@arbiterforge/ca-pi 0.10.7 → 0.10.10

package/README.md

@@ -10,7 +10,7 @@ project context. You decide. codeArbiter enforces.
 <img alt="Claude Code plugin" src="https://img.shields.io/badge/Claude_Code-plugin-d97757">
 <img alt="Codex plugin" src="https://img.shields.io/badge/OpenAI_Codex-plugin-10a37f">
 <img alt="Pi Feature Forge preview" src="https://img.shields.io/badge/ca--pi-Feature_Forge_preview-d97757">
-<img alt="version 2.17.6" src="https://img.shields.io/badge/version-2.17.6-2b7489">
+<img alt="version 2.17.9" src="https://img.shields.io/badge/version-2.17.9-2b7489">
 <img alt="core lanes" src="https://img.shields.io/badge/core_lanes-18-555">
 <img alt="skills" src="https://img.shields.io/badge/skills-23-555">
 <img alt="agents" src="https://img.shields.io/badge/agents-19-555">
@@ -117,7 +117,7 @@ Approve the normal plugin trust prompt, open the target repository, and continue
 
 ### Codex CLI
 
-The public GitHub-slug flow is **available now**. The repository currently ships `ca-codex 0.9.6`;
+The public GitHub-slug flow is **available now**. The repository currently ships `ca-codex 0.9.9`;
 the dated end-to-end public-install record discovered `ca-codex 0.2.4` from release `v2.8.13`.
 Current packaging and shared-core parity are continuously verified, while that dated live-install
 record stays labeled rather than being silently promoted to evidence for a newer adapter:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.10.7",
+  "version": "0.10.10",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/plugins/ca-pi/CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to `ca-pi` are documented in this file.
 
 ## [Unreleased]
 
+## [0.10.10] - 2026-09-07
+
+### Fixed
+
+- Use the same documented done-tasks template for initialization and first-use archiving, with byte-identical UTF-8 headers on Windows and POSIX.
+
+## [0.10.9] - 2026-09-06
+
+### Fixed
+
+- Keep task-board lifecycles Git-clean by locally excluding the retained OS-lock sidecar during initialization, with an explicit repair option for existing repositories.
+
+## [0.10.8] - 2026-09-06
+
+### Fixed
+
+- Distinguish ordinary return-code identifiers such as `rc2` from cipher configuration in the crypto/TLS commit gate.
+
 ## [0.10.7] - 2026-09-06
 
 ### Fixed

package/plugins/ca-pi/hooks/_bashguardlib.py

@@ -38,7 +38,7 @@
 #                                         (case-insensitive)
 #   head_on_protected_tip(cwd) -> bool|None  True iff detached HEAD sits on a
 #                                         protected branch's tip
-#   added_lines(cwd, ref, paths=None) -> str|None  added ('+') diff lines,
+#   added_lines(cwd, ref, paths=None) -> SecurityScan|None  classified added lines,
 #                                         narrowed to the H-09b/H-10b candidate
 #                                         set, or None on a git-read failure
 #   staged_paths(cwd) -> set|None        index paths (`git diff --cached
@@ -84,7 +84,7 @@ from _hooklib import (
     ADR_LIFECYCLE_LOG_BASENAME, AUDIT_LOG_BASENAMES, AUDIT_LOG_FLAT_BASENAMES,
     AUDIT_LOG_NAMES, CRYPTO_RE, DECISION_AUDIT_LOG_NAMES, DECISION_LOG_BASENAME, DECISIONS_DIR_RE,
     GATE_MARKER_NAMES, MARKER_FRESHNESS_MINUTES, SECRET_RE, SECURITY_DIFF_GIT_ARGS, block,
-    content_digest, is_migration_path, line_digest, marker_fresh, sensitive_scan_added_lines,
+    content_digest, is_migration_path, line_digest, marker_fresh, security_scan_diff,
 )
 from _gitexec import git_executable
 import _gitlib  # reused for its spawn-free, worktree-aware (.git-as-a-FILE /
@@ -1042,7 +1042,7 @@ def head_on_protected_tip(cwd):
 
 
 def added_lines(cwd, ref, paths=None):
-    """The added (`+`) lines of a diff — what a commit would introduce — or None
+    """The shared classification/bindings for a diff, or None
     when git could not produce the diff (nonzero exit / timeout / error). The
     None return (not "") lets the H-09b/H-10b security scan fail CLOSED on a read
     error rather than silently passing — an empty diff and an unreadable diff are
@@ -1073,7 +1073,10 @@ def added_lines(cwd, ref, paths=None):
     except Exception as e:  # noqa: BLE001
         _note_read_err(argv, repr(e))
         return None
-    return "\n".join(sensitive_scan_added_lines(out.stdout))
+    result = security_scan_diff(out.stdout)
+    if result is None:
+        _note_read_err(argv, "malformed or incomplete crypto context")
+    return result
 
 
 def _names(cwd, args):
@@ -1531,11 +1534,9 @@ def _check_h09b_h10b_crypto_secret(commit, add, cwd, root):
                        "read (git unavailable or timed out) — failing closed "
                        "(ORCHESTRATOR §2). Retry, or run the crypto-compliance / "
                        "secret-handling gate, then commit." + _read_err_hint())
-    added = "\n".join(parts)
-    sensitive = [ln for ln in added.splitlines()
-                 if CRYPTO_RE.search(ln) or SECRET_RE.search(ln)]
+    sensitive = set().union(*(part.digests for part in parts))
     if sensitive:
-        touches_crypto = bool(CRYPTO_RE.search(added))
+        touches_crypto = any(part.crypto for part in parts)
         kind = "crypto/TLS" if touches_crypto else "secret"
         tag = "H-09b" if touches_crypto else "H-10b"
         skill = "crypto-compliance" if touches_crypto else "secret-handling"
@@ -1551,7 +1552,7 @@ def _check_h09b_h10b_crypto_secret(commit, add, cwd, root):
                 approved = set(f.read().split())
         except Exception:  # noqa: BLE001
             approved = set()
-        uncovered = [ln for ln in sensitive if line_digest(ln) not in approved]
+        uncovered = sensitive - approved
         if uncovered:
             block(tag, f"{len(uncovered)} {kind} line(s) in this commit are not covered "
                        f"by the recorded security-gate pass — the pass is bound to the "

package/plugins/ca-pi/hooks/_hooklib.py

@@ -209,6 +209,10 @@ from _sensitivelib import (  # noqa: F401
     is_sensitive_scan_exempt,
     line_digest,
     sensitive_scan_added_lines,
+    SecurityScan,
+    security_scan_diff,
+    security_scan_lines,
+    security_scan_source,
 )
 
 

package/plugins/ca-pi/hooks/_host.py

@@ -11,7 +11,7 @@ import hostapi  # noqa: E402
 class PiHost(hostapi.Host):
     name = "pi"
     adapter_name = "@arbiterforge/ca-pi"
-    adapter_version = "0.10.7"
+    adapter_version = "0.10.10"
     update_target = "ca-pi"
     update_tag_prefix = "ca-pi-v"
     update_command = "pi update npm:@arbiterforge/ca-pi"

package/plugins/ca-pi/hooks/_sensitivelib.py

@@ -26,7 +26,12 @@
 from __future__ import annotations
 
 import hashlib
+import io
+import json
 import re
+import tokenize
+from bisect import bisect_right
+from collections import namedtuple
 
 from _pathnorm import norm_path
 
@@ -38,10 +43,31 @@ from _pathnorm import norm_path
 # catch-all is narrowed to the members that actually sign, encrypt, derive
 # keys, or produce security-relevant randomness. bcrypt stays: approved or
 # not, a password-hashing change is exactly what crypto-compliance reviews.
+# Short names also occur as return-code variables and ordinary prose (#678).
+# Require configuration, known mode/padding suffixes, a crypto call/member, or
+# an import/crypto namespace. A standalone quoted value also matches when its
+# config key is outside the diff; unrelated quoted labels and prose do not.
+# Line-shape arms also work in joined content (the H-09b verdict/reminder read).
+_SHORT_CRYPTO_NAME = r"(?:rc2|rc4|des|rsa)"
+_CRYPTO_LINE_END = r"(?:[ \t]*[,;\])}])*[ \t]*(?:(?:\#|//)[^\r\n]*)?\r?$"
 CRYPTO_RE = re.compile(
-    r"(createHash|createCipher|createHmac|\bmd5\b|\bsha1\b|\brc4\b|\bdes\b|3des"
-    r"|\brc2\b|\bblowfish\b"
-    r"|\bRSA\b|x509|bcrypt"
+    r"(createHash|createCipher|createHmac|\bmd5\b|\bsha1\b|3des"
+    r"|\bblowfish\b|x509|bcrypt"
+    rf"""|(?m:^[ \t]*(?:-[ \t]*)?["']{_SHORT_CRYPTO_NAME}["']{_CRYPTO_LINE_END})"""
+    rf"|\b{_SHORT_CRYPTO_NAME}[-/](?:cbc|ecb|cfb|ofb|ctr|ede3?|oaep|pss|pkcs1)\b"
+    rf"|\b{_SHORT_CRYPTO_NAME}\s*\("
+    rf"|\b{_SHORT_CRYPTO_NAME}\s*\.\s*"
+    r"(?:new|create|generate|construct|import_?key|encrypt|decrypt|sign|verify"
+    r"|(?:rsa)?(?:public|private)(?:key|numbers)|rsakey|mode_)\w*\b"
+    rf"""|\b(?:cipher|algorithm)["']?\s*[:=]\s*["']?{_SHORT_CRYPTO_NAME}\b"""
+    r"""|\bkey_type["']?\s*[:=]\s*["']?rsa\b"""
+    rf"""|\b(?:Cipher|KeyFactory)\s*\.\s*getInstance\s*\(\s*["']{_SHORT_CRYPTO_NAME}\b"""
+    rf"|\b(?:Cipher|PublicKey|algorithms|asymmetric|Cryptography)\s*\.\s*{_SHORT_CRYPTO_NAME}\b"
+    rf"|\bcrypto/{_SHORT_CRYPTO_NAME}\b"
+    rf"|\b(?:from|import)(?:\s+(?:\(\s*)?|\(\s*)"
+    rf"(?:\w+(?:\.\w+)*(?:\s+as\s+\w+)?\s*,\s*)*"
+    rf"(?:\w+\.)*{_SHORT_CRYPTO_NAME}\b"
+    rf"|(?m:^[ \t]*{_SHORT_CRYPTO_NAME}[ \t]+as[ \t]+\w+{_CRYPTO_LINE_END})"
     r"|crypto\.(subtle|sign|verify|createSign|createVerify|generateKey"
     r"|publicEncrypt|privateDecrypt|pbkdf2|scrypt|randomBytes|createDiffieHellman)"
     r"|InsecureSkipVerify|verify=False"
@@ -118,7 +144,8 @@ def is_sensitive_scan_exempt(rel):
 # forget to pin it (that was exactly how this hole would keep reopening).
 SECURITY_DIFF_GIT_ARGS = (
     "-c", "diff.mnemonicPrefix=false", "-c", "diff.noprefix=false",
-    "diff", "--no-ext-diff", "--src-prefix=a/", "--dst-prefix=b/",
+    "diff", "--no-ext-diff", "--no-textconv", "--no-color",
+    "--src-prefix=a/", "--dst-prefix=b/", "--unified=2147483647",
 )
 
 # The fixed-width destination-path prefix `diff_added_lines` strips off a
@@ -249,6 +276,238 @@ def sensitive_scan_added_lines(diff_text):
             if not (path and is_sensitive_scan_exempt(path))]
 
 
+# H-09b contextual additions (#678): raw line bindings stay compatible. Only
+# bare short-name import items require lexical destination context. Context
+# bindings use a separate marker namespace; a user-authored source string or
+# an old line-only approval cannot impersonate one of these records.
+# SecurityScan(crypto, digests): classification and exact approval identities.
+# security_scan_lines(lines) -> SecurityScan|None: line-bound scan or refusal.
+# security_scan_source(path, source, added_rows) -> SecurityScan|None.
+# security_scan_diff(text) -> SecurityScan|None: None means untrusted context.
+SecurityScan = namedtuple("SecurityScan", "crypto digests")
+_SHORT_CRYPTO_TOKEN_RE = re.compile(rf"\b{_SHORT_CRYPTO_NAME}\b", re.I)
+_IMPORT_ITEM = r"[^\W\d]\w*(?:[ \t]+as[ \t]+[^\W\d]\w*)?"
+_IMPORT_ITEM_LINE_RE = re.compile(
+    rf"[ \t]*{_IMPORT_ITEM}(?:[ \t]*,[ \t]*{_IMPORT_ITEM})*[ \t]*,?[ \t]*"
+    r"(?:\\|\)[ \t]*(?:;[^\r\n]*)?)?[ \t]*(?:\#[^\r\n]*)?", re.I)
+_FULL_HUNK_RE = re.compile(r"@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@(?: .*)?")
+_MAX_CRYPTO_CONTEXT_BYTES = 1_000_000
+
+
+def _is_context_item_line(line):
+    """Route bounded import-list syntax to context, never classify it alone."""
+    if not _SHORT_CRYPTO_TOKEN_RE.search(line):
+        return False
+    # Collapse only the temporary routing text, avoiding overlapping whitespace
+    # partitions. Tokenization and approval binding still use the original source.
+    candidate = re.sub(r"[ \t]+", " ", line)
+    return bool(_IMPORT_ITEM_LINE_RE.fullmatch(candidate))
+
+
+def _cross_line_crypto_spans(lines):
+    """Locate joined matches by zero-based row/column, without quadratic slicing."""
+    starts = [0]
+    for line in lines:
+        starts.append(starts[-1] + len(line) + 1)
+    spans = set()
+    for match in CRYPTO_RE.finditer("\n".join(lines)):
+        if "\n" not in match.group():
+            continue
+        first = bisect_right(starts, match.start()) - 1
+        last = bisect_right(starts, match.end()) - 1
+        spans.add((first, match.start() - starts[first],
+                   last, match.end() - starts[last]))
+    return spans
+
+
+def _scan_bound_lines(lines, contextual_bindings):
+    """Each cross-line match needs its own recognized contextual identity."""
+    spans = _cross_line_crypto_spans(lines)
+    if not spans <= contextual_bindings.keys():
+        return None
+    return SecurityScan(bool(spans) or any(CRYPTO_RE.search(line) for line in lines), {
+        line_digest(line) for line in lines
+        if CRYPTO_RE.search(line) or SECRET_RE.search(line)
+    } | set(contextual_bindings.values()))
+
+
+def security_scan_lines(lines):
+    """Preserve same-line bindings; refuse crypto spanning unbound lines."""
+    return _scan_bound_lines(lines, {})
+
+
+def security_scan_source(path, source, added_rows):
+    """Classify original added lines plus narrowly recognized Python imports.
+
+    `source` is ONE destination snapshot; rows are one-based positions in it.
+    Tokenization only separates import NAME/OP tokens from strings/comments;
+    this is not an expression, type, or general-language parser. Invalid or
+    unavailable required context returns None, never an ordinary exemption.
+    """
+    lines = source.splitlines()
+    if any(row < 1 or row > len(lines) for row in added_rows):
+        return None
+    added = [lines[row - 1] for row in added_rows]
+    result = security_scan_lines(added)
+    candidates = {row for row in added_rows
+                  if _is_context_item_line(lines[row - 1])}
+    if not candidates:
+        return result
+    if not path or len(source.encode("utf-8", "replace")) > _MAX_CRYPTO_CONTEXT_BYTES:
+        return None
+    # Replacement decoding can collapse distinct original bytes. Even a
+    # literal replacement character is ambiguous here: refuse contextual proof.
+    if "\ufffd" in source:
+        return None
+    try:
+        tokens = [token for token in tokenize.generate_tokens(io.StringIO(source).readline)
+                  if token.type not in (tokenize.COMMENT, tokenize.NL,
+                                        tokenize.INDENT, tokenize.DEDENT)]
+    except (tokenize.TokenError, SyntaxError):
+        return None
+    if any(token.type == tokenize.ERRORTOKEN and not token.string.isspace()
+           for token in tokens):
+        return None
+    matched = set()
+    import_spans = []
+    start = [(tokenize.NAME, "from"), (tokenize.NAME, "Crypto"),
+             (tokenize.OP, "."), (tokenize.NAME, "Cipher"),
+             (tokenize.NAME, "import"), (tokenize.OP, "(")]
+    for index in range(len(tokens) - len(start)):
+        if [(token.type, token.string) for token in tokens[index:index + len(start)]] != start:
+            continue
+        cursor = index + len(start)
+        while cursor < len(tokens) and tokens[cursor].string != ")":
+            item = tokens[cursor]
+            if item.type != tokenize.NAME:
+                return None
+            cursor += 1
+            if cursor < len(tokens) and tokens[cursor].string == "as":
+                cursor += 1
+                if cursor >= len(tokens) or tokens[cursor].type != tokenize.NAME:
+                    return None
+                cursor += 1
+            if item.start[0] in candidates and _SHORT_CRYPTO_TOKEN_RE.fullmatch(item.string):
+                matched.add(item.start[0])
+                import_spans.append((tokens[index + 4].start, item.end))
+            if cursor >= len(tokens) or tokens[cursor].string not in (",", ")"):
+                return None
+            if tokens[cursor].string == ",":
+                cursor += 1
+        if cursor >= len(tokens):
+            return None
+    # Preserve lexical whitespace; only transport CRLF decoding is normalized.
+    destination = hashlib.sha256(source.encode("utf-8", "replace")).hexdigest()
+    contexts = {row: "ctx-v1:" + hashlib.sha256(json.dumps(
+        [path, destination, row, lines[row - 1]], separators=(",", ":")
+    ).encode("utf-8")).hexdigest() for row in matched}
+    positions = {row: index for index, row in enumerate(added_rows)}
+    bindings = {(positions[first[0]], first[1], positions[last[0]], last[1]): contexts[last[0]]
+                for first, last in import_spans
+                if first[0] in positions and last[0] in positions}
+    result = _scan_bound_lines(added, bindings)
+    if result is None:
+        return None
+    return SecurityScan(result.crypto or bool(contexts), result.digests | set(contexts.values()))
+
+
+def _full_destination(section):
+    """Validate one whole-file Git hunk before using its destination context."""
+    path = None
+    hunk = None
+    for index, line in enumerate(section):
+        if line.startswith(_PLUS_B_PREFIX):
+            path = line[len(_PLUS_B_PREFIX):]
+        if line.startswith("@@"):
+            hunk = index
+            break
+    if not path or hunk is None:
+        return None
+    header = _FULL_HUNK_RE.fullmatch(section[hunk])
+    if header is None:
+        return None
+    old_start, old_count, new_start, new_count = header.groups()
+    old_start, new_start = int(old_start), int(new_start)
+    old_count, new_count = int(old_count or 1), int(new_count or 1)
+    if old_start != (1 if old_count else 0) or new_start != 1:
+        return None
+    destination, rows = [], []
+    old_seen = new_seen = 0
+    previous = None
+    for line in section[hunk + 1:]:
+        if line.startswith("\\"):
+            if line != "\" or previous not in ("+", "-", " "):
+                return None
+            if previous != "-":
+                destination[-1] = destination[-1].removesuffix("\n")
+            previous = None
+            continue
+        if not line or line[0] not in ("+", "-", " "):
+            return None
+        previous = line[0]
+        if previous in ("-", " "):
+            old_seen += 1
+        if previous in ("+", " "):
+            new_seen += 1
+            destination.append(line[1:] + "\n")
+            if previous == "+":
+                rows.append(new_seen)
+    if (old_seen, new_seen) != (old_count, new_count):
+        return None
+    return path, "".join(destination), rows
+
+
+def security_scan_diff(diff_text):
+    """Shared producer/consumer scan; context comes from this one pinned diff.
+
+    Legacy classification and audit-path handling remain unchanged. Only a
+    section with an ambiguous bare added item pays the full-context/token cost.
+    Missing attribution, incomplete hunks and unsupported context fail closed.
+    """
+    # A flattened match may not borrow approval from a different file section.
+    cross_spans = _cross_line_crypto_spans(sensitive_scan_added_lines(diff_text))
+    covered_spans = set()
+    added_offset = 0
+    result = SecurityScan(False, set())
+    sections = []
+    for line in diff_text.splitlines():
+        if line.startswith("diff ") or not sections:
+            sections.append([])
+        sections[-1].append(line)
+    for section in sections:
+        attributed = diff_added_lines("\n".join(section))
+        if attributed and all(path and is_sensitive_scan_exempt(path)
+                              for path, _ in attributed):
+            continue
+        added = sensitive_scan_added_lines("\n".join(section))
+        # A damaged hunk header must not make an apparent added item disappear
+        # in the legacy permissive walker before context validation even runs.
+        if not any(line.startswith("+") and _is_context_item_line(line[1:])
+                   for line in section):
+            contextual = security_scan_lines(added)
+        else:
+            if not section[0].startswith("diff --git "):
+                return None
+            context = _full_destination(section)
+            if context is None:
+                return None
+            path, source, rows = context
+            source_lines = source.splitlines()
+            if attributed != [(path, source_lines[row - 1]) for row in rows]:
+                return None
+            contextual = security_scan_source(path, source, rows)
+        if contextual is None:
+            return None
+        covered_spans.update((first + added_offset, col, last + added_offset, end)
+                             for first, col, last, end in _cross_line_crypto_spans(added))
+        added_offset += len(added)
+        result = SecurityScan(result.crypto or contextual.crypto,
+                              result.digests | contextual.digests)
+    if not cross_spans <= covered_spans:
+        return None
+    return result
+
+
 def line_digest(line):
     """Digest of one added diff line, for the security-gate binding
     (H-09b/H-10b). The gate-pass marker stores these digests instead of being

package/plugins/ca-pi/hooks/_taskboardlib.py

@@ -704,6 +704,23 @@ ARCHIVE_CUTOFF_DAYS = 14
 
 DONE_TASKS_HEADING = "# Done tasks"
 
+# The canonical documented archive template, shared by init and first use.
+DONE_TASKS = """\
+# Done tasks
+
+Completed work swept off the board by `taskwrite archive`, newest last.
+APPEND-ONLY: entries are added here and never edited or removed, so a
+finished task has exactly one permanent record.
+
+Each archived task preserves its original lifecycle line and indented task block verbatim
+from `open-tasks.md`. The lifecycle line keeps its `(done YYYY-MM-DD)` stamp
+intact — the stamp is what makes an entry ageable, and what `archive` refuses
+to invent.
+
+Written only by `taskwrite archive`. `/ca:standup` proposes the sweep with
+per-item confirmation; nothing sweeps automatically.
+"""
+
 
 def archive_candidates(text, *, today, cutoff_days=ARCHIVE_CUTOFF_DAYS):
     """`(aged, undated)` — done tasks eligible for the archival sweep.
@@ -862,7 +879,7 @@ def archive_transform(open_text, done_text, task):
     if already_archived(done_text, task):
         new_done = done_text
     else:
-        body = done_text if done_text.strip() else DONE_TASKS_HEADING + "\n"
+        body = done_text if done_text.strip() else DONE_TASKS
         if not body.endswith("\n"):
             body += "\n"
         new_done = body + "\n".join(block) + "\n"

package/plugins/ca-pi/hooks/_taskexcludelib.py

@@ -0,0 +1,223 @@
+#!/usr/bin/env python3
+# codeArbiter — locally exclude the retained task-board OS-lock sidecar.
+#
+# The board lock is intentionally never removed: unlinking a locked inode lets
+# another process acquire a different lock. Only Git's common info/exclude is
+# changed, through its own exclusive create/replace lockfile protocol. Existing
+# bytes and modes survive; no tracked file or Git index is written.
+# Static Git-metadata link/reparse aliases and observed concurrent edits fail closed. This
+# cooperates with writers honoring exclude.lock; it is not a sandbox against a
+# hostile same-user process swapping paths between filesystem operations.
+#
+# Public API:
+#   ensure_task_lock_excluded(root, required=False) -> str | None
+#       "added" / "already present", or None for optional non-Git scaffolding.
+#       Raises TaskExclusionError with a surfaced diagnostic on unsafe/failing IO.
+
+import os
+from pathlib import Path
+import stat
+import subprocess
+
+from _gitexec import git_executable, root_bound_git_env
+
+
+LOCK_PATH = ".codearbiter/open-tasks.md.lock"
+EXCLUDE_RULE = b"/" + LOCK_PATH.encode("ascii")
+MAX_EXCLUDE_BYTES = 2 * 1024 * 1024
+_REPARSE = getattr(stat, "FILE_ATTRIBUTE_REPARSE_POINT", 0x400)
+
+
+class TaskExclusionError(RuntimeError):
+    pass
+
+
+def _version(info):
+    # Windows Python can expose creation time via lstat().st_ctime but change
+    # time via fstat().st_ctime. Compare the common birth-time field there;
+    # identity, size, mtime, mode/link count and byte rereads still bind edits.
+    change = getattr(info, "st_birthtime_ns", 0) if os.name == "nt" else info.st_ctime_ns
+    return (info.st_dev, info.st_ino, info.st_size, info.st_mtime_ns,
+            change, info.st_mode, info.st_nlink)
+
+
+def _regular(info):
+    return (stat.S_ISREG(info.st_mode) and info.st_nlink == 1
+            and not getattr(info, "st_file_attributes", 0) & _REPARSE)
+
+
+def _directories(path):
+    for directory in (*reversed(path.parents), path):
+        info = directory.lstat()
+        if not stat.S_ISDIR(info.st_mode) or getattr(info, "st_file_attributes", 0) & _REPARSE:
+            raise TaskExclusionError("unsafe directory in task lock exclusion path")
+
+
+def _git(root, *args, input_bytes=None):
+    return subprocess.run([git_executable(), "-C", str(root), *args],
+                          env=root_bound_git_env(), capture_output=True, timeout=5,
+                          input=input_bytes)
+
+
+def _git_path(root, *args):
+    result = _git(root, "rev-parse", *args)
+    value = os.fsdecode(result.stdout).rstrip("\r\n")
+    if result.returncode or not value or not os.path.isabs(value) or "\n" in value:
+        raise TaskExclusionError("cannot bind task lock exclusion to selected Git")
+    return Path(value)
+
+
+def _same_path(left, right):
+    return os.path.normcase(os.path.abspath(left)) == os.path.normcase(os.path.abspath(right))
+
+
+def _binding(root, required):
+    # A failed Git probe in an actual checkout is never mistaken for non-Git.
+    markers = [item / ".git" for item in (root, *root.parents)]
+    has_marker = any(os.path.lexists(path) for path in markers)
+    try:
+        top = _git_path(root, "--show-toplevel")
+    except (OSError, RuntimeError, subprocess.SubprocessError):
+        if not required and not has_marker:
+            return None
+        raise TaskExclusionError("cannot resolve repository root for task lock exclusion") from None
+    # Git reports physical roots: /var aliases and Windows 8.3 names can differ
+    # from the caller. Resolve only this identity, never metadata paths whose
+    # unresolved link/reparse attributes the checks below must inspect.
+    root = Path(os.path.realpath(root))
+    if not _same_path(os.path.realpath(top), root):
+        raise TaskExclusionError("task lock exclusion requires the exact repository root")
+    _directories(root)
+    marker = root / ".git"
+    info = marker.lstat()
+    if (not (stat.S_ISDIR(info.st_mode) or _regular(info))
+            or getattr(info, "st_file_attributes", 0) & _REPARSE):
+        raise TaskExclusionError("unsafe Git marker for task lock exclusion")
+    common = _git_path(root, "--path-format=absolute", "--git-common-dir")
+    exclude = _git_path(root, "--path-format=absolute", "--git-path", "info/exclude")
+    if not _same_path(exclude, common / "info/exclude"):
+        raise TaskExclusionError("task lock exclusion common-directory mismatch")
+    _directories(common)
+    return exclude
+
+
+def _read_exclude(path):
+    try:
+        before = path.lstat()
+    except FileNotFoundError:
+        return b"", None
+    if not _regular(before):
+        raise TaskExclusionError("task lock exclusion is not a regular single-link file")
+    fd = os.open(path, os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0))
+    with os.fdopen(fd, "rb") as handle:
+        opened = os.fstat(handle.fileno())
+        if not _regular(opened) or _version(opened) != _version(before):
+            raise TaskExclusionError("task lock exclusion changed while opening")
+        data = handle.read(MAX_EXCLUDE_BYTES + 1)
+        if len(data) > MAX_EXCLUDE_BYTES:
+            raise TaskExclusionError("task lock exclusion exceeds size limit")
+        if _version(os.fstat(handle.fileno())) != _version(before):
+            raise TaskExclusionError("task lock exclusion changed while reading")
+    if _version(path.lstat()) != _version(before):
+        raise TaskExclusionError("task lock exclusion path changed while reading")
+    return data, before
+
+
+def _check_conflicts(root):
+    tracked = _git(root, "ls-files", "--error-unmatch", "--", LOCK_PATH)
+    if tracked.returncode == 0:
+        raise TaskExclusionError("task lock sidecar is tracked; local exclusion cannot untrack it")
+    if tracked.returncode != 1:
+        raise TaskExclusionError("cannot check tracked task lock sidecar")
+    # A file can serve both global and per-directory roles. For this conflict
+    # probe only, disable the lower-priority global source without changing
+    # repository configuration. Effectiveness checks below use actual config.
+    ignored = _git(root, "-c", "core.excludesFile=", "check-ignore", "--no-index", "-z", "-v", "--stdin",
+                   input_bytes=LOCK_PATH.encode("ascii") + b"\0")
+    if ignored.returncode not in (0, 1):
+        raise TaskExclusionError("cannot check task lock exclusion precedence")
+    fields = ignored.stdout.split(b"\0")
+    # Git reports the target's per-directory sources relative to the -C root.
+    if len(fields) == 5 and fields[0].replace(b"\\", b"/") in (
+            b".gitignore", b".codearbiter/.gitignore") \
+            and fields[2].startswith(b"!"):
+        raise TaskExclusionError("a .gitignore negation overrides local task lock exclusion")
+
+
+def _ensure(root, required):
+    # Retain the caller spelling so publication-time binding detects retargeting.
+    root = Path(os.path.abspath(root))
+    exclude = _binding(root, required)
+    if exclude is None:
+        return None
+    # mkdir is exclusive and never follows a preexisting info alias.
+    try:
+        exclude.parent.mkdir()
+    except FileExistsError:
+        pass
+    _directories(exclude.parent)
+    lock = exclude.with_name("exclude.lock")
+    fd = None
+    owned = None
+    try:
+        try:
+            fd = os.open(lock, os.O_WRONLY | os.O_CREAT | os.O_EXCL
+                         | getattr(os, "O_NOFOLLOW", 0), 0o666)
+        except FileExistsError:
+            raise TaskExclusionError("exclude.lock already exists; another writer may own it") from None
+        info = os.fstat(fd)
+        owned = info.st_dev, info.st_ino
+        before, snapshot = _read_exclude(exclude)
+        _check_conflicts(root)
+        if EXCLUDE_RULE in before.splitlines():
+            ignored = _git(root, "check-ignore", "-q", "--", LOCK_PATH)
+            if ignored.returncode == 0:
+                return "already present"
+            if ignored.returncode != 1:
+                raise TaskExclusionError("cannot verify task lock exclusion")
+        newline = b"\r\n" if b"\r\n" in before else b"\n"
+        data = before + (newline if before and not before.endswith(b"\n") else b"")
+        data += EXCLUDE_RULE + newline
+        if len(data) > MAX_EXCLUDE_BYTES:
+            raise TaskExclusionError("task lock exclusion output exceeds size limit")
+        with os.fdopen(fd, "wb") as handle:
+            fd = None
+            handle.write(data)
+            handle.flush()
+            os.fsync(handle.fileno())
+        if snapshot is not None:
+            os.chmod(lock, stat.S_IMODE(snapshot.st_mode))
+        latest, current = _read_exclude(exclude)
+        if latest != before or ((snapshot is None) != (current is None)) \
+                or snapshot is not None and _version(snapshot) != _version(current):
+            raise TaskExclusionError("task lock exclusion changed before publication")
+        if _binding(root, True) != exclude:
+            raise TaskExclusionError("task lock exclusion binding changed before publication")
+        _directories(exclude.parent)
+        info = lock.lstat()
+        if not _regular(info) or (info.st_dev, info.st_ino) != owned:
+            raise TaskExclusionError("exclude.lock ownership changed before publication")
+        os.replace(lock, exclude)
+        owned = None
+        if _git(root, "check-ignore", "-q", "--", LOCK_PATH).returncode != 0:
+            raise TaskExclusionError("local rule added but task lock exclusion is not effective")
+        return "added"
+    finally:
+        if fd is not None:
+            os.close(fd)
+        if owned is not None:
+            try:
+                info = lock.lstat()
+                if (info.st_dev, info.st_ino) == owned:
+                    lock.unlink()  # Only OUR Git transaction file, NEVER the board OS lock.
+            except FileNotFoundError:
+                pass
+
+
+def ensure_task_lock_excluded(root, required=False):
+    try:
+        return _ensure(root, required)
+    except TaskExclusionError:
+        raise
+    except (OSError, RuntimeError, subprocess.SubprocessError) as exc:
+        raise TaskExclusionError(f"task lock exclusion failed ({type(exc).__name__})") from None

package/plugins/ca-pi/hooks/git-enforce.py

@@ -32,7 +32,7 @@ from _gitexec import git_executable  # noqa: E402
 from _hooklib import (  # noqa: E402
     CRYPTO_RE, MARKER_FRESHNESS_MINUTES, SECRET_RE, SECURITY_DIFF_GIT_ARGS,
     arbiter_active, content_digest, is_migration_path, line_digest,
-    marker_fresh, sensitive_scan_added_lines, set_host, utf8_stdio,
+    marker_fresh, security_scan_diff, set_host, utf8_stdio,
 )
 
 
@@ -164,7 +164,7 @@ def cached_added_lines(cwd):
     r = _git([*SECURITY_DIFF_GIT_ARGS, "--cached"], cwd)
     if r is None or r.returncode != 0:
         return None
-    return sensitive_scan_added_lines(r.stdout)
+    return security_scan_diff(r.stdout)
 
 
 def cached_names(cwd):
@@ -229,10 +229,9 @@ def pre_commit(root):
     if added is None:
         block("H-09b", "the staged diff for the crypto/secret scan could not be read — "
                        "failing closed (ORCHESTRATOR §2).")
-    sensitive = [ln for ln in added if CRYPTO_RE.search(ln) or SECRET_RE.search(ln)]
+    sensitive = added.digests
     if sensitive:
-        joined = "\n".join(added)
-        touches_crypto = bool(CRYPTO_RE.search(joined))
+        touches_crypto = added.crypto
         kind = "crypto/TLS" if touches_crypto else "secret"
         tag = "H-09b" if touches_crypto else "H-10b"
         skill = "crypto-compliance" if touches_crypto else "secret-handling"
@@ -242,7 +241,7 @@ def pre_commit(root):
             block(tag, f"This commit introduces {kind} changes, but no security-gate pass is "
                        f"recorded (#161 git backstop). Run the {skill} gate, then commit.")
         approved = _marker_set(marker_root, "security-gate-passed")
-        uncovered = [ln for ln in sensitive if line_digest(ln) not in approved]
+        uncovered = sensitive - approved
         if uncovered:
             block(tag, f"{len(uncovered)} {kind} line(s) in this commit are not covered by the "
                        f"recorded security-gate pass (#161 git backstop) — re-run the {skill} "

package/plugins/ca-pi/hooks/hostapi.py

@@ -218,7 +218,7 @@ def git_worktree_main_root(root):
     of the command's effective exec root).
 
     Deliberately NOT wired into `Host.project_root()` itself: `project_root()`
-    also backs `security-pass.py`'s DIFF SCAN (`candidate_lines()`), which
+    also backs `security-pass.py`'s DIFF SCAN (`candidate_scan()`), which
     must stay worktree-local — escalating the general project root to "main"
     would bind digests to the wrong (unrelated, possibly dirty) tree and
     silently drop coverage for the diff actually being committed, the exact
@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "2.17.6"
+    adapter_version = "2.17.9"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,

package/plugins/ca-pi/hooks/init-codearbiter.py

@@ -12,6 +12,7 @@
 # Usage:
 #   python init-codearbiter.py [--root PATH] [--stage N]
 #   python init-codearbiter.py --check        # report state, create nothing
+#   python init-codearbiter.py --repair-lock-exclusion [--root PATH]
 
 import argparse
 import subprocess
@@ -19,7 +20,8 @@ import os
 import sys
 
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-from _gitexec import git_executable  # noqa: E402
+from _gitexec import git_executable, root_bound_git_env  # noqa: E402
+from _taskboardlib import DONE_TASKS  # noqa: E402 — shared archive template (#625)
 import hostapi  # noqa: E402 — host seam (ADR-0011)
 import _hooklib  # noqa: E402 — set_host DI seam (#257)
 import _entrylib  # noqa: E402 — shared run() dispatch (jscpd dedup)
@@ -92,21 +94,6 @@ OVERRIDES = """\
 # last-checkpoint marker as "overrides since last checkpoint."
 """
 
-DONE_TASKS = """\
-# Done tasks
-
-Completed work swept off the board by `taskwrite archive`, newest last.
-APPEND-ONLY: entries are added here and never edited or removed, so a
-finished task has exactly one permanent record.
-
-Each line is the task's original lifecycle line, moved verbatim from
-`open-tasks.md` with its `(done YYYY-MM-DD)` stamp intact — the stamp is
-what makes an entry ageable, and what `archive` refuses to invent.
-
-Written only by `taskwrite archive`. `/ca:standup` proposes the sweep with
-per-item confirmation; nothing sweeps automatically.
-"""
-
 FILES = {
     "open-tasks.md": OPEN_TASKS,
     # B-23: scaffolded at init rather than created on first archive. An
@@ -126,7 +113,7 @@ def project_root(opt):
     # prefer git toplevel; fall back to cwd
     try:
         out = subprocess.run([git_executable(), "rev-parse", "--show-toplevel"],
-                             capture_output=True, text=True, timeout=2)
+                             env=root_bound_git_env(), capture_output=True, text=True, timeout=2)
         top = out.stdout.strip()
         if out.returncode == 0 and top:
             return os.path.abspath(top)
@@ -138,9 +125,16 @@ def project_root(opt):
 def main(argv=None):
     ap = argparse.ArgumentParser(add_help=True)
     ap.add_argument("--root")
-    ap.add_argument("--stage", type=int, default=1)
+    ap.add_argument("--stage", type=int)
     ap.add_argument("--check", action="store_true")
+    ap.add_argument("--repair-lock-exclusion", action="store_true", help=(
+        "repair only Git-local info/exclude for an existing scaffold; retain the "
+        "task-board OS lock, never rewrite project state (cannot combine with --check/--stage)"))
     args = ap.parse_args(argv)
+    if args.repair_lock_exclusion and (args.check or args.stage is not None):
+        ap.error("--repair-lock-exclusion cannot combine with --check or --stage")
+    if args.stage is None:
+        args.stage = 1
 
     root = project_root(args.root)
     cad = os.path.join(root, ".codearbiter")
@@ -168,11 +162,29 @@ def main(argv=None):
             print(f"NOT SCAFFOLDED: {cad} would be created. Run without --check to scaffold.")
         return
 
+    from _taskexcludelib import ensure_task_lock_excluded, TaskExclusionError
+    if args.repair_lock_exclusion:
+        if not os.path.isfile(ctx) or os.path.islink(ctx):
+            raise SystemExit("REFUSING: task lock exclusion repair requires an existing scaffold.")
+        try:
+            result = ensure_task_lock_excluded(root, required=True)
+        except TaskExclusionError as exc:
+            raise SystemExit(f"REFUSING: {exc}") from None
+        print(f"task lock exclusion: {result}")
+        return
+
     if os.path.exists(ctx):
         raise SystemExit(
             f"REFUSING: {ctx} already exists. .codearbiter/ is already scaffolded here. "
             f"To populate it, run {_cc} or {_dc}; to repair, edit by hand.")
 
+    try:
+        result = ensure_task_lock_excluded(root)
+    except TaskExclusionError as exc:
+        raise SystemExit(f"REFUSING: {exc}") from None
+    if result:
+        print(f"task lock exclusion: {result}")
+
     os.makedirs(cad, exist_ok=True)
     created = []
     if not os.path.exists(ctx):
@@ -183,7 +195,10 @@ def main(argv=None):
     for fname, content in FILES.items():
         fp = os.path.join(cad, fname)
         if not os.path.exists(fp):
-            with open(fp, "w", encoding="utf-8") as f:
+            # Match taskwrite's LF output for this shared append-only template
+            # on Windows too; other scaffold files retain their existing EOLs.
+            newline = "\n" if fname == "done-tasks.md" else None
+            with open(fp, "w", encoding="utf-8", newline=newline) as f:
                 f.write(content)
             created.append(fname)
 

package/plugins/ca-pi/hooks/security-pass.py

@@ -17,6 +17,7 @@
 #   "$PY" "<plugin>/hooks/security-pass.py"
 
 import os
+import stat
 import subprocess
 
 from _gitexec import git_executable
@@ -26,8 +27,8 @@ sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 import hostapi  # noqa: E402 — host seam (ADR-0011)
 import _entrylib  # noqa: E402 — shared run() dispatch (jscpd dedup)
 from _hooklib import (  # noqa: E402
-    CRYPTO_RE, SECRET_RE, SECURITY_DIFF_GIT_ARGS, is_sensitive_scan_exempt,
-    line_digest, marker_root, project_root, sensitive_scan_added_lines,
+    SECURITY_DIFF_GIT_ARGS, SecurityScan, is_sensitive_scan_exempt,
+    marker_root, project_root, security_scan_diff, security_scan_source,
     set_host, utf8_stdio, warn, write_text_atomic,
 )
 
@@ -41,20 +42,26 @@ def run_git(args, cwd):
     )
 
 
-def file_lines(root, rel):
+def file_scan(root, rel):
     p = os.path.join(root, rel)
     try:
-        if os.path.getsize(p) > MAX_UNTRACKED_BYTES:
-            return []
+        metadata = os.lstat(p)
+        if not stat.S_ISREG(metadata.st_mode):
+            return None
+        if metadata.st_size > MAX_UNTRACKED_BYTES:
+            return SecurityScan(False, set())
         with open(p, encoding="utf-8", errors="replace") as f:
-            return f.read().splitlines()
+            source = f.read()
+        return security_scan_source(rel, source, range(1, len(source.splitlines()) + 1))
     except Exception:  # noqa: BLE001
-        return []
+        return None
 
 
-def candidate_lines(root):
-    """Every line the next commit could introduce: added lines of the
-    worktree-vs-HEAD diff (staged and unstaged alike), plus the full content
+def candidate_scan(root):
+    """Separate classified index and worktree snapshots, plus untracked content.
+
+    Every line the next commit could introduce: added lines of the
+    staged diff AND worktree-vs-HEAD diff, plus the full content
     of untracked files — `git diff HEAD` never shows those, but they land in
     the staged diff the moment commit-gate stages them.
 
@@ -69,23 +76,41 @@ def candidate_lines(root):
     it pins the `a/`/`b/` prefix format `sensitive_scan_added_lines` depends
     on for path attribution, regardless of the caller's `diff.mnemonicPrefix`
     / `diff.noprefix` / external-diff config (#279 review MEDIUM-1)."""
-    lines = []
+    staged = run_git([*SECURITY_DIFF_GIT_ARGS, "--cached"], root)
+    if staged.returncode != 0:
+        return None
+    scans = [security_scan_diff(staged.stdout)]
     diff = run_git([*SECURITY_DIFF_GIT_ARGS, "HEAD"], root)
     if diff.returncode == 0:
-        lines += sensitive_scan_added_lines(diff.stdout)
+        scans.append(security_scan_diff(diff.stdout))
     else:
-        # Unborn branch (no HEAD yet): every tracked file is new content.
+        # Confirm an absent branch ref, not merely a failed diff read. A real
+        # read/parse failure must never be laundered through the unborn path.
+        head = run_git(["rev-parse", "--verify", "--quiet", "HEAD"], root)
+        branch = run_git(["symbolic-ref", "--quiet", "HEAD"], root)
+        if head.returncode != 1 or branch.returncode != 0:
+            return None
+        absent = run_git(["show-ref", "--verify", "--quiet", branch.stdout.strip()], root)
+        if absent.returncode != 1:
+            return None
         ls = run_git(["ls-files"], root)
+        if ls.returncode != 0:
+            return None
         for rel in ls.stdout.splitlines():
             if is_sensitive_scan_exempt(rel):
                 continue
-            lines += file_lines(root, rel)
+            scans.append(file_scan(root, rel))
     untracked = run_git(["ls-files", "--others", "--exclude-standard"], root)
+    if untracked.returncode != 0:
+        return None
     for rel in untracked.stdout.splitlines():
         if is_sensitive_scan_exempt(rel):
             continue
-        lines += file_lines(root, rel)
-    return lines
+        scans.append(file_scan(root, rel))
+    if any(scan is None for scan in scans):
+        return None
+    return SecurityScan(any(scan.crypto for scan in scans),
+                        set().union(*(scan.digests for scan in scans)))
 
 
 def main():
@@ -95,11 +120,16 @@ def main():
         warn("no .codearbiter/ here — security-pass.py records nothing outside "
              "an initialized repo")
         sys.exit(1)
-    sensitive = [ln for ln in candidate_lines(root)
-                 if CRYPTO_RE.search(ln) or SECRET_RE.search(ln)]
+    try:
+        scan = candidate_scan(root)
+    except (OSError, subprocess.SubprocessError, ValueError):
+        scan = None
+    if scan is None:
+        warn("security-gate pass refused: unavailable or malformed crypto/secret context")
+        sys.exit(1)
     # #604: the MARKER root is deliberately NOT `root` above. `root` (plain
     # project_root()) must stay wherever this process is actually running —
-    # candidate_lines(root) just scanned exactly that tree's diff, and binding
+    # candidate_scan(root) just scanned exactly that tree's diff, and binding
     # digests to a DIFFERENT tree would review lines nobody staged. But in a
     # linked git worktree, `root` names the worktree's own (gitignored,
     # never-checked-out) `.codearbiter/.markers/`, while the H-09b/H-10b
@@ -110,7 +140,7 @@ def main():
     marker_dir = os.path.join(write_root, ".codearbiter", ".markers")
     os.makedirs(marker_dir, exist_ok=True)
     marker = os.path.join(marker_dir, "security-gate-passed")
-    digests = sorted({line_digest(ln) for ln in sensitive})
+    digests = sorted(scan.digests)
     # Atomic write (migration-002): a crash mid-write never leaves a half-written
     # marker, which the backstop would read as an unrecognized digest and force a
     # spurious gate re-run.