@arbiterforge/ca-pi 0.17.4 → 0.17.5

package/README.md

@@ -10,7 +10,7 @@ and durable project context. You decide. codeArbiter enforces.
 <img alt="Claude Code plugin" src="https://img.shields.io/badge/Claude_Code-plugin-d97757">
 <img alt="Codex plugin" src="https://img.shields.io/badge/OpenAI_Codex-plugin-10a37f">
 <img alt="Pi Feature Forge preview" src="https://img.shields.io/badge/ca--pi-Feature_Forge_preview-d97757">
-<img alt="version 2.25.3" src="https://img.shields.io/badge/version-2.25.3-2b7489">
+<img alt="version 2.25.4" src="https://img.shields.io/badge/version-2.25.4-2b7489">
 <img alt="core lanes" src="https://img.shields.io/badge/core_lanes-18-555">
 <img alt="skills" src="https://img.shields.io/badge/skills-22-555">
 <img alt="agents" src="https://img.shields.io/badge/agents-20-555">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.17.4",
+  "version": "0.17.5",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/plugins/ca-pi/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `ca-pi` are documented in this file.
 
 ## [Unreleased]
 
+## [0.17.5] - 2026-10-10
+
+### Fixed
+
+- Preserve the shared adapter's bounded native completion-review context
+  references and complete review-result prompt contract (#921).
+- Fingerprint complete completion-review workspaces up to 1 GiB independently
+  of the 256 MiB selected verification-input budget. Preserve full content
+  hashing, freshness checks, and the 32 MiB member and 50,000 entry limits.
+- Preserve the shared engine's distinct fresh-verification completion profile
+  and historical receipt validation. Pi verification and review authority remain
+  unsupported; this shared payload change does not enable those host seams.
+
 ## [0.17.4] - 2026-10-09
 
 ### Changed

package/plugins/ca-pi/helpers/artifacts/release.json

@@ -6,43 +6,43 @@
   "binaries": {
     "darwin/amd64": {
       "file": "ca-artifact-darwin-amd64",
-      "sha256": "433780fa59913512346069f9e1891e306a8bec41ed6fcc7cd26b50748d03ae06",
+      "sha256": "12a8a4b23da84cd672d03abe0c748310225e8bce47c5e8c8cbb3753e5acdbe57",
       "native_tested": true
     },
     "darwin/arm64": {
       "file": "ca-artifact-darwin-arm64",
-      "sha256": "b68192c7a1da2cd2f9031f71ab4c7e015673f060d6bfdfa3aa4b57d9f090bf34",
+      "sha256": "2107c247473c8a9cc7c422dd754d98fa6211cf7bec5b7ecdd85ba5d7db0676b0",
       "native_tested": true
     },
     "linux/amd64": {
       "file": "ca-artifact-linux-amd64",
-      "sha256": "09582eabdef3f828a12de21b85ccc7b52a188651c2a4f69f3f776a2e62c86036",
+      "sha256": "92e27501fd18ae805c6390b17b4f2335e97d69c3645c60b3267fb7869c624727",
       "native_tested": true
     },
     "linux/arm64": {
       "file": "ca-artifact-linux-arm64",
-      "sha256": "f7699ce8f2f07200ea8508f21a6d369506443392aa8897d84e9d5e7dd6469770",
+      "sha256": "1961df0bdf37fd6a7b3a6214b925cf9f3b2efe0e797c05151a43ee96d7df07b3",
       "native_tested": true
     },
     "windows/amd64": {
       "file": "ca-artifact-windows-amd64.exe",
-      "sha256": "9a0f186e2a1bcfd92c8f9db5cb0aa2f6dfb128dd6f0dad2708a78596f0364e16",
+      "sha256": "63def27bda36ed03c9f7e6898eaf2110badda2419950a8dcb91666c4e4bdd438",
       "native_tested": true
     },
     "windows/arm64": {
       "file": "ca-artifact-windows-arm64.exe",
-      "sha256": "3f1bc7d00f9488b4a4a9f21e5ca414fd5c97031ad7b1c2b52c02f5d7f2956e3a",
+      "sha256": "107e1a8fe971fe24ce8a274ce1188b15c9785e4f94b835dadde1918b8fed5c4b",
       "native_tested": true
     }
   },
   "context_qualification": {
     "darwin/amd64": {
-      "source_commit": "6a243348a0e74b0a50c37eccf4d61520129a5c1c",
+      "source_commit": "ee70aa8851f2b96500e1b27085e3466ab222445d",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37938394077",
-      "binary_sha256": "433780fa59913512346069f9e1891e306a8bec41ed6fcc7cd26b50748d03ae06",
-      "observation_sha256": "017903dc1173484279e8029e5edee028cd81d1eb71c60e706b0476d7ea1d0e42",
-      "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
+      "run_id": "38030208537",
+      "binary_sha256": "12a8a4b23da84cd672d03abe0c748310225e8bce47c5e8c8cbb3753e5acdbe57",
+      "observation_sha256": "cbfbaf744db2c79e4c71fd23903ff06b5284e7475b3f094a90711bb62eb6a39e",
+      "module_sha256": "a7600f74a743626c4569da0da7803e057ed1df33d0fab8b0581bd25e45d402ed",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -53,12 +53,12 @@
       ]
     },
     "darwin/arm64": {
-      "source_commit": "6a243348a0e74b0a50c37eccf4d61520129a5c1c",
+      "source_commit": "ee70aa8851f2b96500e1b27085e3466ab222445d",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37938394077",
-      "binary_sha256": "b68192c7a1da2cd2f9031f71ab4c7e015673f060d6bfdfa3aa4b57d9f090bf34",
-      "observation_sha256": "28682b5ece3e695125587ff8578d22ce5ccd75f6643f626b64246bc7dd664716",
-      "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
+      "run_id": "38030208537",
+      "binary_sha256": "2107c247473c8a9cc7c422dd754d98fa6211cf7bec5b7ecdd85ba5d7db0676b0",
+      "observation_sha256": "426035459f63029ddd368a2a1a9dc542aeaebd920ae0ed993c6bbe6d5ecc1aa5",
+      "module_sha256": "a7600f74a743626c4569da0da7803e057ed1df33d0fab8b0581bd25e45d402ed",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -69,12 +69,12 @@
       ]
     },
     "linux/amd64": {
-      "source_commit": "6a243348a0e74b0a50c37eccf4d61520129a5c1c",
+      "source_commit": "ee70aa8851f2b96500e1b27085e3466ab222445d",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37938394077",
-      "binary_sha256": "09582eabdef3f828a12de21b85ccc7b52a188651c2a4f69f3f776a2e62c86036",
-      "observation_sha256": "0782dc40b8b03584b6f048204234fbf3896e0ee33ebfb52da4b72237d18679a6",
-      "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
+      "run_id": "38030208537",
+      "binary_sha256": "92e27501fd18ae805c6390b17b4f2335e97d69c3645c60b3267fb7869c624727",
+      "observation_sha256": "50f326cc374cd2914c907ef1367e75dc4ac49ef3526cebfc220a08e9e0d9bac8",
+      "module_sha256": "a7600f74a743626c4569da0da7803e057ed1df33d0fab8b0581bd25e45d402ed",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -85,12 +85,12 @@
       ]
     },
     "linux/arm64": {
-      "source_commit": "6a243348a0e74b0a50c37eccf4d61520129a5c1c",
+      "source_commit": "ee70aa8851f2b96500e1b27085e3466ab222445d",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37938394077",
-      "binary_sha256": "f7699ce8f2f07200ea8508f21a6d369506443392aa8897d84e9d5e7dd6469770",
-      "observation_sha256": "451808d71946bed78727672d0c8ed94903eb9179a3907dd86248c1885eb7b094",
-      "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
+      "run_id": "38030208537",
+      "binary_sha256": "1961df0bdf37fd6a7b3a6214b925cf9f3b2efe0e797c05151a43ee96d7df07b3",
+      "observation_sha256": "59a46860f93ed22094e9de20f7d2753cf361411d9e5230fcaabde95275cd7092",
+      "module_sha256": "a7600f74a743626c4569da0da7803e057ed1df33d0fab8b0581bd25e45d402ed",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -101,12 +101,12 @@
       ]
     },
     "windows/amd64": {
-      "source_commit": "6a243348a0e74b0a50c37eccf4d61520129a5c1c",
+      "source_commit": "ee70aa8851f2b96500e1b27085e3466ab222445d",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37938394077",
-      "binary_sha256": "9a0f186e2a1bcfd92c8f9db5cb0aa2f6dfb128dd6f0dad2708a78596f0364e16",
-      "observation_sha256": "336b9ea6f4b53b2aaa98cf5ee47f7d2792e2ece09eaafef8f37b0ae51c222275",
-      "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
+      "run_id": "38030208537",
+      "binary_sha256": "63def27bda36ed03c9f7e6898eaf2110badda2419950a8dcb91666c4e4bdd438",
+      "observation_sha256": "ff372ee0e5f5bacc316909afc37c6b9b5442143385180dd7eb235eae725f25f5",
+      "module_sha256": "a7600f74a743626c4569da0da7803e057ed1df33d0fab8b0581bd25e45d402ed",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -117,12 +117,12 @@
       ]
     },
     "windows/arm64": {
-      "source_commit": "6a243348a0e74b0a50c37eccf4d61520129a5c1c",
+      "source_commit": "ee70aa8851f2b96500e1b27085e3466ab222445d",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "37938394077",
-      "binary_sha256": "3f1bc7d00f9488b4a4a9f21e5ca414fd5c97031ad7b1c2b52c02f5d7f2956e3a",
-      "observation_sha256": "817414c35d85c544d9554544af86fc14aa11f866f0df0f6fe28f64adda5bfe1a",
-      "module_sha256": "421b4db5fa1afc9a8620c5538161d8b23f193d6a1042ad1c5aa004facdd77844",
+      "run_id": "38030208537",
+      "binary_sha256": "107e1a8fe971fe24ce8a274ce1188b15c9785e4f94b835dadde1918b8fed5c4b",
+      "observation_sha256": "c6761f9845ea9f51281ceb31118dc526a0496a57fa606807bf6118478f2906b4",
+      "module_sha256": "a7600f74a743626c4569da0da7803e057ed1df33d0fab8b0581bd25e45d402ed",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",

package/plugins/ca-pi/hooks/_artifactauthoritylib.py

@@ -82,6 +82,16 @@ REQUEST_LOCK_WAIT_SECONDS = 5.0
 CLAUDE_JOIN_LOCK_WAIT_SECONDS = 30.0
 MAX_OUTPUT = 8 << 20
 MAX_DECISION = 65536
+# Current native completion reviews retain the complete immutable context by
+# exact reference instead of duplicating it in every mutable request state.
+CONTEXT_STORAGE = "frozen-reference/0.1.0"
+CONTEXT_REFERENCE = {"format": "codearbiter.evidence-context-reference/0.1.0"}
+# The native canonical decoder already bounds each complete context at 8 MiB.
+MAX_EVIDENCE_CONTEXT = 8 << 20
+# ASCII canonical JSON can expand each input UTF-8 byte to at most six bytes.
+# Reserve that closed decision budget plus 32 bounded 256-byte lifecycle slots
+# (host identities, content-addressed locators, their keys and delimiters).
+REVIEW_RESULT_RESERVE = 6 * MAX_DECISION + 32 * 256
 MAX_COMPLETION_FILES = 16
 MAX_COMPLETION_FILE_BYTES = 64 << 10
 MAX_COMPLETION_TOTAL_BYTES = 256 << 10
@@ -404,9 +414,41 @@ def _request_lock(spool: Path, relative: Path, wait: float | None = None):
         # Do not unlink: a peer may already be waiting on this same inode.
 
 
+def _referenced_review_state(value: dict[str, Any]) -> dict[str, Any]:
+    if (value.get("context_storage") != CONTEXT_STORAGE
+            or value.get("codex_review_profile") != CODEX_NATIVE_V1
+            or value.get("host", "codex") != "codex"
+            or value.get("activity") not in REVIEW_ACTIVITIES
+            or "completion" not in value["context"] or "handback" in value):
+        raise AuthorityError("INVALID_AUTHORITY_STATE", "context reference is not a native completion review")
+    base = dict(value, state="ARMED", launch=None, observation_ref=None,
+                observation_sha256=None, receipt=None, recovery=None)
+    for field in ("payload", "authority_source"):
+        base.pop(field, None)
+    base["integrity_sha256"] = "0" * 64
+    stored_base = dict(base, context=CONTEXT_REFERENCE)
+    context = value["context"]
+    # Quality review additionally copies its exact task hashes into the result.
+    static_payload = {"input_sha256": context["input_sha256"],
+                      "spec_sha256": context["spec_sha256"],
+                      "completion_sha256": context["completion_sha256"]}
+    if value["activity"] == "spec_review":
+        static_payload["task_sha256"] = context["task_sha256"]
+    else:
+        static_payload.update(base_input_sha256=context["base_input_sha256"],
+                              task_hashes=context["task_hashes"])
+    if len(_canonical(stored_base)) + len(_canonical(static_payload)) + REVIEW_RESULT_RESERVE > MAX_STATE:
+        raise AuthorityError("INVALID_AUTHORITY_STATE", "review result has no bounded lifecycle reserve")
+    return dict(value, context=CONTEXT_REFERENCE)
+
+
 def _save(root: Path, value: dict[str, Any]) -> None:
     expected = value.get("integrity_sha256")
     updated = dict(value)
+    if "context_storage" in updated:
+        if _read_context(root, updated["context_ref"], updated["context_sha256"]) != updated["context"]:
+            raise AuthorityError("INVALID_EVIDENCE_CONTEXT", "stored review context changed")
+        updated = _referenced_review_state(updated)
     updated["integrity_sha256"] = _integrity(updated)
     legacy_abandonment = (
         value["state"] == "ABANDONED"
@@ -468,7 +510,7 @@ def _load(
         "authority_source", "dispatch_prompt", "review_contract_sha256",
         "required_coverage", "wrapper", "command_bindings", "recovery",
         "launch_envelope", "workspace_roots", "host", "codex_review_profile",
-        "handback",
+        "handback", "context_storage",
     }
     if (
         not isinstance(value, dict)
@@ -496,6 +538,16 @@ def _load(
         or value["activity"] not in REVIEW_ACTIVITIES
     ):
         raise AuthorityError("INVALID_AUTHORITY_STATE", "Codex review profile is unsupported")
+    if "context_storage" in value:
+        if value["context"] != CONTEXT_REFERENCE:
+            raise AuthorityError("INVALID_AUTHORITY_STATE", "stored context reference is malformed")
+        value["context"] = _read_context(root, value["context_ref"], value["context_sha256"])
+        subject = value["context"].get("subject", {})
+        _validate_context(value["context"], subject.get("artifact_id"),
+                          subject.get("record_id"), value["activity"])
+        _referenced_review_state(value)
+    elif value["context"] == CONTEXT_REFERENCE:
+        raise AuthorityError("INVALID_AUTHORITY_STATE", "context reference lacks its closed storage profile")
     if len(raw) > MAX_STATE:
         if recover_armed_review and value["state"] == "ABANDONED":
             # Only an abandonment can have retained this; recovering it again is
@@ -526,13 +578,20 @@ def _validate_hash(value: Any, field: str) -> str:
     return value
 
 
-def _read_context(root: Path, context_ref: str, context_hash: str) -> dict[str, Any]:
+def _read_context(
+    root: Path, context_ref: str, context_hash: str
+) -> dict[str, Any]:
     _validate_hash(context_hash, "context_sha256")
     expected_ref = f".codearbiter/.artifacts/evidence-contexts/{context_hash}.json"
     if context_ref != expected_ref:
         raise AuthorityError("INVALID_EVIDENCE_CONTEXT", "context locator is not content addressed")
     try:
-        raw = (root / expected_ref).read_bytes()
+        path = root / expected_ref
+        _path_identity(path)
+        with path.open("rb") as stream:
+            raw = stream.read(MAX_EVIDENCE_CONTEXT + 1)
+        if len(raw) > MAX_EVIDENCE_CONTEXT:
+            raise ValueError("context exceeds the native canonical budget")
         context = json.loads(raw.decode("utf-8"))
     except (OSError, UnicodeError, ValueError) as exc:
         raise AuthorityError("INVALID_EVIDENCE_CONTEXT", "context bytes are unavailable") from exc
@@ -1341,6 +1400,7 @@ def _dispatch_prompt(request: dict[str, Any], *, legacy_inline: bool = False) ->
         if request.get("codex_review_profile") == CODEX_NATIVE_V1 else ""
     )
     completion = ""
+    completion_fields = ""
     if "completion" in context:
         completion = (
             "This explicit completion review assesses performed work against every selected task's "
@@ -1370,7 +1430,10 @@ def _dispatch_prompt(request: dict[str, Any], *, legacy_inline: bool = False) ->
             "that support each conclusion. Missing or unreadable facts require status=missing and "
             "decision=changes_requested. A passing decision requires every completion obligation "
             "substantiated; a claimed coverage list is insufficient.\n"
+            "Separate required task/obligation pairs: "
+            + json.dumps(sorted(_completion_obligations(context)), ensure_ascii=True) + ".\n"
         )
+        completion_fields = ", completion_sha256 (exact selected packet hash), completion_assessment (separate obligation rows)"
     return (
         f"[CODEARBITER_AUTHORITY_REQUEST:{request['request_id']}]\n"
         f"Target repository: {request['repository']['path']}\n"
@@ -1384,7 +1447,8 @@ def _dispatch_prompt(request: dict[str, Any], *, legacy_inline: bool = False) ->
         + json.dumps(request["required_coverage"], ensure_ascii=True)
         + ". Fields: format, request_id, target_sha256, contract_sha256, decision "
           "(pass or changes_requested), coverage (unique strings), findings (objects with "
-          "severity, code, message), assessment (non-empty string). Reply with the JSON "
+          "severity, code, message), assessment (non-empty string)"
+        + completion_fields + ". Reply with the JSON "
           "object only: no code fence and no other text."
     )
 
@@ -1468,6 +1532,8 @@ def arm_request(
         seed_value["host"] = host
     if codex_review_profile is not None:
         seed_value["codex_review_profile"] = CODEX_NATIVE_V1
+        if completion_selection is not None:
+            seed_value["context_storage"] = CONTEXT_STORAGE
     seed = _canonical(seed_value)
     request_id = _digest(seed)
     request = {
@@ -1493,6 +1559,8 @@ def arm_request(
         request["host"] = host
     if codex_review_profile is not None:
         request["codex_review_profile"] = CODEX_NATIVE_V1
+        if completion_selection is not None:
+            request["context_storage"] = CONTEXT_STORAGE
     if activity in REVIEW_ACTIVITIES:
         request["review_contract_sha256"], request["required_coverage"] = _review_binding(context)
         request["dispatch_prompt"] = _dispatch_prompt(request)
@@ -2388,6 +2456,24 @@ def run_verification(
         request["context"], request["context_ref"], request["context_sha256"],
     ):
         raise AuthorityError("WORKSPACE_DRIFT", "repository content changed after arm")
+    def normalized_workspace():
+        result = client.call("evidence-context", {
+            "artifact_id": request["context"]["subject"]["artifact_id"],
+            "record_id": request["context"]["subject"]["record_id"],
+            "activity": "verification",
+            "verification_command_bindings": request["command_bindings"],
+        })
+        if (not isinstance(result, dict)
+                or result.get("context_ref") != request["context_ref"]
+                or result.get("context_sha256") != request["context_sha256"]
+                or not isinstance(result.get("completion_workspace_after"), list)
+                or not result["completion_workspace_after"]):
+            raise AuthorityError("WORKSPACE_DRIFT", "engine completion closure is absent or changed context")
+        return result["completion_workspace_after"]
+
+    # The engine alone normalizes validated native bookkeeping. Raw snapshots
+    # still freeze every byte across the actual command execution interval.
+    completion_workspace_before = normalized_workspace()
     workspace_before = _workspace_snapshots(request["command_bindings"])
     if workspace_before != wrapper.get("workspace_before"):
         raise AuthorityError("WORKSPACE_DRIFT", "workspace changed after wrapper authorization")
@@ -2422,6 +2508,9 @@ def run_verification(
     workspace_after = _workspace_snapshots(request["command_bindings"])
     if workspace_after != workspace_before:
         raise AuthorityError("WORKSPACE_DRIFT", "verification changed the frozen workspace")
+    completion_workspace_after = normalized_workspace()
+    if completion_workspace_after != completion_workspace_before:
+        raise AuthorityError("WORKSPACE_DRIFT", "verification changed the normalized completion workspace")
     final_context, final_ref, final_hash = _context(
         root, client, request["context"]["subject"]["artifact_id"],
         request["context"]["subject"]["record_id"], "verification",
@@ -2435,6 +2524,7 @@ def run_verification(
         "command_bindings": request["command_bindings"],
         "workspace_before": workspace_before,
         "workspace_after": workspace_after,
+        "completion_workspace_after": completion_workspace_after,
         "commands": commands,
     }
     payload = {
@@ -2444,7 +2534,7 @@ def run_verification(
         "commands": commands,
     }
     observation = _closed_observation(
-        request, payload, "declared-command/0.2.0", request["attempt"],
+        request, payload, "declared-command/0.3.0", request["attempt"],
         producer_result,
     )
     _observation(root, request, observation)

package/plugins/ca-pi/hooks/_host.py

@@ -11,7 +11,7 @@ import hostapi  # noqa: E402
 class PiHost(hostapi.Host):
     name = "pi"
     adapter_name = "@arbiterforge/ca-pi"
-    adapter_version = "0.17.4"
+    adapter_version = "0.17.5"
     update_target = "ca-pi"
     update_tag_prefix = "ca-pi-v"
     update_command = "pi update npm:@arbiterforge/ca-pi"

package/plugins/ca-pi/hooks/hostapi.py

@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "2.25.3"
+    adapter_version = "2.25.4"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,

package/plugins/ca-pi/includes/artifacts.md

@@ -287,9 +287,11 @@ options. Local executables shadowing nested npm are rejected.
 Direct Node script entrypoints are also pinned. These launch-file bindings do
 not establish transitive dependency closure for deliberately excluded inputs.
 
-New observations use the closed `declared-command/0.2.0` producer profile to
-retain collector and launch-file identities. Historical `0.1.0` bindings remain
-separate and cannot be relabelled as qualified launch evidence.
+New observations use the closed `declared-command/0.3.0` producer profile to
+retain collector and launch-file identities plus an engine-produced normalized
+completion closure. Raw workspace fingerprints must still match before and
+after command execution. Historical `0.1.0` and `0.2.0` bindings retain their
+original contracts and cannot be relabelled as newer evidence.
 
 For `spec_review` or `quality_review`, arm the corresponding activity without
 workspace mappings and dispatch the returned `launch_envelope` unchanged to one
@@ -332,10 +334,13 @@ acceptance. Scope review uses validated task completion bindings. If verificatio
 is rerun, obtain and record its completed task review before selecting that run
 for scope review; do not infer equivalence between receipts.
 
-Creating the first completion context recomputes the current raw worktree
-fingerprint and requires it to match the selected verifier's recorded fingerprint.
-Later freshness checks allow native task-status and execution bookkeeping updates
-in validated canonical artifacts while retaining their normative content hashes.
+Creating a completion context for a `0.3.0` verification recomputes the normalized
+worktree closure bound during that verification. Only validated native outputs
+and execution bookkeeping are normalized; their publication must not invalidate
+unchanged source. Historical `0.2.0` verification retains its initial exact raw
+fingerprint comparison. Later freshness checks allow native task-status and
+execution bookkeeping updates in validated canonical artifacts while retaining
+their normative content hashes.
 Changes to task definitions, other HTML or other governance files still affect
 freshness under the normal snapshot policy. The closure covers
 tracked working-tree bytes and non-ignored untracked files, not ignored
@@ -349,6 +354,16 @@ the scope reaches `REVIEW`, reverify against one current source snapshot, run th
 combined quality review, and use `accept-scope` once. Do not accept tasks
 individually.
 
+Current Codex native V1 completion reviews retain the full frozen context in
+its immutable, content-addressed file and keep only its closed reference in
+mutable request state. Loading validates the exact context locator, hash,
+canonical bytes and review kind. The native context budget remains 8 MiB;
+mutable request state remains bounded at 1 MiB. Before dispatch, the adapter
+reserves the exact fixed result identities, six times the 64 KiB decision
+budget for canonical JSON escaping, and 32 bounded 256-byte lifecycle slots.
+A request without that capacity is refused before child launch. Historical
+inline requests retain their existing limits and abandonment-only recovery.
+
 An ARMED review that never launched can be abandoned through the adapter:
 
 ```sh

package/plugins/ca-pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.17.4",
+  "version": "0.17.5",
   "private": true,
   "license": "AGPL-3.0-only",
   "type": "module",