@arbiterforge/ca-pi 0.14.12 → 0.14.16

package/plugins/ca-pi/hooks/artifact-authority-hook.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
-# codeArbiter — Codex hook bridge for independent artifact reviewers.
-"""Correlate closed production review requests with documented Codex hooks."""
+# codeArbiter — Codex and Claude Code hook bridge for artifact authority.
+"""Correlate closed production verification and review requests with host hooks."""
 
 import json
 import os
@@ -61,8 +61,63 @@ def main() -> int:
     return 0
 
 
+def claude_main() -> int:
+    """Claude Code seams. Success is silent: an explicit allow would bypass the
+    user's permission rules, and a SubagentStop block would make the reviewer
+    keep going. Only a PreToolUse refusal prints (a Claude deny decision)."""
+    _hooklib.utf8_stdio()
+    payload = _hooklib.read_input()
+    if not isinstance(payload, dict):
+        return 0
+    event = payload.get("hook_event_name")
+    tool = payload.get("tool_name")
+    root = _hooklib.project_root(payload)
+    try:
+        if event in {"PreToolUse", "PostToolUse", "PostToolUseFailure"} and tool == "Bash":
+            _artifactauthoritylib.observe_verifier_hook(root, payload, host="claude")
+        elif (
+            (event in {"PreToolUse", "PostToolUse"} and tool == "Agent")
+            or (event == "PreToolUse" and tool == "SendMessage")
+            or event in {"SubagentStart", "SubagentStop"}
+        ):
+            _artifactauthoritylib.observe_claude_hook(root, payload)
+    except Exception as exc:  # noqa: BLE001 - an authority seam must fail closed
+        reason = f"codeArbiter authority producer blocked: {exc}"
+        if event == "PreToolUse" and (
+            isinstance(exc, _artifactauthoritylib.AuthorityError) or _authority_call(payload)
+        ):
+            print(json.dumps({"hookSpecificOutput": {
+                "hookEventName": "PreToolUse",
+                "permissionDecision": "deny",
+                "permissionDecisionReason": reason,
+            }}))
+        else:
+            sys.stderr.write(reason + "\n")
+    return 0
+
+
+def _authority_call(payload: dict) -> bool:
+    """Whether an unexpected failure must deny: an ordinary tool call is never
+    refused, but a SendMessage could steer a running review and an authority
+    launch or wrapper must not proceed unobserved."""
+    tool = payload.get("tool_name")
+    tool_input = payload.get("tool_input")
+    tool_input = tool_input if isinstance(tool_input, dict) else {}
+    if tool == "SendMessage":
+        return True
+    if tool == "Agent":
+        prompt = tool_input.get("prompt")
+        return isinstance(prompt, str) and prompt.startswith("[CODEARBITER_AUTHORITY_REQUEST:")
+    if tool == "Bash":
+        command = tool_input.get("command")
+        return isinstance(command, str) and "artifact-authority" in command.casefold()
+    return False
+
+
 def run(host) -> int:
     _hooklib.set_host(host)
+    if host.name == "claude":
+        return claude_main()
     if host.name != "codex":
         return 0
     return main()

package/plugins/ca-pi/hooks/artifact-authority.py

@@ -11,6 +11,7 @@ import sys
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 import _artifactauthoritylib  # noqa: E402
 import _artifactlib  # noqa: E402
+import hostapi  # noqa: E402
 
 
 def _workspace_map(values: list[str]) -> dict[str, Path]:
@@ -37,6 +38,14 @@ def main(argv=None) -> int:
         choices=("verification", "spec_review", "quality_review"),
     )
     arm.add_argument("--workspace", action="append", default=[], metavar="LABEL=PATH")
+    arm.add_argument(
+        "--host", choices=sorted(_artifactauthoritylib.HOSTS), default=None,
+        help="observing host; defaults to the host this package was built for",
+    )
+    arm.add_argument(
+        "--reviewer-model", choices=sorted(_artifactauthoritylib.CLAUDE_REVIEWER_MODELS),
+        default="opus", help="Claude reviewer model pinned into the launch envelope",
+    )
     verify = sub.add_parser("verify")
     verify.add_argument("--root", required=True)
     verify.add_argument("--request-id", required=True)
@@ -54,10 +63,23 @@ def main(argv=None) -> int:
     )
     if args.command == "arm":
         workspaces = _workspace_map(args.workspace)
+        host = args.host or hostapi.load_host().name
+        if host not in _artifactauthoritylib.HOSTS:
+            raise _artifactauthoritylib.AuthorityError(
+                "UNSUPPORTED_HOST_SEAM", f"host {host} has no verification or review authority"
+            )
         result = _artifactauthoritylib.arm_request(
             root, client, args.artifact_id, args.record_id, args.activity,
-            workspace_roots=workspaces or None,
+            workspace_roots=workspaces or None, host=host,
+            reviewer_model=args.reviewer_model,
         )
+        if host == "claude" and args.activity == "verification":
+            # The Claude verifier hook pins this exact shipped script and
+            # refuses shell expansion, so hand back literal paths.
+            script = Path(__file__).resolve().parent / "artifact-authority.py"
+            result["verify_command"] = (
+                f'python "{script}" verify --root "{root}" --request-id {result["request_id"]}'
+            )
     elif args.command == "verify":
         result = _artifactauthoritylib.run_verification(
             root, client, args.request_id,

package/plugins/ca-pi/hooks/hostapi.py

@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "2.21.12"
+    adapter_version = "2.21.16"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,

package/plugins/ca-pi/hooks/releasehash.py

@@ -1,8 +1,8 @@
 #!/usr/bin/env python3
 # codeArbiter — executable release-command confirmation (A-2.10).
 #
-# A row's `pre-tag` commands and optional `release-build` are operator-authored
-# shell that `/ca:release` EXECUTES before composing a tag.
+# A row's `pre-tag`, `release-build`, `rebuild`, and `generate` commands are
+# operator-authored shell that `/ca:release` may execute before publication.
 # `.codearbiter/release-targets.md` is
 # marker-gated under H-22, so changing those commands already costs a fresh
 # authoring marker — but that gate is about WRITING the file. Nothing made the
@@ -31,11 +31,13 @@
 # file.
 #
 # Public API:
-#   pre_tag_digest(commands, release_build=None) -> str
+#   pre_tag_digest(commands, release_build=None, rebuild=None, generate=None)
+#       -> str
 #   confirmation_path(root, target) -> str
 #   read_confirmation(root, target) -> str | None
 #   record_confirmation(root, target, digest) -> str
-#   confirmation_state(root, target, commands, release_build=None) -> str
+#   confirmation_state(root, target, commands, release_build=None,
+#                      rebuild=None, generate=None) -> str
 #   main(argv) -> int
 #
 # CLI:
@@ -78,7 +80,7 @@ NEVER = "never-confirmed"
 NO_COMMANDS = "no-commands"
 
 
-def pre_tag_digest(commands, release_build=None):
+def pre_tag_digest(commands, release_build=None, rebuild=None, generate=None):
     """A stable digest of a row's executable release command inputs.
 
     ORDER-SENSITIVE on purpose. The commands run in declared order and a
@@ -91,10 +93,10 @@ def pre_tag_digest(commands, release_build=None):
     change to this construction cannot be mistaken for a content change
     by an old recorded value.
 
-    Rows without `release-build` deliberately retain the exact v1 digest and
-    marker identity, so existing confirmations do not churn. A present build
-    command is appended with a typed, length-prefixed record, so changing only
-    that command invalidates the same per-target confirmation marker.
+    Rows without any newly bound scalar command deliberately retain the exact
+    v1 digest and marker identity, so existing confirmations do not churn.
+    Each present scalar command is appended with a typed, length-prefixed
+    record, so changing only one invalidates the same per-target marker.
 
     Pure and non-raising: malformed values degrade conservatively to their
     absent forms rather than raising inside a release lane.
@@ -108,6 +110,10 @@ def pre_tag_digest(commands, release_build=None):
         parts.append(f"{len(command)}:{command}")
     if isinstance(release_build, str) and release_build:
         parts.append(f"release-build:{len(release_build)}:{release_build}")
+    if isinstance(rebuild, str) and rebuild:
+        parts.append(f"rebuild:{len(rebuild)}:{rebuild}")
+    if isinstance(generate, str) and generate:
+        parts.append(f"generate:{len(generate)}:{generate}")
     joined = "\n".join(parts)
     return hashlib.sha256(joined.encode("utf-8")).hexdigest()
 
@@ -162,22 +168,24 @@ def record_confirmation(root, target, digest):
     return path
 
 
-def confirmation_state(root, target, commands, release_build=None):
+def confirmation_state(root, target, commands, release_build=None,
+                       rebuild=None, generate=None):
     """One of `confirmed` / `changed` / `never-confirmed` / `no-commands`.
 
     `no-commands` is deliberately distinct from `confirmed`: a row that
-    declares neither pre-tag commands nor release-build has nothing to
-    confirm, and reporting it as confirmed would claim an operator approved
-    something that does not exist. A release-build-only row still requires
-    confirmation. The lane treats `no-commands` and `confirmed` as
+    declares none of pre-tag, release-build, rebuild, or generate has nothing
+    to confirm, and reporting it as confirmed would claim an operator approved
+    something that does not exist. A row with any one scalar command still
+    requires confirmation. The lane treats `no-commands` and `confirmed` as
     "proceed", but only one of them is a statement about human review.
     """
-    if not commands and not release_build:
+    if not commands and not release_build and not rebuild and not generate:
         return NO_COMMANDS
     recorded = read_confirmation(root, target)
     if recorded is None:
         return NEVER
-    return (CONFIRMED if recorded == pre_tag_digest(commands, release_build)
+    return (CONFIRMED if recorded == pre_tag_digest(
+        commands, release_build, rebuild, generate)
             else CHANGED)
 
 
@@ -187,7 +195,8 @@ def _row_executable_inputs(target, targets_path=None):
     row = next((r for r in rows if r["target"] == target), None)
     if row is None:
         return None
-    return row.get("pre_tag") or [], row.get("release_build")
+    return (row.get("pre_tag") or [], row.get("release_build"),
+            row.get("rebuild"), row.get("generate"))
 
 
 def main(argv=None):
@@ -207,26 +216,29 @@ def main(argv=None):
     if executable_inputs is None:
         sys.stderr.write(f"unknown release target: {target}\n")
         return 65
-    commands, release_build = executable_inputs
+    commands, release_build, rebuild, generate = executable_inputs
 
     if command == "digest":
-        print(pre_tag_digest(commands, release_build))
+        print(pre_tag_digest(commands, release_build, rebuild, generate))
         return 0
 
     if command == "record":
         path = record_confirmation(
-            root, target, pre_tag_digest(commands, release_build))
+            root, target, pre_tag_digest(
+                commands, release_build, rebuild, generate))
         print(f"recorded executable-command confirmation for {target}: {path}")
         return 0
 
-    state = confirmation_state(root, target, commands, release_build)
+    state = confirmation_state(
+        root, target, commands, release_build, rebuild, generate)
     print(state)
     if state in (CONFIRMED, NO_COMMANDS):
         return 0
     if state == CHANGED:
         sys.stderr.write(
             f"releasehash: {target}'s executable release commands have CHANGED "
-            "since they were last confirmed. Read every pre-tag and release-build "
+            "since they were last confirmed. Read every pre-tag, release-build, "
+            "rebuild, and generate "
             "command, and re-confirm with "
             f"`releasehash.py record {target}` before releasing. These commands "
             "are executed by the release lane, so a change nobody has read is "
@@ -234,7 +246,8 @@ def main(argv=None):
         return 1
     sys.stderr.write(
         f"releasehash: {target}'s executable release commands have never been "
-        f"confirmed. Read every pre-tag and release-build command, then run "
+        f"confirmed. Read every pre-tag, release-build, rebuild, and generate "
+        f"command, then run "
         f"`releasehash.py record {target}`.\n")
     return 2
 

package/plugins/ca-pi/includes/artifacts.md

@@ -10,11 +10,30 @@ default to canonical `.html`. Check the installed capability before writing; a
 missing, invalid, mismatched or unqualified capability is a STOP and
 the workflow must not fall back to Markdown or create any fallback artifact.
 Report `CAPABILITY_MISSING` and direct the user to repair or reinstall the pinned
-artifact payload before retrying. An existing `.md` exact pair remains Markdown
+artifact payload before retrying. The payload ships only through the release
+channels: Claude Code `/plugin marketplace update codearbiter` then
+`/plugin update ca@codearbiter`; Codex the `ca-codex-marketplace` ref; Pi
+`pi install npm:@arbiterforge/ca-pi`. A main-branch checkout never carries it. An existing `.md` exact pair remains Markdown
 and continues on the legacy path without automatic conversion. The feature
 small lane remains an inline mini-spec and creates no artifact. HTML `--farm`
 dispatch remains disabled and outside this rollout.
 
+## Installed host admission
+
+Before new full-lane or plan authoring, the bridge checks the exact installed
+host's required producers, helpers, reviewer charter where applicable, and
+platform-specific hook registrations. `_select_authoring_route` and
+`_preflight_plan_authoring` require this read-only preflight in addition to the
+native engine capability. `HOST_WORKFLOW_UNAVAILABLE` stops before authoring;
+repair the installed package or use a supported host. Never create a fallback
+artifact, substitute another package, or mint an authority event to proceed.
+
+`ArtifactClient.workflow_preflight()` reports only installed resources. It does
+not prove host trust, enabled hooks, supported host-version behavior, reviewer
+independence, or a completed live workflow. Actual authority producers and their
+existing validation remain required. Pi currently fails this admission check;
+existing Markdown pairs and the inline small feature lane are unchanged.
+
 ## Internal execution contract
 
 The normal qualified package's installation-owned `release.json` pins the native
@@ -173,9 +192,9 @@ scope evidence. Provisional progress never counts as completion.
 The orchestrator executes the declared verification through its existing governed
 execution tool through the installed production authority adapter; it never
 constructs a successful workflow event itself. Arm an exact task request first.
-Verification and review authority below is currently Codex-only. On Claude or
-Pi, stop at this boundary rather than treating model-authored results as
-authority; their installed prompt approval seams do not imply verification or
+Verification and review authority below is supported on Codex and Claude Code.
+On Pi, stop at this boundary rather than treating model-authored results as
+authority; its installed prompt approval seam does not imply verification or
 review support.
 Every distinct `cwd` label in the engine context must be mapped once to an exact
 linked Git worktree root. Mapped worktrees must share the artifact repository's
@@ -204,8 +223,9 @@ attempt under the same request.
 
 For `spec_review` or `quality_review`, arm the corresponding activity without
 workspace mappings and dispatch the returned `launch_envelope` unchanged to one
-fresh host subagent. The Codex hooks bind the exact spawn call, child start and
-child stop; a pasted or coordinator-authored decision is not review authority.
+fresh host subagent. The host hooks bind the exact launch call, child start and
+the child's first stop; a pasted or coordinator-authored decision is not review
+authority.
 Publish the completed request through the same `publish` command. `task-review`
 records the separate verification and spec-review receipts. After every task in
 the scope reaches `REVIEW`, reverify against one current source snapshot, run the

package/plugins/ca-pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.14.12",
+  "version": "0.14.16",
   "private": true,
   "license": "AGPL-3.0-only",
   "type": "module",