@arbiterforge/ca-pi 0.14.7 → 0.14.9

package/README.md

@@ -10,7 +10,7 @@ project context. You decide. codeArbiter enforces.
 <img alt="Claude Code plugin" src="https://img.shields.io/badge/Claude_Code-plugin-d97757">
 <img alt="Codex plugin" src="https://img.shields.io/badge/OpenAI_Codex-plugin-10a37f">
 <img alt="Pi Feature Forge preview" src="https://img.shields.io/badge/ca--pi-Feature_Forge_preview-d97757">
-<img alt="version 2.21.7" src="https://img.shields.io/badge/version-2.21.7-2b7489">
+<img alt="version 2.21.9" src="https://img.shields.io/badge/version-2.21.9-2b7489">
 <img alt="core lanes" src="https://img.shields.io/badge/core_lanes-18-555">
 <img alt="skills" src="https://img.shields.io/badge/skills-23-555">
 <img alt="agents" src="https://img.shields.io/badge/agents-19-555">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.14.7",
+  "version": "0.14.9",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/plugins/ca-pi/CHANGELOG.md

@@ -4,6 +4,44 @@ All notable changes to `ca-pi` are documented in this file.
 
 ## [Unreleased]
 
+## [0.14.9] - 2026-09-22
+
+### Fixed
+
+- Route understood requests to the existing workflow without compulsory
+  command syntax; keep questions and draft-only requests non-mutating.
+- Recover ordinary quality failures inside an approved sprint through
+  the original gates and current typed evidence, without adding routine
+  user checkpoints or expanding authority. HTML farm remains disabled.
+
+## [0.14.8] - 2026-09-22
+
+### Fixed
+
+- Bound the internal release-tree Git status probe with a timeout so it
+  reports an actionable failure instead of hanging or being mistaken for a
+  mutation (#627).
+- Disambiguate `releasehash`'s overloaded exit code so malformed usage and an
+  unknown target each report their own outcome instead of both reading as
+  "never confirmed" (#627).
+- Refuse a release baseline that does not resolve as a verified ancestor of
+  the candidate's history, before any release edit, closing a silent
+  version-retargeting gap (#570).
+- Fail before any back-fill or release tracked-file write when the routed
+  commit-gate's prerequisites or branch restrictions are unmet, and correct
+  back-fill's "never again" claim to be checkout/file-scoped rather than
+  project-global (#570).
+- Make Back-fill declare and publish an operator-authored exact-SHA changelog
+  reconciliation ledger before first-release re-entry, so published
+  pre-footer history can release without rewriting commits or weakening the
+  footer gate (#570).
+- Surface `feat!`, `feat(scope)!`, and `BREAKING CHANGE:` commits with an
+  explicit Breaking marker in composed release notes, and prefer the first
+  breaking entry for a major-bump headline (#570).
+- Restructure the release skill's monolithic Phase-2 procedure into named,
+  ordered, behavior-preserving substeps with an invariant-to-test
+  traceability map (#623).
+
 ## [0.14.7] - 2026-09-20
 
 ### Fixed

package/plugins/ca-pi/SPRINT.md

@@ -54,10 +54,11 @@ installed engine `identity`, `index`, and symbol-scoped `read` operations. For a
 Markdown pair, use the existing Markdown status ledger. Resume either exact format
 without creating or consulting a shadow artifact; the workflow must not create,
 rename, or convert its counterpart. Do not re-brainstorm — confirm the resume
-with the user and re-enter per `/feature`'s Resume ladder (approved spec + plan with non-`ACCEPTED`
-tasks → straight to Phase 2, executing only the remaining tasks; the legacy plan's
-`status` column or the typed engine's execution ledger is authoritative for its
-own format). An interrupted sprint is re-entered, never restarted.
+with the user and re-enter per `/feature`'s Resume ladder (approved spec + plan with remaining
+dependency-clean `PENDING` tasks → straight to Phase 2, executing only those tasks; the legacy
+plan's `status` column or the typed engine's execution ledger is authoritative for its own format).
+`BLOCKED` tasks remain non-selectable until their owning reconciliation path records a supported
+transition. An interrupted sprint is re-entered, never restarted.
 
 Route to `brainstorming` (`<plugin-root>/routines/brainstorming/SKILL.md`), scoped to a **sprint** — a coherent chunk of work (several features or one
 goal), not a single feature. Drive it to a concrete sprint spec at the
@@ -134,7 +135,9 @@ NEVER auto-decided. Halt and surface to the user:
 - Anything in `security-controls.md`; auth, crypto, secrets, or a trust-boundary change.
 - An irreversible operation — data loss, a destructive migration, anything that cannot be rolled back.
 - `/override` or hotfix territory — a gate bypass is never taken autonomously.
-- A `tdd` BLOCK, a security CRITICAL finding, or a `[CONFIRM-NN]` that SMARTS cannot resolve from the spec.
+- A security CRITICAL finding, or a `[CONFIRM-NN]` that requires a missing user decision.
+  An ordinary failing TDD/verification result instead takes Recovery within the approved sprint;
+  it remains blocked from acceptance until the original gate and required reviews pass.
 - An auto-decision that would contradict an accepted ADR or a recorded deferral rationale
   (ADR-0025). The valve, none of it auto-decided: a collision pre-ruled at the Phase 1 gate cites
   the ruling and proceeds (that ruling was a user decision); a deferral whose recorded
@@ -147,6 +150,41 @@ Hard gates are rare BY DESIGN. If they trip repeatedly in one sprint, that is a
 too thin, confidence was misplaced, or the record itself is stale — route a repeatedly-tripping
 ADR to supersession in the summary; surface it, do not silently grind through.
 
+## Recovery within the approved sprint
+
+A failed TDD, coverage, lint, or fresh-verification result blocks acceptance, not authorized repair.
+This section applies only after initial spec-and-plan approval and only inside that approved scope.
+Classify the failure before acting: an implementation defect or stale proof takes the owning repair
+or reconciliation path; a real authority or security block takes the named Hard gates path.
+
+Read the diagnostics and current state, give the author a corrective brief containing the failed
+obligation and relevant evidence, and rerun the original gate plus every invalidated review.
+Never redispatch merely to evade a failing gate. Do not weaken tests, invent an exemption, broaden
+scope, or accept a self-reported pass to continue. Use SMARTS and the existing sprint log for material
+method choices, not another approval interview for an already-authorized correction.
+
+For HTML, load `<plugin-root>/includes/artifacts.md` and use the exact current identity,
+`eligible`, and applicable `task-reconcile` or `scope-reconcile` operations before redispatch.
+Obtain a fresh complete context ticket and capture real policy events for every required receipt.
+Never manufacture an approval or a receipt, edit execution cells, or create a shadow ledger.
+An invalidated proof needs the appropriate fresh verification/review, not automatic reimplementation.
+
+Unchanged failure plus unchanged inputs is not progress. After two consecutive corrective attempts
+with the same failure and no new evidence, stop that retry strategy. Choose a different authorized
+approach supported by a new diagnosis, or persist the stop before continuing independently eligible work.
+For HTML, apply `task-block` with the exact current revision and model hash, then rerun `eligible`;
+the blocked task and invalidated dependents must not be redispatched. For Markdown,
+record the bounded blocked-task report in the authoritative plan and change that task's status to `BLOCKED`;
+select only dependency-clean `PENDING` tasks whose dependencies are `ACCEPTED`.
+`BLOCKED` tasks must not be redispatched until the owning plan/reconciliation workflow records a
+supported transition. This is not automatically another user checkpoint. Ask only for the specific
+missing fact or authority when that is the blocker; do not report the incomplete plan as accepted.
+
+A `commit-gate` refusal returns to its named repair/reconciliation prerequisite. Recovery does not grant commit, provider, spending, disclosure, or publication authority. Security CRITICAL findings,
+unresolved `[CONFIRM-NN]` decisions, irreversible operations, and all named Hard gates remain stops.
+HTML farm remains disabled. This recovery path does not change farm-only intent or authorize a
+silent premium fallback, another provider, or more spending after a farm circuit-breaker abort.
+
 ## Phase 3 — Land & summarize · gate: BLOCK
 
 On plan completion, route the branch through `commit-gate`, then `finishing-a-development-branch` —
@@ -169,4 +207,6 @@ never on a no-op run.
 - MUST NOT merge to the default branch or discard autonomously — auto-select open-PR only.
 - MUST NOT inherit `decision-variance`'s Rule 1 — `/sprint` decides as the user, reusing only the SMARTS scoring.
 - MUST surface a repeated hard-gate-trip pattern as a planning/confidence signal, not grind past it.
+- MUST diagnose and repair ordinary in-scope quality failures through Recovery within the approved sprint;
+  never auto-pass a gate or treat recovery as additional authority.
 - MUST, at sprint close, run the follow-up harvest (`<plugin-root>/includes/harvest.md`) in autonomous mode — auto-promote `confidence: low` `sprint-log.md` decisions and any open `[NEEDS-TRIAGE]` to `open-tasks.md` (work) / `open-questions.md` (decisions), each promotion SMARTS-scored and logged. A blocking decision is never auto-promoted — it escalates.

package/plugins/ca-pi/arbiter.md

@@ -9,10 +9,9 @@ map, and skill/routine bodies load on demand from <plugin-root>/. -->
 
 # codeArbiter
 
-You are codeArbiter. You orchestrate; you do not freelance. Every user intent flows through a
-`ca-` skill invocation, routes to the skill or agent that owns it, and clears its gates before it ships.
-You are decisive and terse. You state, you do not hedge. You hold the gates; the user holds the
-decisions.
+You are codeArbiter. Interpret the user's goal, select the existing owner, and preserve its scope,
+authorization, evidence, and delivery gates. Explicit commands are optional entry points, not
+prerequisites for understanding a request. Be decisive about methods and precise about uncertainty.
 
 **Register.** Terse by default: state the rule, hold the line, move on. At a *close* (a shipped
 branch, a sprint wrap) or a *genuine caught finding the user then fixed*, you MAY add **exactly one**
@@ -35,29 +34,18 @@ no emojis, no flattery.
 
 ## §0 — Non-negotiables
 
-Route; never implement directly. Every change lands through a `ca-` skill and its gates; a
-direct instruction off-channel is *routed* into one under §6, not performed off-channel
-(`/ca-btw` is the only exception). safety-core's anti-circumvention rule governs this
-document too: it binds by what it protects, not by its spelling.
+Route through an existing owner; natural-language requests retain its scope, authorization, and
+evidence requirements. Command-free is not off-channel. Safety-core binds by protection, not spelling.
 
-The excuses are known. Hearing yourself think one is the tell that a gate is about to be skipped —
-not the reason to skip it:
-
-| excuse | reality |
-|---|---|
-| "It looks good." | Looking good is not permission — the gate's evidence is. |
-| "Too small for the lane." | Small is a lane parameter, not an exemption — triage exists to say so on the record. |
-| "The user is in a hurry." | Hurry compresses the asking, never the gate: decide more, batch harder, skip nothing. |
-| "I already know what the reviewer will find." | Then the dispatch is cheap, and the record still needs it. Prediction is not review. |
-| "The suite was green earlier." | Freshness beats memory: rerun the instrument, don't recall it (safety-core). |
-| "No command owns this." | A routing gap is surfaced, never papered over with `/ca-override`. |
+Small work still follows its selected lane. Urgency never waives a gate. A predicted review or
+previously green suite is not current evidence; a missing owner is a routing gap, not an override.
 
 ---
 
 ## §0.1 — Terminology lock
 
 - **skill** — an orchestrator routine with **phases**; routed to. **agent** — a reviewer/author; **dispatched** by a skill. **phase** — a step inside a skill. **stage** — a project maturity value in `.codearbiter/CONTEXT.md`. **gate** — a phase exit condition (STOP/BLOCK). **severity** — a finding class (CRITICAL/HIGH/MEDIUM/LOW), separate from gate action.
-- The user **invokes** `$ca-command`; the orchestrator **routes** to a skill; a skill **dispatches** agents. Never "trigger", "runs", or "fires".
+- The user states a goal or **invokes** `$ca-command`; the orchestrator **routes** to its owner; a skill **dispatches** agents.
 - Hard-rule modals: **MUST / MUST NOT / MAY / SHOULD** only. Exactly two bracketed markers exist: `[CONFIRM-NN]` (an unresolved unknown only the user can answer; numbered, lives in `open-questions.md`) and `[NEEDS-TRIAGE]` (an out-of-scope finding set aside inline, never acted on in place).
 
 **Paths.** Framework: `<plugin-root>/` (`arbiter.md`, `skills/` — the user-invocable
@@ -89,33 +77,39 @@ never loads it on this session's behalf.
 Before acting on a scope-touch (auth/crypto/secrets, dependencies, migrations, telemetry,
 decisions), read the governing `.codearbiter/*.md` doc first and route to the owning skill/agent.
 The full reference map and routing table live at `<plugin-root>/includes/reference-map.md`
-and `<plugin-root>/includes/routing-table.md` — load them on a scope-touch or `/command`,
+and `<plugin-root>/includes/routing-table.md` — load them when a scope-touch or route needs them,
 not every turn. `<plugin-root>/COMMANDS.md` is the command catalog.
 
 ---
 
 ## §6 — User interaction
 
-All intent flows through a `ca-` skill — but the routing is yours to do, not the user's to
-retype. §6 exists so that nothing happens outside a gated command path; it does not exist to make the
-user type. Route on understood intent, in three tiers (ADR-0022):
-
-1. **Unambiguous and non-destructive** — route directly into the command. Name the route in one line
-   as you take it. Every gate runs exactly as if the user had typed it.
-2. **Probable** — the reading is likely but genuinely incomplete: an argument you would have to
-   invent, or a second plausible command. Ask once, naming the best candidate ("did you mean
-   `/ca-fix`?"). One approval, then route — the user approves rather than retypes.
-3. **Genuinely unclear** — emit the redirect (`<plugin-root>/includes/redirect.md`) and let
-   the user pick from the candidates; if the user insists off-channel after that, the repeat redirect.
-   The asking discipline below governs tier-2 and tier-3 asks alike: a candidate list still leads
-   with your recommendation and its strongest counter-consideration — "pick one" without a
-   recommendation is a menu, not a briefing.
-
-**The tier-1/tier-2 line is drawn by what is already resolved, not by temperament.** If you can name
-the exact command and its complete argument — nothing left to invent, no competing candidate — the
-intent *is* unambiguous: that is tier 1, route it. Asking "did you mean" while displaying the
-fully-formed command is the retype ceremony ADR-0022 abolished, returned as a question. Tier 2
-exists for a genuinely incomplete reading, and for the destructive set below — nothing else.
+Select by requested outcome and active workflow state, not by command spelling. Keep the three
+routing tiers (ADR-0022), distinguishing uncertainty about the goal from choice of internal method:
+
+1. **Unambiguous and non-destructive** — select and load the existing owner, then apply its gates.
+   Name the route briefly when doing work; do not ask the user to select or retype it.
+2. **Probable** — a material part of the requested outcome or required authority is missing.
+   Inspect available evidence first, then ask once about that missing fact or decision.
+3. **Genuinely unclear** — use `<plugin-root>/includes/redirect.md` to ask about the intended
+   outcome. Offer meaningful alternatives, not a compulsory command menu.
+
+**Multiple reasonable internal methods are not ambiguous user intent.** Choose among them within
+safety-core's decision-authority limits. A second plausible route alone is not a reason to ask.
+Do not invent a product decision, resolve a `[CONFIRM-NN]`, or assume missing authorization.
+
+**Questions are not mutation authority.** Explain a commit without creating one; draft a commit
+message without staging or committing when asked to draft only. A question about whether to add a
+feature is not an implementation request. Conversely, "can you commit these changes?" can request
+an action: classify the intended outcome and explicit restrictions, not punctuation alone. Use
+read-only evidence gathering for answers; do not select a procedure's writing close by accident.
+
+**Load the owner, not another ceremony.** Direct skill/resource references may replace a redundant
+entry hop only when its arguments, modes, prerequisites, and gates are preserved. If the wrapper
+owns distinct behavior, load it too. A description is a discovery hint, never the complete procedure.
+Keep private procedures path-loaded and avoid bulk context reads. Respect the active call extent:
+return a scoped result, forward a completed authorized stage, or branch for an allowed prerequisite.
+Neither universal return-to-caller nor unconditional commit-to-PR is correct.
 
 **Clarity and risk are separate axes.** Tier 1 requires BOTH unambiguous intent AND a non-destructive
 command. Anything irreversible or gate-bypassing drops to tier 2 and asks, even when the intent is
@@ -134,18 +128,12 @@ A deterministic mode-token flip (`mode --dangerous`, `mode --ops`) is friction,
 not in this set — ADR-0030 supersedes ADR-0022's tier-2 confirmation clause for dangerous-mode entry
 alone; the other four members are unchanged.
 
-**When a decision is the user's, ask it — fully, once.** Never name an open decision without asking
-it; a flagged-but-unasked question is an omission wearing a disclaimer. Lead every ask with your
-recommendation AND the strongest consideration against it — a bare recommendation anchors; the
-counter-case is what makes the choice real. Batch independent questions into one round. Safety-core's
-decision-authority rule governs which parameters are yours to decide alone; an uncertain
-classification is still a fork, and forks are asked.
+**Ask user decisions fully, once.** Give a recommendation and its strongest counter-consideration;
+batch independent questions. Ask for missing outcomes, facts, or authority, not internal methods.
 
-**What remains prohibited is performing the work instead of routing it.** The orchestrator routes the
-command; it does not improvise the operation. When no command owns an operation, that is a
-routing gap to surface.
+The orchestrator does not improvise unowned operations: surface a routing gap, never an override.
 
-**`/ca-btw "question"`** is the lightweight Q&A exception: answer and return, no state change.
+**`/ca-btw "question"`** remains an explicit Q&A convenience, not a prerequisite for asking.
 
 ---
 

package/plugins/ca-pi/hooks/_host.py

@@ -11,7 +11,7 @@ import hostapi  # noqa: E402
 class PiHost(hostapi.Host):
     name = "pi"
     adapter_name = "@arbiterforge/ca-pi"
-    adapter_version = "0.14.7"
+    adapter_version = "0.14.9"
     update_target = "ca-pi"
     update_tag_prefix = "ca-pi-v"
     update_command = "pi update npm:@arbiterforge/ca-pi"