py record {target}` before releasing. These commands "
             "are executed by the release lane, so a change nobody has read is "
             "the case this check exists for.\n")
         return 1
     sys.stderr.write(
-        f"releasehash: {target}'s pre-tag commands have never been confirmed. "
-        f"Read them, then run `releasehash.py record {target}`.\n")
+        f"releasehash: {target}'s executable release commands have never been "
+        f"confirmed. Read every pre-tag and release-build command, then run "
+        f"`releasehash.py record {target}`.\n")
     return 2
 
 

package/plugins/ca-pi/hooks/session-start.py

@@ -1080,10 +1080,11 @@ def emit_update_notice(update_line):
 
 
 def emit_trailer(host):
-    """AC-32: the await-a-command trailer + catalog reference. ARBITER-ONLY —
+    """AC-32: the continue-or-await trailer + catalog reference. ARBITER-ONLY —
     the caller omits this emitter entirely for a non-arbiter startup (a mode
-    with no commands has nothing to 'await')."""
-    print(f"Present this state, then await a {host.command_noun}. "
+    with no commands has no command catalog to reference)."""
+    print("Present this state. Continue any active authorized work or accompanying "
+          f"user request; otherwise await a {host.command_noun}. "
           f"Type {host.cmd_ref('commands')} for the catalog.")
 
 
@@ -1221,7 +1222,7 @@ def main():
     # --- Startup-state block: per-mode composable emitters (T-44) ---------
     # AC-30: each emitter below is individually callable with only its own
     # explicit inputs. AC-32: host/stage/active-mode are unconditional in
-    # every mode; the await-a-command trailer and the daily briefing (which
+    # every mode; the continue-or-await trailer and the daily briefing (which
     # references {standup}) are ARBITER-ONLY.
     print("=== codeArbiter startup state ===")
     # observability-004 (#268): name the RESOLVED host so a dormant/broken