@arbiterforge/ca-pi 0.17.6 → 0.17.7

package/README.md

@@ -10,7 +10,7 @@ and durable project context. You decide. codeArbiter enforces.
 <img alt="Claude Code plugin" src="https://img.shields.io/badge/Claude_Code-plugin-d97757">
 <img alt="Codex plugin" src="https://img.shields.io/badge/OpenAI_Codex-plugin-10a37f">
 <img alt="Pi Feature Forge preview" src="https://img.shields.io/badge/ca--pi-Feature_Forge_preview-d97757">
-<img alt="version 2.25.5" src="https://img.shields.io/badge/version-2.25.5-2b7489">
+<img alt="version 2.25.6" src="https://img.shields.io/badge/version-2.25.6-2b7489">
 <img alt="core lanes" src="https://img.shields.io/badge/core_lanes-18-555">
 <img alt="skills" src="https://img.shields.io/badge/skills-22-555">
 <img alt="agents" src="https://img.shields.io/badge/agents-20-555">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.17.6",
+  "version": "0.17.7",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/plugins/ca-pi/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to `ca-pi` are documented in this file.
 
 ## [Unreleased]
 
+## [0.17.7] - 2026-10-10
+
+### Fixed
+
+- Carry the shared bounded verification projection and approval preflight checks,
+  retaining complete command definitions, source snapshot ordering and full plan
+  identity freshness. Pi verification and review authority remain unsupported.
+
 ## [0.17.6] - 2026-10-10
 
 ### Fixed

package/plugins/ca-pi/helpers/artifacts/release.json

@@ -6,43 +6,43 @@
   "binaries": {
     "darwin/amd64": {
       "file": "ca-artifact-darwin-amd64",
-      "sha256": "7b9e95dba78bda2962d1b879c373a835466fe59aa082a3afb6efbc1fb3de454d",
+      "sha256": "5214e1062e49aa39cd73868cd9792e7e296a865bb6e86230b17c19dda1ba3b71",
       "native_tested": true
     },
     "darwin/arm64": {
       "file": "ca-artifact-darwin-arm64",
-      "sha256": "2469bd38df4e241f19bb443c4388283aaadc0638951a77331b25be81929d4f4c",
+      "sha256": "dde6deb178a0e725f8a88b1b30fa6980622b8af3b13fb73261aaaea47eb75a38",
       "native_tested": true
     },
     "linux/amd64": {
       "file": "ca-artifact-linux-amd64",
-      "sha256": "cf4116c08afa66426c3b9d78853dfc09b608e05412054b6fe18817a65db96a76",
+      "sha256": "ca2d5e0fecac0c99c45dc7576fff7d56af63dbd85decb4cfc54f81621ac90901",
       "native_tested": true
     },
     "linux/arm64": {
       "file": "ca-artifact-linux-arm64",
-      "sha256": "b1e92f0d279fe04b61dd287a4b20fc1db4abc3722c0325f5294a55bb1a972895",
+      "sha256": "de18df4c499814f6ccfc69efa6bfb6f4bbcd37c2af5dd091727233f1aaf91a39",
       "native_tested": true
     },
     "windows/amd64": {
       "file": "ca-artifact-windows-amd64.exe",
-      "sha256": "d8fa783dc8d30c5d48a8c336bca8ee5fd85be4c72629d7ac7246842b89c5135c",
+      "sha256": "ddab696f02b946400feac527f747a020b76dbb9e5dd444b0b7d464acbcd3888e",
       "native_tested": true
     },
     "windows/arm64": {
       "file": "ca-artifact-windows-arm64.exe",
-      "sha256": "2df30c81eb58d502aa9a146563b9dd725176cac9f907ebf36b73c157e5de2124",
+      "sha256": "23689eaa4df71f95bde58b18bc32fab8d4ae709495250ddfd13192fc0427a813",
       "native_tested": true
     }
   },
   "context_qualification": {
     "darwin/amd64": {
-      "source_commit": "7ef1feead876e08e9ad63d5e507a01650488719f",
+      "source_commit": "91b2cbba46d29d69ea052019acfabf52dc8e3897",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "38042731230",
-      "binary_sha256": "7b9e95dba78bda2962d1b879c373a835466fe59aa082a3afb6efbc1fb3de454d",
-      "observation_sha256": "c359781d36118baf2ebe6b73bb0ecefb59f4ca500b31a6f7e5baf52474e1127c",
-      "module_sha256": "fb635481a9bf9a88dbe052c2d738c28c1e3d2a6d741514fc28ac51b6fc8a47b4",
+      "run_id": "38199172149",
+      "binary_sha256": "5214e1062e49aa39cd73868cd9792e7e296a865bb6e86230b17c19dda1ba3b71",
+      "observation_sha256": "1c6f01fc33af2fabbd15633dbd1f5313208dd6eb754d00a1a17d80287f656a37",
+      "module_sha256": "1aea76bc4dc8b54b368dccc80c3a1133b403b5915018fdcb6018f1a3913fe66c",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -53,12 +53,12 @@
       ]
     },
     "darwin/arm64": {
-      "source_commit": "7ef1feead876e08e9ad63d5e507a01650488719f",
+      "source_commit": "91b2cbba46d29d69ea052019acfabf52dc8e3897",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "38042731230",
-      "binary_sha256": "2469bd38df4e241f19bb443c4388283aaadc0638951a77331b25be81929d4f4c",
-      "observation_sha256": "2d4c75ec50210c0bbf4b8c9a754a0fd89ee81dc60c9607066cf17c4e1af2050a",
-      "module_sha256": "fb635481a9bf9a88dbe052c2d738c28c1e3d2a6d741514fc28ac51b6fc8a47b4",
+      "run_id": "38199172149",
+      "binary_sha256": "dde6deb178a0e725f8a88b1b30fa6980622b8af3b13fb73261aaaea47eb75a38",
+      "observation_sha256": "94f984c74dd5a906bd5ea8ad03c2efe2e561c1e19e3574bb2825e353531c138d",
+      "module_sha256": "1aea76bc4dc8b54b368dccc80c3a1133b403b5915018fdcb6018f1a3913fe66c",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -69,12 +69,12 @@
       ]
     },
     "linux/amd64": {
-      "source_commit": "7ef1feead876e08e9ad63d5e507a01650488719f",
+      "source_commit": "91b2cbba46d29d69ea052019acfabf52dc8e3897",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "38042731230",
-      "binary_sha256": "cf4116c08afa66426c3b9d78853dfc09b608e05412054b6fe18817a65db96a76",
-      "observation_sha256": "0a57cde8e4f251ee5faf2cd2dc256638622464030cda79988c11295dec6dfec9",
-      "module_sha256": "fb635481a9bf9a88dbe052c2d738c28c1e3d2a6d741514fc28ac51b6fc8a47b4",
+      "run_id": "38199172149",
+      "binary_sha256": "ca2d5e0fecac0c99c45dc7576fff7d56af63dbd85decb4cfc54f81621ac90901",
+      "observation_sha256": "ba2155d373bbfd6e4469aa4e240cb1f06a6ac93823d9b6958ae8c0053a4d4a61",
+      "module_sha256": "1aea76bc4dc8b54b368dccc80c3a1133b403b5915018fdcb6018f1a3913fe66c",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -85,12 +85,12 @@
       ]
     },
     "linux/arm64": {
-      "source_commit": "7ef1feead876e08e9ad63d5e507a01650488719f",
+      "source_commit": "91b2cbba46d29d69ea052019acfabf52dc8e3897",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "38042731230",
-      "binary_sha256": "b1e92f0d279fe04b61dd287a4b20fc1db4abc3722c0325f5294a55bb1a972895",
-      "observation_sha256": "926d97ef85d2cd9caa658db620c7f135ea5a07873a188f289181a37ae636921d",
-      "module_sha256": "fb635481a9bf9a88dbe052c2d738c28c1e3d2a6d741514fc28ac51b6fc8a47b4",
+      "run_id": "38199172149",
+      "binary_sha256": "de18df4c499814f6ccfc69efa6bfb6f4bbcd37c2af5dd091727233f1aaf91a39",
+      "observation_sha256": "fd52f870338809a6dca3a0f1367130af716fbe463c1f7715e775bed2307508f3",
+      "module_sha256": "1aea76bc4dc8b54b368dccc80c3a1133b403b5915018fdcb6018f1a3913fe66c",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -101,12 +101,12 @@
       ]
     },
     "windows/amd64": {
-      "source_commit": "7ef1feead876e08e9ad63d5e507a01650488719f",
+      "source_commit": "91b2cbba46d29d69ea052019acfabf52dc8e3897",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "38042731230",
-      "binary_sha256": "d8fa783dc8d30c5d48a8c336bca8ee5fd85be4c72629d7ac7246842b89c5135c",
-      "observation_sha256": "70827706a7d231df640f9d4b27b4250f81311bfd89bee11b65ff48b985c1085c",
-      "module_sha256": "fb635481a9bf9a88dbe052c2d738c28c1e3d2a6d741514fc28ac51b6fc8a47b4",
+      "run_id": "38199172149",
+      "binary_sha256": "ddab696f02b946400feac527f747a020b76dbb9e5dd444b0b7d464acbcd3888e",
+      "observation_sha256": "fcfedfe79d6b914347674538c432dad334da8d06794d138ec295c1568e3ef158",
+      "module_sha256": "1aea76bc4dc8b54b368dccc80c3a1133b403b5915018fdcb6018f1a3913fe66c",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -117,12 +117,12 @@
       ]
     },
     "windows/arm64": {
-      "source_commit": "7ef1feead876e08e9ad63d5e507a01650488719f",
+      "source_commit": "91b2cbba46d29d69ea052019acfabf52dc8e3897",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "38042731230",
-      "binary_sha256": "2df30c81eb58d502aa9a146563b9dd725176cac9f907ebf36b73c157e5de2124",
-      "observation_sha256": "f15d9d9894d0ae845e14c3bfba1cf1528f1debe166850e9fb0b46aee27d99dbd",
-      "module_sha256": "fb635481a9bf9a88dbe052c2d738c28c1e3d2a6d741514fc28ac51b6fc8a47b4",
+      "run_id": "38199172149",
+      "binary_sha256": "23689eaa4df71f95bde58b18bc32fab8d4ae709495250ddfd13192fc0427a813",
+      "observation_sha256": "3ea32af39b84aaf1ccfbda2063c2c2c3031f205f838b52e3fc2b03ae00f3e392",
+      "module_sha256": "1aea76bc4dc8b54b368dccc80c3a1133b403b5915018fdcb6018f1a3913fe66c",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",

package/plugins/ca-pi/hooks/_approvallib.py

@@ -93,70 +93,44 @@ def _preflight_plan_verification(client: Any, identity: dict[str, Any]) -> dict[
     artifact_id = identity["artifact_id"]
 
     def same_identity(value: dict[str, Any]) -> None:
-        if not isinstance(value, dict) or any(value.get(key) != identity.get(key) for key in keys):
+        if not isinstance(value, dict) or type(value.get("revision")) is not int:
+            raise _artifactlib.ArtifactError("INVALID_RESPONSE", "plan verification identity is malformed")
+        if any(value.get(key) != identity.get(key) for key in keys):
             raise _artifactlib.ArtifactError("STALE_PLAN_PREFLIGHT", "plan identity changed during verification preflight; reread the complete current plan")
 
-    def task_records(ids: list[str]):
-        for start in range(0, len(ids), 128):
-            selected = ids[start:start + 128]
-            offset = 0
-            for _ in range(len(selected)):
-                page = client.call("read-batch", {
-                    "artifact_id": artifact_id, "symbols": selected,
-                    "model_sha256": identity["model_sha256"], "offset": offset, "budget": 16384,
-                })
-                same_identity(page)
-                _artifactlib.ArtifactClient._check_page(page, offset, "records")
-                records = page["records"]
-                end = offset + len(records)
-                if (page.get("mode") != "exact" or page.get("context_complete") is not False
-                        or type(page.get("offset")) is not int or page["offset"] != offset
-                        or type(page.get("total")) is not int or page["total"] != len(selected)
-                        or not records or end > len(selected)
-                        or page["next_offset"] != (end if end < len(selected) else None)):
-                    raise _artifactlib.ArtifactError("INVALID_RESPONSE", "plan task batch count, offset or completeness changed")
-                for expected_id, row in zip(selected[offset:end], records):
-                    if (not isinstance(row, dict) or row.get("id") != expected_id
-                            or row.get("kind") != "tasks" or row.get("retired") is not False
-                            or not isinstance(row.get("record"), dict) or row["record"].get("id") != expected_id):
-                        raise _artifactlib.ArtifactError("INVALID_RESPONSE", "plan task batch contains an invalid or unexpected record")
-                    yield row["record"]
-                if page["next_offset"] is None:
-                    break
-                offset = end
-            else:
-                raise _artifactlib.ArtifactError("INVALID_RESPONSE", "plan task batch did not terminate")
-
-    same_identity(client.call("identity", {"artifact_id": artifact_id}))
     root = _artifactlib._trusted_directory(client.root, "UNSAFE_ROOT")
     diagnostics: list[str] = []
-    seen: set[str] = set()
+    last_task_id = ""
     command_count = 0
     offset, total = 0, None
     for _ in range(8193):
-        request = {"artifact_id": artifact_id, "offset": offset, "budget": 16384}
-        if offset:
-            request["model_sha256"] = identity["model_sha256"]
-        page = client.call("outline", request)
+        try:
+            page = client.call("plan-verification", {
+                "artifact_id": artifact_id, "expected": {key: identity[key] for key in keys},
+                "offset": offset, "budget": 16384,
+            })
+        except _artifactlib.ArtifactError as exc:
+            if exc.code == "STALE_CURSOR":
+                raise _artifactlib.ArtifactError("STALE_PLAN_PREFLIGHT", "plan identity changed during verification preflight; reread the complete current plan") from exc
+            raise
         same_identity(page)
-        _artifactlib.ArtifactClient._check_page(page, offset, "records")
-        if (page.get("offset") != offset or type(page.get("total")) is not int
-                or page["total"] < offset + len(page["records"])
-                or total is not None and page["total"] != total):
-            raise _artifactlib.ArtifactError("INVALID_RESPONSE", "plan outline count or offset changed")
+        _artifactlib.ArtifactClient._check_page(page, offset, "tasks")
+        tasks = page["tasks"]
+        end = offset + len(tasks)
+        if (page.get("context_complete") is not False
+                or type(page.get("offset")) is not int or page["offset"] != offset
+                or type(page.get("total")) is not int or page["total"] < end
+                or total is not None and page["total"] != total
+                or not tasks and page["total"] != 0
+                or page["next_offset"] != (end if end < page["total"] else None)):
+            raise _artifactlib.ArtifactError("INVALID_RESPONSE", "plan verification count, offset or completeness changed")
         total = page["total"]
-        tasks = []
-        for row in page["records"]:
-            if (not isinstance(row, dict) or not isinstance(row.get("id"), str)
-                    or row["id"] in seen or type(row.get("retired")) is not bool):
-                raise _artifactlib.ArtifactError("INVALID_RESPONSE", "plan outline contains an invalid or duplicate record")
-            seen.add(row["id"])
-            if row.get("kind") != "tasks" or row["retired"]:
-                continue
-            tasks.append(row["id"])
-        for task in task_records(tasks):
-            if not isinstance(task.get("verification"), list) or not task["verification"]:
-                raise _artifactlib.ArtifactError("INVALID_RESPONSE", "plan task lacks complete verification definitions")
+        for task in tasks:
+            if (not isinstance(task, dict) or set(task) != {"id", "verification"}
+                    or not isinstance(task.get("id"), str) or task["id"] <= last_task_id
+                    or not isinstance(task.get("verification"), list) or not task["verification"]):
+                raise _artifactlib.ArtifactError("INVALID_RESPONSE", "plan verification contains an invalid, unordered or incomplete task")
+            last_task_id = task["id"]
             for number, definition in enumerate(task["verification"], 1):
                 command_count += 1
                 try:
@@ -177,17 +151,11 @@ def _preflight_plan_verification(client: Any, identity: dict[str, Any]) -> dict[
                 except (_artifactlib.ArtifactError, _artifactauthoritylib.AuthorityError) as exc:
                     argv = definition.get("argv") if isinstance(definition, dict) else None
                     diagnostics.append(f"{task['id']} verification[{number}] {json.dumps(argv, ensure_ascii=True)}: {exc}")
-        next_offset = page["next_offset"]
-        expected = offset + len(page["records"])
-        if next_offset is None:
-            if expected != total:
-                raise _artifactlib.ArtifactError("INVALID_RESPONSE", "plan outline ended before every record was inspected")
+        if page["next_offset"] is None:
             break
-        if next_offset != expected:
-            raise _artifactlib.ArtifactError("INVALID_RESPONSE", "plan outline skipped records")
-        offset = next_offset
+        offset = end
     else:
-        raise _artifactlib.ArtifactError("INVALID_RESPONSE", "plan outline did not terminate")
+        raise _artifactlib.ArtifactError("INVALID_RESPONSE", "plan verification did not terminate")
     try:
         snapshot = client.call("snapshot", {"artifact_id": artifact_id})
     except _artifactlib.ArtifactError as exc:

package/plugins/ca-pi/hooks/_host.py

@@ -11,7 +11,7 @@ import hostapi  # noqa: E402
 class PiHost(hostapi.Host):
     name = "pi"
     adapter_name = "@arbiterforge/ca-pi"
-    adapter_version = "0.17.6"
+    adapter_version = "0.17.7"
     update_target = "ca-pi"
     update_tag_prefix = "ca-pi-v"
     update_command = "pi update npm:@arbiterforge/ca-pi"

package/plugins/ca-pi/hooks/hostapi.py

@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "2.25.5"
+    adapter_version = "2.25.6"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,

package/plugins/ca-pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.17.6",
+  "version": "0.17.7",
   "private": true,
   "license": "AGPL-3.0-only",
   "type": "module",