@arbiterforge/ca-pi 0.15.2 → 0.15.3

package/plugins/ca-pi/hooks/hostapi.py

@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "2.22.2"
+    adapter_version = "2.22.3"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,

package/plugins/ca-pi/includes/command-compatibility.md

@@ -14,3 +14,34 @@ contain the compatibility metadata. ca retains these routes through every 2.x re
 before a separately approved 3.0.0. ca-codex and ca-pi retain them through every later 0.x release,
 with no removal before a separately approved 1.0.0. Passing a version floor never authorizes removal:
 removal needs a new governed decision and fresh compatibility evidence.
+## Explicitly retired capability: skill authoring
+
+The maintainer explicitly approved removal of `new-skill` and `skill-author` on
+2026-09-25 in PR #854. This one named exception supersedes the earlier
+retain-every-route requirement for that workflow only. Its command, owning skill,
+template and generated host entries are removed, not deprecated aliases. No
+`extend skill` replacement or hidden callable routine is installed.
+
+Requests to author or change repository resources use the applicable existing
+change workflow and its authorization, verification and commit requirements.
+CodeArbiter maintainers can read the format conventions in the source repository's
+`core/surface/README.md`; that document is not an installed workflow.
+
+This is an intentional command-compatibility break, not a claim that older
+invocations continue to resolve. Existing installed older releases are unchanged.
+The five other compatibility aliases and their publication clocks remain intact;
+this retirement is not permission to remove any other entry.
+
+## Reviewed single-owner entries
+
+PR #854 composes `tribunal`, `threat-model`, `context-check`, `cleanup`, and `pr`
+from their existing skill owners. These operations are retained, not retired or
+renamed. Their explicit argument grammars, mode markers, compatibility clocks and
+host availability remain unchanged. `status drift` and `pr --cleanup` reach the
+same owners directly; PR watch mode retains its existing watcher resource.
+
+The wrapper text is no longer an independent policy source. Drift and cleanup
+retain their full operational body, and PR retains current acceptance/ancestry
+preflight plus one shared opening procedure. Tests keep historical wrapper
+fingerprints while checking these named migrations against the owning contracts.
+This permission does not authorize an unrelated route removal or gate change.

package/plugins/ca-pi/includes/farm.md

@@ -35,8 +35,14 @@ the same hard gates; **only the cheap HTTP-chat worker ships today** — premium
 model) and agentic (a worker that reads files and iterates) are what the seam is designed for, roadmap
 not built. Cost arbitrage is one worker policy, not the definition.
 
-The worker prompt is enriched with the failing-test source and current in-scope file contents, byte-capped
-(`FARM_ENRICH_MAX_BYTES`) and secret-redacted before transmission to the endpoint.
+The worker prompt includes the failing-test source, current in-scope files, and available prior output.
+`FARM_ENRICH_MAX_BYTES` limits their rendered UTF-8 enrichment, including section text, file labels,
+separators, and any truncation notice. Complete source is redacted before truncation; a cut never splits
+an encoded code point. Current source takes priority over prior output. When a file does not fit, its
+body is shortened and later files are omitted. A label that cannot fit is omitted rather than split.
+Small limits use a compact notice; limits too small for that notice omit enrichment entirely.
+This is not a cap on task instructions, failure details, the full JSON request, model tokens, or local
+file-read memory. No additional model request or user checkpoint is made solely because context was cut.
 
 **Swapping the worker changes who writes the code, never whether it's reviewed.** Every task the farm
 reports green is still routed through the normal spec-compliance, quality, and fresh-verification
@@ -47,18 +53,84 @@ capable of the slice).
 
 ### Zero-token quality guards
 
-1. **Literal-leak** — rejects an impl that simply hard-codes the literal value the test asserts
-   (`return 42` for `expect(f()).toBe(42)`).
+1. **Literal-leak** — flags repeated whole, same-kind string or numeric spellings in a small
+   implementation (`return 42` for `expect(f()).toBe(42)`). A number inside an identifier, a larger
+   number/string, or a conventional source comment is not a match. String `"42"` and number `42`
+   are distinct. The existing five-code-line boundary determines rejection versus warning; a
+   rejection names the actual small-file match, not an earlier substantial-file match.
 2. **Mutation** — after the gate is green, mutates the worker's in-scope impl (operator flips, return
    replacement, boolean inversion) and re-runs **only the task's narrow test** (`gate.commands[0]`). A
-   surviving mutant is code the test does not constrain — gaming, dead code, or a weak test. The score
-   is **bounded by test strength**: a low score is a strong red flag, a high score is necessary but not
-   sufficient (Phases 3–5 remain the real quality gate). A low score attaches a **warning that rides
-   into Phase 3** for Claude to judge (worker gaming vs. weak test); only a near-zero score on a
-   non-trivial impl hard-escalates. Sampled and time-boxed so it never balloons wall-clock. Set
+   surviving mutant is an implementation change the test command did not reject. It can indicate
+   weak tests, dead code or an equivalent change; it does not by itself prove gaming. Bare nonzero
+   exits do not establish valid, assertion-killed mutants. Built-in positive rejection ratios remain
+   unverified bounds, not measured scores; see the accounting rule below. Any completed nonzero
+   built-in rerun leaves the measurement unavailable, whatever its ratio. It attaches a
+   **warning that rides into Phase 3** for independent review unless the existing near-zero bound
+   with sufficient evaluated evidence rejects the candidate. `FARM_MUTATION_WARN_BELOW` applies
+   only to measured scores from a successful external hook or a built-in all-pass zero result;
+   it cannot suppress an unavailable-measurement warning. Screening is sampled and time-boxed. Set
    `FARM_MUTATION_CMD` to swap the built-in text mutator for a real per-language framework (Stryker,
    mutmut, …); it runs in the worktree with `FARM_MUTATION_FILES` / `FARM_MUTATION_TEST_PATH` /
-   `FARM_MUTATION_TEST_CMD` set and must print a trailing JSON line with a numeric `score`.
+   `FARM_MUTATION_TEST_CMD` set. A measured hook score requires successful completion (exit 0,
+   no timeout, verified timeout cleanup when needed) and a trailing stdout JSON report with a finite
+   `score` in `[0, 1]`. A wrapper around a percentage-based framework must normalize its measurement;
+   stderr diagnostics are not the score channel. Optional counts and survivors remain absent unless
+   the hook actually reports them.
+
+The literal check is a bounded lexical heuristic, not an assertion parser or proof of intent. It
+ignores conventional slash comments in recognized C-family source suffixes and hash comments in
+Python; other suffixes do not acquire a guessed comment grammar. Plain quote delimiters and numeric
+spellings are compared without evaluating escapes or constant expressions. Dynamic templates are not
+constant-string evidence; only unambiguous expression-start regex forms are skipped. Language-specific
+prefixes, JSX and other ambiguous grammar are not fully interpreted. Test labels, inputs and legitimate
+shared constants can still match. Normal independent review remains authoritative; an absent lexical
+match neither skips the mutation check nor accepts the work.
+
+A configured hook that fails, times out, or reports invalid output supplies diagnostics, not a
+measured `mutationScore`. Ordinary unavailable measurements retain the existing warning policy and
+continue through normal independent review; this does not add a user checkpoint. Do not hide adverse
+evidence: a failed hook's parseable stdout report at or below the existing near-zero floor, with at
+least five explicitly reported evaluated mutants, still rejects that candidate pending successful
+remeasurement. It is not published as a valid score. No evaluated count is invented from absence or a
+survivor list. A retained alternative can qualify under the same rules before another model round.
+
+If timeout cleanup cannot establish that the mutation process tree stopped, qualification is fatal
+for that task: no further candidate, retry, commit or integration may run against a possibly live
+writer. Existing task reporting retains known spend and cleanup diagnostics. Neither an adverse
+report nor failed process containment can be converted into acceptance by scoring prose.
+
+The built-in text mutator bounds each test launch by the remaining mutation budget and any shorter
+configured gate timeout. Zero mutation budget launches no tests; disabling the general gate timeout
+does not disable this budget. Mutant writes count against the trial budget. Verified process teardown
+and defensive restoration can take additional time and must finish or refuse safely before work
+advances. An interrupted trial is not a killed mutant: stop screening, restore the worker's output,
+and return diagnostics without a measured score. Completed observations before the interruption stay
+explicitly unverified; the existing near-zero/five-completed-reruns floor still rejects an adverse
+candidate. A clean timeout otherwise warns through independent review, without another default
+user checkpoint. Unverified process cleanup retains the fatal containment boundary above.
+
+A completed nonzero rerun is an **unclassified gate rejection**, not a proved mutant kill. The
+built-in runner cannot distinguish a compiler, loader, infrastructure or assertion failure from an
+arbitrary command's exit status. Diagnostic wording and printed score-like JSON do not grant that
+classification. Preserve a bounded, redacted first-rejection witness and completed/pass counts;
+do not publish a positive `mutationScore` from these exits. For real language-specific measurements,
+use the existing explicitly configured external framework hook rather than another public command.
+
+For at least three completed reruns, retain `R / (S + R)` as an **unverified gate-rejection upper
+bound**, where `R` is completed nonzero reruns and `S` is successful reruns. Treating every rejected
+trial as a valid kill is the most favorable interpretation of those observations; excluding invalid
+rejections cannot increase that fraction. This is not a language-aware mutation score and does not
+classify equivalent or unexercised changes. Preserve the existing near-zero/five-completed-reruns
+rejection floor even on this bound: uncertainty cannot erase an already adverse result. Otherwise
+retain the ordinary warning and independent review, without spending another model round or adding a
+user checkpoint solely because the measurement is unavailable.
+
+With no rejected or interrupted trial, at least three successful reruns still produce the existing
+zero screening score and survivor list. A shorter all-pass run stays too thin to score; a short
+nonzero run reports its diagnostic without inventing a usable evaluated count. A budget ending
+between trials follows these same rules; interruption never publishes a partial measured score.
+Language-aware validity and semantic interpretation of literal overlap remain separate work. None
+of these screening outcomes is task or scope acceptance proof.
 
 Note: `writing-plans --farm` MUST place the task's narrow behavioral test first in `gate.commands` —
 the mutation guard runs `gate.commands[0]` as the per-mutant test (running an exhaustive suite per mutant
@@ -66,22 +138,56 @@ would be too slow).
 
 ### Best-of-N sampling and iterative retries
 
-By default the farm draws one worker completion per task attempt (`FARM_SAMPLES=1` — unchanged
-behavior). Because the gate is a deterministic pass/fail oracle and each task runs in an isolated
-worktree, you can instead draw **N candidates in parallel** and accept the first that passes the gate:
-set `FARM_SAMPLES=N`. Each sample runs in its own scratch worktree cut from the integration HEAD; the
-winner's files are taken into the task worktree and merged, the losers discarded. Total in-flight
-worker calls never exceed `FARM_CONCURRENCY` — sampling **shares** that budget, it does not multiply
-it. The cost is up to N× worker tokens (the cheap axis) for a higher first-time-go rate;
-`farm-report.json` records both the summed sample-token spend (`promptTokens`/`completionTokens`) and
-the accepted candidate's own tokens (`acceptedPromptTokens`/`acceptedCompletionTokens`) so the
-trade-off is visible. With `FARM_SAMPLES>1` the worker temperature is auto-bumped off 0 (to 0.7) so the
-samples actually diversify; set `FARM_TEMPERATURE` to control it.
-
-On a **retry** — a failed gate, or a sampling round with no green — the worker is shown its own previous
-in-scope output, not just the gate-failure tail, so it refines rather than restarts blind. That prior
-output rides the same byte-cap (`FARM_ENRICH_MAX_BYTES`) and secret-redaction chokepoint as all other
-injected context; out-of-scope drift is never carried forward.
+By default the farm draws one worker completion per task attempt (`FARM_SAMPLES=1`). With
+`FARM_SAMPLES=N`, it draws **N candidates** in isolated scratch worktrees from the task's frozen
+baseline. Total in-flight worker calls share `FARM_CONCURRENCY`; sampling does not multiply that cap.
+
+Sample gate success is only a shortlist. In deterministic sample-index order, each shortlisted
+candidate is materialized into the task worktree and receives the same containment, immutable-test,
+drift, task-gate, literal-risk and mutation checks as the single-worker path. Alternatives remain
+available until one passes those checks. A gate or high-risk rejection tries the next existing
+candidate before spending another model round. An integrity failure or an unusable reset/setup
+stops that task rather than disguising the failure with an unrelated passing candidate.
+
+Between candidates, tracked and non-ignored worker changes are reset to the task baseline and the
+existing setup phases are reapplied. Ignored dependency caches retain their existing policy. Cleanup
+is attempted for every sample, including exception paths; unresolved cleanup is reported. The same
+selection applies to detached canary work, which still stops before commit or merge.
+
+`farm-report.json` records summed known sample usage (`promptTokens`/`completionTokens`) separately from
+the selected candidate's own tokens (`acceptedPromptTokens`/`acceptedCompletionTokens`). Qualification
+makes no additional model requests, but can run local gates and mutation checks for multiple
+candidates. It is not comparative quality ranking or a measured savings claim. Normal independent
+reviews and acceptance still follow. With `FARM_SAMPLES>1` and no explicit temperature, sampling
+defaults to `0.7`; `FARM_TEMPERATURE` remains the operator override. An explicit
+`FARM_TEMPERATURE=0` is respected even with multiple samples and disables this automatic
+bump. Leave the override unset or choose a supported nonzero temperature when seeking
+more varied candidates; a temperature setting is not a guarantee of distinct outputs.
+
+On a **retry**, available output reported written by the selected previous candidate is retained only
+where it intersects implementation scope. Untouched baseline files remain current-source context, not
+previous work. Partial output and file evidence can survive rejection or a later qualification exception;
+sibling candidates are not mixed. Prior output uses the same byte cap and redaction as other context.
+Labels say **not accepted**, not that a test necessarily failed. Actual failure details distinguish a
+worker response, qualification, transport, or integration problem so valid work need not be rewritten
+blindly. Retained context grants no acceptance, new retry allowance, or permission.
+If the retry cannot reset its worktree, the task escalates without another model call.
+Its report retains the completed attempts' known token usage, last output/risk evidence,
+and any unresolved sample cleanup outcomes; a failed reset cannot erase them.
+
+A decoded provider response can contain reported usage even when its output is
+rejected. The worker preserves valid counters through malformed message content,
+read-only or escaping paths, and guarded-write refusals, including any already
+written file list. A malformed non-text response becomes an ordinary worker
+failure under the existing retry/selection policy, not an unhandled parser error.
+Counters must be explicitly reported nonnegative safe integers; validate prompt
+and completion independently. Explicit zero is valid; missing, invalid or
+undecodable counts stay absent at the worker boundary. The existing report sums
+known counts, so its total is not proof of complete usage or verified billing.
+No extra provider request is made to recover a missing counter. HTTP failures,
+transport retries without usable usage and provider pricing remain outside this
+accounting correction. Output rejection still enforces the original write,
+test, gate and independent-review requirements.
 
 ## Required
 
@@ -110,8 +216,16 @@ picks a model by *measurement*, not hearsay:
    an acceptable canary pass-rate. Otherwise re-select.
 2. **Discovery** — websearch the current free Zen roster to enumerate candidate ids (codenames included).
    This finds *candidates*; it does not judge quality.
-3. **Canary** — `farm.js --canary` runs the plan's smallest task against each candidate and ranks them by
-   measured pass-rate / attempts / latency (`FARM_CANDIDATE_MODELS` carries the list). The top passer wins.
+3. **Canary** — `farm.js --canary` runs the plan's smallest no-dependency task against each candidate
+   and ranks that task's gate result / attempts / latency (`FARM_CANDIDATE_MODELS` carries the list).
+   It freezes the configured base commit before probing, uses separate detached scratch worktrees
+   for each model and sample, and records `baseCommit` in `.farm/canary-report.json`. Candidate
+   selection overrides `task.model` for the trial only; normal dispatch keeps its task override.
+   Worker containment, immutable tests, drift and verification checks still apply. Evaluation stops
+   before staging, committing or merging: it does not reset or advance an existing integration
+   branch. Existing task branches and worktrees are not its scratch. The top passer wins only after
+   verified cleanup; retained scratch is reported and exits nonzero without recursively erasing it.
+   A single task's result is not a general model pass-rate or promotion qualification.
 4. **Surface** — the choice is presented with its measured basis (and a one-line websearched identity note
    for the audit log), then written to `plan.meta.model` + `.farm/model-cache.json`.
 5. **Fallback ladder** — if the canary can't run or none pass: cached model → unmeasured websearch pick
@@ -125,21 +239,21 @@ picks a model by *measurement*, not hearsay:
 | `FARM_API_BASE_URL` | `https://opencode.ai/zen/v1` | Endpoint URL (env → plan.json → this default). |
 | `FARM_CANDIDATE_MODELS` | _(unset)_ | Comma-separated ids for `--canary` probing. Set by the dispatch skill. |
 | `FARM_CONCURRENCY` | `4` | Max concurrent task workers — and the shared ceiling on TOTAL in-flight worker calls, including best-of-N samples. |
-| `FARM_SAMPLES` | `1` | Best-of-N: candidates drawn per task attempt; first to pass the gate wins. `1` = today's single-candidate path. N>1 trades up to N× worker tokens for higher first-time-go; shares the `FARM_CONCURRENCY` budget (never N× it). |
-| `FARM_TEMPERATURE` | `0` | Sampling temperature sent to the worker. Auto-bumped to `0.7` when `FARM_SAMPLES>1` and left at `0` (so samples diversify); set explicitly to override. |
+| `FARM_SAMPLES` | `1` | Best-of-N: candidates drawn per attempt; first in index order to pass task-worktree gates and risk qualification is selected. `1` keeps the single-worker path. Shares `FARM_CONCURRENCY`; known reported usage from all candidates is summed. |
+| `FARM_TEMPERATURE` | `0` (one sample); `0.7` (multiple, unset) | Sampling temperature sent to the worker. Defaults to `0` when `FARM_SAMPLES=1` and `0.7` when `FARM_SAMPLES>1`. Any explicit value, including `0`, overrides the automatic default. |
 | `FARM_MAX_TOKENS` | _(unset)_ | Max completion tokens per worker call. `0`/unset = provider default (today's unbounded behavior). |
 | `FARM_MAX_RETRIES` | `2` | Max gate retries per task before escalating. |
 | `FARM_BASE_BRANCH` | `main` | Branch the integration branch is cut from. |
-| `FARM_REQUEST_TIMEOUT_MS` | `120000` | Per-request hard timeout (prevents worker-slot deadlock). |
-| `FARM_API_MAX_RETRIES` | `3` | Transport retries for 429/5xx (honors `Retry-After`). |
+| `FARM_REQUEST_TIMEOUT_MS` | `120000` | Per-request hard timeout. A valid provider `Retry-After` longer than this is not shortened; the task is deferred without another authoring attempt. |
+| `FARM_API_MAX_RETRIES` | `3` | Transport retries for 429/5xx. Bounded `Retry-After` is honored; exhaustion defers new authoring for that task. |
 | `FARM_ENTITLEMENT_PROBE_TIMEOUT_MS` | `35000` | Per-candidate wall-clock cap for the `--canary` entitlement pre-screen (drops 401 promo-expired models). |
-| `FARM_ENRICH_MAX_BYTES` | `131072` | Cap on bytes of test-source + in-scope file context injected into the worker prompt (data-minimization; redacted for secrets). |
+| `FARM_ENRICH_MAX_BYTES` | `131072` | UTF-8 cap on rendered current/prior file context, labels, separators and notices; not the complete prompt or request. |
 | `FARM_ABORT_ESCALATION_RATE` | `0.5` | Circuit breaker: abort once escalations exceed this fraction… |
 | `FARM_ABORT_MIN_TASKS` | `3` | …after at least this many tasks have settled. |
 | `FARM_MUTATION` | `on` | Mutation guard on/off. |
 | `FARM_MUTATION_SAMPLE` | `15` | Max mutants per task (sampled). |
 | `FARM_MUTATION_BUDGET_MS` | `30000` | Per-task mutation time box. |
-| `FARM_MUTATION_WARN_BELOW` | `0.5` | Score below this attaches a warning into Phase 3. |
+| `FARM_MUTATION_WARN_BELOW` | `0.5` | Measured scores below this warn in Phase 3 unless the rejection floor applies. Unavailable or unverified measurements warn independently of this threshold. |
 | `FARM_MUTATION_ESCALATE_BELOW` | `0.1` | Score at/below this (≥5 mutants) hard-escalates. |
 | `FARM_MUTATION_CMD` | _(unset)_ | Pluggable external mutation framework hook. |
 | `FARM_RUN_ID` | _(random)_ | Pin this run's id — also the name of its artifact directory (`.farm/runs/<run-id>/`). Must be 1–64 chars of `[A-Za-z0-9._-]`; anything else is refused at startup. Reusing an id publishes over that directory's receipts, so pin a fresh one per run. |
@@ -217,7 +331,7 @@ Every run owns an artifact directory keyed by its run id — `<project-root>/.fa
 that directory is the **durable receipt**, written by that run alone. Two farm processes against one
 repository therefore cannot overwrite each other's *evidence* (see the concurrency caveat below — the
 receipts are isolated, the git state is not):
-- `farm-report.json` — structured results: per-task status, attempts, files written, worker token spend,
+- `farm-report.json` — structured results: per-task status, attempts, files written, known reported worker usage,
   warnings (gaming-risk), and an `aborted` flag; plus a `blocked[]` array with reasons, and an
   `artifacts` block stating whether the streaming rail was complete and which tasks' diff evidence is
   unavailable.
@@ -230,7 +344,8 @@ own artifacts: `.farm/farm-report.json`, `.farm/farm-report.md`, `.farm/farm-res
 `.farm/diffs/<task-id>.patch`. Under concurrency the pointer is last-writer-wins — always a complete
 artifact, never a truncated one, but attributable only via its `run_id`. Reconcile against the run
 directory when it matters. Also in `.farm/`:
-- `canary-report.json` — model-probe ranking (when `--canary` was run).
+- `canary-report.json` — model-probe ranking, frozen `baseCommit`, and any cleanup failures
+  (when `--canary` was run). This is evaluation evidence, not task acceptance or integration proof.
 - `model-cache.json` — last selected model + timestamp + canary pass-rate.
 
 Every report write is atomic (same-directory temp file, then rename), so a reader of a report path sees
@@ -258,3 +373,39 @@ To run two farms against one repository at the same time, give each process:
 Escalated tasks leave their worktrees at `.farm/worktrees/<task-id>/` for inspection.
 
 Canary ranking: `FARM_CANDIDATE_MODELS=a,b,c farm.js --canary <plan.json>` (cwd at the project root).
+
+### Transport retry boundaries
+
+A 429 or server failure retries the HTTP request within `FARM_API_MAX_RETRIES`, not a fresh
+implementation. Recognized `Retry-After` delay-seconds and HTTP-date values are honored only when
+the wait fits the existing `FARM_REQUEST_TIMEOUT_MS` budget and the runtime timer range. An excessive
+valid cooldown is not shortened or allowed to park a worker indefinitely. Missing or malformed fields
+use the existing exponential backoff capped at 16 seconds; explicit zero or a past valid date permits
+an immediate retry. Request deadlines still cover headers and successful body reads; between-request
+waits are separate. Discarded error streams are aborted before waiting or returning.
+
+Once that HTTP retry budget is exhausted, or a valid cooldown cannot fit locally, the worker returns
+an explicit non-retryable transport disposition. The task does not spend another authoring attempt
+against the same unavailable provider. Already-produced candidates may still qualify, independently
+eligible tasks can continue under the existing circuit breaker, and dependent work remains unaccepted.
+This is a reported task deferral, not a new user-approval gate or automatic delayed-resume service.
+Network/body failures and ordinary implementation failures otherwise retain their existing retry
+policy. This does not introduce a provider-wide cooldown coordinator, a new setting, or a spend claim.
+
+### Merge-conflict recovery
+
+A failed integration merge uses the existing task retry budget, not a new interview.
+The dispatcher verifies merge rollback and clean tracked integration state, pins that
+integration commit, and checks task reset, cleanup and HEAD before the next author.
+It keeps the prior qualified implementation as labeled feedback instead of presenting
+replacement baseline files as the worker's previous output. A protected test brought
+in by the verified integration commit becomes the next attempt's immutable baseline;
+setup and worker edits to that test still fail the same checks. Retained samples use
+this path too. Ignored setup caches keep their existing fingerprint contract.
+
+The same explicit-path staging operation gets up to three attempts, with 150 ms
+and 300 ms waits after refusal. This repeats no worker or commit and never removes
+another process's index lock. Persistent staging refusal, unverified rollback/reset
+or an unreadable replacement test cannot be repaired by another model call. The task retains its actual
+attempt, written-file and known-usage evidence, without commit or acceptance bypass.
+This does not add process resume, a provider fallback or a new approval checkpoint.

package/plugins/ca-pi/includes/maturity-coverage.md

@@ -11,29 +11,69 @@ The single source of truth for the coverage threshold. Coverage scales with the
 | 3 | ≥ 85% |
 | 4 | ≥ 90% |
 
-## Which metric (issue #507)
-
-**Lines and branches. Both must clear the threshold.** A report satisfying one and not the other
-does not pass.
-
-This was previously unstated, and the omission was load-bearing rather than cosmetic: a coverage
-report gives four numbers that disagree, so "≥ 70%" without a column named is not a threshold anyone
-can be held to. Measured on codeArbiter itself at the time of writing, one tree sat at 85.37% lines
-and 78.73% branches — compliant at maturity 3, or not, depending purely on which column the reader
-picked.
-
-- **Lines** catches code no test reaches at all — a `catch` block with zero executions inside a
-  passing suite, which no assertion is ever going to surface.
-- **Branches** catches the untaken half of a condition a test does reach: the error arm of an `if`,
-  the fallback of a `??`. Line coverage alone reports those as covered.
-- **Statements** duplicates lines closely enough to add nothing. **Functions** is the noisiest
-  column at small counts, where one uncovered helper moves it several points.
+## Which metric: declared coverage profile
+
+**Every required metric in the surface's declared coverage profile must clear the
+maturity threshold.** `tech-stack.md` binds each source tree to one supported
+profile and names its tool, command, production scope, exclusions and supported
+hosts. This declaration selects a language-appropriate measurement; it does not
+change the threshold table.
+
+| profile | applicable surface | required metrics |
+|---|---|---|
+| `lines-branches` | JavaScript/TypeScript and existing surfaces with qualified line and branch tooling | lines, branches |
+| `go-native` | Go measured with the native Go coverage toolchain | statements |
+
+Existing documented line-and-branch requirements already declare
+`lines-branches`, even without that label. Preserve them without another approval
+or a metadata migration; adding the label during normal maintenance changes no
+measurement requirement.
+
+The `lines-branches` profile retains issue #507's rule: both metrics must pass.
+For example, 85.37% lines and 78.73% branches fails maturity 3. A high line figure
+does not establish that error and fallback outcomes have been exercised.
+
+The `go-native` profile uses `go test -cover` and, for executable surfaces,
+instrumented `go build -cover` integration runs. Include all production packages
+in scope, including those reached through other packages' tests. Native Go
+reports statements, not lines or branches; label those other metrics
+**unmeasured**, never zero, inferred, or passed. A partial branch analyzer may
+provide diagnostic findings but does not turn statement counts into branch
+proof. Go native coverage is not the no-tooling exemption.
+
+Existing stronger measurement contracts remain binding until explicit user
+approval changes them. An agent MUST NOT switch profiles, remove required
+metrics, narrow production scope or exclude source to obtain a pass. Adding a
+profile or changing a surface's binding requires an explicit user approval of
+the concrete change, recorded with its rationale. A missing declaration or an
+unknown profile blocks; another language cannot silently borrow `go-native`.
+
+Missing, malformed, stale, partial or mismatched reports block the overall
+coverage verdict. Bind the reports to the tested source and declared tools,
+scope and hosts. A scoped local result may be reported as PARTIAL under
+`<plugin-root>/includes/verification-boundary.md`; the complete exact-head
+hosted result must pass before merge. Never average host percentages, discard
+an uncovered host-specific file, or relabel a metric to fill a missing column.
 
 **The number is the floor, not the goal.** A test written only to move a percentage is worse than
 the gap it closed, because it converts an honest red into a green that asserts nothing. When
 backfilling to clear this bar, work the uncovered *report* — error and refusal paths first — and let
 the number follow.
 
+## Behavioral evidence beyond percentages
+
+Every profile also requires tests for the changed behavior. For changed critical
+paths, cover approval and rejection, malformed or stale inputs, filesystem
+containment, and recovery where applicable. Each test must exercise the actual
+boundary and assert the expected outcome; merely reaching a line or avoiding an
+exception is insufficient. Use focused mutation checks for critical safeguards:
+removing or inverting the safeguard must make the relevant test fail.
+
+Missing critical-path evidence blocks even when the numeric floor passes. Scope
+this proof to the affected obligations and their callers; do not demand unrelated
+test expansion merely because a different language uses different metrics. These
+tests establish the named outcomes, not an unmeasured global branch percentage.
+
 ## Which host (issue #521)
 
 **A quoted coverage figure is the UNION of the supported hosts' reports for that tree.** Not any

package/plugins/ca-pi/includes/routing-table.md

@@ -26,10 +26,10 @@ reached the same way.
 | Bug fix | `/fix` → `tdd` (bug variant) | impl author | Failing regression test before any fix code |
 | Docs edit / dep bump / revert | `/chore` (type-scaled gates) | `dependency-reviewer` for deps | No behavioral code; suite green for deps/revert; exits via `commit-gate` |
 | Exploratory throwaway spike | `/spike` (self-contained command) → `spike/<slug>` branch | — | Never merges or PRs; `commit-gate`-exempt (nothing on the branch can land); exits to a findings note or `/feature` |
-| Behavior-preserving restructure | `/refactor` → `refactor` skill | `tdd` Phase 1 (new seams only) | No refactor without parity-coverage proof |
-| Unknown defect / investigation | `/debug` → `debug` skill | — | No code change in the skill; one named exit |
-| Commit | `/commit` → `commit-gate` | — | No commit without all nine gates green |
-| Open a PR / finish a branch | `/pr` → `finishing-a-development-branch` | reviewer fleet per path; PR-body prose applies `anti-slop-design` (`core` + `medium-documents` §7.A.1) | PR only; no direct-to-default, no force-push |
+| Behavior-preserving restructure | `refactor` skill at `<plugin-root>/routines/refactor/SKILL.md` (explicit `/refactor` uses the same owner) | `tdd` Phase 1 (coverage backfill or new seams) | No refactor without parity-coverage proof |
+| Unknown defect / investigation | `debug` skill at `<plugin-root>/routines/debug/SKILL.md` (explicit `/debug` uses the same owner) | — | No code change in the skill; one named exit |
+| Commit | `commit-gate` skill at `<plugin-root>/routines/commit-gate/SKILL.md` (explicit `/commit` uses the same owner) | — | No commit without all nine gates green |
+| Open a PR / finish a branch | `finishing-a-development-branch` at `<plugin-root>/routines/finishing-a-development-branch/SKILL.md`; select direct-open or caller mode first | reviewer fleet per path; PR-body prose applies `anti-slop-design` (`core` + `medium-documents` §7.A.1) | PR only; no direct-to-default, no force-push |
 | Watch a PR's CI / babysit checks | `/watch` → detached `gh pr checks --watch` | on-red diagnose (propose\|branch) | Never auto-merges; green → notify + offer; merge-to-default routes through the hard gate; no poll loop |
 | Code review of the diff | `/review` → `dispatching-parallel-agents` | reviewer fleet → `finding-triage` → `verdict-aggregator` | BLOCK on any CRITICAL/HIGH |
 | Periodic sweep | `/checkpoint` → `dispatching-parallel-agents` | reviewer fleet → finding-triage → read-only verdict; then explicit `checkpoint-aggregator` persistence | Surfaces and persists a triaged report; not a promotion gate |
@@ -41,18 +41,17 @@ reached the same way.
 | Migration file added or changed | `migration-reviewer` | — | BLOCK on missing classification or irreversible destructive op |
 | `package.json` / lockfile / base image changed | `/add-dep` → `dependency-reviewer` | — | BLOCK on denied license or supply-chain concern |
 | Run a pinned third-party tool ONCE, adopting nothing (`npx jscpd@4.0.5 .`) | `/ca-add-dep` → its *Ephemeral tool run* section (no `dependency-reviewer` dispatch) | — | Exact pinned version + approved registry + one confirmation; MUST NOT touch a manifest or lockfile, verified after the run, or it is adoption and takes the full review |
-| Sensitive feature / attack-surface change | `/threat-model` → `security-architecture` (optional) | `security-reviewer`, `auth-crypto-reviewer` | STOP only on a critical unmitigated threat |
-| Arbitration / variance / ADR reconciliation | `/reconcile` → `decision-variance` | `scout`, `grader`, `decision-challenger` | No decision recorded without user attribution |
-| New / aged ADR, unresolved `[CONFIRM-NN]` | `/adr`, `/adr-status` → `decision-lifecycle` | `decision-challenger` (optional) | No `[CONFIRM-NN]` resolved by guessing |
+| Requested threat model of a sensitive design | `security-architecture` at `<plugin-root>/routines/security-architecture/SKILL.md` (opt-in; explicit `/threat-model` retained) | `security-reviewer`, `auth-crypto-reviewer` | STOP only on a critical unmitigated threat |
+| Arbitration / variance / ADR reconciliation | `decision-variance` at `<plugin-root>/routines/decision-variance/SKILL.md` (explicit `/ca-reconcile` retained); select report-only or reconciliation first | `scout`, `grader`, `decision-challenger` (optional, read-only) | No decision recorded without explicit user choice and attribution; report-only writes nothing |
+| New / aged ADR, unresolved `[CONFIRM-NN]` | `decision-lifecycle` at `<plugin-root>/routines/decision-lifecycle/SKILL.md`; select author or read-only status before prerequisites | `decision-challenger` (optional) | No `[CONFIRM-NN]` resolved by guessing |
 | Rule conflict (persona vs docs vs code) | `/conflict` | — | STOP all other work immediately |
 | Unsure `/reconcile` vs `/conflict`? | rules contradict and work cannot safely continue → `/conflict`; artifacts drifted, work continues → `/reconcile` | — | When genuinely ambiguous, `/conflict` wins — stopping is recoverable, drifting past a rule conflict is not |
-| New skill needed | `/new-skill` → `skill-author` | — | No skill until the gap is proven uncovered |
 | Subagent raises an out-of-scope finding | inline `[NEEDS-TRIAGE]` marker | — | Never an ADR disposition; never silently dropped |
 | Sitting down to code / repo hygiene cleanup | `/ca-standup` → orchestrator git actions | — | ff-only pull on a clean tree; branch deletions confirmed individually, worktree removals may be confirmed as one named enumerated group; stash/dirty/un-pushed report-only; never touch the default branch |
-| Finish an already-merged branch (post-merge cleanup) | `/ca-cleanup` → `post-merge-cleanup` | — | Merge proven against the FETCHED default by ancestry, PR-record squash proof, or a byte-identical fallback; unique/unclassifiable artifacts never discarded without a per-item confirmation; `--ff-only`; `branch -d`, or `-D` only under the restated squash-proof path; remote branch untouched; never routes to `/ca-override` |
+| Finish an already-merged branch (post-merge cleanup) | `post-merge-cleanup` at `<plugin-root>/routines/post-merge-cleanup/SKILL.md` (explicit `/ca-cleanup` or `/ca-pr --cleanup`) | — | Merge proven against the FETCHED default by ancestry, PR-record squash proof, or a byte-identical fallback; unique/unclassifiable artifacts never discarded without a per-item confirmation; `--ff-only`; `branch -d`, or `-D` only under the restated squash-proof path; remote branch untouched; never routes to `/ca-override` |
 | Add / start / done a backlog task | `/ca-task` → `hooks/taskwrite.py` (the pure `_taskboardlib` transforms) | — | Board written only through the writer; `start` always stamps a date; `done` requires in-progress; never delete to complete |
 | Local runtime work (run, watch, exercise this repo's own app) | `mode --ops` → narrows the persona per `includes/ops-mode.md`, no skill/agent dispatch | — | Advisory only, no hook becomes mode-aware; permitted only when the operation starts, observes, or exercises and leaves no change in tracked files or git history — anything that mutates tracked files, the index, git history, or published state still routes normally |
 | Promote a workflow's un-actioned follow-ups | `includes/harvest.md` (run at a terminal step) → `/ca-task` (work) / `open-questions.md` (decision) | — | Batch-confirm interactive; SMARTS-logged auto under `/sprint`; dedup by `(from <origin>)`; a blocking decision escalates, never demoted |
 | Zero-onboarding dry-run of the reviewer fleet | `/ca-preview` (no skill; reuses `includes/review-matrix.md` to predict reviewers) | — | Read-only; writes nothing, stages nothing, `git status` unchanged; no `/ca-init` or `.codearbiter/` required; empty diff exits clean |
-| Manual drift audit of provenance-tracked docs (bypass / merge / external edit case) | `/ca-context-check` → `context-check` skill | — | Read-only unless user selects re-scout or re-baseline; MUST NOT commit on its own; not the daily loop — commit-gate auto-heal is the routine path |
-| Deep on-demand codebase audit | `/ca-tribunal` → `tribunal` skill | `tribunal-lens-reviewer` per active lens (+ optional `map-structure`/`map-deps` on large repos) | Read-only until the filing gate; runs only after the user acknowledges the token estimate; never blocks a merge/commit; nothing filed or sent without explicit authorization |
+| Manual drift audit of provenance-tracked docs (bypass / merge / external edit case) | `context-check` at `<plugin-root>/routines/context-check/SKILL.md` (explicit `/ca-status drift` or `/ca-context-check`) | — | Read-only unless user selects re-scout or re-baseline; MUST NOT commit on its own; not the daily loop — commit-gate auto-heal is the routine path |
+| Deep on-demand codebase audit | `tribunal` at `<plugin-root>/routines/tribunal/SKILL.md` (explicit `/ca-tribunal` retained) | `tribunal-lens-reviewer` per active lens (+ optional `map-structure`/`map-deps` on large repos) | Read-only until the filing gate; runs only after the user acknowledges the token estimate; never blocks a merge/commit; nothing filed or sent without explicit authorization |

package/plugins/ca-pi/includes/safety-core.md

@@ -31,7 +31,7 @@ Cite the level of any non-obvious tradeoff in the PR description.
   or a prompt — `pre-write.py` classifies by path, never content. In a gates-off mode this
   sentence is the only remaining protection.
 - MUST NOT write directly to the default branch or force-push. All changes via branch/PR.
-- MUST NOT author an ADR except via `/adr`, with user attribution.
+- MUST NOT author an ADR except via the authorized `/adr` workflow (`decision-lifecycle`), with user attribution.
 - MUST NOT silently reconcile a conflict — invoke `/conflict`.
 
 ---
@@ -47,7 +47,7 @@ skill/agent — a changed dependency manifest is reviewed before it is committed
 ## §6 — Irreversible actions
 
 ADR files under `.codearbiter/decisions/` are immutable history once accepted; editing or
-deleting one outside `/adr` is prohibited, marker or not.
+deleting one outside that authoring workflow is prohibited, marker or not.
 
 The irreversible-action set draws a confirmation even when intent is obvious, because the
 confirmation is the gate, not friction: merge to the default branch, branch or worktree

package/plugins/ca-pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.15.2",
+  "version": "0.15.3",
   "private": true,
   "license": "AGPL-3.0-only",
   "type": "module",

package/plugins/ca-pi/routines/INDEX.md

@@ -2,7 +2,9 @@
 
 Skill bodies load on routing only. This index is the surface scan; never bulk-read
 `skills/*/SKILL.md`. Each skill is an orchestrator routine with gated phases, routed to, never
-"triggered." Command-backed owners `commit-gate` and `skill-author` supply their
+"triggered." Command-backed owners `commit-gate`, `debug`, `refactor`, `tribunal`,
+`security-architecture`, `context-check`, `post-merge-cleanup`, and
+`finishing-a-development-branch` supply their
 complete public entries at build time. Claude keeps the owner discoverable and the
 command explicit-only; Codex/Pi expose the entry and keep the routine private. Read a needed owner directly or use the complete public body,
 not both merely to repeat the same procedure. This index lists what each skill OWNS; to decide WHERE a trigger routes, load
@@ -12,9 +14,9 @@ not both merely to repeat the same procedure. This index lists what each skill O
 |---|---|---|
 | [tdd](tdd/SKILL.md) | `/feature` (after spec approval), `/fix`, `/refactor` | The test-first gate: six phases — obligation scan → red → green → obligation verify → coverage → lint. No implementation before Phase 1; no path to `commit-gate` until all six gates are green. |
 | [commit-gate](commit-gate/SKILL.md) | `/commit` | The commit gate: nine phases — permission, branch, classification, impact-bounded local verification under the shared [verification boundary](../includes/verification-boundary.md), behavioral proof, diff review, selective stage, message, commit. No commit while an applicable check is red, the behavior unproven, or secrets/cruft present; exhaustive exact-head proof remains a hosted-CI merge gate. |
-| [decision-variance](decision-variance/SKILL.md) | `/reconcile` | SMARTS 6-lens arbitration of project/ADR conflicts; append-only, user-attributed decision log + audit trail. Never decides alone — every choice carries user attribution. |
-| [debug](debug/SKILL.md) | `/debug` | Investigate-then-decide root-cause analysis: five phases. Investigation only, no code change here; forces one named exit — `/fix`, `/adr`, or a no-action close. |
-| [refactor](refactor/SKILL.md) | `/refactor` | Behavior-preserving change behind a parity-coverage proof gate; routes to `tdd` Phase 1 only when new test seams are needed. |
+| [decision-variance](decision-variance/SKILL.md) | Architectural reconciliation or variance report; explicit `/reconcile` retained | One SMARTS arbitration owner; report-only is non-mutating. Analysis card loads on demand; only explicit user choices enter the append-only log. |
+| [debug](debug/SKILL.md) | Diagnosis intent or `/debug` | Investigate-then-decide root-cause analysis: five phases. Investigation only, no code change here; forces one named exit — `/fix`, `/adr`, or a no-action close. |
+| [refactor](refactor/SKILL.md) | Behavior-preserving restructure intent or `/refactor` | Behavior-preserving change behind a parity-coverage proof gate; routes to `tdd` Phase 1 for coverage backfill or new test seams. |
 | [context-creation](context-creation/SKILL.md) | `/create-context` (brownfield) | Back-fills `.codearbiter/` from existing source via parallel scouts; writes `CONTEXT.md` (`arbiter: enabled` + `stage:`) and locks it `<!--INITIALIZED-->`. |
 | [decompose](decompose/SKILL.md) | greenfield startup, `/decompose` | Six-layer senior-architect interview, compaction-resilient via per-layer disk drafts + DRAFT ADRs; populates `.codearbiter/` and locks it initialized. |
 | [brainstorming](brainstorming/SKILL.md) | `/feature` (front), `/sprint` planning | Caller-scoped feature or coherent sprint specification. Initial approval is user-owned; delegated choices require existing authority. Uses the selected artifact format, preserves recorded intent, and returns or forwards to the caller's required planning step before execution. |
@@ -22,14 +24,13 @@ not both merely to repeat the same procedure. This index lists what each skill O
 | [executing-plans](executing-plans/SKILL.md) | `/feature` | Attended coordinator: uses authored HTML checkpoint membership or bounded legacy batches, delegates to `subagent-driven-development`, and retains the user checkpoint. A display batch never changes an HTML acceptance scope; sprint does not inherit these pauses. |
 | [subagent-driven-development](subagent-driven-development/SKILL.md) | `/sprint` (engine), `executing-plans` (batch scope) | Fresh subagent per task → spec-compliance then quality review → fresh-run verification; accepts only on proof. A quality failure blocks acceptance; approved sprint recovery owns correction. Security CRITICAL and unresolved `[CONFIRM-NN]` remain stops. |
 | [dispatching-parallel-agents](dispatching-parallel-agents/SKILL.md) | `subagent-driven-development`, `/sprint`, parallel `/review` | Reusable fan-out primitive: bound concurrency, collect, dedupe, funnel through `finding-triage`→`verdict-aggregator`. Results unused until the read-only funnel runs. |
-| [finishing-a-development-branch](finishing-a-development-branch/SKILL.md) | `/feature`, `/sprint` (terminal) | The terminal step after `commit-gate`: open-PR / merge-via-PR / discard. No direct-to-main, no force-push; `/sprint` auto-selects open-PR and never merges. |
+| [finishing-a-development-branch](finishing-a-development-branch/SKILL.md) | PR intent or `/feature` / `/sprint` terminal handoff |Select watch/cleanup before creation preflight. Own PR opening after the current-head gates; sprint opens only. Merge/discard require explicit authority and their own proof. |
 | [using-git-worktrees](using-git-worktrees/SKILL.md) | `subagent-driven-development`, `dispatching-parallel-agents` (opt-in) | OPTIONAL per-unit filesystem isolation for parallel work; integrates accepted units back onto the caller's working branch for its single `commit-gate` + finish. Never the default path. |
 | [secret-handling](secret-handling/SKILL.md) | changed code reads/writes/passes a secret | The secret-source gate: identify → source → sinks/persistence. Secrets only from the approved store in `security-controls.md`; never in source, log, error, telemetry, image, or LLM prompt. Dispatches `auth-crypto-reviewer`. |
 | [crypto-compliance](crypto-compliance/SKILL.md) | changed code uses crypto/hashing/signing/TLS/random | The banned-primitive gate: one scan. Rejects broken primitives, disabled TLS verification, home-rolled crypto; approved list lives in `security-controls.md`. Dispatches `auth-crypto-reviewer`. |
-| [skill-author](skill-author/SKILL.md) | `/new-skill "<gap>"` | The only path to a new skill: five phases — gap evidence, scope, authoring, self-review against the v2 house style, routing integration. No skill written until the gap is proven uncovered; none shipped without gated phases, hard rules, and an `INDEX.md` + routing entry. |
-| [decision-lifecycle](decision-lifecycle/SKILL.md) | `/adr`, `/adr-status` | Lean ADR author + status: author a numbered, dated, user-attributed ADR under `.codearbiter/decisions/`; list/status; forward-only supersede chains. Optional `decision-challenger`. Log-entry format lives in `includes/smarts/decision-log-format.md`. ADRs only via `/adr`, with user attribution. |
+| [decision-lifecycle](decision-lifecycle/SKILL.md) | Record a decided ADR / inspect ADR health (`/adr`, `/adr-status`) | One owner; select read-only status before authoring prerequisites. User-attributed writing loads its reference on demand. Full-stem identity; Accepted/Planned is not delivery proof. |
 | [release](release/SKILL.md) | `/release` | Lean declared-policy release, three phases: derive the next identity from Conventional Commits under `version-policy` + roll the changelog; cut the annotated tag and qualify declared assets through either a protected hosted `release-build` or a provenance-bound retained exact-head CI cohort; publish that tag and only those assets on explicit authorization, then verify the remote inventory. SemVer remains the default. No tag on a red suite; no direct-to-main/force-push; nothing published unbidden; a release commit routes through `commit-gate`. |
-| [security-architecture](security-architecture/SKILL.md) | `/threat-model` (optional) | OPTIONAL lightweight STRIDE pass for sensitive features: attack surface → STRIDE → findings, governed by `security-controls.md`. MAY dispatch `security-reviewer` / `auth-crypto-reviewer`. Not a routine gate; hard-STOPs only on a critical unmitigated threat. |
-| [context-check](context-check/SKILL.md) | `/context-check` | OPTIONAL manual drift audit: load `.codearbiter/.provenance/` via `load_provenance_dir` + `compute_drift`, report stale docs, then per stale doc: re-scout / re-baseline (`rebaseline`) / defer. Not the daily loop — commit-gate auto-heal owns routine maintenance. |
-| [post-merge-cleanup](post-merge-cleanup/SKILL.md) | `/ca-cleanup` | The already-merged branch transition: fetch, prove `HEAD` is contained in the fetched default (SHA-ancestry, or a squash-merge proven by the merged PR record), classify every dirty/untracked artifact as unique/redundant/superseded, resolve each under its own confirmation, fast-forward the local default ref then `--ff-only` onto it, then `branch -d` the merged local branch. Unique or unclassifiable artifacts are never discarded unbidden; the remote branch is never touched; never routes to `/ca-override`. |
-| [tribunal](tribunal/SKILL.md) | `/ca-tribunal` | The deep, rarely-convened whole-codebase audit lane: seven gated phases across eleven specialist lenses, each finding persisted to its own file (plus append-only triage/run logs) under `.codearbiter/reports/<run-id>/`, resumable from disk, filing approved findings as GitHub issues; never a required gate. |
+| [security-architecture](security-architecture/SKILL.md) | Requested threat model or `/threat-model` |Read-only STRIDE analysis of a sensitive design. Lesser gaps remain constraints; critical unmitigated threats stop the pass. No ordinary-change auto-entry. |
+| [context-check](context-check/SKILL.md) | Drift-audit intent, `/status drift`, or `/context-check` |Report provenance drift; re-scout or re-baseline selected documents only. No staging or commits; routine auto-heal remains with commit-gate. |
+| [post-merge-cleanup](post-merge-cleanup/SKILL.md) | Merged-branch cleanup intent, `/ca-pr --cleanup`, or `/ca-cleanup` |Prove fetched containment, classify residue, confirm each discard, and transition fast-forward-only. Preserve unique work, stashes and remote branches. |
+| [tribunal](tribunal/SKILL.md) | Deliberate deep-audit intent or `/ca-tribunal` |Cost-approved deep audit with persisted findings and resumable triage. Separate approval for issue filing and telemetry; never a required gate. |