@arbiterforge/ca-pi 0.15.1 → 0.15.3

package/plugins/ca-pi/hooks/_artifactlib.py

@@ -345,7 +345,9 @@ def _installed_workflow_preflight(installation: Path) -> dict[str, object]:
 
     required = [("UserPromptSubmit", None, "prompt-submit.py")]
     tools = ("Bash", "Agent") if host == "claude" else (
-        "Bash", "shell_command", "exec_command", "unified_exec", "spawn_agent")
+        "Bash", "shell_command", "exec_command", "unified_exec", "spawn_agent",
+        "collaborationspawn_agent", "multi_agent_v1send_input", "multi_agent_v1resume_agent",
+        "multi_agent_v1close_agent")
     required += [(event, tool, "artifact-authority-hook.py")
                  for event in ("PreToolUse", "PostToolUse") for tool in tools]
     required += [(event, None, "artifact-authority-hook.py")

package/plugins/ca-pi/hooks/_host.py

@@ -11,7 +11,7 @@ import hostapi  # noqa: E402
 class PiHost(hostapi.Host):
     name = "pi"
     adapter_name = "@arbiterforge/ca-pi"
-    adapter_version = "0.15.1"
+    adapter_version = "0.15.3"
     update_target = "ca-pi"
     update_tag_prefix = "ca-pi-v"
     update_command = "pi update npm:@arbiterforge/ca-pi"

package/plugins/ca-pi/hooks/artifact-authority-hook.py

@@ -25,7 +25,7 @@ def main() -> int:
     tool = payload.get("tool_name")
     root = _hooklib.project_root(payload)
     try:
-        if event in {"PreToolUse", "PostToolUse"} and tool != "spawn_agent":
+        if event in {"PreToolUse", "PostToolUse"} and tool not in _artifactauthoritylib.CODEX_REVIEW_TOOLS:
             result = _artifactauthoritylib.observe_verifier_hook(root, payload)
             if result is None:
                 return 0
@@ -40,26 +40,9 @@ def main() -> int:
         else:
             sys.stderr.write(reason + "\n")
         return 0
-    if event == "PreToolUse" and result.get("state") == "AUTHORIZED":
-        print(json.dumps({
-            "decision": "allow",
-            "reason": (
-                "codeArbiter authorized this wrapper for the exact resolved child set: "
-                + json.dumps(result["command_bindings"], sort_keys=True)
-            ),
-        }))
-    if event == "SubagentStop" and result.get("state") == "COMPLETED":
-        print(json.dumps({
-            "continue": True,
-            "hookSpecificOutput": {
-                "hookEventName": "SubagentStop",
-                "additionalContext": (
-                    "codeArbiter: independent review observation recorded for request "
-                    + result["request_id"]
-                    + "; publish it through the production authority adapter."
-                ),
-            },
-        }))
+    # Saved observations are the result. Success is silent: Codex's closed
+    # SubagentStop schema has no additionalContext, and an explicit approval
+    # would unnecessarily override the host's normal permission processing.
     return 0
 
 

package/plugins/ca-pi/hooks/artifact-authority.py

@@ -46,6 +46,10 @@ def main(argv=None) -> int:
         "--reviewer-model", choices=sorted(_artifactauthoritylib.CLAUDE_REVIEWER_MODELS),
         default="opus", help="Claude reviewer model pinned into the launch envelope",
     )
+    arm.add_argument(
+        "--codex-review-profile", choices=("native-v1",), default=None,
+        help="select only after qualifying the actual registered native V1 UUID interface",
+    )
     verify = sub.add_parser("verify")
     verify.add_argument("--root", required=True)
     verify.add_argument("--request-id", required=True)
@@ -68,10 +72,17 @@ def main(argv=None) -> int:
             raise _artifactauthoritylib.AuthorityError(
                 "UNSUPPORTED_HOST_SEAM", f"host {host} has no verification or review authority"
             )
+        if (host == "codex" and args.activity in _artifactauthoritylib.REVIEW_ACTIVITIES
+                and args.codex_review_profile is None):
+            raise _artifactauthoritylib.AuthorityError(
+                "UNSUPPORTED_HOST_SEAM",
+                "Codex review requires explicit --codex-review-profile native-v1 after live interface qualification",
+            )
         result = _artifactauthoritylib.arm_request(
             root, client, args.artifact_id, args.record_id, args.activity,
             workspace_roots=workspaces or None, host=host,
             reviewer_model=args.reviewer_model,
+            codex_review_profile=args.codex_review_profile,
         )
         if host == "claude" and args.activity == "verification":
             # The Claude verifier hook pins this exact shipped script and

package/plugins/ca-pi/hooks/hostapi.py

@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "2.22.1"
+    adapter_version = "2.22.3"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,

package/plugins/ca-pi/includes/artifacts.md

@@ -278,7 +278,13 @@ separate and cannot be relabelled as qualified launch evidence.
 
 For `spec_review` or `quality_review`, arm the corresponding activity without
 workspace mappings and dispatch the returned `launch_envelope` unchanged to one
-fresh host subagent. The host hooks bind the exact launch call, child start and
+fresh host subagent. The bounded prompt names the retained, content-addressed
+evidence context instead of embedding its full input manifest. The reviewer
+must read that context and inspect its subject, coverage and source inputs.
+The adapter verifies the context's canonical bytes and digest before launch and
+publication; a missing or changed context blocks authority. Never shorten or
+rewrite the returned envelope yourself.
+The host hooks bind the exact launch call, child start and
 the child's first stop; a pasted or coordinator-authored decision is not review
 authority.
 Publish the completed request through the same `publish` command. `task-review`
@@ -287,6 +293,19 @@ the scope reaches `REVIEW`, reverify against one current source snapshot, run th
 combined quality review, and use `accept-scope` once. Do not accept tasks
 individually.
 
+An ARMED review that never launched can be abandoned through the adapter:
+
+```sh
+python "<plugin-root>/hooks/artifact-authority.py" recover --root "<project-root>" --request-id <request-id> --disposition abandoned
+```
+
+The adapter requires no attempt, launch, observation, receipt or prior recovery.
+It retains the request and its evidence, creates no receipt, and prohibits
+dispatching that request again. This also covers bounded legacy requests whose
+inline manifests made them too large for normal dispatch. Launched or captured
+requests remain subject to their existing recovery rules. Arm a new request
+only after the retained request is terminal.
+
 An interrupted or `BLOCKED` HTML task never resumes by editing its status. Arm
 the installed reconciliation adapter for the exact task or scope, present its
 returned `short_reply` (`reconcile <STATE> <code>` for a task, `reconcile <code>`

package/plugins/ca-pi/includes/command-compatibility.md

@@ -14,3 +14,34 @@ contain the compatibility metadata. ca retains these routes through every 2.x re
 before a separately approved 3.0.0. ca-codex and ca-pi retain them through every later 0.x release,
 with no removal before a separately approved 1.0.0. Passing a version floor never authorizes removal:
 removal needs a new governed decision and fresh compatibility evidence.
+## Explicitly retired capability: skill authoring
+
+The maintainer explicitly approved removal of `new-skill` and `skill-author` on
+2026-09-25 in PR #854. This one named exception supersedes the earlier
+retain-every-route requirement for that workflow only. Its command, owning skill,
+template and generated host entries are removed, not deprecated aliases. No
+`extend skill` replacement or hidden callable routine is installed.
+
+Requests to author or change repository resources use the applicable existing
+change workflow and its authorization, verification and commit requirements.
+CodeArbiter maintainers can read the format conventions in the source repository's
+`core/surface/README.md`; that document is not an installed workflow.
+
+This is an intentional command-compatibility break, not a claim that older
+invocations continue to resolve. Existing installed older releases are unchanged.
+The five other compatibility aliases and their publication clocks remain intact;
+this retirement is not permission to remove any other entry.
+
+## Reviewed single-owner entries
+
+PR #854 composes `tribunal`, `threat-model`, `context-check`, `cleanup`, and `pr`
+from their existing skill owners. These operations are retained, not retired or
+renamed. Their explicit argument grammars, mode markers, compatibility clocks and
+host availability remain unchanged. `status drift` and `pr --cleanup` reach the
+same owners directly; PR watch mode retains its existing watcher resource.
+
+The wrapper text is no longer an independent policy source. Drift and cleanup
+retain their full operational body, and PR retains current acceptance/ancestry
+preflight plus one shared opening procedure. Tests keep historical wrapper
+fingerprints while checking these named migrations against the owning contracts.
+This permission does not authorize an unrelated route removal or gate change.

package/plugins/ca-pi/includes/farm.md

@@ -35,8 +35,14 @@ the same hard gates; **only the cheap HTTP-chat worker ships today** — premium
 model) and agentic (a worker that reads files and iterates) are what the seam is designed for, roadmap
 not built. Cost arbitrage is one worker policy, not the definition.
 
-The worker prompt is enriched with the failing-test source and current in-scope file contents, byte-capped
-(`FARM_ENRICH_MAX_BYTES`) and secret-redacted before transmission to the endpoint.
+The worker prompt includes the failing-test source, current in-scope files, and available prior output.
+`FARM_ENRICH_MAX_BYTES` limits their rendered UTF-8 enrichment, including section text, file labels,
+separators, and any truncation notice. Complete source is redacted before truncation; a cut never splits
+an encoded code point. Current source takes priority over prior output. When a file does not fit, its
+body is shortened and later files are omitted. A label that cannot fit is omitted rather than split.
+Small limits use a compact notice; limits too small for that notice omit enrichment entirely.
+This is not a cap on task instructions, failure details, the full JSON request, model tokens, or local
+file-read memory. No additional model request or user checkpoint is made solely because context was cut.
 
 **Swapping the worker changes who writes the code, never whether it's reviewed.** Every task the farm
 reports green is still routed through the normal spec-compliance, quality, and fresh-verification
@@ -47,18 +53,84 @@ capable of the slice).
 
 ### Zero-token quality guards
 
-1. **Literal-leak** — rejects an impl that simply hard-codes the literal value the test asserts
-   (`return 42` for `expect(f()).toBe(42)`).
+1. **Literal-leak** — flags repeated whole, same-kind string or numeric spellings in a small
+   implementation (`return 42` for `expect(f()).toBe(42)`). A number inside an identifier, a larger
+   number/string, or a conventional source comment is not a match. String `"42"` and number `42`
+   are distinct. The existing five-code-line boundary determines rejection versus warning; a
+   rejection names the actual small-file match, not an earlier substantial-file match.
 2. **Mutation** — after the gate is green, mutates the worker's in-scope impl (operator flips, return
    replacement, boolean inversion) and re-runs **only the task's narrow test** (`gate.commands[0]`). A
-   surviving mutant is code the test does not constrain — gaming, dead code, or a weak test. The score
-   is **bounded by test strength**: a low score is a strong red flag, a high score is necessary but not
-   sufficient (Phases 3–5 remain the real quality gate). A low score attaches a **warning that rides
-   into Phase 3** for Claude to judge (worker gaming vs. weak test); only a near-zero score on a
-   non-trivial impl hard-escalates. Sampled and time-boxed so it never balloons wall-clock. Set
+   surviving mutant is an implementation change the test command did not reject. It can indicate
+   weak tests, dead code or an equivalent change; it does not by itself prove gaming. Bare nonzero
+   exits do not establish valid, assertion-killed mutants. Built-in positive rejection ratios remain
+   unverified bounds, not measured scores; see the accounting rule below. Any completed nonzero
+   built-in rerun leaves the measurement unavailable, whatever its ratio. It attaches a
+   **warning that rides into Phase 3** for independent review unless the existing near-zero bound
+   with sufficient evaluated evidence rejects the candidate. `FARM_MUTATION_WARN_BELOW` applies
+   only to measured scores from a successful external hook or a built-in all-pass zero result;
+   it cannot suppress an unavailable-measurement warning. Screening is sampled and time-boxed. Set
    `FARM_MUTATION_CMD` to swap the built-in text mutator for a real per-language framework (Stryker,
    mutmut, …); it runs in the worktree with `FARM_MUTATION_FILES` / `FARM_MUTATION_TEST_PATH` /
-   `FARM_MUTATION_TEST_CMD` set and must print a trailing JSON line with a numeric `score`.
+   `FARM_MUTATION_TEST_CMD` set. A measured hook score requires successful completion (exit 0,
+   no timeout, verified timeout cleanup when needed) and a trailing stdout JSON report with a finite
+   `score` in `[0, 1]`. A wrapper around a percentage-based framework must normalize its measurement;
+   stderr diagnostics are not the score channel. Optional counts and survivors remain absent unless
+   the hook actually reports them.
+
+The literal check is a bounded lexical heuristic, not an assertion parser or proof of intent. It
+ignores conventional slash comments in recognized C-family source suffixes and hash comments in
+Python; other suffixes do not acquire a guessed comment grammar. Plain quote delimiters and numeric
+spellings are compared without evaluating escapes or constant expressions. Dynamic templates are not
+constant-string evidence; only unambiguous expression-start regex forms are skipped. Language-specific
+prefixes, JSX and other ambiguous grammar are not fully interpreted. Test labels, inputs and legitimate
+shared constants can still match. Normal independent review remains authoritative; an absent lexical
+match neither skips the mutation check nor accepts the work.
+
+A configured hook that fails, times out, or reports invalid output supplies diagnostics, not a
+measured `mutationScore`. Ordinary unavailable measurements retain the existing warning policy and
+continue through normal independent review; this does not add a user checkpoint. Do not hide adverse
+evidence: a failed hook's parseable stdout report at or below the existing near-zero floor, with at
+least five explicitly reported evaluated mutants, still rejects that candidate pending successful
+remeasurement. It is not published as a valid score. No evaluated count is invented from absence or a
+survivor list. A retained alternative can qualify under the same rules before another model round.
+
+If timeout cleanup cannot establish that the mutation process tree stopped, qualification is fatal
+for that task: no further candidate, retry, commit or integration may run against a possibly live
+writer. Existing task reporting retains known spend and cleanup diagnostics. Neither an adverse
+report nor failed process containment can be converted into acceptance by scoring prose.
+
+The built-in text mutator bounds each test launch by the remaining mutation budget and any shorter
+configured gate timeout. Zero mutation budget launches no tests; disabling the general gate timeout
+does not disable this budget. Mutant writes count against the trial budget. Verified process teardown
+and defensive restoration can take additional time and must finish or refuse safely before work
+advances. An interrupted trial is not a killed mutant: stop screening, restore the worker's output,
+and return diagnostics without a measured score. Completed observations before the interruption stay
+explicitly unverified; the existing near-zero/five-completed-reruns floor still rejects an adverse
+candidate. A clean timeout otherwise warns through independent review, without another default
+user checkpoint. Unverified process cleanup retains the fatal containment boundary above.
+
+A completed nonzero rerun is an **unclassified gate rejection**, not a proved mutant kill. The
+built-in runner cannot distinguish a compiler, loader, infrastructure or assertion failure from an
+arbitrary command's exit status. Diagnostic wording and printed score-like JSON do not grant that
+classification. Preserve a bounded, redacted first-rejection witness and completed/pass counts;
+do not publish a positive `mutationScore` from these exits. For real language-specific measurements,
+use the existing explicitly configured external framework hook rather than another public command.
+
+For at least three completed reruns, retain `R / (S + R)` as an **unverified gate-rejection upper
+bound**, where `R` is completed nonzero reruns and `S` is successful reruns. Treating every rejected
+trial as a valid kill is the most favorable interpretation of those observations; excluding invalid
+rejections cannot increase that fraction. This is not a language-aware mutation score and does not
+classify equivalent or unexercised changes. Preserve the existing near-zero/five-completed-reruns
+rejection floor even on this bound: uncertainty cannot erase an already adverse result. Otherwise
+retain the ordinary warning and independent review, without spending another model round or adding a
+user checkpoint solely because the measurement is unavailable.
+
+With no rejected or interrupted trial, at least three successful reruns still produce the existing
+zero screening score and survivor list. A shorter all-pass run stays too thin to score; a short
+nonzero run reports its diagnostic without inventing a usable evaluated count. A budget ending
+between trials follows these same rules; interruption never publishes a partial measured score.
+Language-aware validity and semantic interpretation of literal overlap remain separate work. None
+of these screening outcomes is task or scope acceptance proof.
 
 Note: `writing-plans --farm` MUST place the task's narrow behavioral test first in `gate.commands` —
 the mutation guard runs `gate.commands[0]` as the per-mutant test (running an exhaustive suite per mutant
@@ -66,22 +138,56 @@ would be too slow).
 
 ### Best-of-N sampling and iterative retries
 
-By default the farm draws one worker completion per task attempt (`FARM_SAMPLES=1` — unchanged
-behavior). Because the gate is a deterministic pass/fail oracle and each task runs in an isolated
-worktree, you can instead draw **N candidates in parallel** and accept the first that passes the gate:
-set `FARM_SAMPLES=N`. Each sample runs in its own scratch worktree cut from the integration HEAD; the
-winner's files are taken into the task worktree and merged, the losers discarded. Total in-flight
-worker calls never exceed `FARM_CONCURRENCY` — sampling **shares** that budget, it does not multiply
-it. The cost is up to N× worker tokens (the cheap axis) for a higher first-time-go rate;
-`farm-report.json` records both the summed sample-token spend (`promptTokens`/`completionTokens`) and
-the accepted candidate's own tokens (`acceptedPromptTokens`/`acceptedCompletionTokens`) so the
-trade-off is visible. With `FARM_SAMPLES>1` the worker temperature is auto-bumped off 0 (to 0.7) so the
-samples actually diversify; set `FARM_TEMPERATURE` to control it.
-
-On a **retry** — a failed gate, or a sampling round with no green — the worker is shown its own previous
-in-scope output, not just the gate-failure tail, so it refines rather than restarts blind. That prior
-output rides the same byte-cap (`FARM_ENRICH_MAX_BYTES`) and secret-redaction chokepoint as all other
-injected context; out-of-scope drift is never carried forward.
+By default the farm draws one worker completion per task attempt (`FARM_SAMPLES=1`). With
+`FARM_SAMPLES=N`, it draws **N candidates** in isolated scratch worktrees from the task's frozen
+baseline. Total in-flight worker calls share `FARM_CONCURRENCY`; sampling does not multiply that cap.
+
+Sample gate success is only a shortlist. In deterministic sample-index order, each shortlisted
+candidate is materialized into the task worktree and receives the same containment, immutable-test,
+drift, task-gate, literal-risk and mutation checks as the single-worker path. Alternatives remain
+available until one passes those checks. A gate or high-risk rejection tries the next existing
+candidate before spending another model round. An integrity failure or an unusable reset/setup
+stops that task rather than disguising the failure with an unrelated passing candidate.
+
+Between candidates, tracked and non-ignored worker changes are reset to the task baseline and the
+existing setup phases are reapplied. Ignored dependency caches retain their existing policy. Cleanup
+is attempted for every sample, including exception paths; unresolved cleanup is reported. The same
+selection applies to detached canary work, which still stops before commit or merge.
+
+`farm-report.json` records summed known sample usage (`promptTokens`/`completionTokens`) separately from
+the selected candidate's own tokens (`acceptedPromptTokens`/`acceptedCompletionTokens`). Qualification
+makes no additional model requests, but can run local gates and mutation checks for multiple
+candidates. It is not comparative quality ranking or a measured savings claim. Normal independent
+reviews and acceptance still follow. With `FARM_SAMPLES>1` and no explicit temperature, sampling
+defaults to `0.7`; `FARM_TEMPERATURE` remains the operator override. An explicit
+`FARM_TEMPERATURE=0` is respected even with multiple samples and disables this automatic
+bump. Leave the override unset or choose a supported nonzero temperature when seeking
+more varied candidates; a temperature setting is not a guarantee of distinct outputs.
+
+On a **retry**, available output reported written by the selected previous candidate is retained only
+where it intersects implementation scope. Untouched baseline files remain current-source context, not
+previous work. Partial output and file evidence can survive rejection or a later qualification exception;
+sibling candidates are not mixed. Prior output uses the same byte cap and redaction as other context.
+Labels say **not accepted**, not that a test necessarily failed. Actual failure details distinguish a
+worker response, qualification, transport, or integration problem so valid work need not be rewritten
+blindly. Retained context grants no acceptance, new retry allowance, or permission.
+If the retry cannot reset its worktree, the task escalates without another model call.
+Its report retains the completed attempts' known token usage, last output/risk evidence,
+and any unresolved sample cleanup outcomes; a failed reset cannot erase them.
+
+A decoded provider response can contain reported usage even when its output is
+rejected. The worker preserves valid counters through malformed message content,
+read-only or escaping paths, and guarded-write refusals, including any already
+written file list. A malformed non-text response becomes an ordinary worker
+failure under the existing retry/selection policy, not an unhandled parser error.
+Counters must be explicitly reported nonnegative safe integers; validate prompt
+and completion independently. Explicit zero is valid; missing, invalid or
+undecodable counts stay absent at the worker boundary. The existing report sums
+known counts, so its total is not proof of complete usage or verified billing.
+No extra provider request is made to recover a missing counter. HTTP failures,
+transport retries without usable usage and provider pricing remain outside this
+accounting correction. Output rejection still enforces the original write,
+test, gate and independent-review requirements.
 
 ## Required
 
@@ -110,8 +216,16 @@ picks a model by *measurement*, not hearsay:
    an acceptable canary pass-rate. Otherwise re-select.
 2. **Discovery** — websearch the current free Zen roster to enumerate candidate ids (codenames included).
    This finds *candidates*; it does not judge quality.
-3. **Canary** — `farm.js --canary` runs the plan's smallest task against each candidate and ranks them by
-   measured pass-rate / attempts / latency (`FARM_CANDIDATE_MODELS` carries the list). The top passer wins.
+3. **Canary** — `farm.js --canary` runs the plan's smallest no-dependency task against each candidate
+   and ranks that task's gate result / attempts / latency (`FARM_CANDIDATE_MODELS` carries the list).
+   It freezes the configured base commit before probing, uses separate detached scratch worktrees
+   for each model and sample, and records `baseCommit` in `.farm/canary-report.json`. Candidate
+   selection overrides `task.model` for the trial only; normal dispatch keeps its task override.
+   Worker containment, immutable tests, drift and verification checks still apply. Evaluation stops
+   before staging, committing or merging: it does not reset or advance an existing integration
+   branch. Existing task branches and worktrees are not its scratch. The top passer wins only after
+   verified cleanup; retained scratch is reported and exits nonzero without recursively erasing it.
+   A single task's result is not a general model pass-rate or promotion qualification.
 4. **Surface** — the choice is presented with its measured basis (and a one-line websearched identity note
    for the audit log), then written to `plan.meta.model` + `.farm/model-cache.json`.
 5. **Fallback ladder** — if the canary can't run or none pass: cached model → unmeasured websearch pick
@@ -125,21 +239,21 @@ picks a model by *measurement*, not hearsay:
 | `FARM_API_BASE_URL` | `https://opencode.ai/zen/v1` | Endpoint URL (env → plan.json → this default). |
 | `FARM_CANDIDATE_MODELS` | _(unset)_ | Comma-separated ids for `--canary` probing. Set by the dispatch skill. |
 | `FARM_CONCURRENCY` | `4` | Max concurrent task workers — and the shared ceiling on TOTAL in-flight worker calls, including best-of-N samples. |
-| `FARM_SAMPLES` | `1` | Best-of-N: candidates drawn per task attempt; first to pass the gate wins. `1` = today's single-candidate path. N>1 trades up to N× worker tokens for higher first-time-go; shares the `FARM_CONCURRENCY` budget (never N× it). |
-| `FARM_TEMPERATURE` | `0` | Sampling temperature sent to the worker. Auto-bumped to `0.7` when `FARM_SAMPLES>1` and left at `0` (so samples diversify); set explicitly to override. |
+| `FARM_SAMPLES` | `1` | Best-of-N: candidates drawn per attempt; first in index order to pass task-worktree gates and risk qualification is selected. `1` keeps the single-worker path. Shares `FARM_CONCURRENCY`; known reported usage from all candidates is summed. |
+| `FARM_TEMPERATURE` | `0` (one sample); `0.7` (multiple, unset) | Sampling temperature sent to the worker. Defaults to `0` when `FARM_SAMPLES=1` and `0.7` when `FARM_SAMPLES>1`. Any explicit value, including `0`, overrides the automatic default. |
 | `FARM_MAX_TOKENS` | _(unset)_ | Max completion tokens per worker call. `0`/unset = provider default (today's unbounded behavior). |
 | `FARM_MAX_RETRIES` | `2` | Max gate retries per task before escalating. |
 | `FARM_BASE_BRANCH` | `main` | Branch the integration branch is cut from. |
-| `FARM_REQUEST_TIMEOUT_MS` | `120000` | Per-request hard timeout (prevents worker-slot deadlock). |
-| `FARM_API_MAX_RETRIES` | `3` | Transport retries for 429/5xx (honors `Retry-After`). |
+| `FARM_REQUEST_TIMEOUT_MS` | `120000` | Per-request hard timeout. A valid provider `Retry-After` longer than this is not shortened; the task is deferred without another authoring attempt. |
+| `FARM_API_MAX_RETRIES` | `3` | Transport retries for 429/5xx. Bounded `Retry-After` is honored; exhaustion defers new authoring for that task. |
 | `FARM_ENTITLEMENT_PROBE_TIMEOUT_MS` | `35000` | Per-candidate wall-clock cap for the `--canary` entitlement pre-screen (drops 401 promo-expired models). |
-| `FARM_ENRICH_MAX_BYTES` | `131072` | Cap on bytes of test-source + in-scope file context injected into the worker prompt (data-minimization; redacted for secrets). |
+| `FARM_ENRICH_MAX_BYTES` | `131072` | UTF-8 cap on rendered current/prior file context, labels, separators and notices; not the complete prompt or request. |
 | `FARM_ABORT_ESCALATION_RATE` | `0.5` | Circuit breaker: abort once escalations exceed this fraction… |
 | `FARM_ABORT_MIN_TASKS` | `3` | …after at least this many tasks have settled. |
 | `FARM_MUTATION` | `on` | Mutation guard on/off. |
 | `FARM_MUTATION_SAMPLE` | `15` | Max mutants per task (sampled). |
 | `FARM_MUTATION_BUDGET_MS` | `30000` | Per-task mutation time box. |
-| `FARM_MUTATION_WARN_BELOW` | `0.5` | Score below this attaches a warning into Phase 3. |
+| `FARM_MUTATION_WARN_BELOW` | `0.5` | Measured scores below this warn in Phase 3 unless the rejection floor applies. Unavailable or unverified measurements warn independently of this threshold. |
 | `FARM_MUTATION_ESCALATE_BELOW` | `0.1` | Score at/below this (≥5 mutants) hard-escalates. |
 | `FARM_MUTATION_CMD` | _(unset)_ | Pluggable external mutation framework hook. |
 | `FARM_RUN_ID` | _(random)_ | Pin this run's id — also the name of its artifact directory (`.farm/runs/<run-id>/`). Must be 1–64 chars of `[A-Za-z0-9._-]`; anything else is refused at startup. Reusing an id publishes over that directory's receipts, so pin a fresh one per run. |
@@ -217,7 +331,7 @@ Every run owns an artifact directory keyed by its run id — `<project-root>/.fa
 that directory is the **durable receipt**, written by that run alone. Two farm processes against one
 repository therefore cannot overwrite each other's *evidence* (see the concurrency caveat below — the
 receipts are isolated, the git state is not):
-- `farm-report.json` — structured results: per-task status, attempts, files written, worker token spend,
+- `farm-report.json` — structured results: per-task status, attempts, files written, known reported worker usage,
   warnings (gaming-risk), and an `aborted` flag; plus a `blocked[]` array with reasons, and an
   `artifacts` block stating whether the streaming rail was complete and which tasks' diff evidence is
   unavailable.
@@ -230,7 +344,8 @@ own artifacts: `.farm/farm-report.json`, `.farm/farm-report.md`, `.farm/farm-res
 `.farm/diffs/<task-id>.patch`. Under concurrency the pointer is last-writer-wins — always a complete
 artifact, never a truncated one, but attributable only via its `run_id`. Reconcile against the run
 directory when it matters. Also in `.farm/`:
-- `canary-report.json` — model-probe ranking (when `--canary` was run).
+- `canary-report.json` — model-probe ranking, frozen `baseCommit`, and any cleanup failures
+  (when `--canary` was run). This is evaluation evidence, not task acceptance or integration proof.
 - `model-cache.json` — last selected model + timestamp + canary pass-rate.
 
 Every report write is atomic (same-directory temp file, then rename), so a reader of a report path sees
@@ -258,3 +373,39 @@ To run two farms against one repository at the same time, give each process:
 Escalated tasks leave their worktrees at `.farm/worktrees/<task-id>/` for inspection.
 
 Canary ranking: `FARM_CANDIDATE_MODELS=a,b,c farm.js --canary <plan.json>` (cwd at the project root).
+
+### Transport retry boundaries
+
+A 429 or server failure retries the HTTP request within `FARM_API_MAX_RETRIES`, not a fresh
+implementation. Recognized `Retry-After` delay-seconds and HTTP-date values are honored only when
+the wait fits the existing `FARM_REQUEST_TIMEOUT_MS` budget and the runtime timer range. An excessive
+valid cooldown is not shortened or allowed to park a worker indefinitely. Missing or malformed fields
+use the existing exponential backoff capped at 16 seconds; explicit zero or a past valid date permits
+an immediate retry. Request deadlines still cover headers and successful body reads; between-request
+waits are separate. Discarded error streams are aborted before waiting or returning.
+
+Once that HTTP retry budget is exhausted, or a valid cooldown cannot fit locally, the worker returns
+an explicit non-retryable transport disposition. The task does not spend another authoring attempt
+against the same unavailable provider. Already-produced candidates may still qualify, independently
+eligible tasks can continue under the existing circuit breaker, and dependent work remains unaccepted.
+This is a reported task deferral, not a new user-approval gate or automatic delayed-resume service.
+Network/body failures and ordinary implementation failures otherwise retain their existing retry
+policy. This does not introduce a provider-wide cooldown coordinator, a new setting, or a spend claim.
+
+### Merge-conflict recovery
+
+A failed integration merge uses the existing task retry budget, not a new interview.
+The dispatcher verifies merge rollback and clean tracked integration state, pins that
+integration commit, and checks task reset, cleanup and HEAD before the next author.
+It keeps the prior qualified implementation as labeled feedback instead of presenting
+replacement baseline files as the worker's previous output. A protected test brought
+in by the verified integration commit becomes the next attempt's immutable baseline;
+setup and worker edits to that test still fail the same checks. Retained samples use
+this path too. Ignored setup caches keep their existing fingerprint contract.
+
+The same explicit-path staging operation gets up to three attempts, with 150 ms
+and 300 ms waits after refusal. This repeats no worker or commit and never removes
+another process's index lock. Persistent staging refusal, unverified rollback/reset
+or an unreadable replacement test cannot be repaired by another model call. The task retains its actual
+attempt, written-file and known-usage evidence, without commit or acceptance bypass.
+This does not add process resume, a provider fallback or a new approval checkpoint.

package/plugins/ca-pi/includes/maturity-coverage.md

@@ -11,29 +11,69 @@ The single source of truth for the coverage threshold. Coverage scales with the
 | 3 | ≥ 85% |
 | 4 | ≥ 90% |
 
-## Which metric (issue #507)
-
-**Lines and branches. Both must clear the threshold.** A report satisfying one and not the other
-does not pass.
-
-This was previously unstated, and the omission was load-bearing rather than cosmetic: a coverage
-report gives four numbers that disagree, so "≥ 70%" without a column named is not a threshold anyone
-can be held to. Measured on codeArbiter itself at the time of writing, one tree sat at 85.37% lines
-and 78.73% branches — compliant at maturity 3, or not, depending purely on which column the reader
-picked.
-
-- **Lines** catches code no test reaches at all — a `catch` block with zero executions inside a
-  passing suite, which no assertion is ever going to surface.
-- **Branches** catches the untaken half of a condition a test does reach: the error arm of an `if`,
-  the fallback of a `??`. Line coverage alone reports those as covered.
-- **Statements** duplicates lines closely enough to add nothing. **Functions** is the noisiest
-  column at small counts, where one uncovered helper moves it several points.
+## Which metric: declared coverage profile
+
+**Every required metric in the surface's declared coverage profile must clear the
+maturity threshold.** `tech-stack.md` binds each source tree to one supported
+profile and names its tool, command, production scope, exclusions and supported
+hosts. This declaration selects a language-appropriate measurement; it does not
+change the threshold table.
+
+| profile | applicable surface | required metrics |
+|---|---|---|
+| `lines-branches` | JavaScript/TypeScript and existing surfaces with qualified line and branch tooling | lines, branches |
+| `go-native` | Go measured with the native Go coverage toolchain | statements |
+
+Existing documented line-and-branch requirements already declare
+`lines-branches`, even without that label. Preserve them without another approval
+or a metadata migration; adding the label during normal maintenance changes no
+measurement requirement.
+
+The `lines-branches` profile retains issue #507's rule: both metrics must pass.
+For example, 85.37% lines and 78.73% branches fails maturity 3. A high line figure
+does not establish that error and fallback outcomes have been exercised.
+
+The `go-native` profile uses `go test -cover` and, for executable surfaces,
+instrumented `go build -cover` integration runs. Include all production packages
+in scope, including those reached through other packages' tests. Native Go
+reports statements, not lines or branches; label those other metrics
+**unmeasured**, never zero, inferred, or passed. A partial branch analyzer may
+provide diagnostic findings but does not turn statement counts into branch
+proof. Go native coverage is not the no-tooling exemption.
+
+Existing stronger measurement contracts remain binding until explicit user
+approval changes them. An agent MUST NOT switch profiles, remove required
+metrics, narrow production scope or exclude source to obtain a pass. Adding a
+profile or changing a surface's binding requires an explicit user approval of
+the concrete change, recorded with its rationale. A missing declaration or an
+unknown profile blocks; another language cannot silently borrow `go-native`.
+
+Missing, malformed, stale, partial or mismatched reports block the overall
+coverage verdict. Bind the reports to the tested source and declared tools,
+scope and hosts. A scoped local result may be reported as PARTIAL under
+`<plugin-root>/includes/verification-boundary.md`; the complete exact-head
+hosted result must pass before merge. Never average host percentages, discard
+an uncovered host-specific file, or relabel a metric to fill a missing column.
 
 **The number is the floor, not the goal.** A test written only to move a percentage is worse than
 the gap it closed, because it converts an honest red into a green that asserts nothing. When
 backfilling to clear this bar, work the uncovered *report* — error and refusal paths first — and let
 the number follow.
 
+## Behavioral evidence beyond percentages
+
+Every profile also requires tests for the changed behavior. For changed critical
+paths, cover approval and rejection, malformed or stale inputs, filesystem
+containment, and recovery where applicable. Each test must exercise the actual
+boundary and assert the expected outcome; merely reaching a line or avoiding an
+exception is insufficient. Use focused mutation checks for critical safeguards:
+removing or inverting the safeguard must make the relevant test fail.
+
+Missing critical-path evidence blocks even when the numeric floor passes. Scope
+this proof to the affected obligations and their callers; do not demand unrelated
+test expansion merely because a different language uses different metrics. These
+tests establish the named outcomes, not an unmeasured global branch percentage.
+
 ## Which host (issue #521)
 
 **A quoted coverage figure is the UNION of the supported hosts' reports for that tree.** Not any

package/plugins/ca-pi/includes/routing-table.md

@@ -26,10 +26,10 @@ reached the same way.
 | Bug fix | `/fix` → `tdd` (bug variant) | impl author | Failing regression test before any fix code |
 | Docs edit / dep bump / revert | `/chore` (type-scaled gates) | `dependency-reviewer` for deps | No behavioral code; suite green for deps/revert; exits via `commit-gate` |
 | Exploratory throwaway spike | `/spike` (self-contained command) → `spike/<slug>` branch | — | Never merges or PRs; `commit-gate`-exempt (nothing on the branch can land); exits to a findings note or `/feature` |
-| Behavior-preserving restructure | `/refactor` → `refactor` skill | `tdd` Phase 1 (new seams only) | No refactor without parity-coverage proof |
-| Unknown defect / investigation | `/debug` → `debug` skill | — | No code change in the skill; one named exit |
-| Commit | `/commit` → `commit-gate` | — | No commit without all nine gates green |
-| Open a PR / finish a branch | `/pr` → `finishing-a-development-branch` | reviewer fleet per path; PR-body prose applies `anti-slop-design` (`core` + `medium-documents` §7.A.1) | PR only; no direct-to-default, no force-push |
+| Behavior-preserving restructure | `refactor` skill at `<plugin-root>/routines/refactor/SKILL.md` (explicit `/refactor` uses the same owner) | `tdd` Phase 1 (coverage backfill or new seams) | No refactor without parity-coverage proof |
+| Unknown defect / investigation | `debug` skill at `<plugin-root>/routines/debug/SKILL.md` (explicit `/debug` uses the same owner) | — | No code change in the skill; one named exit |
+| Commit | `commit-gate` skill at `<plugin-root>/routines/commit-gate/SKILL.md` (explicit `/commit` uses the same owner) | — | No commit without all nine gates green |
+| Open a PR / finish a branch | `finishing-a-development-branch` at `<plugin-root>/routines/finishing-a-development-branch/SKILL.md`; select direct-open or caller mode first | reviewer fleet per path; PR-body prose applies `anti-slop-design` (`core` + `medium-documents` §7.A.1) | PR only; no direct-to-default, no force-push |
 | Watch a PR's CI / babysit checks | `/watch` → detached `gh pr checks --watch` | on-red diagnose (propose\|branch) | Never auto-merges; green → notify + offer; merge-to-default routes through the hard gate; no poll loop |
 | Code review of the diff | `/review` → `dispatching-parallel-agents` | reviewer fleet → `finding-triage` → `verdict-aggregator` | BLOCK on any CRITICAL/HIGH |
 | Periodic sweep | `/checkpoint` → `dispatching-parallel-agents` | reviewer fleet → finding-triage → read-only verdict; then explicit `checkpoint-aggregator` persistence | Surfaces and persists a triaged report; not a promotion gate |
@@ -41,18 +41,17 @@ reached the same way.
 | Migration file added or changed | `migration-reviewer` | — | BLOCK on missing classification or irreversible destructive op |
 | `package.json` / lockfile / base image changed | `/add-dep` → `dependency-reviewer` | — | BLOCK on denied license or supply-chain concern |
 | Run a pinned third-party tool ONCE, adopting nothing (`npx jscpd@4.0.5 .`) | `/ca-add-dep` → its *Ephemeral tool run* section (no `dependency-reviewer` dispatch) | — | Exact pinned version + approved registry + one confirmation; MUST NOT touch a manifest or lockfile, verified after the run, or it is adoption and takes the full review |
-| Sensitive feature / attack-surface change | `/threat-model` → `security-architecture` (optional) | `security-reviewer`, `auth-crypto-reviewer` | STOP only on a critical unmitigated threat |
-| Arbitration / variance / ADR reconciliation | `/reconcile` → `decision-variance` | `scout`, `grader`, `decision-challenger` | No decision recorded without user attribution |
-| New / aged ADR, unresolved `[CONFIRM-NN]` | `/adr`, `/adr-status` → `decision-lifecycle` | `decision-challenger` (optional) | No `[CONFIRM-NN]` resolved by guessing |
+| Requested threat model of a sensitive design | `security-architecture` at `<plugin-root>/routines/security-architecture/SKILL.md` (opt-in; explicit `/threat-model` retained) | `security-reviewer`, `auth-crypto-reviewer` | STOP only on a critical unmitigated threat |
+| Arbitration / variance / ADR reconciliation | `decision-variance` at `<plugin-root>/routines/decision-variance/SKILL.md` (explicit `/ca-reconcile` retained); select report-only or reconciliation first | `scout`, `grader`, `decision-challenger` (optional, read-only) | No decision recorded without explicit user choice and attribution; report-only writes nothing |
+| New / aged ADR, unresolved `[CONFIRM-NN]` | `decision-lifecycle` at `<plugin-root>/routines/decision-lifecycle/SKILL.md`; select author or read-only status before prerequisites | `decision-challenger` (optional) | No `[CONFIRM-NN]` resolved by guessing |
 | Rule conflict (persona vs docs vs code) | `/conflict` | — | STOP all other work immediately |
 | Unsure `/reconcile` vs `/conflict`? | rules contradict and work cannot safely continue → `/conflict`; artifacts drifted, work continues → `/reconcile` | — | When genuinely ambiguous, `/conflict` wins — stopping is recoverable, drifting past a rule conflict is not |
-| New skill needed | `/new-skill` → `skill-author` | — | No skill until the gap is proven uncovered |
 | Subagent raises an out-of-scope finding | inline `[NEEDS-TRIAGE]` marker | — | Never an ADR disposition; never silently dropped |
 | Sitting down to code / repo hygiene cleanup | `/ca-standup` → orchestrator git actions | — | ff-only pull on a clean tree; branch deletions confirmed individually, worktree removals may be confirmed as one named enumerated group; stash/dirty/un-pushed report-only; never touch the default branch |
-| Finish an already-merged branch (post-merge cleanup) | `/ca-cleanup` → `post-merge-cleanup` | — | Merge proven against the FETCHED default by ancestry, PR-record squash proof, or a byte-identical fallback; unique/unclassifiable artifacts never discarded without a per-item confirmation; `--ff-only`; `branch -d`, or `-D` only under the restated squash-proof path; remote branch untouched; never routes to `/ca-override` |
+| Finish an already-merged branch (post-merge cleanup) | `post-merge-cleanup` at `<plugin-root>/routines/post-merge-cleanup/SKILL.md` (explicit `/ca-cleanup` or `/ca-pr --cleanup`) | — | Merge proven against the FETCHED default by ancestry, PR-record squash proof, or a byte-identical fallback; unique/unclassifiable artifacts never discarded without a per-item confirmation; `--ff-only`; `branch -d`, or `-D` only under the restated squash-proof path; remote branch untouched; never routes to `/ca-override` |
 | Add / start / done a backlog task | `/ca-task` → `hooks/taskwrite.py` (the pure `_taskboardlib` transforms) | — | Board written only through the writer; `start` always stamps a date; `done` requires in-progress; never delete to complete |
 | Local runtime work (run, watch, exercise this repo's own app) | `mode --ops` → narrows the persona per `includes/ops-mode.md`, no skill/agent dispatch | — | Advisory only, no hook becomes mode-aware; permitted only when the operation starts, observes, or exercises and leaves no change in tracked files or git history — anything that mutates tracked files, the index, git history, or published state still routes normally |
 | Promote a workflow's un-actioned follow-ups | `includes/harvest.md` (run at a terminal step) → `/ca-task` (work) / `open-questions.md` (decision) | — | Batch-confirm interactive; SMARTS-logged auto under `/sprint`; dedup by `(from <origin>)`; a blocking decision escalates, never demoted |
 | Zero-onboarding dry-run of the reviewer fleet | `/ca-preview` (no skill; reuses `includes/review-matrix.md` to predict reviewers) | — | Read-only; writes nothing, stages nothing, `git status` unchanged; no `/ca-init` or `.codearbiter/` required; empty diff exits clean |
-| Manual drift audit of provenance-tracked docs (bypass / merge / external edit case) | `/ca-context-check` → `context-check` skill | — | Read-only unless user selects re-scout or re-baseline; MUST NOT commit on its own; not the daily loop — commit-gate auto-heal is the routine path |
-| Deep on-demand codebase audit | `/ca-tribunal` → `tribunal` skill | `tribunal-lens-reviewer` per active lens (+ optional `map-structure`/`map-deps` on large repos) | Read-only until the filing gate; runs only after the user acknowledges the token estimate; never blocks a merge/commit; nothing filed or sent without explicit authorization |
+| Manual drift audit of provenance-tracked docs (bypass / merge / external edit case) | `context-check` at `<plugin-root>/routines/context-check/SKILL.md` (explicit `/ca-status drift` or `/ca-context-check`) | — | Read-only unless user selects re-scout or re-baseline; MUST NOT commit on its own; not the daily loop — commit-gate auto-heal is the routine path |
+| Deep on-demand codebase audit | `tribunal` at `<plugin-root>/routines/tribunal/SKILL.md` (explicit `/ca-tribunal` retained) | `tribunal-lens-reviewer` per active lens (+ optional `map-structure`/`map-deps` on large repos) | Read-only until the filing gate; runs only after the user acknowledges the token estimate; never blocks a merge/commit; nothing filed or sent without explicit authorization |