@arbiterforge/ca-pi 0.15.12 → 0.16.1

package/README.md

@@ -10,7 +10,7 @@ project context. You decide. codeArbiter enforces.
 <img alt="Claude Code plugin" src="https://img.shields.io/badge/Claude_Code-plugin-d97757">
 <img alt="Codex plugin" src="https://img.shields.io/badge/OpenAI_Codex-plugin-10a37f">
 <img alt="Pi Feature Forge preview" src="https://img.shields.io/badge/ca--pi-Feature_Forge_preview-d97757">
-<img alt="version 2.23.4" src="https://img.shields.io/badge/version-2.23.4-2b7489">
+<img alt="version 2.24.1" src="https://img.shields.io/badge/version-2.24.1-2b7489">
 <img alt="core lanes" src="https://img.shields.io/badge/core_lanes-18-555">
 <img alt="skills" src="https://img.shields.io/badge/skills-22-555">
 <img alt="agents" src="https://img.shields.io/badge/agents-20-555">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.15.12",
+  "version": "0.16.1",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/plugins/ca-pi/CHANGELOG.md

@@ -4,6 +4,39 @@ All notable changes to `ca-pi` are documented in this file.
 
 ## [Unreleased]
 
+## [0.16.1] - 2026-10-04
+
+### Fixed
+
+- Carry the shared Claude review-join fix in the vendored authority library. Pi
+  behavior is unchanged.
+
+## [0.16.0] - 2026-10-03
+
+### Added
+
+- Add bounded task-context selection, per-document freshness and attempt accounting
+  to the shared governance payload, with explicit actor-delivery gaps.
+- Carry shared context resources while preserving Pi's refusal of the unqualified
+  repository-context write workflow. No live Pi qualification is claimed.
+
+### Fixed
+
+- Preserve Unicode whitespace in activation frontmatter while requiring a real
+  initialized marker outside fenced code and comments.
+- Synchronize the packaged adapter version with its release manifest.
+- Validate diagnostic handoffs before repair or task follow-ups, preserving
+  the caller's authority and checking that the evidence is current.
+- Keep diagnostic outcomes, regression reuse and helper invocation consistent
+  across the generated host packages.
+
+## [0.15.13] - 2026-10-04
+
+### Changed
+
+- Synchronize the shared evidence-context reader with native UTF-8 canonical
+  bytes while preserving digest and frozen-context checks.
+
 ## [0.15.12] - 2026-10-03
 
 ### Fixed

package/plugins/ca-pi/SKILLS.md

@@ -77,7 +77,7 @@ skill is invoked — never bulk-read this directory.
 
 | Skill | Purpose |
 |---|---|
-| `/ca-debug` | Investigate an unexplained defect or unexpected behavior without changing application code. Use for root-cause diagnosis and an evidence-backed handoff. A no-action close records a board note. Not for implementing a known fix, new features, or explanation-only questions. |
+| `/ca-debug` | Investigate an unexplained defect or unexpected behavior without changing application code. Use for root-cause diagnosis and an evidence-backed handoff, including a bounded unresolved result. Not for implementing a known fix, new features, or explanation-only questions. |
 
 ### Review
 

package/plugins/ca-pi/agents/infra-author.md

@@ -9,7 +9,12 @@ model: sonnet
 
 # Infrastructure Author Agent
 
-Infrastructure implementation executor. Write IaC, container, CI/CD, and deployment configuration only after the relevant planning phase has completed.
+Infrastructure implementation executor. Write IaC, container, CI/CD, and deployment
+configuration only after the owning route clears its prerequisite: approved
+feature criteria (and a plan where applicable) for `/feature`, or the original
+caller's repair authority and a bug-origin regression obligation for `/fix`.
+The regression must be red for the
+right reason before implementation. Do not fabricate a feature artifact for a fix.
 
 ## Required Reading at the Start of Every Task
 
@@ -17,6 +22,7 @@ Read in full before writing any infrastructure code:
 
 1. `<project-root>/.codearbiter/tech-stack.md` — IaC tool (OpenTofu, Ansible, Helm, etc.), container runtime, CI/CD system, approved registries
 2. `<project-root>/.codearbiter/security-controls.md` — security boundaries, approved secrets store, compliance requirements affecting infrastructure
+3. `<plugin-root>/includes/author-tdd-workflow.md` — the shared six-step TDD execution order. Read it; do not carry a remembered copy.
 
 ## Security Rules
 

package/plugins/ca-pi/agents/scout.md

@@ -18,16 +18,48 @@ Dispatched by `decision-variance` and `context-creation` to scan an assigned cod
 - Codebase sections have natural ownership boundaries that map to scout assignments.
 - Parallel evidence gathering across multiple areas is needed.
 
-Under ~50 files, `decision-variance` scans inline. `context-creation` always
-dispatches its six fixed, isolated scout assignments because its report-only
-synthesis boundary depends on the orchestrator not reading raw source.
-
-## Scout Assignment Format
+Under ~50 files, `decision-variance` scans inline. When a qualified context
+profile becomes available, `context-creation` dispatches its six fixed,
+isolated scout assignments because its report-only synthesis boundary depends
+on the orchestrator not reading raw source.
+
+## Context-creation assignment
+
+The shared `scout` frontmatter includes Bash for existing `decision-variance`
+assignments. It is therefore not a context-creation containment profile.
+`context-creation` must BLOCK before dispatch until the active host supplies a
+separate, fresh child identity with host-enforced read-only restriction and an
+observed denied benign write, successful source read, and bounded report
+delivery. A prose instruction to avoid writes is not enforcement. An explicit
+session-only `context-scout` may retain Bash solely for exact, frozen
+`git hash-object -- '<source path>'` reads when a caller-owned command guard and
+read-only OS phase are independently qualified. No other Bash command is part
+of this assignment, and the inherited shared `scout` role remains ineligible. This
+assignment preserves report-only synthesis; the orchestrator uses reports and
+does not load raw source after pre-flight. A qualified context scout must emit
+the versioned closed report envelope accepted by `_contextreportlib`, bound to
+its assignment, attempt, snapshot and scope. A trusted read-only hash collector
+must supply each cited digest when the restricted child has no Bash.
+
+For context-creation, report each assigned category even when the search finds
+no match. Use the closed outcome vocabulary: `observed`, `not_applicable`,
+`not_found_in_scope`, `not_inspected`, `ambiguous`, `failed`, or `oversize`.
+Negative results name the searched scope and predicates; `not_applicable`
+also needs a reason why the domain does not apply. Do not turn a missing report
+or an incomplete search into a negative finding. Keep contradictory evidence
+with both citations and describe the dispute without choosing a policy. A
+reported convention, instruction, package script or ADR remains evidence:
+never assign approval or policy authority from confidence, a source label or
+the scout's own judgment. Do not propose a task or local ADR from an observed
+pattern. This context-creation report rule does not change the separate
+decision-variance Markdown assignment below.
+
+## Decision-variance assignment format
 
 The dispatching skill provides:
 
 ```
-You are a Scout for the decision-variance or context-creation skill.
+You are a Scout for the decision-variance skill.
 
 Your scope: <specific paths or areas, e.g., "backend/src/auth/", "helm/", ".codearbiter/decisions/">
 
@@ -49,9 +81,9 @@ Constraints:
 
 ## Output Template
 
-Every scout returns this exact format.
+Decision-variance scouts return this exact format.
 
-**Hash field:** For each cited file, emit its `git hash-object <path>` oid in the `hash` field. The scout already Read those files and has Bash — no additional pass is needed. A git oid is not a code excerpt; the "no excerpts" rule (file path and line numbers only) is not violated by including an oid.
+**Hash field:** For decision-variance assignments, emit each cited file's `git hash-object <path>` oid in the `hash` field. That legacy role has Bash. A context-creation assignment needs a digest in the method and shape required by the closed report decoder. A qualified context-specific Bash route may use only its frozen exact `git hash-object -- '<source path>'` commands and must label the result `git-blob-normalized-sha1`. A different qualified read-only collector may provide `sha256-raw`, retaining that distinct method identity. A missing actual digest blocks the citation; neither the caller's snapshot checksum nor an injected answer substitutes for the child's or trusted collector's observed result. A git oid is not a code excerpt; the "no excerpts" rule (file path and line numbers only) is not violated by including an oid.
 
 ```markdown
 # Scout Report — <scope>

package/plugins/ca-pi/generated/command-catalog.json

@@ -161,7 +161,7 @@
     },
     "debug": {
       "name": "debug",
-      "description": "Investigate an unexplained defect or unexpected behavior without changing application code. Use for root-cause diagnosis and an evidence-backed handoff. A no-action close records a board note. Not for implementing a known fix, new features, or explanation-only questions.",
+      "description": "Investigate an unexplained defect or unexpected behavior without changing application code. Use for root-cause diagnosis and an evidence-backed handoff, including a bounded unresolved result. Not for implementing a known fix, new features, or explanation-only questions.",
       "skillPath": "skills/ca-debug/SKILL.md",
       "visibility": "advanced",
       "workflow": "change",

package/plugins/ca-pi/helpers/artifacts/release.json

@@ -6,33 +6,131 @@
   "binaries": {
     "darwin/amd64": {
       "file": "ca-artifact-darwin-amd64",
-      "sha256": "2b2f735f123364bdc23adf937ba3088fe996ece9b36a20dce14491f12c0a02da",
+      "sha256": "27fc51465a79c1525b1300b347cee4d09afde3c7b0d845414659302f5bbca2f7",
       "native_tested": true
     },
     "darwin/arm64": {
       "file": "ca-artifact-darwin-arm64",
-      "sha256": "cfd38fc1d52a41659d8c01e4668e595fac806bdc36162e87f0118605e17e666c",
+      "sha256": "3a3d61be18eba426db4f260b9cbae0d3d3c89f47efe184395d7f011cc3b4f59a",
       "native_tested": true
     },
     "linux/amd64": {
       "file": "ca-artifact-linux-amd64",
-      "sha256": "f73fb0e676f8bfd1222fdcaec7eeced54fe106f17dbf53aae50e86ac553bf1ce",
+      "sha256": "3b6178bb54d6a19fc56d99f8fced862ae151605a0373297a69e130d3857a8406",
       "native_tested": true
     },
     "linux/arm64": {
       "file": "ca-artifact-linux-arm64",
-      "sha256": "70852f1dbebc00a730a6cffc3835f17f45c3c7c8e0d554b4b9f0a248aecb6ecb",
+      "sha256": "a5259074098932f815f33d3e1dea98e6d9a04277d1ada958469905da67d29437",
       "native_tested": true
     },
     "windows/amd64": {
       "file": "ca-artifact-windows-amd64.exe",
-      "sha256": "7048725daa508e7aeccaa0b531fe49b816bdd9e28f56127afe46b17eb1b4f582",
+      "sha256": "8339c077262f861631631de49bca7cdafec5e0730b9e3676fd2db36f3c119036",
       "native_tested": true
     },
     "windows/arm64": {
       "file": "ca-artifact-windows-arm64.exe",
-      "sha256": "294b5bd3418979fb094bcc4f480d7284fdcdcd4e5e89f0459073d5315e243e66",
+      "sha256": "f7b193cf0d1eb9ecd233bf1588f6290c2fb8bc41ad327918a740beb2099f719c",
       "native_tested": true
     }
+  },
+  "context_qualification": {
+    "darwin/amd64": {
+      "source_commit": "fa94c56afa59aaa3e429bf15613989bd444090f6",
+      "workflow": ".github/workflows/ci.yml",
+      "run_id": "37253197914",
+      "binary_sha256": "27fc51465a79c1525b1300b347cee4d09afde3c7b0d845414659302f5bbca2f7",
+      "observation_sha256": "f6a8c71afa0e06521de263ae49934ce33f4272ed40d0fec6d9a17f7a68357c87",
+      "module_sha256": "d5cccd13647e2c3a2a752b94b34dec4d4fc6aec5ced8fb0abce6ec9346ba1a7e",
+      "native_cases": [
+        "TestContextBoundedRender",
+        "TestContextDocumentContract",
+        "TestContextMarkdownPreservation",
+        "TestContextMutationAdmission",
+        "TestContextRecoveryAndPaths",
+        "TestContextRepresentationBoundary"
+      ]
+    },
+    "darwin/arm64": {
+      "source_commit": "fa94c56afa59aaa3e429bf15613989bd444090f6",
+      "workflow": ".github/workflows/ci.yml",
+      "run_id": "37253197914",
+      "binary_sha256": "3a3d61be18eba426db4f260b9cbae0d3d3c89f47efe184395d7f011cc3b4f59a",
+      "observation_sha256": "2ca37cd149e0efdf73929f0398334089cd3bbb1bba03c61407a485eb8edaecad",
+      "module_sha256": "d5cccd13647e2c3a2a752b94b34dec4d4fc6aec5ced8fb0abce6ec9346ba1a7e",
+      "native_cases": [
+        "TestContextBoundedRender",
+        "TestContextDocumentContract",
+        "TestContextMarkdownPreservation",
+        "TestContextMutationAdmission",
+        "TestContextRecoveryAndPaths",
+        "TestContextRepresentationBoundary"
+      ]
+    },
+    "linux/amd64": {
+      "source_commit": "fa94c56afa59aaa3e429bf15613989bd444090f6",
+      "workflow": ".github/workflows/ci.yml",
+      "run_id": "37253197914",
+      "binary_sha256": "3b6178bb54d6a19fc56d99f8fced862ae151605a0373297a69e130d3857a8406",
+      "observation_sha256": "85f789dc87517f96042a8e88da689100bcd561ddda863e0986ace221f18dbbab",
+      "module_sha256": "d5cccd13647e2c3a2a752b94b34dec4d4fc6aec5ced8fb0abce6ec9346ba1a7e",
+      "native_cases": [
+        "TestContextBoundedRender",
+        "TestContextDocumentContract",
+        "TestContextMarkdownPreservation",
+        "TestContextMutationAdmission",
+        "TestContextRecoveryAndPaths",
+        "TestContextRepresentationBoundary"
+      ]
+    },
+    "linux/arm64": {
+      "source_commit": "fa94c56afa59aaa3e429bf15613989bd444090f6",
+      "workflow": ".github/workflows/ci.yml",
+      "run_id": "37253197914",
+      "binary_sha256": "a5259074098932f815f33d3e1dea98e6d9a04277d1ada958469905da67d29437",
+      "observation_sha256": "50afdbe9ce2e9893cc3557fc230010baf5c093da6f0839f17ed15a3c45c69905",
+      "module_sha256": "d5cccd13647e2c3a2a752b94b34dec4d4fc6aec5ced8fb0abce6ec9346ba1a7e",
+      "native_cases": [
+        "TestContextBoundedRender",
+        "TestContextDocumentContract",
+        "TestContextMarkdownPreservation",
+        "TestContextMutationAdmission",
+        "TestContextRecoveryAndPaths",
+        "TestContextRepresentationBoundary"
+      ]
+    },
+    "windows/amd64": {
+      "source_commit": "fa94c56afa59aaa3e429bf15613989bd444090f6",
+      "workflow": ".github/workflows/ci.yml",
+      "run_id": "37253197914",
+      "binary_sha256": "8339c077262f861631631de49bca7cdafec5e0730b9e3676fd2db36f3c119036",
+      "observation_sha256": "56e2f848ba306bbf4acbb2febdfd298e08988761a53b87d9dded7bbf23c9a0ea",
+      "module_sha256": "d5cccd13647e2c3a2a752b94b34dec4d4fc6aec5ced8fb0abce6ec9346ba1a7e",
+      "native_cases": [
+        "TestContextBoundedRender",
+        "TestContextDocumentContract",
+        "TestContextMarkdownPreservation",
+        "TestContextMutationAdmission",
+        "TestContextRecoveryAndPaths",
+        "TestContextRepresentationBoundary"
+      ]
+    },
+    "windows/arm64": {
+      "source_commit": "fa94c56afa59aaa3e429bf15613989bd444090f6",
+      "workflow": ".github/workflows/ci.yml",
+      "run_id": "37253197914",
+      "binary_sha256": "f7b193cf0d1eb9ecd233bf1588f6290c2fb8bc41ad327918a740beb2099f719c",
+      "observation_sha256": "5db05023f4fe8441c0e2f664fc0704f42967285a54566f801f9e37f9ad4819a5",
+      "module_sha256": "d5cccd13647e2c3a2a752b94b34dec4d4fc6aec5ced8fb0abce6ec9346ba1a7e",
+      "native_cases": [
+        "TestContextBoundedRender",
+        "TestContextDocumentContract",
+        "TestContextMarkdownPreservation",
+        "TestContextMutationAdmission",
+        "TestContextRecoveryAndPaths",
+        "TestContextRepresentationBoundary"
+      ]
+    }
   }
 }

package/plugins/ca-pi/hooks/_activationlib.py

@@ -127,26 +127,110 @@ def marker_root(payload=None):
     return get_host().marker_root(payload)
 
 ARBITER_RE = re.compile(r"^\s*arbiter:\s*enabled\s*$", re.I)
+_BODY_MARKER_RE = re.compile(r"^\s*<!--\s*INITIALIZED\s*-->\s*$")
+_FENCE_RE = re.compile(r"^ {0,3}(`{3,}|~{3,})(?:[^`~].*)?$")
 
-def frontmatter_enabled_text(text):
-    """(enabled, malformed) for CONTEXT.md *content* (see frontmatter_enabled).
-    Split out so the #159 Write/Edit guard can vet the RESULTING content of an
-    edit — 'does this edit keep the repo arbiter-enabled?' — without going to
-    disk, sharing one parser with the on-disk activation check so the two never
-    disagree on what 'enabled' means."""
+def context_state_text(text):
+    """Return (enabled, malformed, initialized) from one CONTEXT.md parse."""
     lines = (text or "").split("\n")
     if not lines:
-        return (False, False)
+        return (False, False, False)
     first = lines[0].lstrip("")  # tolerate a leading UTF-8 BOM
     if first.strip() != "---":
-        return (False, False)  # no opening delimiter — dormant, not malformed
-    found = False
-    for ln in lines[1:]:
+        return (False, False, False)
+    enabled = False
+    body_start = None
+    for index, ln in enumerate(lines[1:], 1):
         if ln.strip() == "---":
-            return (found, False)  # closing delimiter — decision is final
+            body_start = index + 1
+            break
         if ARBITER_RE.match(ln):
-            found = True
-    return (False, True)  # opened but never closed — malformed
+            enabled = True
+    if body_start is None:
+        return (False, True, False)
+    if not enabled:
+        return (False, False, False)
+
+    fence_char = ""
+    fence_length = 0
+    in_comment = False
+    for ln in lines[body_start:]:
+        stripped = ln.strip()
+        if fence_char:
+            if re.fullmatch(r" {0,3}" + re.escape(fence_char) +
+                            "{" + str(fence_length) + r",}\s*", ln):
+                fence_char = ""
+            continue
+        if in_comment:
+            if "-->" in ln:
+                in_comment = False
+            continue
+        fence = _FENCE_RE.match(ln)
+        if fence:
+            fence_char, fence_length = fence.group(1)[0], len(fence.group(1))
+            continue
+        if _BODY_MARKER_RE.fullmatch(ln):
+            return (True, False, True)
+        if "<!--" in stripped and "-->" not in stripped:
+            in_comment = True
+    return (True, False, False)
+
+
+def frontmatter_enabled_text(text):
+    """(enabled, malformed) for CONTEXT.md content; shared with body parsing."""
+    enabled, malformed, _initialized = context_state_text(text)
+    return (enabled, malformed)
+
+
+def initialized_body_text(text):
+    """True only for a standalone marker in an enabled CONTEXT.md body."""
+    return context_state_text(text)[2]
+
+
+def passive_activation_inventory(root):
+    """Read only the explicit root's activation marker; execute no project tools.
+
+    This is a pre-session inspection result, not proof of repository identity,
+    host capability, network policy, or permission to activate. The caller must
+    inventory sensitive paths before sending any source to a model.
+    """
+    root = os.path.abspath(root)
+    if not os.path.isdir(root) or os.path.islink(root):
+        raise ValueError("passive inspection requires an existing, non-link directory")
+    state_dir = os.path.join(root, ".codearbiter")
+    ctx = os.path.join(state_dir, "CONTEXT.md")
+    if os.path.islink(state_dir) or os.path.islink(ctx):
+        raise ValueError("passive inspection refuses linked context paths")
+    if os.path.lexists(state_dir) and not os.path.isdir(state_dir):
+        raise ValueError(".codearbiter is not a directory")
+    if os.path.lexists(ctx) and not os.path.isfile(ctx):
+        raise ValueError("CONTEXT.md is not a regular file")
+    exists = os.path.isfile(ctx)
+    enabled = malformed = initialized = False
+    if exists:
+        if os.path.getsize(ctx) > 1024 * 1024:
+            raise ValueError("CONTEXT.md exceeds passive inspection read limit")
+        with open(ctx, encoding="utf-8") as stream:
+            enabled, malformed, initialized = context_state_text(stream.read(1024 * 1024 + 1))
+    effect = {"capability": "unverified", "authorization": "not_established",
+              "performed": False}
+    activation_behaviors = {
+        "git_hooks_exclusions": "scaffold may write Git-local exclusions and hooks; active startup may refresh hooks",
+        "git_fetch": "active startup may spawn detached Git fetch",
+        "update_refresh": "active startup may spawn detached update refresh",
+        "inference_transport": "host-selected model may receive approved source after authorization",
+    }
+    return {
+        "profile": "passive-before-activation",
+        "root": root,
+        "root_identity": "caller_supplied_unverified",
+        "context": {"exists": exists, "enabled": enabled,
+                    "initialized": initialized, "malformed": malformed},
+        "effects": {name: {**effect, "activation_behavior": behavior}
+                    for name, behavior in activation_behaviors.items()},
+        "source_reads": "none",
+        "sensitive_path_inventory": "pending",
+    }
 
 
 def frontmatter_enabled(ctx_path):

package/plugins/ca-pi/hooks/_arbiterstatelib.py

@@ -52,6 +52,7 @@ import re
 # exactly like a failure to import `os` would. No circularity risk: _modelib
 # imports _activationlib and _hooklib, neither of which imports this module.
 from _modelib import current_mode as _modelib_current_mode
+from _activationlib import frontmatter_enabled_text as _activation_enabled_text
 
 # mtime-keyed memo: statusline.py is a short-lived subprocess, but a single render
 # can resolve arbiter_state more than once (safe() probes), and the StopHook fires
@@ -143,14 +144,18 @@ def _arbiter_enabled(ctx_path, frontmatter_enabled=None, ctx_text=None):
     When `ctx_text` is supplied (performance-003: the caller already read
     CONTEXT.md), the decision is made from that text — no re-read of ctx_path."""
     if ctx_text is not None:
-        return frontmatter_text(ctx_text).get("arbiter", "").lower() == "enabled"
+        return _activation_enabled_text(ctx_text)[0]
     if frontmatter_enabled is not None:
         try:
             enabled, _malformed = frontmatter_enabled(ctx_path)
             return enabled
         except Exception:  # noqa: BLE001 — degrade to the local parser, never crash
             pass
-    return frontmatter(ctx_path).get("arbiter", "").lower() == "enabled"
+    try:
+        with open(ctx_path, encoding="utf-8-sig", errors="replace") as handle:
+            return _activation_enabled_text(handle.read())[0]
+    except OSError:
+        return False
 
 
 def arbiter_state(root, count_in_flight=None, read_board=None, frontmatter_enabled=None,