@arbiterforge/ca-pi 0.16.5 → 0.16.6

package/README.md

@@ -10,7 +10,7 @@ and durable project context. You decide. codeArbiter enforces.
 <img alt="Claude Code plugin" src="https://img.shields.io/badge/Claude_Code-plugin-d97757">
 <img alt="Codex plugin" src="https://img.shields.io/badge/OpenAI_Codex-plugin-10a37f">
 <img alt="Pi Feature Forge preview" src="https://img.shields.io/badge/ca--pi-Feature_Forge_preview-d97757">
-<img alt="version 2.24.4" src="https://img.shields.io/badge/version-2.24.4-2b7489">
+<img alt="version 2.24.5" src="https://img.shields.io/badge/version-2.24.5-2b7489">
 <img alt="core lanes" src="https://img.shields.io/badge/core_lanes-18-555">
 <img alt="skills" src="https://img.shields.io/badge/skills-22-555">
 <img alt="agents" src="https://img.shields.io/badge/agents-20-555">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.16.5",
+  "version": "0.16.6",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/plugins/ca-pi/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to `ca-pi` are documented in this file.
 
 ## [Unreleased]
 
+## [0.16.6] - 2026-10-05
+
+### Fixed
+
+- Publish a review whose reply contains non-ASCII text (an em dash, accented or emoji
+  characters). The authority adapter hashed the observation payload and producer
+  result as ASCII-escaped JSON while the engine hashes raw UTF-8, so such a review
+  failed with `OBSERVATION_UNVERIFIED`. Observation digests now use the engine's
+  canonical form.
+
 ## [0.16.5] - 2026-10-05
 
 ### Changed

package/plugins/ca-pi/helpers/artifacts/release.json

@@ -37,11 +37,11 @@
   },
   "context_qualification": {
     "darwin/amd64": {
-      "source_commit": "cd5b0a0e21ddbc97183c079106ce6418bc1cf7b1",
+      "source_commit": "49aed5b5c4f78d3e8fcf359c2b9e43472068ebb1",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37284472605",
+      "run_id": "37623035385",
       "binary_sha256": "5670d20116a3c846f539b82e8db49a68509016c3dda4a147126c0d85e63e484a",
-      "observation_sha256": "d417fcff8ea37dbed3719ceafc0fe188f15a07aeacf8cb317bc13c46e5951b14",
+      "observation_sha256": "2329112713771cc95c19bad6b0350b0a37eeebf067ab2d9c14fa6c03c2f3121b",
       "module_sha256": "f4b15732c8d1066be412718753670f3aeedc9ac668447919bb903db2eedace10",
       "native_cases": [
         "TestContextBoundedRender",
@@ -53,11 +53,11 @@
       ]
     },
     "darwin/arm64": {
-      "source_commit": "cd5b0a0e21ddbc97183c079106ce6418bc1cf7b1",
+      "source_commit": "49aed5b5c4f78d3e8fcf359c2b9e43472068ebb1",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37284472605",
+      "run_id": "37623035385",
       "binary_sha256": "dbc911004289993da4d720113906baba12f1afa510894f850a042869c9af918b",
-      "observation_sha256": "cd69f360e69729fbb4165cce3f53772bed227b42780584373cb8fff1f63f73ad",
+      "observation_sha256": "1bb537709ab07417e7d0a1c61527d426bf9e583db7ea939523e88c9e2b7cc97d",
       "module_sha256": "f4b15732c8d1066be412718753670f3aeedc9ac668447919bb903db2eedace10",
       "native_cases": [
         "TestContextBoundedRender",
@@ -69,11 +69,11 @@
       ]
     },
     "linux/amd64": {
-      "source_commit": "cd5b0a0e21ddbc97183c079106ce6418bc1cf7b1",
+      "source_commit": "49aed5b5c4f78d3e8fcf359c2b9e43472068ebb1",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37284472605",
+      "run_id": "37623035385",
       "binary_sha256": "9e13efce9499ea895a60fe7461a6234e258ac1ad836f1e9272cce7dfc88bb0d4",
-      "observation_sha256": "fa83068cfee6f8c8d2bb6b675c2e3e65b223301718cc7265468d8a46d120aa1d",
+      "observation_sha256": "6f295c8569f441a8bdfc02492b2962f182be62561d6911be7e5819c114aa7a78",
       "module_sha256": "f4b15732c8d1066be412718753670f3aeedc9ac668447919bb903db2eedace10",
       "native_cases": [
         "TestContextBoundedRender",
@@ -85,11 +85,11 @@
       ]
     },
     "linux/arm64": {
-      "source_commit": "cd5b0a0e21ddbc97183c079106ce6418bc1cf7b1",
+      "source_commit": "49aed5b5c4f78d3e8fcf359c2b9e43472068ebb1",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37284472605",
+      "run_id": "37623035385",
       "binary_sha256": "e527ac09363a15c2c70cfe92b1a051ee645c3ce528cafccdfc5349e16bcf34e8",
-      "observation_sha256": "324ee82fdcb905b75d6b47fd86e26c2fd38f2be40f3f10dbd77aa774034ef8a0",
+      "observation_sha256": "7b0b251ac87d6ae31c1d9fe6622f6f316474ccde2ebbce153e380e296cb02097",
       "module_sha256": "f4b15732c8d1066be412718753670f3aeedc9ac668447919bb903db2eedace10",
       "native_cases": [
         "TestContextBoundedRender",
@@ -101,11 +101,11 @@
       ]
     },
     "windows/amd64": {
-      "source_commit": "cd5b0a0e21ddbc97183c079106ce6418bc1cf7b1",
+      "source_commit": "49aed5b5c4f78d3e8fcf359c2b9e43472068ebb1",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37284472605",
+      "run_id": "37623035385",
       "binary_sha256": "c545c16d9aad8968e6616a5749500ee56e7907bab97fc9aefa7e02204162e2cb",
-      "observation_sha256": "00d758222e539a54708ca7fbfda23f17d5e4e4d4ea15503a8b5e19af84a49828",
+      "observation_sha256": "531460c5014621590d9e5afd3c455cb66c88e5d32a137b8c8c92559c29a8523e",
       "module_sha256": "f4b15732c8d1066be412718753670f3aeedc9ac668447919bb903db2eedace10",
       "native_cases": [
         "TestContextBoundedRender",
@@ -117,11 +117,11 @@
       ]
     },
     "windows/arm64": {
-      "source_commit": "cd5b0a0e21ddbc97183c079106ce6418bc1cf7b1",
+      "source_commit": "49aed5b5c4f78d3e8fcf359c2b9e43472068ebb1",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37284472605",
+      "run_id": "37623035385",
       "binary_sha256": "0bc2c45ab2eff641ae2f493016f2a0828d2757c9670be645b2c7366d3a86c9f3",
-      "observation_sha256": "53a83992644fc0223e9c1acf66c8611fe4647a5f93d3b5014b209f37c782e99b",
+      "observation_sha256": "020ff24e68e25f62d65151c8d476a3abb8a2aba5bb01fc0558e526c777461bf3",
       "module_sha256": "f4b15732c8d1066be412718753670f3aeedc9ac668447919bb903db2eedace10",
       "native_cases": [
         "TestContextBoundedRender",

package/plugins/ca-pi/hooks/_artifactauthoritylib.py

@@ -141,7 +141,7 @@ def _canonical(value: Any) -> bytes:
         raise AuthorityError("INVALID_AUTHORITY_STATE", "state is not finite JSON") from exc
 
 
-def _native_context_canonical(value: Any) -> bytes:
+def _native_context_canonical(value: Any, code: str = "INVALID_EVIDENCE_CONTEXT") -> bytes:
     """Match the artifact engine's safe-integer, UTF-16-key-order JSON bytes."""
     def ordered(item: Any, depth: int) -> Any:
         if depth > 64:
@@ -172,7 +172,13 @@ def _native_context_canonical(value: Any) -> bytes:
             raise ValueError("context exceeds native byte limit")
         return raw
     except (TypeError, ValueError, UnicodeError, RecursionError) as exc:
-        raise AuthorityError("INVALID_EVIDENCE_CONTEXT", "context is outside native canonical JSON") from exc
+        raise AuthorityError(code, "value is outside native canonical JSON") from exc
+
+
+def _engine_digest(value: Any) -> str:
+    """Digest a value exactly as the engine's canonical.Hash does: raw UTF-8,
+    never ASCII-escaped, so non-ASCII text binds to the same digest."""
+    return _digest(_native_context_canonical(value, "INVALID_AUTHORITY_STATE"))
 
 
 def _digest(data: bytes) -> str:
@@ -2106,11 +2112,11 @@ def _closed_observation(
         "subject": request["context"]["subject"],
         "context_ref": request["context_ref"],
         "context_sha256": request["context_sha256"],
-        "payload_sha256": _digest(_canonical(payload)),
+        "payload_sha256": _engine_digest(payload),
         "producer_profile": producer_profile,
         "producer_run_id": producer_run_id,
         "producer_result": producer_result,
-        "producer_result_sha256": _digest(_canonical(producer_result)),
+        "producer_result_sha256": _engine_digest(producer_result),
     }
 
 
@@ -2163,11 +2169,11 @@ def capture_user_prompt(
         "subject": subject,
         "context_ref": context_ref,
         "context_sha256": context_sha256,
-        "payload_sha256": _digest(_canonical(event.get("payload"))),
+        "payload_sha256": _engine_digest(event.get("payload")),
         "producer_profile": "host-user-prompt/0.1.0",
         "producer_run_id": producer_run_id,
         "producer_result": producer_result,
-        "producer_result_sha256": _digest(_canonical(producer_result)),
+        "producer_result_sha256": _engine_digest(producer_result),
     }
     observation_raw = _canonical(observation)
     observation_sha256 = _digest(observation_raw)
@@ -2213,12 +2219,12 @@ def _context_preview_context(root: Path, client: Any, preview: dict[str, Any], p
                "record_id": "CONTEXT-" + preview["document_id"].upper(),
                "normative_sha256": binding}
     if (
-        _digest(raw) != context_hash or raw != _canonical(context)
+        _digest(raw) != context_hash or raw != _native_context_canonical(context, "INVALID_CONTEXT_AUTHORITY")
         or context.get("activity") != CONTEXT_ROUTE
         or context.get("preview") != preview
         or context.get("subject") != subject
         or context.get("record") != {"preview_binding_sha256": binding}
-        or context.get("record_sha256") != _digest(_canonical(context.get("record")))
+        or context.get("record_sha256") != _engine_digest(context.get("record"))
         or context.get("input_sha256") != binding
         or context.get("prompt_sha256") != _digest(prompt.encode("utf-8"))
         or result.get("subject") != subject
@@ -2302,9 +2308,9 @@ def capture_context_preview(root: str | Path, client: Any, prompt: str, *, host:
     observation = {
         "format": OBSERVATION_FORMAT, "kind": CONTEXT_ROUTE,
         "subject": context["subject"], "context_ref": context_ref,
-        "context_sha256": context_hash, "payload_sha256": _digest(_canonical(payload)),
+        "context_sha256": context_hash, "payload_sha256": _engine_digest(payload),
         "producer_profile": "host-user-context-preview/0.1.0", "producer_run_id": producer_run_id,
-        "producer_result": producer_result, "producer_result_sha256": _digest(_canonical(producer_result)),
+        "producer_result": producer_result, "producer_result_sha256": _engine_digest(producer_result),
     }
     observation_raw = _canonical(observation)
     observation_hash = _digest(observation_raw)

package/plugins/ca-pi/hooks/_host.py

@@ -11,7 +11,7 @@ import hostapi  # noqa: E402
 class PiHost(hostapi.Host):
     name = "pi"
     adapter_name = "@arbiterforge/ca-pi"
-    adapter_version = "0.16.5"
+    adapter_version = "0.16.6"
     update_target = "ca-pi"
     update_tag_prefix = "ca-pi-v"
     update_command = "pi update npm:@arbiterforge/ca-pi"

package/plugins/ca-pi/hooks/hostapi.py

@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "2.24.4"
+    adapter_version = "2.24.5"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,

package/plugins/ca-pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.16.5",
+  "version": "0.16.6",
   "private": true,
   "license": "AGPL-3.0-only",
   "type": "module",