@arbiterforge/ca-pi 0.15.8 → 0.15.12

package/plugins/ca-pi/hooks/_artifactlib.py

@@ -1,8 +1,8 @@
 #!/usr/bin/env python3
 """Bounded stdlib bridge to an installation-pinned ca-artifact executable.
 
-No imports perform I/O. No PATH search, environment-selected executable, schema
-parser duplication, command execution from a document, or new host registration.
+No imports perform I/O. No native-binary PATH search, environment-selected
+engine, schema parser duplication, document command execution, or host registration.
 The caller supplies a trusted installation directory, never a repository setting.
 """
 from __future__ import annotations
@@ -742,10 +742,83 @@ def _preflight_current_acceptance(
     }
 
 
-def _bounded_child(argv: list[str], request: bytes, fd: int, timeout: float) -> tuple[int, bytes, bytes]:
+def _native_git_excludes(git: Path, root: Path) -> dict[str, str]:
+    """Resolve only the governed root's ignore policy with the producer's Git.
+
+    Git expands the explicit setting or its documented XDG/home default. No
+    general configuration or host environment crosses the native boundary.
+    Mapped roots with different policies still must pass exact closure equality.
+    """
+    from _gitexec import root_bound_git_env
+
+    default = os.environ.get("XDG_CONFIG_HOME")
+    default = str(Path(default) / "git" / "ignore") if default else "~/.config/git/ignore"
+    environment = root_bound_git_env()
+    environment.pop("GIT_CONFIG", None)  # git-config-only override; inventory commands ignore it.
+    try:
+        code, raw, _ = _bounded_child(
+            [str(git), "--no-lazy-fetch", "--no-optional-locks", "-C", str(root),
+             "-c", "core.fsmonitor=false", "-c", "protocol.allow=never", "config",
+             "--null", "--path", "--default", default, "--get", "core.excludesFile"],
+            b"", None, 5, environment=environment, cwd=root)
+        if code != 0 or not raw.endswith(b"\0") or b"\0" in raw[:-1] or len(raw) > 4096:
+            return {}
+        value = raw[:-1].decode("utf-8", "strict")
+        if not value:
+            return {}
+        path = Path(value)
+        path = (path if path.is_absolute() else root / path).resolve()
+    except (ArtifactError, OSError, RuntimeError, UnicodeError, ValueError):
+        return {}
+    return {"GIT_CONFIG_COUNT": "1", "GIT_CONFIG_KEY_0": "core.excludesFile",
+            "GIT_CONFIG_VALUE_0": str(path)}
+
+
+def _native_child_environment(argv: list[str]) -> dict[str, str]:
+    """Transport one host Git identity for fixed native workspace probes only.
+
+    CODEARBITER_GIT_EXECUTABLE is the shared _gitexec host override. Resolve the
+    ordinary host PATH in this bridge, excluding CWD/relative entries and the
+    governed checkout; the native engine receives only that identity and the
+    resolved core.excludesFile setting, never PATH or general ambient state.
+    Cold ordinary operations remain usable when no safe Git is available.
+    """
+    try:
+        root = Path(argv[argv.index("--root") + 1]).resolve(strict=True)
+        boundaries = [root, *(parent for parent in root.parents if (parent / ".git").exists())]
+    except (ValueError, IndexError, OSError):
+        return {}
+    configured = os.environ.get("CODEARBITER_GIT_EXECUTABLE")
+    if configured:
+        candidates = [Path(configured)]
+    else:
+        name = "git.exe" if os.name == "nt" else "git"
+        candidates = [Path(directory) / name for directory in os.environ.get("PATH", "").split(os.pathsep)
+                      if directory and Path(directory).is_absolute()]
+    for candidate in candidates:
+        try:
+            if not candidate.is_absolute() or any(candidate.is_relative_to(boundary) for boundary in boundaries):
+                continue
+            resolved = candidate.resolve(strict=True)
+            if (any(resolved.is_relative_to(boundary) for boundary in boundaries)
+                    or not stat.S_ISREG(resolved.stat().st_mode) or not os.access(resolved, os.X_OK)):
+                continue
+        except (OSError, RuntimeError):
+            continue
+        return {"CODEARBITER_GIT_EXECUTABLE": str(resolved),
+                **_native_git_excludes(resolved, root)}
+    return {}
+
+
+def _bounded_child(argv: list[str], request: bytes, fd: int | None, timeout: float,
+                   *, environment: dict[str, str] | None = None,
+                   cwd: Path | None = None) -> tuple[int, bytes, bytes]:
     options = dict(stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
-                   close_fds=True, start_new_session=True, env={})
-    if os.name != "nt":
+                   close_fds=True, start_new_session=True,
+                   env=_native_child_environment(argv) if environment is None else environment)
+    if cwd is not None:
+        options["cwd"] = cwd
+    if os.name != "nt" and fd is not None:
         options["pass_fds"] = (fd,)
     process = subprocess.Popen(argv, **options)
     buffers = [bytearray(), bytearray()]

package/plugins/ca-pi/hooks/_bashguardlib.py

@@ -83,8 +83,8 @@ import sys
 from _hooklib import (
     ADR_LIFECYCLE_LOG_BASENAME, AUDIT_LOG_BASENAMES, AUDIT_LOG_FLAT_BASENAMES,
     AUDIT_LOG_NAMES, CRYPTO_RE, DECISION_AUDIT_LOG_NAMES, DECISION_LOG_BASENAME, DECISIONS_DIR_RE,
-    GATE_MARKER_NAMES, MARKER_FRESHNESS_MINUTES, SECRET_RE, SECURITY_DIFF_GIT_ARGS, block,
-    content_digest, is_migration_path, line_digest, marker_fresh, security_scan_diff,
+    GATE_MARKER_NAMES, SECRET_RE, SECURITY_DIFF_GIT_ARGS, block,
+    content_digest, is_migration_path, line_digest, security_scan_diff,
 )
 from _gitexec import git_executable
 import _gitlib  # reused for its spawn-free, worktree-aware (.git-as-a-FILE /
@@ -1508,11 +1508,12 @@ def _check_h09b_h10b_crypto_secret(commit, add, cwd, root):
     """H-09b / H-10b: BLOCK a commit that introduces crypto/secret changes without
     a recorded security-gate pass. The crypto-compliance / secret-handling skills
     record the pass via hooks/security-pass.py — a marker holding the digest of
-    every sensitive line the gate approved. Two checks, both required:
-    freshness (< 30 min) AND coverage (every sensitive line being committed is
-    in the approved set). Coverage is what closes the TOCTOU window: a pass
-    minted for one diff can no longer launder a different diff committed inside
-    the freshness window. Scans the staged diff, plus the worktree diff when
+    every sensitive line the gate approved. Two checks, both required: a pass
+    is recorded AND it covers every sensitive line being committed. Coverage is
+    by line digest with no time window (as H-14 binds migrations by content): a
+    pass stays valid for exactly the lines it reviewed, and any new or changed
+    sensitive line is uncovered and blocks, so a pass for one diff can never
+    launder a different one. Scans the staged diff, plus the worktree diff when
     the commit uses -a/--all or the same command stages files."""
     if not commit:
         return
@@ -1541,7 +1542,7 @@ def _check_h09b_h10b_crypto_secret(commit, add, cwd, root):
         tag = "H-09b" if touches_crypto else "H-10b"
         skill = "crypto-compliance" if touches_crypto else "secret-handling"
         marker = os.path.join(_marker_root(root), ".codearbiter", ".markers", "security-gate-passed")
-        if not marker_fresh(marker, MARKER_FRESHNESS_MINUTES):
+        if not os.path.isfile(marker):
             block(tag, f"This commit introduces {kind} changes, but no security-gate pass is "
                        f"recorded (.codearbiter/.markers/security-gate-passed). Run the "
                        f"{skill} gate (it records the pass), then commit. To bypass a "

package/plugins/ca-pi/hooks/_hooklib.py

@@ -46,7 +46,7 @@
 #                                         own checkout — the root gate MARKERS
 #                                         (.codearbiter/.markers/) live under (#604)
 #   repo_rel(fpath, root) -> str         repo-relative POSIX path, or "" if outside root
-#   line_digest(line) -> str             sha256 hex of one diff line (H-09b/H-10b gate)
+#   line_digest(line, path=None) -> str  path-bound sha256 of one diff line (H-09b/H-10b gate)
 #   content_digest(text) -> str          sha256 hex of a whole file's content (H-14 gate)
 #   migration_globs(root) -> tuple[list, list]   (includes, excludes) for migration detection
 #   scope_globs(root, defaults, decl_re) -> tuple[list, list]   generic glob scope resolver

package/plugins/ca-pi/hooks/_host.py

@@ -11,7 +11,7 @@ import hostapi  # noqa: E402
 class PiHost(hostapi.Host):
     name = "pi"
     adapter_name = "@arbiterforge/ca-pi"
-    adapter_version = "0.15.8"
+    adapter_version = "0.15.12"
     update_target = "ca-pi"
     update_tag_prefix = "ca-pi-v"
     update_command = "pi update npm:@arbiterforge/ca-pi"

package/plugins/ca-pi/hooks/_sensitivelib.py

@@ -281,7 +281,7 @@ def sensitive_scan_added_lines(diff_text):
 # bindings use a separate marker namespace; a user-authored source string or
 # an old line-only approval cannot impersonate one of these records.
 # SecurityScan(crypto, digests): classification and exact approval identities.
-# security_scan_lines(lines) -> SecurityScan|None: line-bound scan or refusal.
+# security_scan_lines(lines, path=None) -> SecurityScan|None: line-bound scan or refusal.
 # security_scan_source(path, source, added_rows) -> SecurityScan|None.
 # security_scan_diff(text) -> SecurityScan|None: None means untrusted context.
 SecurityScan = namedtuple("SecurityScan", "crypto digests")
@@ -320,20 +320,23 @@ def _cross_line_crypto_spans(lines):
     return spans
 
 
-def _scan_bound_lines(lines, contextual_bindings):
+def _scan_bound_lines(lines, contextual_bindings, path=None):
     """Each cross-line match needs its own recognized contextual identity."""
     spans = _cross_line_crypto_spans(lines)
     if not spans <= contextual_bindings.keys():
         return None
     return SecurityScan(bool(spans) or any(CRYPTO_RE.search(line) for line in lines), {
-        line_digest(line) for line in lines
+        line_digest(line, path) for line in lines
         if CRYPTO_RE.search(line) or SECRET_RE.search(line)
     } | set(contextual_bindings.values()))
 
 
-def security_scan_lines(lines):
-    """Preserve same-line bindings; refuse crypto spanning unbound lines."""
-    return _scan_bound_lines(lines, {})
+def security_scan_lines(lines, path=None):
+    """Preserve same-line bindings; refuse crypto spanning unbound lines.
+
+    `path` binds each approval to the file the line lives in, so a reviewed
+    line cannot be admitted again after moving to a different file."""
+    return _scan_bound_lines(lines, {}, path)
 
 
 def security_scan_source(path, source, added_rows):
@@ -348,7 +351,7 @@ def security_scan_source(path, source, added_rows):
     if any(row < 1 or row > len(lines) for row in added_rows):
         return None
     added = [lines[row - 1] for row in added_rows]
-    result = security_scan_lines(added)
+    result = security_scan_lines(added, path)
     candidates = {row for row in added_rows
                   if _is_context_item_line(lines[row - 1])}
     if not candidates:
@@ -405,7 +408,7 @@ def security_scan_source(path, source, added_rows):
     bindings = {(positions[first[0]], first[1], positions[last[0]], last[1]): contexts[last[0]]
                 for first, last in import_spans
                 if first[0] in positions and last[0] in positions}
-    result = _scan_bound_lines(added, bindings)
+    result = _scan_bound_lines(added, bindings, path)
     if result is None:
         return None
     return SecurityScan(result.crypto or bool(contexts), result.digests | set(contexts.values()))
@@ -484,7 +487,9 @@ def security_scan_diff(diff_text):
         # in the legacy permissive walker before context validation even runs.
         if not any(line.startswith("+") and _is_context_item_line(line[1:])
                    for line in section):
-            contextual = security_scan_lines(added)
+            # One file per section: bind its approvals to that file's path.
+            paths = {path for path, _ in attributed if path}
+            contextual = security_scan_lines(added, paths.pop() if len(paths) == 1 else None)
         else:
             if not section[0].startswith("diff --git "):
                 return None
@@ -508,14 +513,23 @@ def security_scan_diff(diff_text):
     return result
 
 
-def line_digest(line):
+def line_digest(line, path=None):
     """Digest of one added diff line, for the security-gate binding
     (H-09b/H-10b). The gate-pass marker stores these digests instead of being
     an empty `touch`d file, so a recorded pass admits only the exact sensitive
-    lines it reviewed — not whatever lands in the next 30 minutes. Trailing
-    whitespace is stripped so CRLF translation between worktree and index
-    never breaks the match."""
-    return hashlib.sha256(line.rstrip().encode("utf-8", "replace")).hexdigest()
+    lines it reviewed. A pass has no time window, so the digest also binds the
+    repository-relative `path` the line was reviewed in: the identical line in
+    a different file is a different digest and needs its own review. Without
+    a path (an unattributable diff section) both the recording and the
+    checking side fall back to the line alone. Trailing whitespace is
+    stripped so CRLF translation between worktree and index never breaks the
+    match."""
+    text = line.rstrip()
+    if path is None:
+        return hashlib.sha256(text.encode("utf-8", "replace")).hexdigest()
+    return "path-v1:" + hashlib.sha256(json.dumps(
+        [path, text], separators=(",", ":"), ensure_ascii=False
+    ).encode("utf-8", "replace")).hexdigest()
 
 
 def content_digest(text):

package/plugins/ca-pi/hooks/artifact-authority-hook.py

@@ -64,6 +64,7 @@ def claude_main() -> int:
             _artifactauthoritylib.observe_verifier_hook(root, payload, host="claude")
         elif (
             (event in {"PreToolUse", "PostToolUse"} and tool == "Agent")
+            or (event == "PostToolUse" and tool == _artifactauthoritylib.CLAUDE_HANDBACK_TOOL)
             or (event == "PreToolUse" and tool == "SendMessage")
             or event in {"SubagentStart", "SubagentStop"}
         ):

package/plugins/ca-pi/hooks/artifact-authority.py

@@ -38,6 +38,10 @@ def main(argv=None) -> int:
         choices=("verification", "spec_review", "quality_review"),
     )
     arm.add_argument("--workspace", action="append", default=[], metavar="LABEL=PATH")
+    arm.add_argument("--completion-receipt", action="append", metavar="RECEIPT_REF",
+                     help="exact published verification receipt selected for completion review; repeat per task")
+    arm.add_argument("--supporting-file", action="append", metavar="ABSOLUTE_PATH",
+                     help="explicit bounded regular file retained as completion review data")
     arm.add_argument(
         "--host", choices=sorted(_artifactauthoritylib.HOSTS), default=None,
         help="observing host; defaults to the host this package was built for",
@@ -83,6 +87,7 @@ def main(argv=None) -> int:
             workspace_roots=workspaces or None, host=host,
             reviewer_model=args.reviewer_model,
             codex_review_profile=args.codex_review_profile,
+            completion_receipts=args.completion_receipt, supporting_files=args.supporting_file,
         )
         if host == "claude" and args.activity == "verification":
             # The Claude verifier hook pins this exact shipped script and

package/plugins/ca-pi/hooks/git-enforce.py

@@ -11,7 +11,7 @@
 #
 # It mirrors pre-bash.py's commit/push gates and reuses the SAME detection
 # primitives from _hooklib (CRYPTO_RE / SECRET_RE / line_digest / content_digest
-# / is_migration_path / marker_fresh / sensitive_scan_added_lines), so the two
+# / is_migration_path / sensitive_scan_added_lines), so the two
 # enforcement points can never drift on what counts as sensitive or as a
 # migration, on how a gate-pass marker binds to the lines it approved, or on
 # which path (gate-events.log, #279) is exempt from the sensitive-line scan.
@@ -30,9 +30,9 @@ import hostapi  # noqa: E402 — host seam (ADR-0011)
 import _entrylib  # noqa: E402 — shared run() dispatch (jscpd dedup)
 from _gitexec import git_executable  # noqa: E402
 from _hooklib import (  # noqa: E402
-    CRYPTO_RE, MARKER_FRESHNESS_MINUTES, SECRET_RE, SECURITY_DIFF_GIT_ARGS,
+    CRYPTO_RE, SECRET_RE, SECURITY_DIFF_GIT_ARGS,
     arbiter_active, content_digest, is_migration_path, line_digest,
-    marker_fresh, security_scan_diff, set_host, utf8_stdio,
+    security_scan_diff, set_host, utf8_stdio,
 )
 
 
@@ -223,8 +223,9 @@ def pre_commit(root):
         block("H-01", f"Direct commit to {target} is prohibited (ORCHESTRATOR §3) — this is "
                       f"the git-level backstop (#161). Create a feature branch.")
 
-    # H-09b / H-10b: a commit introducing crypto/secret changes needs a fresh,
-    # line-covering security-gate pass. Reuses the exact _hooklib primitives.
+    # H-09b / H-10b: a commit introducing crypto/secret changes needs a recorded,
+    # line-covering security-gate pass (bound by line digest, no time window).
+    # Reuses the exact _hooklib primitives.
     added = cached_added_lines(cwd)
     if added is None:
         block("H-09b", "the staged diff for the crypto/secret scan could not be read — "
@@ -237,7 +238,7 @@ def pre_commit(root):
         skill = "crypto-compliance" if touches_crypto else "secret-handling"
         marker_root = _marker_root(root)
         marker = os.path.join(marker_root, ".codearbiter", ".markers", "security-gate-passed")
-        if not marker_fresh(marker, MARKER_FRESHNESS_MINUTES):
+        if not os.path.isfile(marker):
             block(tag, f"This commit introduces {kind} changes, but no security-gate pass is "
                        f"recorded (#161 git backstop). Run the {skill} gate, then commit.")
         approved = _marker_set(marker_root, "security-gate-passed")

package/plugins/ca-pi/hooks/hostapi.py

@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "2.23.1"
+    adapter_version = "2.23.4"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,

package/plugins/ca-pi/includes/artifacts.md

@@ -262,13 +262,27 @@ the filename, not a leaf-name alias. Named unittest commands require `-v` or
 Plain exit checks cannot attest named tests.
 
 Named npm commands support inspectable single-runner scripts, a contained
-repository-relative `--prefix`, and arguments forwarded after `--`. Compound
+repository-relative `--prefix`, and arguments forwarded after `--`. A root script
+may delegate once through `npm -w <name> run <script>` or
+`npm --workspace <name> run <script>` when the name resolves uniquely in an array
+of at most 32 explicit, contained workspace directories. The runner binds the root
+manifest and every inspected workspace manifest. Globs, linked directories,
+multiple workspace selectors and recursive npm delegation are unsupported.
+Workspace delegation uses the declared cwd; a non-dot `--prefix` is unsupported
+for this shape.
+Preserve both npm argument boundaries when adding a reporter: for a root
+`test:client` script containing `npm -w @example/client run test`, declare
+`npm run test:client -- -- --reporter=verbose` to forward the reporter to Vitest.
+The original root command still executes the full script. Compound
 scripts and pre/post lifecycle scripts require separately declared direct-runner
 commands; retain every check from the original suite when splitting commands.
 On Windows, only the qualified standard `npm.cmd` layout is adapted: the runner
 pins the wrapper, sibling `node.exe`, sibling `node_modules/npm/bin/npm-cli.js`,
 and script manifest. It deliberately selects that sibling CLI rather than the
 shim's optional global-prefix redirection. Unknown batch wrappers fail closed.
+For workspace delegation, it also pins `npm-prefix.js` and checks that the nested
+wrapper uses the same CLI, the default script shell, and no configured Node
+options. Local executables shadowing nested npm are rejected.
 Direct Node script entrypoints are also pinned. These launch-file bindings do
 not establish transitive dependency closure for deliberately excluded inputs.
 
@@ -287,6 +301,47 @@ rewrite the returned envelope yourself.
 The host hooks bind the exact launch call, child start and
 the child's first stop; a pasted or coordinator-authored decision is not review
 authority.
+
+When reviewing completed work that relies on a verification run, linked
+worktrees or supporting evidence, explicitly select the completion path. Add
+`--completion-receipt <exact-published-receipt>` once per task and
+`--supporting-file <absolute-regular-file>` for each supporting document to the
+review `arm` command. A task review selects one verification receipt; a scope
+review selects the exact receipt for every member. Supporting files require a
+receipt selection. The existing review-before-verification path remains
+available; it does not satisfy an explicitly requested completion review.
+
+The native engine validates the selected published verification chain and
+derives the worktree mappings from its qualified observation. It retains the
+selected identities, worktree closure and supporting bytes in the immutable
+context. Supporting material is data for review, not authority. Selection is
+explicit: no newest-receipt search, directory import or attachment execution.
+At most 16 regular files are admitted, each at most 64 KiB and together at most
+256 KiB; links, reparse indirection, duplicate paths and changed content fail
+closed. Read canonical spec and plan artifacts through the native artifact API;
+they cannot be imported as supporting files. The generated prompt directs the reviewer to assess performed work
+against each criterion, step and `done_when` obligation, using selected evidence
+and source references. A consistent plan or an empty diff is insufficient.
+
+Use the returned `completion_sha256` in the native `task-review` or
+`accept-scope` request. The completed review and its exact verification run must
+agree; a definition-only review or a different successful run is rejected.
+The recorded task selection remains required by downstream freshness and scope
+acceptance. Scope review uses validated task completion bindings. If verification
+is rerun, obtain and record its completed task review before selecting that run
+for scope review; do not infer equivalence between receipts.
+
+Creating the first completion context recomputes the current raw worktree
+fingerprint and requires it to match the selected verifier's recorded fingerprint.
+Later freshness checks allow native task-status and execution bookkeeping updates
+in validated canonical artifacts while retaining their normative content hashes.
+Changes to task definitions, other HTML or other governance files still affect
+freshness under the normal snapshot policy. The closure covers
+tracked working-tree bytes and non-ignored untracked files, not ignored
+dependencies or outputs. The completion assessment is still an independent
+reviewer's judgment; schema validation does not prove that every file was read
+or every conclusion is correct. Preserve the unchanged launch envelope and
+genuine host capture throughout this path.
 Publish the completed request through the same `publish` command. `task-review`
 records the separate verification and spec-review receipts. After every task in
 the scope reaches `REVIEW`, reverify against one current source snapshot, run the

package/plugins/ca-pi/includes/pi-host-notes.md

@@ -74,7 +74,7 @@ file maps those actions to Pi's extension API.
   operator-launched Pi CLI, imported module, package root, and reported version.
   It does not prove publisher authenticity. Verify the source separately with
   `pi list` and `pi config`.
-- The supported promotion target is exact Pi 0.84.1. The package is
+- The supported promotion target is exact Pi 1.0.0. The package is
   published as `npm:@arbiterforge/ca-pi` on every `ca-pi-v*` tag (ADR-0029);
   the pinned Git tag remains the reproducible install. A Pi-native embedded
   farm worker is a future spike, not an installed dependency.

package/plugins/ca-pi/includes/security-gate-record.md

@@ -14,9 +14,11 @@ code instead of the first's (#577) — then run:
 
 It writes `<project-root>/.codearbiter/.markers/security-gate-passed` containing a digest of
 every sensitive added line it approved. The PreToolUse commit hook (**H-09b** for crypto/TLS, **H-10b**
-for secrets) blocks any commit whose staged diff touches a guarded pattern until this marker is fresh
-(< 30 min) AND covers every sensitive line being committed — a pass recorded for one diff cannot
-launder a later, different change through the freshness window.
+for secrets) blocks any commit whose staged diff touches a guarded pattern until this marker exists
+AND covers every sensitive line being committed. There is no time window: a pass stays valid for
+exactly the lines it reviewed, in the files it reviewed them in. Any new or changed sensitive line,
+or a reviewed line moved to another file, is uncovered and blocks, so a pass recorded for one diff
+cannot launder a later, different change.
 
 On any BLOCK, do **not** record the pass — the commit stays blocked until the finding is resolved and
 the gate genuinely passes. A premature or unconditional recording defeats the gate.

package/plugins/ca-pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.15.8",
+  "version": "0.15.12",
   "private": true,
   "license": "AGPL-3.0-only",
   "type": "module",

package/plugins/ca-pi/skills/ca-doctor/SKILL.md

@@ -32,7 +32,7 @@ repository binary, mutate an artifact, or silently fall back to Markdown.
    Pi bash wrapper. The exact shared-core `[H-03]` block is healthy and cannot stage files; execution
    or a different block is unhealthy. This self-test does not traverse Pi's active dispatcher. Do not
    rerun or respell it.
-4. Its `active-dispatch` row remains degraded because supported Pi 0.84.1 public extension
+4. Its `active-dispatch` row remains degraded because supported Pi 1.0.0 public extension
    APIs cannot submit that deterministic call through the active dispatcher. PI-AC-28 remains blocked
    until supported-version real-host promotion/CI evidence closes the gap.
 5. Resolve Python once, run `<plugin-root>/hooks/doctor.py`, and present its mechanical report