@arbiterforge/ca-pi 0.15.10 → 0.16.0

package/plugins/ca-pi/hooks/_readinjectlib.py

@@ -123,6 +123,8 @@ import json
 import math
 import os
 import re
+import tempfile
+import time
 import unicodedata
 
 import _provenancelib
@@ -791,11 +793,23 @@ def governing_docs(rel, index, runner=None):
         # paths.  This is git-free.  A non-provenance Read exits here with zero
         # git calls.
         entry_paths = set()
+        v2_docs = []
         if isinstance(provenance, dict):
-            for record in provenance.values():
+            for doc_name, record in provenance.items():
                 try:
                     if not isinstance(record, dict):
                         continue
+                    if record.get("schema") == _provenancelib.V2_SCHEMA_VERSION:
+                        if not _provenancelib.valid_provenance_record(record):
+                            continue
+                        cited = any(
+                            evidence.get("kind") == "content" and evidence.get("path") == rel
+                            for field in record["fields"] for claim in field["claims"]
+                            for evidence in claim["evidence"]
+                        )
+                        if cited or record["document"]["path"] == rel:
+                            v2_docs.append(doc_name)
+                        continue
                     entries = record.get("entries")
                     if not isinstance(entries, list):
                         continue
@@ -810,6 +824,13 @@ def governing_docs(rel, index, runner=None):
                 except Exception:  # noqa: BLE001
                     continue
 
+        # A v2 content dependency is relevant advisory context, but its raw
+        # digest and semantic review cannot be proved by the legacy Git-hash
+        # gate. Point to the action-boundary audit without claiming freshness.
+        for doc_name in v2_docs:
+            result.append({"text": "{}.md context identity and semantic review unverified here -- run context-check".format(
+                _strip_context_controls(doc_name)), "tier": "standards"})
+
         # Step B: only call batch_hash when rel is a known provenance entry path.
         # Absence from entry_paths → SKIP; zero git calls.
         if rel and rel in entry_paths:
@@ -1166,6 +1187,104 @@ def spec_pointers(rel, index):
 
 _artifact_legacy_compute_injection = compute_injection
 
+def _session_context_generation_path(root, session_id):
+    # One bounded value per session avoids a shared unbounded session map and
+    # lets unrelated sessions advance without a read/modify/write race.
+    return marker_path(root, session_id, 'compaction-generation',
+                       prefix='readinject-context-')
+
+
+def _linklike(path):
+    return os.path.islink(path) or getattr(os.path, 'isjunction', lambda _: False)(path)
+
+
+def _safe_context_generation_path(root, session_id):
+    if not isinstance(root, (str, os.PathLike)) or not os.path.isabs(root):
+        return None
+    path = _session_context_generation_path(root, session_id)
+    parent = os.path.dirname(path)
+    if (_linklike(root) or _linklike(os.path.join(root, '.codearbiter')) or _linklike(parent)
+            or _linklike(path) or _linklike(path + '.lock')):
+        return None
+    return path
+
+
+def read_context_generation(root, session_id):
+    """Read a bounded worktree-local epoch; None means corrupt/unsafe/unknown."""
+    try:
+        path = _safe_context_generation_path(root, session_id)
+        if path is None:
+            return None
+        with open(path, 'rb') as stream:
+            raw = stream.read(257)
+        if len(raw) > 256 or not raw or not raw.isdigit():
+            return None
+        value = int(raw)
+        return value if value <= 1_000_000_000 else None
+    except FileNotFoundError:
+        return 0
+    except Exception:  # noqa: BLE001 - advisory hook never blocks a read
+        return None
+
+
+def bump_context_generation(root, session_id):
+    """Invalidate surviving read markers after compaction, without a scan."""
+    if not session_id:
+        return False
+    lock = None
+    lock_acquired = False
+    temporary = None
+    try:
+        path = _safe_context_generation_path(root, session_id)
+        if path is None:
+            return False
+        os.makedirs(os.path.dirname(path), exist_ok=True)
+        if _safe_context_generation_path(root, session_id) != path:
+            return False
+        lock = path + '.lock'
+        for _ in range(25):
+            try:
+                os.mkdir(lock)
+                lock_acquired = True
+                break
+            except FileExistsError:
+                time.sleep(0.01)
+        else:
+            return False
+        current = read_context_generation(root, session_id)
+        if current is None or current >= 1_000_000_000:
+            return False  # Corrupt bytes stay intact and force redelivery.
+        fd, temporary = tempfile.mkstemp(prefix='readinject-context-',
+                                          dir=os.path.dirname(path))
+        with os.fdopen(fd, 'wb') as stream:
+            stream.write(str(current + 1).encode('ascii'))
+        if _safe_context_generation_path(root, session_id) != path:
+            return False
+        os.replace(temporary, path)
+        temporary = None
+        return True
+    except Exception:  # noqa: BLE001 - task-time delivery remains the primary route
+        return False
+    finally:
+        if temporary is not None:
+            try:
+                os.unlink(temporary)
+            except OSError:
+                pass
+        if lock_acquired:
+            try:
+                os.rmdir(lock)
+            except OSError:
+                pass
+
+
+def _context_epoch_session(root, session_id):
+    generation = read_context_generation(root, session_id)
+    if generation is None:
+        return None
+    return (str(session_id) + '|context:' + str(generation)
+            if generation else session_id)
+
 
 def compute_injection(root, session_id, rel, runner=None):
     # Bind the injected pointers and dedup epoch to ONE validated HTML snapshot.
@@ -1173,8 +1292,19 @@ def compute_injection(root, session_id, rel, runner=None):
     # under B's marker, suppressing a later stable B read. HTML therefore builds
     # once before dedup; the same entries drive both context and epoch. This is
     # advisory identity only, never approval or execution authority.
+    # Preserve the legacy self-read zero-I/O path before any epoch lookup.
     if not isinstance(rel, str) or rel.replace("\\", "/").split("/", 1)[0] == ".codearbiter":
         return _artifact_legacy_compute_injection(root, session_id, rel, runner)
+    session_id = _context_epoch_session(root, session_id)
+    if session_id is None:
+        # Unknown/corrupt epoch: bounded advisory redelivery without writing
+        # a fresh marker for every read. The actor delivery planner owns its
+        # separate two-attempt accounting and action gap.
+        try:
+            index = build_index(root)
+            return assemble_context(governing_docs(rel, index, runner), budget=150)
+        except Exception:  # noqa: BLE001
+            return ""
     try:
         from _artifactlib import has_html
         if not has_html(root):

package/plugins/ca-pi/hooks/_sensitivelib.py

@@ -281,7 +281,7 @@ def sensitive_scan_added_lines(diff_text):
 # bindings use a separate marker namespace; a user-authored source string or
 # an old line-only approval cannot impersonate one of these records.
 # SecurityScan(crypto, digests): classification and exact approval identities.
-# security_scan_lines(lines) -> SecurityScan|None: line-bound scan or refusal.
+# security_scan_lines(lines, path=None) -> SecurityScan|None: line-bound scan or refusal.
 # security_scan_source(path, source, added_rows) -> SecurityScan|None.
 # security_scan_diff(text) -> SecurityScan|None: None means untrusted context.
 SecurityScan = namedtuple("SecurityScan", "crypto digests")
@@ -320,20 +320,23 @@ def _cross_line_crypto_spans(lines):
     return spans
 
 
-def _scan_bound_lines(lines, contextual_bindings):
+def _scan_bound_lines(lines, contextual_bindings, path=None):
     """Each cross-line match needs its own recognized contextual identity."""
     spans = _cross_line_crypto_spans(lines)
     if not spans <= contextual_bindings.keys():
         return None
     return SecurityScan(bool(spans) or any(CRYPTO_RE.search(line) for line in lines), {
-        line_digest(line) for line in lines
+        line_digest(line, path) for line in lines
         if CRYPTO_RE.search(line) or SECRET_RE.search(line)
     } | set(contextual_bindings.values()))
 
 
-def security_scan_lines(lines):
-    """Preserve same-line bindings; refuse crypto spanning unbound lines."""
-    return _scan_bound_lines(lines, {})
+def security_scan_lines(lines, path=None):
+    """Preserve same-line bindings; refuse crypto spanning unbound lines.
+
+    `path` binds each approval to the file the line lives in, so a reviewed
+    line cannot be admitted again after moving to a different file."""
+    return _scan_bound_lines(lines, {}, path)
 
 
 def security_scan_source(path, source, added_rows):
@@ -348,7 +351,7 @@ def security_scan_source(path, source, added_rows):
     if any(row < 1 or row > len(lines) for row in added_rows):
         return None
     added = [lines[row - 1] for row in added_rows]
-    result = security_scan_lines(added)
+    result = security_scan_lines(added, path)
     candidates = {row for row in added_rows
                   if _is_context_item_line(lines[row - 1])}
     if not candidates:
@@ -405,7 +408,7 @@ def security_scan_source(path, source, added_rows):
     bindings = {(positions[first[0]], first[1], positions[last[0]], last[1]): contexts[last[0]]
                 for first, last in import_spans
                 if first[0] in positions and last[0] in positions}
-    result = _scan_bound_lines(added, bindings)
+    result = _scan_bound_lines(added, bindings, path)
     if result is None:
         return None
     return SecurityScan(result.crypto or bool(contexts), result.digests | set(contexts.values()))
@@ -484,7 +487,9 @@ def security_scan_diff(diff_text):
         # in the legacy permissive walker before context validation even runs.
         if not any(line.startswith("+") and _is_context_item_line(line[1:])
                    for line in section):
-            contextual = security_scan_lines(added)
+            # One file per section: bind its approvals to that file's path.
+            paths = {path for path, _ in attributed if path}
+            contextual = security_scan_lines(added, paths.pop() if len(paths) == 1 else None)
         else:
             if not section[0].startswith("diff --git "):
                 return None
@@ -508,14 +513,23 @@ def security_scan_diff(diff_text):
     return result
 
 
-def line_digest(line):
+def line_digest(line, path=None):
     """Digest of one added diff line, for the security-gate binding
     (H-09b/H-10b). The gate-pass marker stores these digests instead of being
     an empty `touch`d file, so a recorded pass admits only the exact sensitive
-    lines it reviewed — not whatever lands in the next 30 minutes. Trailing
-    whitespace is stripped so CRLF translation between worktree and index
-    never breaks the match."""
-    return hashlib.sha256(line.rstrip().encode("utf-8", "replace")).hexdigest()
+    lines it reviewed. A pass has no time window, so the digest also binds the
+    repository-relative `path` the line was reviewed in: the identical line in
+    a different file is a different digest and needs its own review. Without
+    a path (an unattributable diff section) both the recording and the
+    checking side fall back to the line alone. Trailing whitespace is
+    stripped so CRLF translation between worktree and index never breaks the
+    match."""
+    text = line.rstrip()
+    if path is None:
+        return hashlib.sha256(text.encode("utf-8", "replace")).hexdigest()
+    return "path-v1:" + hashlib.sha256(json.dumps(
+        [path, text], separators=(",", ":"), ensure_ascii=False
+    ).encode("utf-8", "replace")).hexdigest()
 
 
 def content_digest(text):

package/plugins/ca-pi/hooks/artifact-authority-hook.py

@@ -64,6 +64,7 @@ def claude_main() -> int:
             _artifactauthoritylib.observe_verifier_hook(root, payload, host="claude")
         elif (
             (event in {"PreToolUse", "PostToolUse"} and tool == "Agent")
+            or (event == "PostToolUse" and tool == _artifactauthoritylib.CLAUDE_HANDBACK_TOOL)
             or (event == "PreToolUse" and tool == "SendMessage")
             or event in {"SubagentStart", "SubagentStop"}
         ):

package/plugins/ca-pi/hooks/artifact-authority.py

@@ -11,6 +11,7 @@ import sys
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 import _artifactauthoritylib  # noqa: E402
 import _artifactlib  # noqa: E402
+import _artifactpromptlib  # noqa: E402
 import hostapi  # noqa: E402
 
 
@@ -38,6 +39,10 @@ def main(argv=None) -> int:
         choices=("verification", "spec_review", "quality_review"),
     )
     arm.add_argument("--workspace", action="append", default=[], metavar="LABEL=PATH")
+    arm.add_argument("--completion-receipt", action="append", metavar="RECEIPT_REF",
+                     help="exact published verification receipt selected for completion review; repeat per task")
+    arm.add_argument("--supporting-file", action="append", metavar="ABSOLUTE_PATH",
+                     help="explicit bounded regular file retained as completion review data")
     arm.add_argument(
         "--host", choices=sorted(_artifactauthoritylib.HOSTS), default=None,
         help="observing host; defaults to the host this package was built for",
@@ -50,6 +55,15 @@ def main(argv=None) -> int:
         "--codex-review-profile", choices=("native-v1",), default=None,
         help="select only after qualifying the actual registered native V1 UUID interface",
     )
+    context_arm = sub.add_parser("arm-context")
+    context_arm.add_argument("--root", required=True)
+    context_arm.add_argument("--request-file", required=True)
+    context_cancel = sub.add_parser("cancel-context")
+    context_cancel.add_argument("--root", required=True)
+    context_cancel.add_argument("--document-id", required=True)
+    context_apply = sub.add_parser("apply-context")
+    context_apply.add_argument("--root", required=True)
+    context_apply.add_argument("--receipt", required=True)
     verify = sub.add_parser("verify")
     verify.add_argument("--root", required=True)
     verify.add_argument("--request-id", required=True)
@@ -62,6 +76,9 @@ def main(argv=None) -> int:
     recover.add_argument("--disposition", required=True, choices=("failed", "abandoned"))
     args = parser.parse_args(argv)
     root = Path(args.root).resolve(strict=True)
+    if args.command == "cancel-context":
+        print(json.dumps(_artifactauthoritylib.cancel_context_preview(root, args.document_id), sort_keys=True))
+        return 0
     client = _artifactlib.ArtifactClient(
         root, _artifactlib.helper_installation(__file__)
     )
@@ -83,6 +100,7 @@ def main(argv=None) -> int:
             workspace_roots=workspaces or None, host=host,
             reviewer_model=args.reviewer_model,
             codex_review_profile=args.codex_review_profile,
+            completion_receipts=args.completion_receipt, supporting_files=args.supporting_file,
         )
         if host == "claude" and args.activity == "verification":
             # The Claude verifier hook pins this exact shipped script and
@@ -91,6 +109,11 @@ def main(argv=None) -> int:
             result["verify_command"] = (
                 f'python "{script}" verify --root "{root}" --request-id {result["request_id"]}'
             )
+    elif args.command == "arm-context":
+        preview = _artifactlib.read_context_preview_request(root, args.request_file)
+        result = _artifactauthoritylib.arm_context_preview(root, client, preview)
+    elif args.command == "apply-context":
+        result = client.call("context-apply", {"receipt": args.receipt})
     elif args.command == "verify":
         result = _artifactauthoritylib.run_verification(
             root, client, args.request_id,
@@ -108,6 +131,7 @@ def main(argv=None) -> int:
 if __name__ == "__main__":
     try:
         raise SystemExit(main())
-    except (_artifactauthoritylib.AuthorityError, _artifactlib.ArtifactError) as exc:
+    except (_artifactauthoritylib.AuthorityError, _artifactlib.ArtifactError,
+            _artifactpromptlib.PromptRouteError) as exc:
         sys.stderr.write(str(exc) + "\n")
         raise SystemExit(1)

package/plugins/ca-pi/hooks/debug-handoff.py

@@ -0,0 +1,85 @@
+# codeArbiter — private bounded debug handoff validation entry.
+# Read only stdin and the installed validator; emit closed, redacted diagnostics.
+# Bytecode suppression precedes the local import and no project state is touched.
+#
+# main(argv) -> int: validate one bounded packet and write one result envelope.
+import sys
+
+sys.dont_write_bytecode = True
+
+import json
+import re
+
+import _debughandofflib as handoff
+
+
+PROTOCOL = "codearbiter.debug-validation/1.0.0"
+DIRECT_CODES = frozenset({
+    "INPUT_LIMIT", "DEPTH_LIMIT", "INVALID_UTF8", "INVALID_JSON",
+    "DUPLICATE_KEY", "UNSUPPORTED_PROTOCOL", "REQUIRED_FIELD",
+    "UNKNOWN_FIELD", "TYPE", "VALUE",
+})
+REFERENCE_CODES = frozenset({"DUPLICATE_ID", "DANGLING_REFERENCE"})
+PATH = re.compile(r"\$(?:\.[A-Za-z_]+|\[[0-9]+\])*\Z", re.ASCII)
+
+
+def _result(valid, errors, truncated=False):
+    return {"protocol": PROTOCOL, "valid": valid,
+            "errors": errors, "truncated": truncated}
+
+
+def _diagnostic(code, path="$"):
+    if code in DIRECT_CODES or code in ("USAGE", "INPUT_IO", "INTERNAL"):
+        public_code = code
+    elif code in REFERENCE_CODES:
+        public_code = "REFERENCE"
+    else:
+        public_code = "SEMANTIC"
+    if type(path) is not str or len(path) > 256 or not PATH.fullmatch(path):
+        return {"code": "INTERNAL", "path": "$"}
+    return {"code": public_code, "path": path}
+
+
+def _write(result):
+    raw = (json.dumps(result, ensure_ascii=True, separators=(",", ":"))
+           + "\n").encode("utf-8")
+    if len(raw) > 8192:
+        result = _result(False, [{"code": "INTERNAL", "path": "$"}])
+        raw = (json.dumps(result, separators=(",", ":")) + "\n").encode("utf-8")
+        exit_code = 3
+    else:
+        exit_code = 0 if result["valid"] else 2
+        if result["errors"] and result["errors"][0]["code"] in ("INPUT_IO", "INTERNAL"):
+            exit_code = 3
+    try:
+        sys.stdout.buffer.write(raw)
+        sys.stdout.buffer.flush()
+    except OSError:
+        return 3
+    return exit_code
+
+
+def main(argv=None):
+    if argv is None:
+        argv = sys.argv[1:]
+    if argv != ["validate"]:
+        return _write(_result(False, [_diagnostic("USAGE")]))
+    try:
+        raw = sys.stdin.buffer.read(65537)
+    except OSError:
+        return _write(_result(False, [_diagnostic("INPUT_IO")]))
+    except Exception:
+        return _write(_result(False, [_diagnostic("INTERNAL")]))
+    try:
+        packet, error = handoff.decode_packet(raw)
+        if error is not None:
+            return _write(_result(False, [_diagnostic(error)]))
+        found, truncated = handoff.validate_semantics_bounded(packet, ceiling=16)
+        errors = [_diagnostic(code, path) for code, path in found]
+        return _write(_result(not found, errors, truncated))
+    except Exception:
+        return _write(_result(False, [_diagnostic("INTERNAL")]))
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/plugins/ca-pi/hooks/doctor.py

@@ -23,7 +23,9 @@ from _gitexec import git_executable, root_bound_git_env  # noqa: E402
 import hostapi  # noqa: E402 — host seam (ADR-0011): plugin-root resolution
 import _entrylib  # noqa: E402 — shared run() dispatch (jscpd dedup)
 import _githooks  # noqa: E402 — #556: git-hook drop-in registry freshness
-from _hooklib import frontmatter_enabled, get_host, set_host, utf8_stdio  # noqa: E402
+from _hooklib import (  # noqa: E402
+    frontmatter_enabled, get_host, initialized_body_text, set_host, utf8_stdio,
+)
 
 HOOK_SCRIPTS = ("session-start.py", "pre-bash.py", "pre-write.py",
                 "pre-edit.py", "post-write-edit.py", "prune-transcript.py",
@@ -298,7 +300,7 @@ def check_repo():
     if enabled:
         with open(ctx, encoding="utf-8", errors="replace") as f:
             body = f.read()
-        if "<!--INITIALIZED-->" in body:
+        if initialized_body_text(body):
             ok("project is initialized (<!--INITIALIZED--> marker present)")
         else:
             warn(f"no <!--INITIALIZED--> marker — startup will route to "

package/plugins/ca-pi/hooks/git-enforce.py

@@ -11,7 +11,7 @@
 #
 # It mirrors pre-bash.py's commit/push gates and reuses the SAME detection
 # primitives from _hooklib (CRYPTO_RE / SECRET_RE / line_digest / content_digest
-# / is_migration_path / marker_fresh / sensitive_scan_added_lines), so the two
+# / is_migration_path / sensitive_scan_added_lines), so the two
 # enforcement points can never drift on what counts as sensitive or as a
 # migration, on how a gate-pass marker binds to the lines it approved, or on
 # which path (gate-events.log, #279) is exempt from the sensitive-line scan.
@@ -30,9 +30,9 @@ import hostapi  # noqa: E402 — host seam (ADR-0011)
 import _entrylib  # noqa: E402 — shared run() dispatch (jscpd dedup)
 from _gitexec import git_executable  # noqa: E402
 from _hooklib import (  # noqa: E402
-    CRYPTO_RE, MARKER_FRESHNESS_MINUTES, SECRET_RE, SECURITY_DIFF_GIT_ARGS,
+    CRYPTO_RE, SECRET_RE, SECURITY_DIFF_GIT_ARGS,
     arbiter_active, content_digest, is_migration_path, line_digest,
-    marker_fresh, security_scan_diff, set_host, utf8_stdio,
+    security_scan_diff, set_host, utf8_stdio,
 )
 
 
@@ -223,8 +223,9 @@ def pre_commit(root):
         block("H-01", f"Direct commit to {target} is prohibited (ORCHESTRATOR §3) — this is "
                       f"the git-level backstop (#161). Create a feature branch.")
 
-    # H-09b / H-10b: a commit introducing crypto/secret changes needs a fresh,
-    # line-covering security-gate pass. Reuses the exact _hooklib primitives.
+    # H-09b / H-10b: a commit introducing crypto/secret changes needs a recorded,
+    # line-covering security-gate pass (bound by line digest, no time window).
+    # Reuses the exact _hooklib primitives.
     added = cached_added_lines(cwd)
     if added is None:
         block("H-09b", "the staged diff for the crypto/secret scan could not be read — "
@@ -237,7 +238,7 @@ def pre_commit(root):
         skill = "crypto-compliance" if touches_crypto else "secret-handling"
         marker_root = _marker_root(root)
         marker = os.path.join(marker_root, ".codearbiter", ".markers", "security-gate-passed")
-        if not marker_fresh(marker, MARKER_FRESHNESS_MINUTES):
+        if not os.path.isfile(marker):
             block(tag, f"This commit introduces {kind} changes, but no security-gate pass is "
                        f"recorded (#161 git backstop). Run the {skill} gate, then commit.")
         approved = _marker_set(marker_root, "security-gate-passed")

package/plugins/ca-pi/hooks/hostapi.py

@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "2.23.2"
+    adapter_version = "2.24.0"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,