@arbiterforge/ca-pi 0.16.5 → 0.17.0

package/plugins/ca-pi/routines/tribunal/references/lenses/coverage.md

@@ -1,20 +1,61 @@
 # coverage — lens mandate
 
-Executed by `tribunal-lens-reviewer` under the `coverage` assignment. Write contract + evidence discipline: `finding-record.md`.
+Executed by `tribunal-lens-reviewer` under the `coverage` assignment.
+
+## Purpose / failure family
+Find missing behavioral verification or weak oracles that let a plausible wrong
+implementation pass. Coverage owns obligations and oracle strength.
+
+## Applicability
+Assigned behavior has a concrete correctness, security, compatibility or recovery
+obligation whose verification can be examined.
+
+## Skip conditions
+No applicable executable behavior or verifiable obligation. Lack of a particular
+test framework or numerical coverage report is not itself a finding.
 
 ## Scope emphasis
-Source-and-test pairs on risk paths in the assigned slice (auth, money, data-mutation, error handling).
+Risk-path source/test pairs: authorization, persistent mutation, error ownership,
+boundary behavior, concurrency, cancellation and compatibility where relevant.
 
 ## Required reading
-- `<project-root>/.codearbiter/tech-stack.md` — test and coverage invocations; `inventory.md` in the run dir — the risk overlay.
+- Finding record (`<plugin-root>/routines/tribunal/references/finding-record.md`) and review risk (`<plugin-root>/routines/tribunal/references/review-risk.md`).
+- Verification quality (`<plugin-root>/routines/tribunal/references/verification-quality.md`) — shared oracle discipline and complementary ownership.
+- `<project-root>/.codearbiter/tech-stack.md` — test suites, alternate harnesses
+  and declared coverage model; current requirements and inventory risk paths.
+
+## Deterministic probes
+Inspect source/test relationships, assertion targets, existing coverage reports
+and test-selection rules. Locate integration/contract checks before claiming a
+unit has no protection; execution counts alone do not reveal oracle strength.
+
+## Review questions
+- Which independent expectation would a realistic wrong implementation violate?
+- Does an assertion detect it, or only execution, a call count or copied output?
+- Are relevant forbidden behavior, error, boundary and compatibility cases checked?
+- Could a focused mutation, property, differential or metamorphic check cheaply
+  discriminate the suspected fault under authorized verification?
+
+## False-positive guards / non-findings
+A limited smoke test is valid for a smoke obligation. Interaction assertions can
+test a real protocol. Low percentages, small test counts and generated tests do
+not establish a gap; good behavioral coverage can live in another harness.
+
+## Evidence requirements
+Name the obligation, plausible fault and missing or ineffective assertion. State
+the searched suites and alternate harnesses and trace ownership of the behavior.
+Distinguish a reasoned surviving-fault example from an actually executed mutation;
+never claim the latter without captured results.
 
-## Checklist
-- Coverage gaps on risk paths (auth, money, data-mutation, error handling).
-- Missing edge-case/property coverage; the empty/null/single-item and zero-value cases.
-- Tests asserting implementation detail rather than observable behavior.
+## Exposure metric
+Count of distinct risk-path obligations whose case selection and oracle were
+examined, with unexamined obligations reported separately.
 
-## Exposure
-Count of risk paths examined (`inventory.md` risk overlay).
+## Escalation / cross-lens handoff
+Test-fidelity owns mismatched doubles/fixtures; send it a lead when that is the
+root mechanism. Send proved product defects to their domain lens and corroborate
+the root cause rather than count both the defect and its missing test as duplicates.
 
 ## Out of scope
-Tests validating fiction (test-fidelity); the underlying bug itself (reliability).
+Mock presence, fixture-contract fidelity, implementing tests, and claiming that a
+coverage percentage proves correctness.

package/plugins/ca-pi/routines/tribunal/references/lenses/infra.md

@@ -1,24 +1,64 @@
 # infra — lens mandate
 
-Executed by `tribunal-lens-reviewer` under the `infra` assignment. Write contract + evidence discipline: `finding-record.md`.
+Executed by `tribunal-lens-reviewer` under the `infra` assignment.
+
+## Purpose / failure family
+Find unsafe build, deployment and publication boundaries, or configuration
+failures that compromise the promised runtime/release behavior.
+
+## Applicability
+The assigned scope includes CI, containers, infrastructure configuration,
+deployment or release automation with meaningful trust or lifecycle boundaries.
+
+## Skip conditions
+No affected pipeline/deployment surface. Do not infer a hosted-service posture
+for a local development fixture or a declared disposable environment.
 
 ## Scope emphasis
-CI workflows, Dockerfiles/compose, IaC and deploy manifests, release automation in the assigned slice.
+Workflow event to credential/artifact/publish boundary; container and deploy
+configuration to actual exposed service, privilege and resource lifecycle.
 
 ## Required reading
-- `<project-root>/.codearbiter/security-controls.md` — trust boundaries and approved secret stores; `<project-root>/.codearbiter/tech-stack.md` — deploy targets and CI conventions.
+- Finding record (`<plugin-root>/routines/tribunal/references/finding-record.md`) and review risk (`<plugin-root>/routines/tribunal/references/review-risk.md`).
+- `<project-root>/.codearbiter/security-controls.md` — pipeline trust and secret
+  boundaries; `<project-root>/.codearbiter/tech-stack.md` — deploy targets,
+  CI/release contracts and applicable protections.
+
+## Deterministic probes
+Inspect workflow triggers/permissions, action/image references, cache/artifact
+producers and consumers, publish conditions, container users/mounts and deploy
+exposure. Use existing configuration/provenance receipts; do not trigger jobs.
+
+## Review questions
+- Can untrusted event data become shell syntax, credential access or executable
+  candidate code in a privileged workflow?
+- Can a less-trusted cache or artifact cross into release without identity checks?
+- Do masked failures or mismatched protections permit publication after failed gates?
+- Are image provenance, privileges, secret layers and service exposure consistent
+  with the declared threat model?
+- Can deploy ordering, resource exhaustion or environment drift violate availability?
+
+## False-positive guards / non-findings
+A tag, root user or wide permission is a lead, not automatic exploitability.
+Establish the reachable event, actual credential scope and accepted controls.
+Inherited protections require evidence; unavailable remote settings remain
+unverified rather than presumed missing or effective.
 
-## Checklist
-- CI/CD workflows: untrusted input (PR titles, branch names, comments) interpolated into `run:` steps; excessive workflow/token `permissions`; third-party actions pinned to tags, not SHAs; fork-writable cache keys (poisoning); artifacts promoted without provenance; masked failures (swallowed exit codes) ahead of a publish step.
-- Container posture: base image unpinned or of unvetted provenance; running as root; secrets baked into layers or build args.
-- IaC/deploy manifests: drift between environments; missing resource limits; services exposed wider than intended.
-- Release automation: publish/tag steps ungated by branch or tag protections.
+## Evidence requirements
+Show the event/input-to-privilege or configuration-to-runtime trace and concrete
+consequence. Absence claims state the search universe across reusable workflows,
+environment/repository controls and deployment owners. Bind artifact claims to
+actual identity; a successful source check does not prove published bytes.
 
-## Categories & severity
-`security` for exploitable pipeline issues (injection, token overreach, cache poisoning); `dependency` for provenance/pinning; `reliability` for deploy-config correctness. Exploitable-from-fork is critical/high.
+## Exposure metric
+Count of pipeline/deploy boundary paths inspected, distinguishing source
+configuration from verified external settings and artifact evidence.
 
-## Exposure
-Count of workflows + Dockerfiles/compose files + IaC/deploy manifests examined.
+## Escalation / cross-lens handoff
+Route application dependency trust to secrets-supply and incomplete propagation
+to change-closure. Corroborate one root defect when bad artifact trust also
+appears as a release-closure issue.
 
 ## Out of scope
-Supply-chain risk of app dependencies (secrets-supply) — this lens owns the pipeline and deploy surface itself.
+Changing infrastructure, running jobs, application dependency audits and severity
+based solely on a configuration signature.

package/plugins/ca-pi/routines/tribunal/references/lenses/migration.md

@@ -1,22 +1,62 @@
 # migration — lens mandate
 
-Executed by `tribunal-lens-reviewer` under the `migration` assignment. Write contract + evidence discipline: `finding-record.md`.
+Executed by `tribunal-lens-reviewer` under the `migration` assignment.
+
+## Purpose / failure family
+Find schema/data transitions that violate compatibility, integrity, availability
+or recovery obligations under the repository's declared deployment model.
+
+## Applicability
+Assigned changes migrate persisted data/schema or alter how deployed versions
+read and write it.
+
+## Skip conditions
+No persisted transition or affected rollout contract. When the deploy model is
+unknown, preserve that uncertainty instead of assuming a reversible rollout.
 
 ## Scope emphasis
-Migration files in the assigned slice, cross-referenced against schema and query code.
+Migration order, schema and query consumers, backfills, deployment windows and
+recovery procedures for the affected data.
 
 ## Required reading
-- `<project-root>/.codearbiter/security-controls.md` — data-classification categories; `<project-root>/.codearbiter/tech-stack.md` — ORM/schema conventions.
+- Finding record (`<plugin-root>/routines/tribunal/references/finding-record.md`) and review risk (`<plugin-root>/routines/tribunal/references/review-risk.md`).
+- `<project-root>/.codearbiter/tech-stack.md` — declared migration/deploy model,
+  schema tools and version overlap; `<project-root>/.codearbiter/security-controls.md`
+  for relevant data classification and recovery obligations.
+
+## Deterministic probes
+Inspect migration history/order, schema diffs, deployed-version compatibility
+matrices, query references and available table-size/lock evidence. Read recovery
+and rollout checks as evidence; do not apply or roll back migrations.
+
+## Review questions
+- Does expand/contract ordering preserve mixed-version readers and writers?
+- Can a backfill lose, duplicate or misclassify data, or fail partway irrecoverably?
+- Do NOT NULL, renames, drops and index operations respect actual data and locks?
+- Is destructive or irreversible work guarded by the required recovery evidence?
+- Does editing a previously applied migration create divergent environments?
+
+## False-positive guards / non-findings
+A declared forward-only model may use a corrective migration and verified restore
+procedure; a down migration is not universally required. A disposable schema or
+exclusive downtime window may have different obligations from a rolling deploy.
+Do not invent annotation or immutability requirements absent the actual contract.
+
+## Evidence requirements
+Cite the deployment model, affected data/version window, operation order and
+concrete compatibility, locking or recovery failure. For an absent backfill or
+recovery path, state the search universe across migrations, deployment orchestration
+and recovery owners. Bound scale claims with available size/lock evidence.
 
-## Checklist
-- Reversibility: rollback/down path present; destructive ops (DROP, TRUNCATE) guarded; NOT NULL added without DEFAULT/backfill; single-step rename that breaks queries mid-deploy.
-- Data-classification annotation present for tables holding sensitive data (PII, credentials, payment, audit).
-- Immutability: edits to an already-committed migration (schema divergence across environments).
-- Index concurrency on large tables; locks that block production traffic.
-- Schema-to-code drift, backfill correctness, operation ordering, unguarded destructive operations.
+## Exposure metric
+Count of persisted transitions checked with their application-version and
+recovery windows, not only migration-file count.
 
-## Exposure
-Count of migration files reviewed.
+## Escalation / cross-lens handoff
+Route rollout wiring to infra/change-closure, application authorization to appsec
+and secret exposure to secrets-supply. Keep missing recovery proof distinct from
+a demonstrated unrecoverable transition.
 
 ## Out of scope
-Application-level data handling (appsec/secrets).
+Applying migrations, universal rollback policy, and unrelated application-level
+data handling outside the assigned transition.

package/plugins/ca-pi/routines/tribunal/references/lenses/observability.md

@@ -1,21 +1,62 @@
 # observability — lens mandate
 
-Executed by `tribunal-lens-reviewer` under the `observability` assignment. Write contract + evidence discipline: `finding-record.md`.
+Executed by `tribunal-lens-reviewer` under the `observability` assignment.
+
+## Purpose / failure family
+Find failures operators or callers cannot diagnose, correlate or recover from
+despite an applicable operational or audit obligation.
+
+## Applicability
+The product's operating model requires diagnosis, correlation, security/audit
+events or failure visibility at the assigned boundary.
+
+## Skip conditions
+Local libraries or pure helpers with no operational/diagnostic contract need not
+have tracing or metrics. Record a skip when diagnosis is adequately owned by
+the caller and no separate obligation applies.
 
 ## Scope emphasis
-The assigned path slice, weighted to critical paths and boundaries.
+Critical failure/recovery paths and service/async boundaries where actionable
+reason, correlation or audit completeness is required.
 
 ## Required reading
-- `<project-root>/.codearbiter/tech-stack.md` — logging/tracing/metrics stack; `inventory.md` in the run dir — the boundary map.
+- Finding record (`<plugin-root>/routines/tribunal/references/finding-record.md`) and review risk (`<plugin-root>/routines/tribunal/references/review-risk.md`).
+- `<project-root>/.codearbiter/tech-stack.md` — logging/tracing/metrics stack
+  and operating model; applicable runbook/audit contracts and inventory boundaries.
+
+## Deterministic probes
+Inspect event/error emission, correlation propagation and diagnostic consumers.
+Compare declared event requirements with existing logging/audit tests and
+operational evidence; event counts do not prove diagnostic usefulness.
+
+## Review questions
+- Can an operator distinguish the critical failure reason and select recovery?
+- Is required correlation preserved across the actual async/service boundary?
+- Are security/audit outcomes complete enough for the declared forensic purpose?
+- Are diagnostic details bounded and appropriate to the recipient?
+- Does a suppressed or misleading success signal hide a relevant failure mode?
+
+## False-positive guards / non-findings
+No universal tracing, structured-logging or metrics requirement applies.
+Central instrumentation and returned errors may satisfy a boundary's obligation.
+Do not propose logging every call or emitting duplicate diagnostics without
+showing which real failure would remain undiagnosable.
+
+## Evidence requirements
+Cite the required operational/audit obligation, failure scenario and unavailable
+diagnostic or recovery decision. For missing signals, state the search universe
+and ownership trace through emitters, middleware, collectors and callers; include
+available evidence about retention/visibility without assuming remote settings.
 
-## Checklist
-- Missing or inconsistent structured logging on critical paths.
-- Absent tracing / correlation IDs across service or async boundaries.
-- No metrics on critical paths; audit-trail gaps for security-relevant events.
-- Sensitive-data-in-logs is flagged once, by the secrets lens — do not double-report it here.
+## Exposure metric
+Count of applicable failure/audit boundary paths whose diagnostic outcome was
+traced, not raw log statements.
 
-## Exposure
-Count of boundary crossings / critical paths inspected (`inventory.md` boundary map).
+## Escalation / cross-lens handoff
+Send sensitive-data logging to secrets-supply and the underlying lost operation
+to reliability. Keep a diagnostic consequence as corroboration when it shares
+the same root failure rather than filing duplicate findings.
 
 ## Out of scope
-Whether the logged operation is itself correct (reliability).
+Tracing for its own sake, correctness of the logged operation, and independent
+secret disclosure findings.

package/plugins/ca-pi/routines/tribunal/references/lenses/performance.md

@@ -1,22 +1,62 @@
 # performance — lens mandate
 
-Executed by `tribunal-lens-reviewer` under the `performance` assignment. Write contract + evidence discipline: `finding-record.md`; flag a signature only where the path is plausibly hot — no speculative micro-optimization.
+Executed by `tribunal-lens-reviewer` under the `performance` assignment.
+
+## Purpose / failure family
+Find demonstrable latency, throughput or resource failures under a supported
+workload, including repeated expensive work and unbounded growth.
+
+## Applicability
+There is a documented SLO/resource constraint, observed benchmark/profile, clear
+asymptotic bound, plausible hot-path repeated I/O, unbounded growth or demonstrable
+scale multiplier.
+
+## Skip conditions
+No supported workload or performance premise can be established. Lack of a
+benchmark alone is not a skip when the code establishes an unbounded cost path.
 
 ## Scope emphasis
-The assigned path slice, weighted to hot paths and data access.
+Actual hot paths, data access, subprocess/network fan-out, queues/caches and
+resource lifetimes, with cold and bounded operations identified separately.
 
 ## Required reading
-- `<project-root>/.codearbiter/tech-stack.md` — data layer, ORM, and cache conventions.
+- Finding record (`<plugin-root>/routines/tribunal/references/finding-record.md`) and review risk (`<plugin-root>/routines/tribunal/references/review-risk.md`).
+- `<project-root>/.codearbiter/tech-stack.md` — data layer, cache and runtime
+  model; relevant SLOs, supported scale, profiles and benchmark conditions.
+
+## Deterministic probes
+Inspect query/I/O/subprocess counts along a bounded path, loop nesting, fan-out
+and retention/eviction bounds. Read existing profiles and query/index evidence;
+do not infer production cost from a loop signature or unrelated benchmark.
+
+## Review questions
+- Does repeated I/O or over-fetching multiply cost on a plausibly exercised path?
+- Can growth, fan-out or retention escape the stated resource bound?
+- Does blocking work violate an established latency/concurrency constraint?
+- Do cache misses, invalidation or keys create the demonstrated cost or stale result?
+- Does the recommendation address the measured/bounded mechanism at supported scale?
+
+## False-positive guards / non-findings
+Cold bounded loops, small fixed collections and deliberately uncached work may
+be appropriate. "Could cache or memoize" is not a finding. A different index or
+algorithm needs a workload and cost argument; benchmark noise is not a regression.
+
+## Evidence requirements
+Provide the observed or documented workload/scale premise, or an explicit
+asymptotic/resource bound and reachable input multiplier. Show the costly path
+and expected consequence, separating measurement from inference. For absent
+batching/cache/limits, state the search universe through callers and data/resource
+owners; centralized bounds can refute the claim.
 
-## Checklist
-- N+1 queries and per-iteration IO in loops.
-- Redundant hot-path work; recomputation that could be hoisted or memoized.
-- Query/index shape: filters/sorts on unindexed columns; over-fetching.
-- Missing or incorrect caching; cache keys that never invalidate or collide.
-- Blocking IO on latency-critical paths.
+## Exposure metric
+Count of workload/path pairs evaluated with their premise and bound, identifying
+which conclusions are measured and which are statically inferred.
 
-## Exposure
-Count of hot-path/data-access sites inspected.
+## Escalation / cross-lens handoff
+Send wrong cached results or races to reliability, externally exploitable
+resource exhaustion to appsec, and missing benchmark discrimination to coverage.
+Combine evidence when the cost and correctness symptoms share one cause.
 
 ## Out of scope
-Correctness of the logic itself (reliability).
+Speculative micro-optimization, universal caching and unsupported production
+latency claims.

package/plugins/ca-pi/routines/tribunal/references/lenses/reliability.md

@@ -1,23 +1,63 @@
 # reliability — lens mandate
 
-Executed by `tribunal-lens-reviewer` under the `reliability` assignment. Write contract + evidence discipline: `finding-record.md`.
+Executed by `tribunal-lens-reviewer` under the `reliability` assignment.
+
+## Purpose / failure family
+Find lost failures, corrupt or orphan state, unsafe concurrency and incomplete
+resource lifecycles by tracing ownership and recovery semantics.
+
+## Applicability
+The assigned code performs fallible work, owns mutable state/resources, or
+coordinates asynchronous, concurrent or restartable operations.
+
+## Skip conditions
+No relevant state transition, fallible boundary or lifecycle. Syntax alone does
+not make a synchronous or pure helper a reliability risk.
 
 ## Scope emphasis
-The assigned path slice: async correctness, error propagation, races, resource lifecycle, boundary conditions, orphan state.
+Follow operations from initiation through success, failure, cancellation,
+deadline and restart, including direct callers and the resource/state owner.
 
 ## Required reading
-- `<project-root>/.codearbiter/tech-stack.md` — async model and concurrency primitives.
+- Finding record (`<plugin-root>/routines/tribunal/references/finding-record.md`) and review risk (`<plugin-root>/routines/tribunal/references/review-risk.md`).
+- `<project-root>/.codearbiter/tech-stack.md` — async/concurrency model and
+  persistence primitives; relevant error, lifecycle and recovery contracts.
+
+## Deterministic probes
+Enumerate state writers, acquisitions/releases, cancellation/deadline paths and
+retry boundaries. Inspect caller and handler chains and existing failure tests;
+counts of awaits or catches do not establish error ownership.
+
+## Review questions
+- Which boundary owns each failure, and does propagation or translation preserve
+  its meaning for the caller? Can a swallowed failure masquerade as success?
+- Are retries bounded and idempotent, with coherent timeout/cancellation outcomes?
+- Can concurrent read-modify-write, reordering or duplicate delivery lose state?
+- Are atomicity, partial failure and fail-open/fail-closed choices consistent with
+  the actual contract? Can recovery or restart strand half-written state?
+- Does the lifecycle owner release resources on every relevant terminal path?
+
+## False-positive guards / non-findings
+Intentional propagation to an owning boundary is valid; no local catch is required
+at every await. A documented best-effort operation may intentionally fail silently.
+Do not demand local cleanup when a parent owns the lifecycle, or locking when an
+established transaction/serialization model already provides the invariant.
+
+## Evidence requirements
+Show a concrete failure or interleaving, the violated invariant and its observable
+effect. Absence claims name the search universe and ownership trace through
+callers, central handlers, transaction owners and cleanup/recovery paths.
+Distinguish a plausible schedule from a reproduced race.
 
-## Checklist
-- Async inventory: every `await`, `Promise`, and `.then()` chain has a `.catch`/`try-catch`.
-- Error-propagation trace: for every `catch`, what happens next. Acceptable — rethrow, typed fallback, central handler, or a state update notifying the caller. Unacceptable — log-and-return-`undefined`, or swallow entirely. Flag every catch that does not propagate a meaningful signal.
-- Race surface: two+ async operations writing shared state (component state, globals, filesystem, DB rows) without locking/serialization; handlers that fire before a prior invocation completes; polling loops without cancellation; message handlers mutating state without queueing.
-- Resource lifecycle: every subscription, listener, connection, or timer set up in an init hook has a teardown in cleanup/unmount.
-- Boundary conditions: empty, null, single-item collections; zero-value numerics; null API responses.
-- Orphan state: state written conditionally but read unconditionally; mutation after unmount (stale closure).
+## Exposure metric
+Count of operation/state lifecycles traced across their owning boundary,
+including which terminal paths were inspected.
 
-## Exposure
-Count of async sites (await/Promise/then) inspected.
+## Escalation / cross-lens handoff
+Send exploitability to appsec, diagnosability to observability and inadequate
+fault detection to coverage. Preserve a shared root cause when several lenses
+observe the same lost error or state transition.
 
 ## Out of scope
-Performance (performance); injection/authz (appsec).
+Local-catch style, speculative speed improvements and unrelated authorization
+claims without a runtime ownership defect.

package/plugins/ca-pi/routines/tribunal/references/lenses/secrets-supply.md

@@ -1,22 +1,65 @@
 # secrets-supply — lens mandate
 
-Executed by `tribunal-lens-reviewer` under the `secrets-supply` assignment. Write contract + evidence discipline: `finding-record.md`.
+Executed by `tribunal-lens-reviewer` under the `secrets-supply` assignment.
+
+## Purpose / failure family
+Find unsafe secret/crypto flows and dependency identity, provenance or use that
+creates a concrete trust, exposure or distribution failure.
+
+## Applicability
+Assigned code/configuration handles sensitive values or cryptographic operations,
+or depends on external packages/artifacts.
+
+## Skip conditions
+No relevant secret, crypto or dependency boundary. Unavailable registry or
+advisory evidence is a stated limitation, not a clean result or a missing package.
 
 ## Scope emphasis
-Source, config, `.env*`, and dependency manifests/lockfiles in the assigned slice.
+Manifests/locks and their intended registries, runtime/build dependency uses,
+secret sources through logs/transmission/storage, and shipped artifact contents.
 
 ## Required reading
-- `<project-root>/.codearbiter/security-controls.md` — approved secret store and crypto; `<project-root>/.codearbiter/tech-stack.md` — dependency manifests.
+- Finding record (`<plugin-root>/routines/tribunal/references/finding-record.md`) and review risk (`<plugin-root>/routines/tribunal/references/review-risk.md`).
+- `<project-root>/.codearbiter/security-controls.md` — approved secret stores,
+  crypto, registries and trust exceptions; `<project-root>/.codearbiter/tech-stack.md`
+  for dependency graphs, build/runtime roles and distribution model.
+
+## Deterministic probes
+Inspect lock/manifest consistency, package identity/resolution and redacted secret
+pattern results. Registry-existence, advisory and provenance lookups use available
+evidence or independently authorized probes, with registry/version/time recorded.
+Do not install a package or execute its scripts to inspect it.
+
+## Review questions
+- Does the named package/version exist in the intended registry, and does a
+  confusable identity or provenance substitution change the trust assumption?
+- Is dependency use necessary to the behavior, or does a concrete unnecessary
+  privilege/attack surface result? What reaches the built or shipped artifact?
+- Does actual vulnerable package use make an advisory applicable?
+- Can a real secret escape into logs, URLs, storage, artifacts or an unintended
+  recipient? Are TLS, randomness and cryptographic choices fit for their contract?
+
+## False-positive guards / non-findings
+Clearly inert fixture values and credential-free examples are not leaked secrets.
+An HTTP body over required TLS is not inherently a disclosure. A public-registry
+miss does not prove absence from an intended private registry or workspace alias.
+Package age, dependency count or supposed model training history is not a defect.
+
+## Evidence requirements
+Show the exact package/registry/version or redacted source-to-sink secret flow,
+applicable policy and consequence. Never reproduce raw credentials in findings.
+For absence, state the search universe across locks, registry resolution,
+wrappers, redactors and artifact producers and identify the owning boundary.
 
-## Checklist
-- Literal secrets in source or `.env.example` — JWT/signing keys, API keys, DB connection strings, OAuth secrets, passwords (CWE-798). `.env.example` populated with real values is a common AI regression.
-- Weak/misused crypto (CWE-327): MD5/SHA-1 for password hashing; `Math.random()` for tokens instead of a CSPRNG.
-- Cleartext transmission: HTTP where HTTPS is required; credentials in query strings or bodies.
-- Secrets/PII in logs; debug flags active without an environment gate.
-- Supply chain: hallucinated/slopsquatted package names; dependency overuse (large trees from small features); pins current at training time but now deprecated or vulnerable.
+## Exposure metric
+Report dependency identities and sensitive-data flow paths examined separately,
+including unavailable external checks.
 
-## Exposure
-Count of dependencies examined + config/secret-bearing files scanned.
+## Escalation / cross-lens handoff
+Infra owns pipeline credential/artifact trust and appsec owns application
+injection/authorization. Send incomplete package propagation to change-closure;
+consolidate shared exposure causes instead of duplicating findings.
 
 ## Out of scope
-Injection/authz (appsec).
+Installing or updating dependencies, secret extraction, authorship inference
+and pipeline defects owned by infra.

package/plugins/ca-pi/routines/tribunal/references/lenses/semantic-contract.md

@@ -0,0 +1,62 @@
+# semantic-contract — lens mandate
+
+Executed by `tribunal-lens-reviewer` under the `semantic-contract` assignment.
+
+## Purpose / failure family
+Catch plausible implementations that diverge from requested semantics, including
+over-broad changes that pass tests while altering protected behavior.
+
+## Applicability
+A current issue/spec, accepted ADR, public contract, or supported pre-existing
+behavior establishes an expectation for the assigned code.
+
+## Skip conditions
+No affected behavior or usable contract basis. Record missing or conflicting
+expectations as a bounded question; absence of a spec is not a product defect.
+
+## Scope emphasis
+Trace requirements through entry points, decisions, outputs and consumers.
+Compare the changed behavior with both positive and negative obligations.
+
+## Required reading
+- Finding record (`<plugin-root>/routines/tribunal/references/finding-record.md`) and review risk (`<plugin-root>/routines/tribunal/references/review-risk.md`).
+- `<project-root>/.codearbiter/CONTEXT.md` — product scope and vocabulary.
+- Applicable issue/spec, accepted ADR obligations, API/protocol contracts,
+  compatibility promises and pre-existing behavior evidence in the packet.
+
+## Deterministic probes
+Inspect changed symbols and direct consumers, contract/schema differences, and
+existing regression expectations. Map each claimed behavior to its cited source;
+do not derive the expected answer by copying the implementation.
+
+## Review questions
+- Does the implementation satisfy the actual requirement, including forbidden
+  behavior, edge values, ordering, units and compatibility?
+- Does a broad filter, fallback or default change unrelated pre-existing behavior?
+- Do tests agree with the intended semantics, or share the same wrong interpretation?
+- Are accepted decision obligations implemented at the boundary they govern?
+
+## False-positive guards / non-findings
+Never invent an unwritten requirement or treat a stylistic preference as a
+contract. Conflicting or ambiguous requirements need clarification, not a guessed
+defect. An intentional, authorized behavior change is not a regression merely
+because historical code behaved differently.
+
+## Evidence requirements
+Cite the current expectation and its applicability, a concrete distinguishing
+input/state, the implementation path, and the wrong observable result. For
+missing behavior, name the search universe and trace callers/consumers to its
+owner; checking one branch alone cannot establish absence.
+
+## Exposure metric
+Count of distinct behavioral obligations traced to implementation and consumers;
+report unresolved expectations separately.
+
+## Escalation / cross-lens handoff
+Send inadequate-oracle leads to coverage, stale-double leads to test-fidelity,
+and incomplete propagation to change-closure. Corroborate a shared root cause
+instead of filing a second defect.
+
+## Out of scope
+Inventing product decisions, general test completeness, and distribution closure
+without a semantic mismatch in the assigned finding scope.