@arbiterforge/ca-pi 0.15.1 → 0.15.3

package/plugins/ca-pi/skills/ca-status/SKILL.md

@@ -13,7 +13,7 @@ A read-only summary of `.codearbiter/` state. No skill is routed to; no file is
 
 <!-- command-mode:drift legacy-route:context-check -->
 With the exact argument `drift`, load and follow
-`<plugin-root>/skills/ca-context-check/SKILL.md`. The audit begins read-only; re-scout or re-baseline may
+`<plugin-root>/routines/context-check/SKILL.md`. The audit begins read-only; re-scout or re-baseline may
 write only after the user's explicit selection. In drift mode the `context-check` contract governs;
 the opening summary and Hard gate below apply only to the no-argument snapshot. With no argument,
 continue with the unchanged read-only snapshot below. Reject other arguments rather than treating

package/plugins/ca-pi/skills/ca-threat-model/SKILL.md

@@ -1,45 +1,74 @@
 ---
 name: ca-threat-model
-description: Opt-in lightweight STRIDE pass for a sensitive feature before implementation. Not a routine gate — invoke it when a change warrants security thought.
+description: "Threat-model a sensitive design with STRIDE on request. Read-only analysis of threats, controls, and implementation constraints."
 argument-hint: "<scope description>"
 ---
 
-# /ca-threat-model — STRIDE pass (opt-in)
+# security-architecture
 
-Optional, lightweight pre-implementation security review for a sensitive change — new external endpoints, new secrets-handling paths, new auth/authz flows. **Opt-in, not a routine gate**: nothing routes here automatically. Invoke it when a change warrants the thought; skip it otherwise. Read-only — modifies no file. Describe what the component does, what data it handles, and which actors interact with it.
+Optional, lightweight threat-modeling pass over a design before it is built. Selected when the user deliberately requests threat modeling of a sensitive design, with or without `/ca-threat-model`. Never forced on an ordinary change. Reviews architectural intent before code exists; for code already written, dispatch `security-reviewer` instead.
 
-## Routes to
+## Entry boundaries
 
-`security-architecture` (`<plugin-root>/routines/security-architecture/SKILL.md`). The skill reads:
+Read-only: modify no project file, decision record, control or implementation.
+Optional reviewers inherit this read-only analysis scope. An explanation-only
+security question does not start the pass; mentioning authentication in an ordinary
+change does not opt in. The user need not repeat a slash command to request it.
+Missing required security-controls input is a prerequisite failure, separate from
+the severity of a finding. A lesser gap is a constraint, not blanket denied clearance.
 
-- `<project-root>/.codearbiter/security-controls.md` — compliance requirements.
-- `<project-root>/.codearbiter/decisions/` — existing security-relevant ADRs.
+## Pre-flight
 
-## Output
+- Read `<project-root>/.codearbiter/security-controls.md` — approved primitives, declared security boundaries and their permitted crossings, what is and is not allowed. If it cannot be read, STOP and surface the gap; do not guess the boundary model.
+- Establish the scope from the user's request: the feature, component, or design under review.
+- Read relevant security ADRs under `<project-root>/.codearbiter/decisions/`; do not invent decisions or interpret their absence as approval.
 
-```
-## Scope
-<what is being analyzed>
+## Phase 1 — Attack surface · gate: BLOCK
 
-## STRIDE findings
-| Threat | Category    | Likelihood | Impact | Control                      |
-|--------|-------------|------------|--------|------------------------------|
-| ...    | S/T/R/I/D/E | H/M/L      | H/M/L  | <control or NONE — needs one> |
+Map what the change exposes. Name, for the scope:
 
-## Recommended controls before implementation
-- <control 1>
+- New or changed entry points — routes, endpoints, message consumers, CLI surfaces.
+- New egress — outbound calls, external dependencies, new data sinks.
+- Security boundaries crossed, as declared in `security-controls.md` (trust transitions, privilege changes, data leaving a controlled zone).
+- The data handled and its sensitivity.
 
-## Clearance
-CLEAR TO IMPLEMENT | BLOCKED — resolve findings first
-```
+A boundary crossing not described in `security-controls.md` is a finding, not a silent pass. A finding outside this scope gets one line with an inline `[NEEDS-TRIAGE]` marker.
 
-## When NOT to use
+Gate: the attack surface and every boundary crossing in scope are enumerated.
 
-- Reviewing already-written code → `/ca-review`.
-- A full cross-cutting review → `/ca-checkpoint`.
-- A security question → `/ca-btw`.
+## Phase 2 — STRIDE pass · gate: STOP
 
-## Hard gate
+Walk the surface from Phase 1 through STRIDE. For each relevant category, name the concrete threat and the control expected to mitigate it:
 
-Read-only — modifies no file. This is an advisory pass, not a routine gate; it never runs unless
-invoked.
+- **Spoofing** — identity/authentication of the actor at the boundary.
+- **Tampering** — integrity of data in transit and at rest.
+- **Repudiation** — whether actions are attributable.
+- **Information disclosure** — exposure of sensitive data, including in logs and errors.
+- **Denial of service** — exhaustion or availability impact.
+- **Elevation of privilege** — privilege gained across the boundary.
+
+Mark each threat's mitigation `PRESENT`, `PLANNED`, or `GAP`. Skip a category only with a one-line reason it does not apply.
+
+If the threat depends on auth, crypto, key handling, or secrets, MAY dispatch `<plugin-root>/agents/auth-crypto-reviewer.md`. For broader boundary or surface concerns, MAY dispatch `<plugin-root>/agents/security-reviewer.md`. Both govern by `security-controls.md`.
+
+Gate: STOP only on a genuinely critical unmitigated threat — a `GAP` that is exploitable now with high impact. Lesser gaps are surfaced as constraints, not stops.
+
+## Phase 3 — Report · gate: BLOCK
+
+Produce a terse report:
+
+- **Surface** — entry points, egress, boundaries crossed.
+- **Threats** — the STRIDE findings; lead with `GAP`s, then `PLANNED`, summarize `PRESENT` in one line.
+- **Verdict** — `PROCEED` (no open gap), `PROCEED-WITH-CONSTRAINTS` (gaps listed with owner), or `STOP` (a critical unmitigated threat is present; name it).
+
+A decision-worthy gap is escalated to the user or to `<project-root>/.codearbiter/decisions/` via `/adr` — never authored as an ADR by this skill.
+
+Gate: report delivered with a stated verdict; every STOP-level threat from Phase 2 is reflected in it.
+
+## Hard rules
+
+- MUST NOT force this pass on an ordinary change. It is invoked deliberately for sensitive features only.
+- MUST NOT guess the boundary model — read `security-controls.md` or STOP.
+- MUST NOT silently pass an undeclared boundary crossing — surface it.
+- MUST NOT STOP on anything short of a critical, exploitable, unmitigated threat; lesser gaps are constraints.
+- MUST NOT author an ADR — escalate decision-worthy gaps to the user or `/adr`.

package/plugins/ca-pi/skills/ca-tribunal/SKILL.md

@@ -1,44 +1,123 @@
 ---
 name: ca-tribunal
-description: Deep, rarely-convened whole-codebase audit — eleven specialist lenses, a resumable on-disk audit log, findings filed as GitHub issues on approval. Expensive; estimates cost and STOPs before running. Never a required gate.
+description: "Run an opt-in deep codebase audit with persisted findings. Confirm cost before dispatch; filing and telemetry need separate approval."
 argument-hint: "[scope-path] [--tag <label>]"
 ---
-# /ca-tribunal — deep codebase audit
 
-The deepest, most expensive review codeArbiter offers, convened rarely and on demand. Routes to the tribunal skill. Eleven lenses judge the codebase; every finding persists to its own file (plus append-only triage/run logs) under `.codearbiter/reports/<run-id>/`, so an interrupted run resumes from disk. Never a required gate — critical/high are blocking-severity findings, not a pipeline halt.
+# tribunal
 
-Cost first — this lane routinely costs millions of tokens on a large repo. Phase 0 sizes the codebase, prints a token-cost band, recommends the highest-reasoning model, and STOPs for your acknowledgement before dispatching anything. Nothing runs unacknowledged.
+The deepest, most expensive review codeArbiter offers — convened rarely, on demand, never as a gate. Selected by a deliberate request for a deep codebase audit, including `/ca-tribunal`. Eleven specialist lenses judge the codebase; every finding persists to its own file (plus append-only triage/run logs) under a run dir that survives compaction and disconnects, so the run resumes from disk.
 
-## Flow
+## Entry boundaries
 
-Load and follow the tribunal skill (`<plugin-root>/routines/tribunal/SKILL.md`). In brief:
+A direct audit request is sufficient routing intent; do not ask the user to repeat a
+command. An explanation-only question does not start an audit. Ordinary diff review,
+periodic checkpoints and a single-feature threat model retain their separate owners.
+Cost acknowledgment, issue filing and telemetry authorization remain separate below.
 
-Phase 0 (STOP) — cost estimate, model recommendation, resume check.
-Phase 1 (BLOCK) — map the codebase; risk-rank and mark trust boundaries; record AI-authorship markers and iteration depth.
-Phase 2 (BLOCK) — dispatch `tribunal-lens-reviewer` once per active lens in priority waves (≤5 in flight); each dispatch writes one file per finding under its own `findings/<lens>/` dir.
-Phase 3 (BLOCK) — triage per wave from disk: dedup, independent calibration, decision vocabulary.
-Phase 4 (BLOCK) — project the human-readable report from the logs.
-Phase 5 (BLOCK) — on explicit selection, file findings as GitHub issues; idempotent against the tracker.
-Phase 6 (STOP) — optional, opt-in KPI telemetry to the public codeArbiter repo.
+`[scope-path]` limits the audit to that subtree (default: repository root). Evaluate
+applicability across the full roster; skip a lens only when its concern is absent and
+record the launched/skipped set. A smaller scope does not require irrelevant lenses.
+`--tag <label>` supplies the optional freeform run label governed by the telemetry card;
+it is not authorization to transmit anything.
 
-## Arguments
+## Pre-flight
 
-`"scope-path"` — focus the audit on a subtree (default: repository root). The full lens roster still runs; only the scope narrows.
+Read these, or STOP and surface the gap — never guess a command or a path:
 
-`--tag <label>` — freeform run label recorded in telemetry (see `references/telemetry.md`).
+- `<project-root>/.codearbiter/tech-stack.md` — stack, async model, concurrency primitives, test/lint/secrets commands, and, when documented, the tracker command. Stop if the test/lint/secrets commands are missing; do not guess.
+- `<project-root>/.codearbiter/CONTEXT.md` — the `stage:` maturity value and domain vocabulary.
+- `<project-root>/.codearbiter/coding-standards.md` — the conventions lenses judge against.
+- `<project-root>/.codearbiter/security-controls.md` — trust boundaries, approved crypto/secret stores; feeds the appsec and secrets lenses. Absent on some repos — proceed without the security lenses' control-file checks if so.
+- A git repository must be present.
+- The reference set under `<plugin-root>/routines/tribunal/references/` — each is cited at its phase, loaded on demand. Do not preload them.
 
-## Routes to
+## Phase 0 — Cost, model & resume · gate: STOP
 
-`<plugin-root>/routines/tribunal/SKILL.md` — dispatches `tribunal-lens-reviewer` once per active lens (and, on a large repo, the optional map-structure / map-deps mappers).
+This lane is expensive. Orient and get explicit go-ahead before dispatching anything.
 
-## When NOT to use
+- **Resume check.** Scan `.codearbiter/reports/` for the most recent run dir matching the current scope-slug, any date — never just today's. If none, skip to sizing. If found, check completion: incomplete (no `report-written` event in its `run.jsonl`) means either resumable or stale, judged by that run dir's latest `run.jsonl` timestamp. A run whose `run.jsonl` carries `run-aborted` is terminal — never offered for resume; a fresh run starts. Younger than 7 days → recover position with the cheap cursor scan in `<plugin-root>/routines/tribunal/references/schemas.md` (grep the last `wave-triaged`, do not read finding bodies) and offer to resume at the first un-triaged wave instead of restarting; skip the estimate. Older than 7 days → STOP and ask the user to resume anyway or start fresh — the codebase may have drifted under the findings, and stale-tree findings must not silently merge with fresh ones. Complete → start a fresh run.
+- **Abandon.** If the user tells the orchestrator to abandon the run, log a `run-aborted` event to `run.jsonl` before stopping.
+- **Cost acknowledgment.** Size the job, compute the token band, recommend the model (highest-reasoning available, high effort), and offer the cost-control levers. Present the band plainly; nothing dispatches until the user acknowledges it and confirms the model.
+- Establish `RUN_ID` = `<UTC-date>-<scope-slug>` on a fresh run; create `.codearbiter/reports/<run-id>/`; open `run.jsonl`. On resume, reuse the existing `RUN_ID` as-is — the date is the run's creation date and never changes on resume.
+- Procedure: `<plugin-root>/routines/tribunal/references/cost-and-models.md` — load now.
 
-- A review of the current diff → `/ca-review` (gate-blocking, fast).
-- A lean periodic sweep → `/ca-checkpoint` (cheap, frequent; tribunal is its rare, deep counterpart).
-- An adversarial STRIDE pass on one sensitive feature → `/ca-threat-model`.
-- A governance packet for a window → `/ca-audit`.
-- Anything on a schedule or in a hot loop — tribunal is a rare, deliberate, expensive convening, not a routine gate.
+Gate: the user has acknowledged the estimated cost and confirmed the model. An unacknowledged run does not pass.
 
-## Hard gate
+## Phase 1 — Map + judgment overlay · gate: BLOCK
 
-MUST NOT dispatch any lens before you acknowledge the Phase 0 cost estimate. MUST NOT act as a required gate or block a merge/commit. MUST NOT file an issue or send telemetry without explicit authorization. Read-only on project code until the filing gate; findings file as GitHub issues, never the task board.
+Map before reviewing; the map decides what gets scrutiny.
+
+- Produce the inventory (inline, or on a large repo dispatch the optional cheap mappers per `<plugin-root>/routines/tribunal/references/cost-and-models.md`): file tree, language breakdown, entry points/routes, core-logic and shared-utility locations, dependency and integration surface. Write `inventory.md`.
+- Apply the judgment overlay in `<plugin-root>/routines/tribunal/references/ai-markers.md`: risk-rank directories (untrusted input, money, auth, PII, churn = highest), mark trust boundaries, record AI-authorship markers and an iteration-depth estimate. High-marker / high-iteration areas carry a scrutiny boost and a small severity prior.
+- Choose the active lenses — the roster IS the set of cards under `<plugin-root>/routines/tribunal/references/lenses/`; the active set is that roster minus any lens whose concern is absent from scope (no migrations → drop the migration lens). Record launched/skipped as `run.jsonl` events.
+- Choose the wave partition — the default in `<plugin-root>/routines/tribunal/references/cost-and-models.md`, or a repartition for cause — and record it in the `run-started` event (`<plugin-root>/routines/tribunal/references/schemas.md`); resume reads this recorded partition, never re-derives it.
+
+Gate: `inventory.md` written with the risk/boundary/marker overlay, and the active-lens set recorded.
+
+## Phase 2 — Roster dispatch (dual output: finding files + summary) · gate: BLOCK
+
+Dispatch one `tribunal-lens-reviewer` per active lens, in the wave partition recorded at Phase 1 (default in `<plugin-root>/routines/tribunal/references/cost-and-models.md`) at the concurrency from `<plugin-root>/routines/tribunal/references/cost-and-models.md` (≤5 in flight). Each dispatch carries the assignment block from the agent's Assignment Format — its FIRST line is the title `Tribunal lens: <lens-slug> — <scope summary>` — naming the lens slug, the scope slice, the run dir, and the findings dir, on the model/effort from `<plugin-root>/routines/tribunal/references/cost-and-models.md`. The agent itself reads its own mandate from `<plugin-root>/routines/tribunal/references/lenses/` (the recorded active lens slug plus `.md`, including that card's Required-reading docs) and the finding contract (`<plugin-root>/routines/tribunal/references/finding-record.md`), and loads neither the other lenses' mandates nor the orchestrator schemas. The orchestrator reads `<plugin-root>/routines/tribunal/references/finding-record.md` to read findings at triage, and consults a lens mandate only to adjudicate that lens's finding.
+
+- Each dispatched lens reviewer writes each finding to its own file `findings/<lens>/<finding-id>.json` the moment it is found — one file per finding, never a batched write at the end (write contract: `<plugin-root>/routines/tribunal/references/finding-record.md`).
+- **Evidence-or-drop.** Every finding cites a concrete `path:line` and the minimal snippet. An absence claim — "no handler", "no teardown", "missing validation" — requires reading the whole unit, never a truncated window.
+- Specialists never dispatch further subagents. Update each wave's status in `run.jsonl` as it flushes.
+- When a lens's summary returns, record a `lens-completed` event in `run.jsonl` with `surface_seen`/`findings`/`model` taken from the agent's summary, plus `tokens` when the orchestrator can observe that lens's spend.
+
+Gate: every active lens has flushed its `findings/<lens>/` files, and each wave's status is recorded.
+
+## Phase 3 — Triage & per-wave planning · gate: BLOCK
+
+Triage per wave from disk as soon as it flushes; do not wait for the whole run.
+
+- **Calibrate independently.** Set `final_severity`/`final_confidence` from the evidence yourself — the lens's values are provisional input; every critical/high carries a `counter_argument`.
+- **Decide per finding, logged.** Each finding gets one decision from the vocabulary, appended as one line to `triage.jsonl`. Below the confidence gate after calibration → `investigate` (medium/low) or `decision-required` (critical/high) — never dropped silently.
+- **Plan the wave.** Write `plans/phase-<n>.md` for its kept (`keep`/`combine`) work.
+- Procedure: `<plugin-root>/routines/tribunal/references/triage.md` — load now.
+
+Gate: every wave's findings triaged into `triage.jsonl` and a `plans/phase-<n>.md` written for its kept work.
+
+## Phase 4 — Report · gate: BLOCK
+
+Regenerate `report.md` and `manifest.yaml` from the two logs per `<plugin-root>/routines/tribunal/references/report.md` — projections, never hand-authored. Task-list-structured (not prose): findings grouped by **calibrated** severity then type, each with id, `path:line`, one-line description, remediation shape, triage decision, and a link to its phase plan; `decision-required` in its own section; a launched/skipped-lens summary; an investigate appendix. Apply `<plugin-root>/includes/anti-slop-design/` (`core` + `medium-documents`) to the prose.
+
+State plainly that critical/high are blocking-severity findings — work that should block shipping the affected code — but that this lane is not itself a gate and blocks nothing.
+
+Gate: `report.md` regenerated from the logs and presented. No issues created.
+
+## Phase 5 — Approval & issue filing · gate: BLOCK
+
+Findings become GitHub issues only on explicit selection and authorization. Silence or ambiguity → file nothing; "looks good" is not authorization.
+
+- **Dedup first.** Skip findings already carrying an `issue_ref` in `triage.jsonl`, then dedup against the tracker — this lane reruns over time and will re-find the same issues.
+- **Default is hand-off.** Write and print `issue-commands.sh`; execute only on explicit approval, writing each `issue_ref` back into `triage.jsonl`.
+- Findings file as GitHub issues, never `open-tasks.md` — a periodic-review finding must survive PR abandonment.
+- Procedure: `<plugin-root>/routines/tribunal/references/issue-filing.md` — load now.
+
+Gate: either `issue-commands.sh` written and printed, or — on approval — issues filed with the id→result table and `issue_ref` recorded. Nothing filed without explicit selection; no duplicates against the tracker.
+
+## Phase 6 — Telemetry · gate: STOP
+
+Optional, opt-in KPI feedback to refine the skill and the estimator — off by default, sent only on explicit per-run authorization.
+
+- **Scrub.** The payload is aggregates and per-lens exposure counts only — no code, paths, or finding text; no repo identity unless the user adds `--tag`.
+- **Show before send.** Write the payload to the run dir and show it in full; state plainly that it posts publicly to the codeArbiter repo. Default: hand the user the ready command; post only on explicit approval.
+- Procedure: `<plugin-root>/routines/tribunal/references/telemetry.md` — load now.
+
+Gate: the payload is shown, and it is either handed to the user as a command or — on approval — posted. No telemetry leaves without per-run authorization.
+
+## Hard rules
+
+- MUST NOT proceed past Phase 0 without the user acknowledging the estimated token cost — this lane can cost millions of tokens.
+- MUST NOT edit, refactor, format, or commit project code — writes are confined to `.codearbiter/reports/<run-id>/` until the filing gate.
+- MUST NOT act as a required gate or block a merge, commit, or other workflow — critical/high are blocking-severity findings, not a pipeline halt.
+- MUST NOT record a finding without a concrete `path:line` and a minimal evidence snippet.
+- MUST NOT assert an absence without reading the whole relevant unit — partial-window absence claims do not pass.
+- MUST NOT let a lens's provisional severity/confidence stand as final — calibrate at triage; every critical/high carries a `counter_argument`.
+- MUST NOT mutate the append-only logs — `manifest.yaml`, `report.md`, and `plans/` are regenerated from them, never hand-edited.
+- MUST NOT file an issue below the confidence gate or without explicit selection and authorization; findings file as GitHub issues, never `open-tasks.md`.
+- MUST NOT create a duplicate issue — skip findings carrying an `issue_ref`, and dedup against the tracker by `dedup_key`/title before filing.
+- MUST NOT author or scaffold an ADR — `decision-required` findings file as a discussion issue; ADRs are authored only via `/ca-adr` with user attribution.
+- MUST NOT send telemetry without explicit per-run authorization, and MUST NOT include code, file paths, finding text, or repo identity (absent an explicit `--tag`) in the payload — KPI aggregates only.
+- MUST NOT guess the test, lint, or secrets-scan command — read `tech-stack.md` or STOP. For the tracker: use `tech-stack.md` if it documents one; else default to `gh issue create` on a GitHub origin; else STOP.
+- MUST NOT dispatch a subagent from within a dispatched specialist — only the orchestrator dispatches.

package/plugins/ca-pi/routines/skill-author/SKILL.md

@@ -1,129 +0,0 @@
----
-name: skill-author
-description: Assess a request for a new reusable codeArbiter skill, prove the uncovered gap, agree scope, author and integrate it. Questions and one-off tasks do not authorize adding a skill.
-argument-hint: <gap or verb-noun skill name>
----
-
-# skill-author
-
-Author a new skill, the right way. The public entry and natural-language requests route
-here; this complete owner is also available as a directly read internal resource.
-Use a verb-noun name (for example, `dependency-review`), not a descriptive sentence.
-A one-time action belongs to the applicable work procedure. A question about whether a
-skill is needed is answered without authoring; an almost-matching owner is reviewed and
-extended through the existing change workflow rather than duplicated.
-
-## Pre-flight
-
-Read these, or STOP and surface the gap — never author on assumption:
-
-- The `<gap>` argument. Absent → STOP and ask: "Describe the gap this skill would fill. What situation does no existing skill cover today?"
-- `<plugin-root>/routines/INDEX.md` — the surface scan of every existing skill. This is the gap-overlap check in Phase 1 and the integration target in Phase 5. Never bulk-read the skill bodies.
-- `<plugin-root>/routines/commit-gate/SKILL.md` and `<plugin-root>/routines/tdd/SKILL.md` — the canonical v2 format the authored skill must mirror. Read them before Phase 3. The command-backed commit owner also demonstrates the
-  single-source entry convention. Keep its description and argument hint with the
-  owning skill; the generator supplies the compatible public spelling per host.
-- `<project-root>/.codearbiter/CONTEXT.md` — project context, only if the gap is project-specific. A generic skill needs no project state.
-
-## Phase 1 — Gap evidence · gate: BLOCK
-
-A new skill is permanent surface area. It is not written until the gap is proven real and proven uncovered.
-
-Restate the gap in one sentence. Then scan `INDEX.md` for overlap: if an existing skill's "Owns" column already covers this, STOP and name it — "The `<name>` skill already owns this; review it before requesting a new one."
-
-If no skill covers it, demand evidence — one of:
-
-- **A** — three specific cases where the gap blocked work: what was attempted, what happened with no skill, what it cost.
-- **B** — one high-impact case with traceable evidence: a blocked PR, an introduced defect, a compliance finding, a repeated failure pattern.
-
-Hypothetical cases do not count. Fewer than three (Option A) or no traceable evidence (Option B) → STOP and decline: "Insufficient evidence of a real, recurring gap. A skill adds permanent maintenance cost. Return with evidence and I'll author it."
-
-Gate: the gap is restated, proven uncovered against `INDEX.md`, and backed by Option-A or Option-B evidence. Speculation does not pass.
-
-## Phase 2 — Scope · gate: BLOCK
-
-Settle scope with the user before any prose is written. Ask, and wait for an explicit answer:
-
-- **Routed or dispatched?** A *skill* is routed to (gated phases, lives at `<plugin-root>/routines/<name>/SKILL.md`). An *agent* is dispatched by a skill (a reviewer/author, lives at `<plugin-root>/agents/<name>.md`). If the gap is really a reviewer, this is the wrong skill — redirect to agent authoring.
-- **Command-invoked or internal?** Does a user type `/<name>` to reach it, or does another skill route to it mid-workflow? A command needs a routing-table entry; an internal skill needs a named parent that routes to it.
-- **Single responsibility.** State the one thing the skill owns in a sentence. If it needs "and" to describe its job, it is two skills — split it or pick one.
-
-Confirm back: "I will write a [command-invoked / internal] skill at `<plugin-root>/routines/<name>/SKILL.md`, owning <one responsibility>. [A `/<name>` command will be added to the routing table. / The `<parent>` skill will route to it.]"
-
-Gate: explicit user agreement on routed-vs-dispatched, command-vs-internal, and a one-sentence single responsibility. Assumed answers do not pass.
-
-## Phase 3 — Authoring · gate: BLOCK
-
-Write `SKILL.md` to the v2 house style — mirror `commit-gate` and `tdd` exactly. Start from `<plugin-root>/routines/skill-author/references/skill-template.md`. Required shape:
-
-- **Frontmatter** — `name:` and `description:` as the normal base. Description is terse: the requested outcome, when it applies, and important negative intent. A command-backed owner also records its argument hint and keeps its natural-language description on the owner. The generator suppresses only the redundant Claude command description. No cut doc refs, no trigger disclaimer.
-- **`# <name>`** H1, then a one-line intro naming what routes to it (`/<command>` or the parent skill).
-- **`## Pre-flight`** — the docs to read or STOP on. Project state cites `<project-root>/.codearbiter/<doc>`; other skills cite `<plugin-root>/routines/<name>`; agents cite `<plugin-root>/agents/<name>.md`. Never guess a command — read it or STOP.
-- **`## Phase N — <title> · gate: BLOCK|STOP`** — sequential, each ending in a one-line `Gate:`. A phase with output that could be wrong has a gate; only a purely declarative phase may omit one.
-- **`## Hard rules`** — `MUST NOT` lines, one per rule, no duplication.
-
-Authoring rules:
-
-- Imperative, terse, no hedging. No "should", no "if it looks wrong". A gate is a concrete, checkable condition.
-- Surviving project docs only: `CONTEXT.md`, `tech-stack.md`, `coding-standards.md`, `specs/`, `plans/`, `security-controls.md`, `decisions/`, `overrides.log`. Do not reference cut docs or cut skills.
-- Terminology lock: a skill is *routed to*; an agent is *dispatched*. Never "trigger", "fires", or "runs".
-- An out-of-scope finding gets one line with an inline `[NEEDS-TRIAGE]` marker.
-
-## Phase 4 — Self-review · gate: BLOCK
-
-Re-read the authored skill against the v2 quality bar. Each line below is a checkable defect, not a vibe:
-
-- **Single responsibility** — the skill owns one thing. If a phase belongs to a different job, it is the wrong skill; cut it.
-- **Concrete gates** — every non-declarative phase ends in a `Gate:` line stating a checkable condition. "Looks good" / "seems right" is not a gate; rewrite it.
-- **House-style prose** — terse, imperative, matches `commit-gate`/`tdd`. Strip hedging and filler.
-- **No duplicated rules** — a rule stated in a phase is not restated in Hard rules, and Hard rules carry no duplicates. State each rule once.
-- **Format conformance** — frontmatter is `name`+`description`, plus `disable-model-invocation: true` on a chain-internal skill (ADR-0028);
-  a command-backed owner instead remains discoverable and also owns its
-  `argument-hint`. The generator suppresses the redundant command listing only on
-  command-native hosts; Codex/Pi entries remain discoverable. Other invocation/tool/model metadata
-  needs explicit generator support, never silent dropping; H1 matches `name`; phases are numbered with `· gate:`; paths use `<plugin-root>` / `<project-root>` correctly; no cut docs/skills, no legacy `${FRAMEWORK_ROOT}`/`${PROJECT_ROOT}`/`.agents/` paths.
-- **Frontmatter scalar quoting** — any frontmatter scalar that starts with `[` or `{`, or contains `": "` or `" | "`, MUST be JSON-quoted (the `_yaml_safe_scalar` predicate the surface generator applies to codex/pi wrappers; the claude surface ships frontmatter verbatim, so the author quotes it at the source).
-- **No trigger language** — "routed to" / "dispatched" only, and no `## Trigger` disclaimer block.
-- **Evidence lenses** (issue #612) — each checked where the skill's shape triggers it, skipped where it does not:
-  - A gate an agent is tempted to skip carries a rationalization guard AT the decision point — the known excuses paired with rebuttals. The best rebuttal carries its own instrument: a check the agent can run that falsifies the excuse either way. A tempting gate with no guard is a defect.
-  - An acceptance or verification step names what is READ, never what is claimed — "the subagent reports green" is a defect; "the runner's output shows green" is not.
-  - A user-facing ask leads with a recommendation AND its strongest counter-consideration.
-  - A rule a tested helper could enforce is mechanized rather than accreted as prose — the helper enforces, the prose explains.
-  - A rule whose literal reading has an exploitable edge names what it protects.
-- **Behavior-changing gate revisions are validated, not assumed** — an A/B pass (fixed scenarios, rubrics written before any output exists, both versions run under identical conditions) scaled to the change's blast radius, with results recorded in the PR (issue #612's method).
-
-Compile the findings, fix each, and re-read once. Present the corrected skill and the findings list to the user.
-
-Gate: zero open self-review defects, and the user has seen the corrected skill. An unaddressed defect blocks Phase 5.
-
-## Phase 5 — Routing integration · gate: BLOCK
-
-A skill no one routes to is dead code. Wire it in.
-
-- Add a row to `<plugin-root>/routines/INDEX.md`: skill name (linked), "Routed to by", and "Owns" (the one-sentence responsibility from Phase 2).
-- Add the skill to the routing table — the invocation cue (the `/<command>` or condition), the primary route, any dispatched agents, the hard gate. For a command-invoked skill, also register the `/<command>` in the command reference.
-- For an internal skill, update the named parent so it routes to the new skill explicitly.
-- Before adding a command wrapper, check whether it would only repeat the skill's
-  description and route back here. In codeArbiter source, use the existing generator's
-  whole-file SKILL_ENTRY declaration for a genuinely command-backed owner; keep its
-  argument hint and procedure in that one discoverable owner. On Claude the generated
-  command remains explicitly usable without a duplicate model listing; Codex/Pi use
-  their generated entry skill for discovery and keep the owner in private routines.
-  Do not register another public operation solely for an implementation step. A
-  directly referenced information card can remain outside discovery roots, owned by
-  its existing caller; it does not need fabricated skill frontmatter or an INDEX row.
-
-Verify no broken references: every path the skill cites resolves. `INDEX.md` row parity and routing-table dangling-route freedom are no longer a hand-check here — `.github/scripts/check_routing_index_parity.py` enforces both mechanically in CI (issue #592); a missing row, an orphan row, or a route to a name that does not exist fails the build.
-
-Hand off to `commit-gate` — never `git commit` directly. The skill change ships only through the commit gate.
-
-Gate: `INDEX.md` and the routing table updated, no broken references, and the change handed to `commit-gate`. CI's routing-parity check is the authority on row/route correctness, not a self-report.
-
-## Hard rules
-
-- MUST NOT author a skill before the gap is proven uncovered against `INDEX.md` and backed by Option-A or Option-B evidence.
-- MUST NOT begin authoring without explicit user agreement on scope (routed-vs-dispatched, command-vs-internal, single responsibility).
-- MUST NOT emit a skill whose phases lack concrete `Gate:` lines, or whose Hard rules duplicate phase rules.
-- MUST NOT use trigger language ("trigger", "fires", "runs") or a `## Trigger` disclaimer — a skill is routed to, an agent dispatched.
-- MUST NOT reference a cut doc, cut skill, or a legacy `.agents/` / `${FRAMEWORK_ROOT}` / `${PROJECT_ROOT}` path in an authored skill.
-- MUST NOT ship a skill without an `INDEX.md` row and a routing entry.
-- MUST NOT commit the new skill directly — hand off to `commit-gate`.

package/plugins/ca-pi/routines/skill-author/references/skill-template.md

@@ -1,58 +0,0 @@
----
-name: <skill-name>
-description: <One terse sentence: what routes to this skill, the phase count, and the hard gate. No doc refs, no trigger disclaimer. JSON-quote the whole scalar if it starts with `[`/`{` or contains `": "` or `" | "`. Example: "The only path to X. Routed to when the user invokes /foo. Three gated phases — A, B, C. Nothing ships until every gate clears.">
----
-<!-- Chain-internal skill (never user-typed, reached only via routing-table path loads)?
-     Add `disable-model-invocation: true` as a third frontmatter line — ADR-0028. -->
-
-# <skill-name>
-
-<One-line intro naming what routes to it: `/<command>` (user-invoked) or the parent skill (internal).>
-
-## Pre-flight
-
-Read these, or STOP and surface the gap — never guess a command:
-
-- `<project-root>/.codearbiter/<doc>.md` — <what it provides>. Stop if missing; do not guess.
-- `<plugin-root>/routines/<other-skill>/SKILL.md` — <only if a sibling skill must clear first>.
-- `<plugin-root>/agents/<agent>.md` — <only if this skill dispatches an agent>.
-
-## Phase 1 — <title> · gate: BLOCK
-
-<Imperative description of what this phase does. Terse, no hedging.>
-
-Gate: <a concrete, checkable exit condition>. A partial result does not pass.
-
-## Phase 2 — <title> · gate: BLOCK
-
-<...>
-
-Gate: <...>.
-
-## Phase N — <title> · gate: BLOCK
-
-<Final phase. If the skill ends by persisting, hand off to `commit-gate` — never `git commit` directly.>
-
-Gate: <...>.
-
-## Hard rules
-
-- MUST NOT <invariant, stated once — not duplicated from a phase>.
-- MUST NOT <invariant>.
-- MUST NOT guess a command — read the cited `.codearbiter/` doc or STOP.
-
-<!--
-House-style reminders (delete before shipping):
-- Frontmatter is `name:` + `description:` only.
-- H1 matches `name`. One-line intro names what routes to it.
-- Each non-declarative phase ends in a one-line `Gate:`.
-- Paths: project state -> `<project-root>/.codearbiter/<doc>`;
-  skills -> `<plugin-root>/routines/<name>`;
-  agents -> `<plugin-root>/agents/<name>.md`.
-- Surviving project docs only: CONTEXT.md, tech-stack.md, coding-standards.md,
-  specs/, plans/, security-controls.md, decisions/, overrides.log.
-- Terminology lock: a skill is *routed to*; an agent is *dispatched*.
-  Never "trigger", "fires", "runs". No `## Trigger` block.
-- Out-of-scope finding -> one line with inline `[NEEDS-TRIAGE]`.
-- Terse, imperative. No "should", no "if it looks wrong".
--->

package/plugins/ca-pi/skills/ca-new-skill/SKILL.md

@@ -1,129 +0,0 @@
----
-name: ca-new-skill
-description: Assess a request for a new reusable codeArbiter skill, prove the uncovered gap, agree scope, author and integrate it. Questions and one-off tasks do not authorize adding a skill.
-argument-hint: <gap or verb-noun skill name>
----
-
-# skill-author
-
-Author a new skill, the right way. The public entry and natural-language requests route
-here; this complete owner is also available as a directly read internal resource.
-Use a verb-noun name (for example, `dependency-review`), not a descriptive sentence.
-A one-time action belongs to the applicable work procedure. A question about whether a
-skill is needed is answered without authoring; an almost-matching owner is reviewed and
-extended through the existing change workflow rather than duplicated.
-
-## Pre-flight
-
-Read these, or STOP and surface the gap — never author on assumption:
-
-- The `<gap>` argument. Absent → STOP and ask: "Describe the gap this skill would fill. What situation does no existing skill cover today?"
-- `<plugin-root>/routines/INDEX.md` — the surface scan of every existing skill. This is the gap-overlap check in Phase 1 and the integration target in Phase 5. Never bulk-read the skill bodies.
-- `<plugin-root>/routines/commit-gate/SKILL.md` and `<plugin-root>/routines/tdd/SKILL.md` — the canonical v2 format the authored skill must mirror. Read them before Phase 3. The command-backed commit owner also demonstrates the
-  single-source entry convention. Keep its description and argument hint with the
-  owning skill; the generator supplies the compatible public spelling per host.
-- `<project-root>/.codearbiter/CONTEXT.md` — project context, only if the gap is project-specific. A generic skill needs no project state.
-
-## Phase 1 — Gap evidence · gate: BLOCK
-
-A new skill is permanent surface area. It is not written until the gap is proven real and proven uncovered.
-
-Restate the gap in one sentence. Then scan `INDEX.md` for overlap: if an existing skill's "Owns" column already covers this, STOP and name it — "The `<name>` skill already owns this; review it before requesting a new one."
-
-If no skill covers it, demand evidence — one of:
-
-- **A** — three specific cases where the gap blocked work: what was attempted, what happened with no skill, what it cost.
-- **B** — one high-impact case with traceable evidence: a blocked PR, an introduced defect, a compliance finding, a repeated failure pattern.
-
-Hypothetical cases do not count. Fewer than three (Option A) or no traceable evidence (Option B) → STOP and decline: "Insufficient evidence of a real, recurring gap. A skill adds permanent maintenance cost. Return with evidence and I'll author it."
-
-Gate: the gap is restated, proven uncovered against `INDEX.md`, and backed by Option-A or Option-B evidence. Speculation does not pass.
-
-## Phase 2 — Scope · gate: BLOCK
-
-Settle scope with the user before any prose is written. Ask, and wait for an explicit answer:
-
-- **Routed or dispatched?** A *skill* is routed to (gated phases, lives at `<plugin-root>/routines/<name>/SKILL.md`). An *agent* is dispatched by a skill (a reviewer/author, lives at `<plugin-root>/agents/<name>.md`). If the gap is really a reviewer, this is the wrong skill — redirect to agent authoring.
-- **Command-invoked or internal?** Does a user type `/<name>` to reach it, or does another skill route to it mid-workflow? A command needs a routing-table entry; an internal skill needs a named parent that routes to it.
-- **Single responsibility.** State the one thing the skill owns in a sentence. If it needs "and" to describe its job, it is two skills — split it or pick one.
-
-Confirm back: "I will write a [command-invoked / internal] skill at `<plugin-root>/routines/<name>/SKILL.md`, owning <one responsibility>. [A `/<name>` command will be added to the routing table. / The `<parent>` skill will route to it.]"
-
-Gate: explicit user agreement on routed-vs-dispatched, command-vs-internal, and a one-sentence single responsibility. Assumed answers do not pass.
-
-## Phase 3 — Authoring · gate: BLOCK
-
-Write `SKILL.md` to the v2 house style — mirror `commit-gate` and `tdd` exactly. Start from `<plugin-root>/routines/skill-author/references/skill-template.md`. Required shape:
-
-- **Frontmatter** — `name:` and `description:` as the normal base. Description is terse: the requested outcome, when it applies, and important negative intent. A command-backed owner also records its argument hint and keeps its natural-language description on the owner. The generator suppresses only the redundant Claude command description. No cut doc refs, no trigger disclaimer.
-- **`# <name>`** H1, then a one-line intro naming what routes to it (`/<command>` or the parent skill).
-- **`## Pre-flight`** — the docs to read or STOP on. Project state cites `<project-root>/.codearbiter/<doc>`; other skills cite `<plugin-root>/routines/<name>`; agents cite `<plugin-root>/agents/<name>.md`. Never guess a command — read it or STOP.
-- **`## Phase N — <title> · gate: BLOCK|STOP`** — sequential, each ending in a one-line `Gate:`. A phase with output that could be wrong has a gate; only a purely declarative phase may omit one.
-- **`## Hard rules`** — `MUST NOT` lines, one per rule, no duplication.
-
-Authoring rules:
-
-- Imperative, terse, no hedging. No "should", no "if it looks wrong". A gate is a concrete, checkable condition.
-- Surviving project docs only: `CONTEXT.md`, `tech-stack.md`, `coding-standards.md`, `specs/`, `plans/`, `security-controls.md`, `decisions/`, `overrides.log`. Do not reference cut docs or cut skills.
-- Terminology lock: a skill is *routed to*; an agent is *dispatched*. Never "trigger", "fires", or "runs".
-- An out-of-scope finding gets one line with an inline `[NEEDS-TRIAGE]` marker.
-
-## Phase 4 — Self-review · gate: BLOCK
-
-Re-read the authored skill against the v2 quality bar. Each line below is a checkable defect, not a vibe:
-
-- **Single responsibility** — the skill owns one thing. If a phase belongs to a different job, it is the wrong skill; cut it.
-- **Concrete gates** — every non-declarative phase ends in a `Gate:` line stating a checkable condition. "Looks good" / "seems right" is not a gate; rewrite it.
-- **House-style prose** — terse, imperative, matches `commit-gate`/`tdd`. Strip hedging and filler.
-- **No duplicated rules** — a rule stated in a phase is not restated in Hard rules, and Hard rules carry no duplicates. State each rule once.
-- **Format conformance** — frontmatter is `name`+`description`, plus `disable-model-invocation: true` on a chain-internal skill (ADR-0028);
-  a command-backed owner instead remains discoverable and also owns its
-  `argument-hint`. The generator suppresses the redundant command listing only on
-  command-native hosts; Codex/Pi entries remain discoverable. Other invocation/tool/model metadata
-  needs explicit generator support, never silent dropping; H1 matches `name`; phases are numbered with `· gate:`; paths use `<plugin-root>` / `<project-root>` correctly; no cut docs/skills, no legacy `${FRAMEWORK_ROOT}`/`${PROJECT_ROOT}`/`.agents/` paths.
-- **Frontmatter scalar quoting** — any frontmatter scalar that starts with `[` or `{`, or contains `": "` or `" | "`, MUST be JSON-quoted (the `_yaml_safe_scalar` predicate the surface generator applies to codex/pi wrappers; the claude surface ships frontmatter verbatim, so the author quotes it at the source).
-- **No trigger language** — "routed to" / "dispatched" only, and no `## Trigger` disclaimer block.
-- **Evidence lenses** (issue #612) — each checked where the skill's shape triggers it, skipped where it does not:
-  - A gate an agent is tempted to skip carries a rationalization guard AT the decision point — the known excuses paired with rebuttals. The best rebuttal carries its own instrument: a check the agent can run that falsifies the excuse either way. A tempting gate with no guard is a defect.
-  - An acceptance or verification step names what is READ, never what is claimed — "the subagent reports green" is a defect; "the runner's output shows green" is not.
-  - A user-facing ask leads with a recommendation AND its strongest counter-consideration.
-  - A rule a tested helper could enforce is mechanized rather than accreted as prose — the helper enforces, the prose explains.
-  - A rule whose literal reading has an exploitable edge names what it protects.
-- **Behavior-changing gate revisions are validated, not assumed** — an A/B pass (fixed scenarios, rubrics written before any output exists, both versions run under identical conditions) scaled to the change's blast radius, with results recorded in the PR (issue #612's method).
-
-Compile the findings, fix each, and re-read once. Present the corrected skill and the findings list to the user.
-
-Gate: zero open self-review defects, and the user has seen the corrected skill. An unaddressed defect blocks Phase 5.
-
-## Phase 5 — Routing integration · gate: BLOCK
-
-A skill no one routes to is dead code. Wire it in.
-
-- Add a row to `<plugin-root>/routines/INDEX.md`: skill name (linked), "Routed to by", and "Owns" (the one-sentence responsibility from Phase 2).
-- Add the skill to the routing table — the invocation cue (the `/<command>` or condition), the primary route, any dispatched agents, the hard gate. For a command-invoked skill, also register the `/<command>` in the command reference.
-- For an internal skill, update the named parent so it routes to the new skill explicitly.
-- Before adding a command wrapper, check whether it would only repeat the skill's
-  description and route back here. In codeArbiter source, use the existing generator's
-  whole-file SKILL_ENTRY declaration for a genuinely command-backed owner; keep its
-  argument hint and procedure in that one discoverable owner. On Claude the generated
-  command remains explicitly usable without a duplicate model listing; Codex/Pi use
-  their generated entry skill for discovery and keep the owner in private routines.
-  Do not register another public operation solely for an implementation step. A
-  directly referenced information card can remain outside discovery roots, owned by
-  its existing caller; it does not need fabricated skill frontmatter or an INDEX row.
-
-Verify no broken references: every path the skill cites resolves. `INDEX.md` row parity and routing-table dangling-route freedom are no longer a hand-check here — `.github/scripts/check_routing_index_parity.py` enforces both mechanically in CI (issue #592); a missing row, an orphan row, or a route to a name that does not exist fails the build.
-
-Hand off to `commit-gate` — never `git commit` directly. The skill change ships only through the commit gate.
-
-Gate: `INDEX.md` and the routing table updated, no broken references, and the change handed to `commit-gate`. CI's routing-parity check is the authority on row/route correctness, not a self-report.
-
-## Hard rules
-
-- MUST NOT author a skill before the gap is proven uncovered against `INDEX.md` and backed by Option-A or Option-B evidence.
-- MUST NOT begin authoring without explicit user agreement on scope (routed-vs-dispatched, command-vs-internal, single responsibility).
-- MUST NOT emit a skill whose phases lack concrete `Gate:` lines, or whose Hard rules duplicate phase rules.
-- MUST NOT use trigger language ("trigger", "fires", "runs") or a `## Trigger` disclaimer — a skill is routed to, an agent dispatched.
-- MUST NOT reference a cut doc, cut skill, or a legacy `.agents/` / `${FRAMEWORK_ROOT}` / `${PROJECT_ROOT}` path in an authored skill.
-- MUST NOT ship a skill without an `INDEX.md` row and a routing entry.
-- MUST NOT commit the new skill directly — hand off to `commit-gate`.