@arbiterforge/ca-pi 0.15.4 → 0.15.5

package/README.md

@@ -10,7 +10,7 @@ project context. You decide. codeArbiter enforces.
 <img alt="Claude Code plugin" src="https://img.shields.io/badge/Claude_Code-plugin-d97757">
 <img alt="Codex plugin" src="https://img.shields.io/badge/OpenAI_Codex-plugin-10a37f">
 <img alt="Pi Feature Forge preview" src="https://img.shields.io/badge/ca--pi-Feature_Forge_preview-d97757">
-<img alt="version 2.22.4" src="https://img.shields.io/badge/version-2.22.4-2b7489">
+<img alt="version 2.22.5" src="https://img.shields.io/badge/version-2.22.5-2b7489">
 <img alt="core lanes" src="https://img.shields.io/badge/core_lanes-18-555">
 <img alt="skills" src="https://img.shields.io/badge/skills-22-555">
 <img alt="agents" src="https://img.shields.io/badge/agents-20-555">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.15.4",
+  "version": "0.15.5",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/plugins/ca-pi/CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to `ca-pi` are documented in this file.
 
 ## [Unreleased]
 
+## [0.15.5] - 2026-09-26
+
+### Fixed
+
+- Explain input-manifest entry kinds to independent reviewers so normative artifact
+  identities are not compared with raw HTML hashes.
+
 ## [0.15.4] - 2026-09-26
 
 ### Fixed

package/plugins/ca-pi/hooks/_artifactauthoritylib.py

@@ -1117,6 +1117,16 @@ def _dispatch_prompt(request: dict[str, Any], *, legacy_inline: bool = False) ->
             "The adapter verifies its exact digest before launch and publication. Inspect its "
             "activity, subject, input_sha256, task definitions and criterion coverage against "
             "these bindings, then inspect the input manifest and referenced target files. "
+            "Use the installed structured-artifact engine's snapshot operation for the frozen "
+            "plan and compare its returned sha256 with input_sha256; that binds the complete "
+            "frozen input_manifest. "
+            "For kind=bytes, sha256 hashes raw file bytes; also check executable. For "
+            "kind=directory, members lists names included under the frozen roots, "
+            "exclude_directories and validated engine output policy, not an unfiltered "
+            "filesystem listing. For kind=artifact_normative, "
+            "sha256 is the normative_sha256 returned by the installed identity operation "
+            "for that artifact, not a digest of raw rendered HTML. Do not parse rendered "
+            "HTML to reconstruct artifact authority. "
             "Do not pass if the evidence is missing, unreadable or inconsistent. The locator "
             "is a reference to the complete immutable evidence, not replacement authority.\n"
         )

package/plugins/ca-pi/hooks/_host.py

@@ -11,7 +11,7 @@ import hostapi  # noqa: E402
 class PiHost(hostapi.Host):
     name = "pi"
     adapter_name = "@arbiterforge/ca-pi"
-    adapter_version = "0.15.4"
+    adapter_version = "0.15.5"
     update_target = "ca-pi"
     update_tag_prefix = "ca-pi-v"
     update_command = "pi update npm:@arbiterforge/ca-pi"

package/plugins/ca-pi/hooks/hostapi.py

@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "2.22.4"
+    adapter_version = "2.22.5"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,

package/plugins/ca-pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.15.4",
+  "version": "0.15.5",
   "private": true,
   "license": "AGPL-3.0-only",
   "type": "module",