@arbiterforge/ca-pi 0.14.10 → 0.14.16

package/plugins/ca-pi/hooks/_artifactlib.py

@@ -244,6 +244,145 @@ def _resolve_workflow_pair(root: str | Path, slug: str) -> dict[str, object]:
     }
 
 
+def _installed_workflow_preflight(installation: Path) -> dict[str, object]:
+    """Inspect installed prerequisites, not host trust or live-event evidence.
+
+    This never imports an adapter, executes a hook, or writes consumer state.
+    Package integrity and the actual authority boundaries remain separate checks.
+    A successful engine capabilities call alone cannot admit a host workflow.
+    """
+    result: dict[str, object] = {
+        "host": None, "adapter_version": None, "resources_available": False,
+        "evidence_kind": "installed-resource-preflight", "live_host_verified": False,
+        "missing": [],
+    }
+    missing: list[str] = []
+    if installation.name != "artifacts" or installation.parent.name != "helpers":
+        result["missing"] = ["installed host package layout"]
+        return result
+    plugin = installation.parent.parent
+
+    def resource(relative: str, *, document: bool = False):
+        path = plugin / relative
+        try:
+            _trusted_directory(installation, "HOST_WORKFLOW_UNAVAILABLE")
+            _trusted_directory(path.parent, "HOST_WORKFLOW_UNAVAILABLE")
+            descriptor = _open_pinned_regular(path)
+            try:
+                info = os.fstat(descriptor)
+                reparse = getattr(info, "st_file_attributes", 0) & getattr(
+                    stat, "FILE_ATTRIBUTE_REPARSE_POINT", 0)
+                if reparse or not stat.S_ISREG(info.st_mode) or info.st_size <= 0:
+                    raise OSError("required installed resource is not a nonempty regular file")
+                return _decode(os.read(descriptor, MAX_RESPONSE + 1)) if document else True
+            finally:
+                os.close(descriptor)
+        except (OSError, ArtifactError):
+            missing.append(relative)
+            return None
+
+    manifests = [("claude", "ca", ".claude-plugin/plugin.json"),
+                 ("codex", "ca-codex", ".codex-plugin/plugin.json")]
+    present = [row for row in manifests if (plugin / row[2]).exists()
+               or (plugin / row[2]).is_symlink()]
+    if not present:
+        present = [("pi", "ca-pi", "package.json")]
+    if len(present) != 1:
+        result["missing"] = ["one unambiguous installed host manifest"]
+        return result
+    host, name, manifest_path = present[0]
+    manifest = resource(manifest_path, document=True)
+    if (not isinstance(manifest, dict) or manifest.get("name") != name
+            or not isinstance(manifest.get("version"), str)
+            or re.fullmatch(r"[0-9]+\.[0-9]+\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?",
+                            manifest["version"]) is None):
+        result["missing"] = ["matching installed host identity"]
+        return result
+    result.update(host=host, adapter_version=manifest["version"])
+    if host == "pi":
+        result["missing"] = ["Pi production prompt, verification and review authority"]
+        return result
+
+    for filename in ("_approvallib.py", "_prerequisitelib.py", "_sprintapprovallib.py",
+                     "_reconciliationlib.py", "_artifactauthoritylib.py", "_gitexec.py",
+                     "artifact-authority.py", "artifact-authority-hook.py", "prompt-submit.py"):
+        resource("hooks/" + filename)
+    if host == "claude":
+        resource("agents/authority-reviewer.md")
+    registry = resource("hooks/hooks.json", document=True)
+    hooks = registry.get("hooks") if isinstance(registry, dict) else None
+    if not isinstance(hooks, dict):
+        result["missing"] = sorted(set(missing + ["valid installed hook registry"]))
+        return result
+
+    token = "${CLAUDE_PLUGIN_ROOT}" if host == "claude" else "${PLUGIN_ROOT}"
+    command_field = "commandWindows" if host == "codex" and platform.system() == "Windows" else "command"
+
+    def registered(event: str, tool: str | None, script: str) -> bool:
+        groups = hooks.get(event)
+        if not isinstance(groups, list):
+            return False
+        commands = {f'{python} "{token}/hooks/{script}"' for python in ("python", "python3")}
+        for group in groups:
+            if not isinstance(group, dict):
+                continue
+            matcher = group.get("matcher", "")
+            if not isinstance(matcher, str):
+                continue
+            # Check the shipped literal alternatives, not a second regex DSL.
+            if (tool is None and matcher not in {"", "*"}) or (
+                    tool is not None and tool not in matcher.split("|")):
+                continue
+            entries = group.get("hooks")
+            if not isinstance(entries, list):
+                continue
+            if any(isinstance(entry, dict) and entry.get("type") == "command"
+                   and entry.get("async", False) is False
+                   and isinstance(entry.get(command_field), str)
+                   and entry[command_field] in commands for entry in entries):
+                return True
+        return False
+
+    required = [("UserPromptSubmit", None, "prompt-submit.py")]
+    tools = ("Bash", "Agent") if host == "claude" else (
+        "Bash", "shell_command", "exec_command", "unified_exec", "spawn_agent")
+    required += [(event, tool, "artifact-authority-hook.py")
+                 for event in ("PreToolUse", "PostToolUse") for tool in tools]
+    required += [(event, None, "artifact-authority-hook.py")
+                 for event in ("SubagentStart", "SubagentStop")]
+    if host == "claude":
+        required += [("PostToolUseFailure", "Bash", "artifact-authority-hook.py"),
+                     ("PreToolUse", "SendMessage", "artifact-authority-hook.py")]
+    missing.extend(f"{event}:{tool or '*'}:{script}"
+                   for event, tool, script in required if not registered(event, tool, script))
+    result["missing"] = sorted(set(missing))
+    result["resources_available"] = not missing
+    return result
+
+
+def _require_host_workflow(client: "ArtifactClient") -> None:
+    readiness = client.workflow_preflight()
+    if readiness["resources_available"] is not True:
+        raise ArtifactError(
+            "HOST_WORKFLOW_UNAVAILABLE",
+            ("installed HTML workflow prerequisites are unavailable: "
+             + ", ".join(readiness["missing"]))[:400]
+            + "; repair this package or use a supported host; no fallback artifacts",
+        )
+
+
+# The native engine ships only through the release distribution channels, never
+# through a main-branch checkout, so the repair is always "install from the
+# channel". Named concretely so the user is not left to guess (ADR-0040).
+PAYLOAD_REPAIR_HINT = (
+    "Claude Code: /plugin marketplace update codearbiter, then /plugin update ca@codearbiter; "
+    "Codex (registered without --ref): codex plugin remove ca-codex@codearbiter, "
+    "codex plugin marketplace remove codearbiter, "
+    "codex plugin marketplace add arbiterForge/codeArbiter --ref ca-codex-marketplace, "
+    "then codex plugin add ca-codex@codearbiter; Pi: pi install npm:@arbiterforge/ca-pi"
+)
+
+
 def _require_authoring_capability(client: "ArtifactClient") -> None:
     """Fail one default-HTML route with a bounded repair diagnostic."""
     try:
@@ -252,7 +391,7 @@ def _require_authoring_capability(client: "ArtifactClient") -> None:
         raise ArtifactError(
             "CAPABILITY_MISSING",
             f"repair or reinstall the pinned artifact payload ({exc.code}); "
-            "new HTML work cannot fall back to Markdown",
+            f"new HTML work cannot fall back to Markdown. Repair: {PAYLOAD_REPAIR_HINT}",
         ) from exc
     if (
         not isinstance(capabilities, dict)
@@ -262,7 +401,7 @@ def _require_authoring_capability(client: "ArtifactClient") -> None:
         raise ArtifactError(
             "CAPABILITY_MISSING",
             "repair or reinstall the qualified default-on artifact payload; "
-            "new HTML work cannot fall back to Markdown",
+            f"new HTML work cannot fall back to Markdown. Repair: {PAYLOAD_REPAIR_HINT}",
         )
 
 
@@ -305,10 +444,13 @@ def _select_authoring_route(
                 "an installation-pinned artifact client bound to this repository is required",
             )
         _require_authoring_capability(client)
+        if _resolve_workflow_pair(root, slug) != selected:
+            raise ArtifactError("STALE_ROUTE", "artifact namespace changed during the capability probe")
+        _require_host_workflow(client)
         if _resolve_workflow_pair(root, slug) != selected:
             raise ArtifactError(
                 "STALE_ROUTE",
-                "artifact namespace changed during the capability probe",
+                "artifact namespace changed during the installed host preflight",
             )
     return {"workflow": workflow, "lane": lane, "mode": "artifact", **selected}
 
@@ -319,8 +461,17 @@ def _preflight_plan_authoring(
     *,
     spec_artifact_id: str,
     spec_normative_sha256: str,
+    draft_for_pair: bool = False,
 ) -> Path:
-    """Verify one approved HTML spec and return its unwritten plan target."""
+    """Verify the exact spec. Only initial sprint-pair preparation admits a ready draft.
+
+    Draft preparation never approves the spec or plan and never permits execution.
+    The ordinary feature/sequential path still requires an approved spec.
+    """
+    if type(draft_for_pair) is not bool:
+        raise ArtifactError("INVALID_ROUTE", "draft_for_pair must be an explicit boolean")
+    if draft_for_pair and (not isinstance(selected, dict) or selected.get("workflow") != "sprint" or selected.get("lane") != "full"):
+        raise ArtifactError("INVALID_ROUTE", "draft preview is limited to full-lane initial sprint pairs")
     if not isinstance(selected, dict):
         raise ArtifactError("INVALID_ROUTE", "plan authoring requires a selected route")
     slug = selected.get("slug")
@@ -362,6 +513,7 @@ def _preflight_plan_authoring(
     ):
         raise ArtifactError("AUTHORITY_MISMATCH", "spec normative digest is invalid")
 
+    _require_host_workflow(client)
     identity = client.call("identity", {"artifact_id": spec_artifact_id})
     expected_path = f".codearbiter/specs/{slug}.html"
     if (
@@ -376,7 +528,7 @@ def _preflight_plan_authoring(
         )
     approved = client.call(
         "validate",
-        {"artifact_id": spec_artifact_id, "gate": "approved"},
+        {"artifact_id": spec_artifact_id, "gate": "ready" if draft_for_pair else "approved"},
         permit_invalid=True,
     )
     authority = approved.get("authority")
@@ -385,8 +537,9 @@ def _preflight_plan_authoring(
         or approved.get("artifact_id") != spec_artifact_id
         or approved.get("normative_sha256") != spec_normative_sha256
         or not isinstance(authority, dict)
-        or authority.get("state") != "approved"
-        or authority.get("authority_verified") is not True
+        or approved.get("model_sha256") != identity.get("model_sha256")
+        or authority.get("state") != ("draft" if draft_for_pair else "approved")
+        or authority.get("authority_verified") is not (not draft_for_pair)
     ):
         raise ArtifactError(
             "AUTHORITY_UNVERIFIED",
@@ -644,6 +797,10 @@ class ArtifactClient:
         self.installation = _trusted_directory(installation, "CAPABILITY_MISSING")
         self.timeout = timeout
 
+    def workflow_preflight(self) -> dict[str, object]:
+        """Read fresh installed prerequisites; never attest live host authority."""
+        return _installed_workflow_preflight(self.installation)
+
     def _open_binary(self) -> int:
         system = {"Linux":"linux", "Darwin":"darwin", "Windows":"windows"}.get(platform.system())
         arch = {"x86_64":"amd64", "amd64":"amd64", "aarch64":"arm64", "arm64":"arm64"}.get(platform.machine().lower())

package/plugins/ca-pi/hooks/_artifactpromptlib.py

@@ -0,0 +1,177 @@
+#!/usr/bin/env python3
+# codeArbiter — cross-repository routing for exact artifact authority prompts.
+"""Register and resolve target repositories without granting prompt authority."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+from pathlib import Path
+import stat
+import tempfile
+
+
+REGISTRY_PARENT = Path(tempfile.gettempdir())
+FORMAT = "codearbiter.artifact-prompt-route/0.1.0"
+
+
+class PromptRouteError(RuntimeError):
+    pass
+
+
+def _canonical(value):
+    return json.dumps(value, ensure_ascii=True, sort_keys=True, separators=(",", ":")).encode()
+
+
+def _digest(value: bytes) -> str:
+    return hashlib.sha256(value).hexdigest()
+
+
+def _identity(root: Path) -> dict[str, str]:
+    root = root.resolve(strict=True)
+    info = root.lstat()
+    reparse = getattr(info, "st_file_attributes", 0) & 0x400
+    if stat.S_ISLNK(info.st_mode) or reparse or not stat.S_ISDIR(info.st_mode):
+        raise PromptRouteError("artifact prompt target is not a real directory")
+    return {
+        "path": str(root),
+        "filesystem_id": f"{int(getattr(info, 'st_dev', 0))}:{int(getattr(info, 'st_ino', 0))}",
+    }
+
+
+def _registry() -> Path:
+    namespace = f"uid-{os.getuid()}" if hasattr(os, "getuid") else "current-user"
+    root = REGISTRY_PARENT.resolve(strict=True) / f"codearbiter-prompt-routes-{namespace}"
+    root.mkdir(mode=0o700, exist_ok=True)
+    info = root.lstat()
+    reparse = getattr(info, "st_file_attributes", 0) & 0x400
+    if stat.S_ISLNK(info.st_mode) or reparse or not stat.S_ISDIR(info.st_mode):
+        raise PromptRouteError("artifact prompt registry is unsafe")
+    if hasattr(os, "getuid"):
+        if info.st_uid != os.getuid():
+            raise PromptRouteError("artifact prompt registry has another owner")
+        os.chmod(root, 0o700)
+    return root
+
+
+def _key(route: str, artifact_id: str, repository: dict[str, str]) -> str:
+    return _digest(_canonical({"route": route, "artifact_id": artifact_id, "repository": repository}))
+
+
+def register(root: str | Path, route: str, artifact_id: str, prompt: str,
+             *, binding_sha256: str | None = None) -> None:
+    if route not in {"approval", "prerequisite", "reconciliation"} or not isinstance(prompt, str) or not prompt:
+        raise PromptRouteError("artifact prompt route is invalid")
+    if binding_sha256 is not None and (
+        not isinstance(binding_sha256, str)
+        or len(binding_sha256) != 64
+        or any(ch not in "0123456789abcdef" for ch in binding_sha256)
+    ):
+        raise PromptRouteError("artifact prompt binding is invalid")
+    repository = _identity(Path(root))
+    value = {
+        "format": FORMAT,
+        "route": route,
+        "artifact_id": artifact_id,
+        "prompt_sha256": _digest(prompt.encode("utf-8")),
+        "repository": repository,
+    }
+    if binding_sha256 is not None:
+        value["binding_sha256"] = binding_sha256
+    value["integrity_sha256"] = _digest(_canonical(value))
+    registry = _registry()
+    key = _key(route, artifact_id, repository)
+    path = registry / f"{key}.json"
+    data = _canonical(value)
+    # Each caller owns an exclusively created pending marker before registering.
+    # A prior route at this key therefore belongs to an interrupted request.
+    fd, temporary = tempfile.mkstemp(prefix=f".{key}.", suffix=".tmp", dir=registry)
+    try:
+        try:
+            view = memoryview(data)
+            while view:
+                written = os.write(fd, view)
+                if written <= 0:
+                    raise OSError("short prompt-route write")
+                view = view[written:]
+            os.fsync(fd)
+        finally:
+            os.close(fd)
+        os.replace(temporary, path)
+    finally:
+        try:
+            os.unlink(temporary)
+        except FileNotFoundError:
+            pass
+
+
+def resolve(route: str, prompt: str) -> Path | None:
+    if route not in {"approval", "prerequisite", "reconciliation"} or not isinstance(prompt, str):
+        return None
+    prompt_hash = _digest(prompt.encode("utf-8"))
+    matches = []
+    for path in _registry().glob("*.json"):
+        try:
+            raw = path.read_bytes()
+            if len(raw) > 16384:
+                continue
+            value = json.loads(raw.decode("utf-8"))
+            unsigned = dict(value)
+            integrity = unsigned.pop("integrity_sha256", None)
+            repository = value.get("repository")
+            if (
+                value.get("format") != FORMAT
+                or value.get("route") != route
+                or value.get("prompt_sha256") != prompt_hash
+                or integrity != _digest(_canonical(unsigned))
+                or not isinstance(repository, dict)
+            ):
+                continue
+            root = Path(repository.get("path", ""))
+            if _identity(root) != repository:
+                continue
+            matches.append(root.resolve(strict=True))
+        except (OSError, UnicodeError, ValueError, PromptRouteError):
+            continue
+    unique = {str(path): path for path in matches}
+    if len(unique) > 1:
+        raise PromptRouteError("artifact authority prompt matches multiple repositories")
+    return next(iter(unique.values()), None)
+
+
+def unregister(root: str | Path, route: str, artifact_id: str) -> None:
+    repository = _identity(Path(root))
+    path = _registry() / f"{_key(route, artifact_id, repository)}.json"
+    try:
+        path.unlink()
+    except FileNotFoundError:
+        pass
+
+
+def binding(root: str | Path, route: str, artifact_id: str) -> str | None:
+    repository = _identity(Path(root))
+    path = _registry() / f"{_key(route, artifact_id, repository)}.json"
+    try:
+        raw = path.read_bytes()
+        if len(raw) > 16384:
+            raise OSError("oversized prompt route")
+        value = json.loads(raw.decode("utf-8"))
+        unsigned = dict(value)
+        integrity = unsigned.pop("integrity_sha256", None)
+    except (OSError, UnicodeError, ValueError) as exc:
+        raise PromptRouteError("artifact prompt route is unreadable") from exc
+    if (
+        value.get("format") != FORMAT
+        or value.get("route") != route
+        or value.get("artifact_id") != artifact_id
+        or value.get("repository") != repository
+        or integrity != _digest(_canonical(unsigned))
+    ):
+        raise PromptRouteError("artifact prompt route is malformed")
+    result = value.get("binding_sha256")
+    if not isinstance(result, str) or len(result) != 64 or any(
+        ch not in "0123456789abcdef" for ch in result
+    ):
+        raise PromptRouteError("artifact prompt route has no closed binding")
+    return result

package/plugins/ca-pi/hooks/_host.py

@@ -11,7 +11,7 @@ import hostapi  # noqa: E402
 class PiHost(hostapi.Host):
     name = "pi"
     adapter_name = "@arbiterforge/ca-pi"
-    adapter_version = "0.14.10"
+    adapter_version = "0.14.16"
     update_target = "ca-pi"
     update_tag_prefix = "ca-pi-v"
     update_command = "pi update npm:@arbiterforge/ca-pi"

package/plugins/ca-pi/hooks/_overrideappendlib.py

@@ -78,7 +78,11 @@ def _validate_file_type(path):
 
 def _validate_existing(path, raw):
     _validate_file_type(path)
-    if raw.startswith(b"\xef\xbb\xbf") or b"\x00" in raw or b"\r" in raw:
+    # Historical audit bytes are immutable. A stray CR can exist in an older
+    # row without making a new O_APPEND write unsafe, so preserve it verbatim
+    # and require only that newly written rows use LF. Rewriting the file to
+    # normalize old bytes would violate the append-only contract.
+    if raw.startswith(b"\xef\xbb\xbf") or b"\x00" in raw:
         raise OverrideAppendError("overrides.log is not canonical UTF-8 LF text")
     try:
         raw.decode("utf-8", errors="strict")

package/plugins/ca-pi/hooks/_prerequisitelib.py

@@ -38,6 +38,8 @@ import time
 from typing import Any
 
 import _artifactlib
+import _artifactauthoritylib
+import _artifactpromptlib
 from _hooklib import acquire_lock, release_lock
 
 
@@ -393,7 +395,7 @@ def _validate_record(value: Any, prerequisite_id: str) -> bool:
     )
 
 
-def _validate_confirmed_state(value: dict[str, Any]) -> None:
+def _validate_confirmed_state(value: dict[str, Any], *, check_source: bool = True) -> None:
     event = value["event"]
     expected_subject = {
         "artifact_id": value["artifact_id"],
@@ -444,7 +446,7 @@ def _validate_confirmed_state(value: dict[str, Any]) -> None:
     expected_source = (
         SOURCE_DIR / f"{_digest(_canonical(event))}.json"
     ).as_posix()
-    if value["authority_source"] != expected_source:
+    if check_source and value["authority_source"] != expected_source:
         raise PrerequisiteError(
             "INVALID_PENDING_PREREQUISITE",
             "confirmed authority source does not match the event",
@@ -535,7 +537,7 @@ def _load_pending(root: Path, artifact_id: str) -> dict[str, Any] | None:
             "INVALID_PENDING_PREREQUISITE", "captured state is incomplete"
         )
     else:
-        _validate_confirmed_state(value)
+        _validate_confirmed_state(value, check_source=False)
         if value["mutation_request"] != _expected_mutation_request(value):
             raise PrerequisiteError(
                 "INVALID_PENDING_PREREQUISITE",
@@ -601,16 +603,22 @@ def arm_user_prerequisite(
             "PENDING_PREREQUISITE",
             "resolve or cancel this plan's existing prerequisite request first",
         ) from exc
+    reply = (
+        f"satisfy-prerequisite {artifact_id} {prerequisite_id} "
+        f"{confirmation_nonce}"
+    )
+    try:
+        _artifactpromptlib.register(root, "prerequisite", artifact_id, reply)
+    except _artifactpromptlib.PromptRouteError:
+        (root / relative).unlink()
+        raise
     return {
         "artifact_id": artifact_id,
         "prerequisite_id": prerequisite_id,
         "title": record["title"],
         "requirement": record["requirement"],
         "review_packet_sha256": packet_sha256,
-        "reply": (
-            f"satisfy-prerequisite {artifact_id} {prerequisite_id} "
-            f"{confirmation_nonce}"
-        ),
+        "reply": reply,
         "pending": relative.as_posix(),
     }
 
@@ -752,12 +760,17 @@ def consume_user_prerequisite(
                 session_id=session_id,
                 now=observed_at,
             )
-        source_ref, source_sha256 = _publish_event(root, pending)
         if pending["state"] == "CONFIRMED":
-            captured = client.call(
-                "capture",
-                {"source_ref": source_ref, "source_sha256": source_sha256},
-            )
+            observed_host, separator, observed_session = pending["event"]["origin"].partition(":UserPromptSubmit:")
+            if not separator:
+                raise PrerequisiteError("INVALID_PENDING_PREREQUISITE", "confirmed prompt origin is malformed")
+            try:
+                captured = _artifactauthoritylib.capture_user_prompt(
+                    root, client, pending["event"], host=observed_host,
+                    session_id=observed_session,
+                )
+            except _artifactauthoritylib.AuthorityError as exc:
+                raise PrerequisiteError("INVALID_AUTHORITY_SOURCE", str(exc)) from exc
             receipt = captured.get("receipt")
             if not isinstance(receipt, str) or RECEIPT_RE.fullmatch(receipt) is None:
                 raise PrerequisiteError("INVALID_RECEIPT", "capture returned no valid receipt")
@@ -774,18 +787,20 @@ def consume_user_prerequisite(
             }
             captured_state = dict(pending)
             captured_state.update(
-                state="CAPTURED", receipt=receipt, mutation_request=mutation_request
+                state="CAPTURED", receipt=receipt, mutation_request=mutation_request,
+                authority_source=captured["authority_source"],
             )
             _replace_state(root, _pending_relative(artifact_id), captured_state)
             pending = captured_state
         result = client.call("prerequisite", pending["mutation_request"])
         (root / _pending_relative(artifact_id)).unlink()
+        _artifactpromptlib.unregister(root, "prerequisite", artifact_id)
         return {
             "matched": True,
             "satisfied": True,
             "artifact_id": artifact_id,
             "prerequisite_id": prerequisite_id,
-            "authority_source": source_ref,
+            "authority_source": pending["authority_source"],
             "receipt": pending["receipt"],
             "revision": result.get("revision"),
             "replayed": bool((result.get("transaction") or {}).get("replayed")),
@@ -817,6 +832,7 @@ def cancel_user_prerequisite(
                 "a confirmed prerequisite decision must be recovered, not cancelled",
             )
         (root / _pending_relative(artifact_id)).unlink()
+        _artifactpromptlib.unregister(root, "prerequisite", artifact_id)
         return {
             "artifact_id": artifact_id,
             "prerequisite_id": prerequisite_id,
@@ -868,6 +884,7 @@ def supersede_user_prerequisite(
                     raise
             else:
                 (root / _pending_relative(artifact_id)).unlink()
+                _artifactpromptlib.unregister(root, "prerequisite", artifact_id)
                 return {
                     "artifact_id": artifact_id,
                     "prerequisite_id": prerequisite_id,
@@ -878,6 +895,7 @@ def supersede_user_prerequisite(
                     "replayed": bool((result.get("transaction") or {}).get("replayed")),
                 }
         (root / _pending_relative(artifact_id)).unlink()
+        _artifactpromptlib.unregister(root, "prerequisite", artifact_id)
         return {
             "artifact_id": artifact_id,
             "prerequisite_id": prerequisite_id,
@@ -904,20 +922,23 @@ def consume_from_hook(
             if attempted
             else ""
         )
-    if not (Path(root) / _pending_relative(match[0])).exists():
-        return (
-            "codeArbiter: prerequisite capture failed: no matching armed request"
-            if attempted
-            else ""
-        )
     try:
+        routed = _artifactpromptlib.resolve("prerequisite", prompt)
+        root = routed or Path(root)
+        if not (Path(root) / _pending_relative(match[0])).exists():
+            return (
+                "codeArbiter: prerequisite capture failed: no matching armed request"
+                if attempted
+                else ""
+            )
         client = _artifactlib.ArtifactClient(
             root, Path(plugin_root) / "helpers" / "artifacts"
         )
         result = consume_user_prerequisite(
             root, client, prompt, host=host, session_id=session_id
         )
-    except (PrerequisiteError, _artifactlib.ArtifactError, OSError) as exc:
+    except (PrerequisiteError, _artifactlib.ArtifactError,
+            _artifactpromptlib.PromptRouteError, OSError) as exc:
         return f"codeArbiter: prerequisite capture failed: {exc}"
     if not result.get("satisfied"):
         return "codeArbiter: prerequisite capture failed: confirmation did not match"
@@ -966,6 +987,7 @@ def main(argv: list[str] | None = None) -> int:
 if __name__ == "__main__":
     try:
         raise SystemExit(main())
-    except (PrerequisiteError, _artifactlib.ArtifactError) as exc:
+    except (PrerequisiteError, _artifactlib.ArtifactError,
+            _artifactpromptlib.PromptRouteError) as exc:
         sys.stderr.write(str(exc) + "\n")
         raise SystemExit(1)