@arbiterforge/ca-pi 0.18.0 → 0.18.2

package/README.md

@@ -10,7 +10,7 @@ and durable project context. You decide. codeArbiter enforces.
 <img alt="Claude Code plugin" src="https://img.shields.io/badge/Claude_Code-plugin-d97757">
 <img alt="Codex plugin" src="https://img.shields.io/badge/OpenAI_Codex-plugin-10a37f">
 <img alt="Pi Feature Forge preview" src="https://img.shields.io/badge/ca--pi-Feature_Forge_preview-d97757">
-<img alt="version 2.26.0" src="https://img.shields.io/badge/version-2.26.0-2b7489">
+<img alt="version 2.26.2" src="https://img.shields.io/badge/version-2.26.2-2b7489">
 <img alt="core lanes" src="https://img.shields.io/badge/core_lanes-18-555">
 <img alt="skills" src="https://img.shields.io/badge/skills-22-555">
 <img alt="agents" src="https://img.shields.io/badge/agents-20-555">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.18.0",
+  "version": "0.18.2",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/plugins/ca-pi/CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to `ca-pi` are documented in this file.
 
 ## [Unreleased]
 
+## [0.18.2] - 2026-10-12
+
+### Fixed
+
+- Allow initialized Windows artifact stores to be observed without write access (#971).
+- Pin the repository, metadata directories, and lock file against replacement while preserving reader/writer exclusion. Missing or unsafe lock state refuses without initialization.
+
+## [0.18.1] - 2026-10-12
+
+### Fixed
+
+- Reproduce normal ORT histogram conflicts in guarded legacy block resolution while preserving exact rendering and index/CAS controls (#968).
+- Clarify unknown host qualification and complete the repository-scoped maintenance commands.
+
+
 ## [0.18.0] - 2026-10-10
 
 ### Changed

package/plugins/ca-pi/helpers/artifacts/release.json

@@ -6,43 +6,43 @@
   "binaries": {
     "darwin/amd64": {
       "file": "ca-artifact-darwin-amd64",
-      "sha256": "e35e21caa147a5e6c9d04fd400b5b4fcdb2d1d9cec9119d70249fcb80aeb3512",
+      "sha256": "0641b0b8014cd8498ab81144e631d9712d3eb5224fcd2726e899149d7ade7175",
       "native_tested": true
     },
     "darwin/arm64": {
       "file": "ca-artifact-darwin-arm64",
-      "sha256": "dc9157c6ecf48fe05c20351b276ef8c2037847eaedee9dfb88b4f8d0b685b51e",
+      "sha256": "9a8bb6a130c8fbd17f0bf20c7f6a9286440e86003ec41eef934fc882a7ae41ca",
       "native_tested": true
     },
     "linux/amd64": {
       "file": "ca-artifact-linux-amd64",
-      "sha256": "6fbd763c319d423291832f796515a4c8202d04e8785ea9ce178a495d917049d6",
+      "sha256": "c0638efca21039ada655c4ebc488c18500eeb0dbc730dd8cb76d878be8a0878e",
       "native_tested": true
     },
     "linux/arm64": {
       "file": "ca-artifact-linux-arm64",
-      "sha256": "2b623d4329665513fb11a99e866e30c579a47172ffd16f6faaae21bf21fda83d",
+      "sha256": "204f5f549aa2f75d16f194aba964b14a367c9992d5e0b4cc88c262999141251b",
       "native_tested": true
     },
     "windows/amd64": {
       "file": "ca-artifact-windows-amd64.exe",
-      "sha256": "44003f24b77a5cd51b63fe991a8775462619e2b2130c1162d36450a0570970d8",
+      "sha256": "1976f22b63679478b1c1f4b5f6b13f1d9ae60c9602e4cbc420073626ce8c20d8",
       "native_tested": true
     },
     "windows/arm64": {
       "file": "ca-artifact-windows-arm64.exe",
-      "sha256": "37efc98301beec7c0bf465dee6f4bb48152abef515ae55aa37bff628e969e5bd",
+      "sha256": "9d50c8a72029483fc425ac2a27c1f5bfd43362454cc1e8cc8eb28d33ec2fa0db",
       "native_tested": true
     }
   },
   "context_qualification": {
     "darwin/amd64": {
-      "source_commit": "54471947e1622fa35233a0fdc16ab42d05267ecb",
+      "source_commit": "e33bb87b30d4a3ac3286378ad9ec5bff70140392",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "38250134924",
-      "binary_sha256": "e35e21caa147a5e6c9d04fd400b5b4fcdb2d1d9cec9119d70249fcb80aeb3512",
-      "observation_sha256": "36cbcb4c398592e658bc2e3d249ade3ff650c1aece503aea9f218ad80679e5db",
-      "module_sha256": "05b0359c108baf52bd3884c36969febc3f98e53786cf80da757115bee5ac9dc2",
+      "run_id": "38289702788",
+      "binary_sha256": "0641b0b8014cd8498ab81144e631d9712d3eb5224fcd2726e899149d7ade7175",
+      "observation_sha256": "3c527a2e9eb02e95c49409e3d71d15632d6e7807a3f74fcc56f9b4808bbe2259",
+      "module_sha256": "4c2f7af945966dbe8e0b31459a87bc1f5ebc40de544a3c42508d824ef82eeb23",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -53,12 +53,12 @@
       ]
     },
     "darwin/arm64": {
-      "source_commit": "54471947e1622fa35233a0fdc16ab42d05267ecb",
+      "source_commit": "e33bb87b30d4a3ac3286378ad9ec5bff70140392",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "38250134924",
-      "binary_sha256": "dc9157c6ecf48fe05c20351b276ef8c2037847eaedee9dfb88b4f8d0b685b51e",
-      "observation_sha256": "b4f9a083e3772d3296826a40ad8364c4faf046d21af0b7bea7e152eb0bda54df",
-      "module_sha256": "05b0359c108baf52bd3884c36969febc3f98e53786cf80da757115bee5ac9dc2",
+      "run_id": "38289702788",
+      "binary_sha256": "9a8bb6a130c8fbd17f0bf20c7f6a9286440e86003ec41eef934fc882a7ae41ca",
+      "observation_sha256": "eba5853f45cc7866ff6dcb94059197f753c25f6295a6a45de748a04bf7e273b4",
+      "module_sha256": "4c2f7af945966dbe8e0b31459a87bc1f5ebc40de544a3c42508d824ef82eeb23",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -69,12 +69,12 @@
       ]
     },
     "linux/amd64": {
-      "source_commit": "54471947e1622fa35233a0fdc16ab42d05267ecb",
+      "source_commit": "e33bb87b30d4a3ac3286378ad9ec5bff70140392",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "38250134924",
-      "binary_sha256": "6fbd763c319d423291832f796515a4c8202d04e8785ea9ce178a495d917049d6",
-      "observation_sha256": "9b040d91f1775fda353b53130c557882ac3be4b7eeed55ebc83fe39d508ff269",
-      "module_sha256": "05b0359c108baf52bd3884c36969febc3f98e53786cf80da757115bee5ac9dc2",
+      "run_id": "38289702788",
+      "binary_sha256": "c0638efca21039ada655c4ebc488c18500eeb0dbc730dd8cb76d878be8a0878e",
+      "observation_sha256": "87ac254be4179136dc1f0e02650182dddac6045b28bd2c2e19889abe1af26665",
+      "module_sha256": "4c2f7af945966dbe8e0b31459a87bc1f5ebc40de544a3c42508d824ef82eeb23",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -85,12 +85,12 @@
       ]
     },
     "linux/arm64": {
-      "source_commit": "54471947e1622fa35233a0fdc16ab42d05267ecb",
+      "source_commit": "e33bb87b30d4a3ac3286378ad9ec5bff70140392",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "38250134924",
-      "binary_sha256": "2b623d4329665513fb11a99e866e30c579a47172ffd16f6faaae21bf21fda83d",
-      "observation_sha256": "c723a04d24d46eb6f95d5665485bd3cc11d2379be2ebad328b3afc4f66ec6be3",
-      "module_sha256": "05b0359c108baf52bd3884c36969febc3f98e53786cf80da757115bee5ac9dc2",
+      "run_id": "38289702788",
+      "binary_sha256": "204f5f549aa2f75d16f194aba964b14a367c9992d5e0b4cc88c262999141251b",
+      "observation_sha256": "9459a65d3dac40380fd15e853cf1e16d3d41f7e786c9c31a0de232b4a4b569f5",
+      "module_sha256": "4c2f7af945966dbe8e0b31459a87bc1f5ebc40de544a3c42508d824ef82eeb23",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -101,12 +101,12 @@
       ]
     },
     "windows/amd64": {
-      "source_commit": "54471947e1622fa35233a0fdc16ab42d05267ecb",
+      "source_commit": "e33bb87b30d4a3ac3286378ad9ec5bff70140392",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "38250134924",
-      "binary_sha256": "44003f24b77a5cd51b63fe991a8775462619e2b2130c1162d36450a0570970d8",
-      "observation_sha256": "1bbcf5fe0c13648e81c643c976a5f456cd2a3c3bbfe7c9a7642a6cdf8e71c68b",
-      "module_sha256": "05b0359c108baf52bd3884c36969febc3f98e53786cf80da757115bee5ac9dc2",
+      "run_id": "38289702788",
+      "binary_sha256": "1976f22b63679478b1c1f4b5f6b13f1d9ae60c9602e4cbc420073626ce8c20d8",
+      "observation_sha256": "80800ef282ee480aaeafca21141ee23e2104e5f22948677d020768b7d6cce939",
+      "module_sha256": "4c2f7af945966dbe8e0b31459a87bc1f5ebc40de544a3c42508d824ef82eeb23",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -117,12 +117,12 @@
       ]
     },
     "windows/arm64": {
-      "source_commit": "54471947e1622fa35233a0fdc16ab42d05267ecb",
+      "source_commit": "e33bb87b30d4a3ac3286378ad9ec5bff70140392",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "38250134924",
-      "binary_sha256": "37efc98301beec7c0bf465dee6f4bb48152abef515ae55aa37bff628e969e5bd",
-      "observation_sha256": "78f3c133923c66945b84e1b4a9f02a6edbfb357e1be4f7d2e1b8e3123b2b17e2",
-      "module_sha256": "05b0359c108baf52bd3884c36969febc3f98e53786cf80da757115bee5ac9dc2",
+      "run_id": "38289702788",
+      "binary_sha256": "9d50c8a72029483fc425ac2a27c1f5bfd43362454cc1e8cc8eb28d33ec2fa0db",
+      "observation_sha256": "01a8e1b91794dbed3d618dc20dd7adf0dcc9597bf9c42e0ba14278197a384f74",
+      "module_sha256": "4c2f7af945966dbe8e0b31459a87bc1f5ebc40de544a3c42508d824ef82eeb23",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",

package/plugins/ca-pi/hooks/_contextmergelib.py

@@ -366,18 +366,23 @@ def _git_conflict_blocks(root, current, base, ours, theirs):
         for path, raw in zip(paths, (ours, base, theirs)):
             path.write_bytes(raw)
         for name, flag in modes:
-            args = [git_executable(), "--no-pager", "--no-lazy-fetch", "-c", "core.fsmonitor=false",
-                    "-c", "core.untrackedCache=false", "-c", "merge.conflictStyle=merge",
-                    "merge-file", "--stdout", "--marker-size=" + str(size)]
-            if flag:
-                args.append(flag)
-            for label in labels:
-                args.extend(("-L", label.decode("utf-8", "strict")))
-            result = subprocess.run([*args, *(str(path) for path in paths)], cwd=root, env=env,
-                                    capture_output=True, shell=False, timeout=30)
-            _require(len(result.stdout) <= MAX_BYTES, "Git conflict rendering is oversized")
-            if 1 <= result.returncode <= 127 and result.stdout.replace(b"\r\n", b"\n") == current.replace(b"\r\n", b"\n"):
-                return payload, name
+            # Retain merge-file's historical default and reproduce ORT's
+            # histogram alignment, still requiring the complete exact rendering.
+            for algorithm in (None, "histogram"):
+                args = [git_executable(), "--no-pager", "--no-lazy-fetch", "-c", "core.fsmonitor=false",
+                        "-c", "core.untrackedCache=false", "-c", "merge.conflictStyle=merge",
+                        "merge-file", "--stdout", "--marker-size=" + str(size)]
+                if flag:
+                    args.append(flag)
+                if algorithm:
+                    args.append("--diff-algorithm=" + algorithm)
+                for label in labels:
+                    args.extend(("-L", label.decode("utf-8", "strict")))
+                result = subprocess.run([*args, *(str(path) for path in paths)], cwd=root, env=env,
+                                        capture_output=True, shell=False, timeout=30)
+                _require(len(result.stdout) <= MAX_BYTES, "Git conflict rendering is oversized")
+                if 1 <= result.returncode <= 127 and result.stdout.replace(b"\r\n", b"\n") == current.replace(b"\r\n", b"\n"):
+                    return payload, name
     raise ResolutionError("worktree is not Git's current three-stage rendering")
 
 

package/plugins/ca-pi/hooks/_host.py

@@ -11,7 +11,7 @@ import hostapi  # noqa: E402
 class PiHost(hostapi.Host):
     name = "pi"
     adapter_name = "@arbiterforge/ca-pi"
-    adapter_version = "0.18.0"
+    adapter_version = "0.18.2"
     update_target = "ca-pi"
     update_tag_prefix = "ca-pi-v"
     update_command = "pi update npm:@arbiterforge/ca-pi"

package/plugins/ca-pi/hooks/hostapi.py

@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "2.26.0"
+    adapter_version = "2.26.2"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,

package/plugins/ca-pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.18.0",
+  "version": "0.18.2",
   "private": true,
   "license": "AGPL-3.0-only",
   "type": "module",

package/plugins/ca-pi/routines/commit-gate/SKILL.md

@@ -114,16 +114,33 @@ Run an **incremental re-scout for each affected document**, scoped to its select
 - **Claim still holds → silently re-baseline only that document's provenance record.** Call `_provenancelib.rebaseline(doc_provenance, selected_current_hashes)` where `selected_current_hashes` contains current hashes only for the selected staged paths whose claims in that document were inspected and still hold. Do not re-baseline a path whose claim changed or was not inspected. Stage only `.codearbiter/.provenance/<doc>.json` by explicit path so the re-baselined record rides THIS commit (ADR-0008 ride-along pattern — nothing is surfaced to the user). After staging, re-run the secrets scan from `tech-stack.md` over the newly-staged path(s) — any file staged after Phase 4 must still pass the automated secrets scan before the commit proceeds. A missing current hash (deletion or rename) cannot be silently re-baselined; surface it in Phase 6 for review.
 - **Claim changed → route to the existing Phase 6 diff-review.** Propose only the affected doc or code-map edit required to reflect its changed claim. The user reviews that edit in the normal diff, and Phase 7 stages approved paths explicitly; do not silently rewrite or add unrelated documentation.
 
-For reviewed legacy code-map metadata, use the shipped fixed-target helper at
-`<plugin-root>/hooks/resolve-context-conflict.py`. Run `--root "<project-root>"
-inspect-claims`, then `--root "<project-root>" refresh-claims --expected <binding>
---claims <json-array>` with one to four reviewed records containing exactly
+For reviewed legacy code-map metadata in codeArbiter's source layout, use the
+shipped fixed-target helper at `<plugin-root>/hooks/resolve-context-conflict.py`.
+This claim-refresh lane reads all three fixed source manifests:
+`<project-root>/plugins/ca/.claude-plugin/plugin.json`,
+`<project-root>/plugins/ca-codex/.codex-plugin/plugin.json`, and `<project-root>/plugins/ca-pi/package.json`,
+even for a date-only refresh. Other repository layouts and arbitrary manifest
+claims are unsupported.
+
+Resolve the interpreter once by presence, then inspect:
+
+```sh
+PY=python3; { command -v python3 >/dev/null 2>&1 && python3 --version >/dev/null 2>&1; } || PY=python
+"$PY" "<plugin-root>/hooks/resolve-context-conflict.py" --root "<project-root>" inspect-claims
+```
+
+Pass the returned `binding` to the same helper and interpreter:
+
+```sh
+"$PY" "<plugin-root>/hooks/resolve-context-conflict.py" --root "<project-root>" refresh-claims --expected '<binding>' --claims '<json-array>'
+```
+
+Supply one to four reviewed records containing exactly
 `field`, `before`, and `after`. The supported existing fields are `ca_version`,
 `codex_version`, `pi_version`, and `metadata_date`. Use the inspection's exact
 current claim as `before`; a version's `after` must match its fixed source
-manifest, and the date must match `inspection_date`. Select the interpreter once
-by presence and use it for both calls; never retry a failed operation under
-another interpreter.
+manifest, and the date must match `inspection_date`. Use the selected interpreter
+for both calls; never retry a failed operation under another interpreter.
 
 This operation requires resolved, tracked legacy schema-1 document/provenance
 and no native or uncertain journal ownership. It binds document, provenance,

package/plugins/ca-pi/routines/finishing-a-development-branch/SKILL.md

@@ -169,9 +169,20 @@ qualification remains unchanged. Re-run the current-head review and CI
 requirements after integration; previous green evidence does not bind new code.
 
 For an explicitly selected per-block resolution, use the same shipped helper
-with `--root "<project-root>" inspect-blocks`, then `--root "<project-root>"
-resolve-blocks --expected <binding> --choices <json-array>`. Review each block
-and supply exactly one `"ours"` or `"theirs"` choice in its displayed order. The
+and the interpreter already selected by presence:
+
+```sh
+"$PY" "<plugin-root>/hooks/resolve-context-conflict.py" --root "<project-root>" inspect-blocks
+```
+
+Pass the returned `binding` to the same helper and interpreter:
+
+```sh
+"$PY" "<plugin-root>/hooks/resolve-context-conflict.py" --root "<project-root>" resolve-blocks --expected '<binding>' --choices '<json-array>'
+```
+
+Review each block and supply exactly one `"ours"` or `"theirs"` choice in its
+displayed order. The
 inspection returns the block count and side hashes; read the conflict document
 to review the actual text. This is a separate operation: `restore-head` keeps
 its original single-block exact-HEAD contract.

package/plugins/ca-pi/skills/ca-commit/SKILL.md

@@ -114,16 +114,33 @@ Run an **incremental re-scout for each affected document**, scoped to its select
 - **Claim still holds → silently re-baseline only that document's provenance record.** Call `_provenancelib.rebaseline(doc_provenance, selected_current_hashes)` where `selected_current_hashes` contains current hashes only for the selected staged paths whose claims in that document were inspected and still hold. Do not re-baseline a path whose claim changed or was not inspected. Stage only `.codearbiter/.provenance/<doc>.json` by explicit path so the re-baselined record rides THIS commit (ADR-0008 ride-along pattern — nothing is surfaced to the user). After staging, re-run the secrets scan from `tech-stack.md` over the newly-staged path(s) — any file staged after Phase 4 must still pass the automated secrets scan before the commit proceeds. A missing current hash (deletion or rename) cannot be silently re-baselined; surface it in Phase 6 for review.
 - **Claim changed → route to the existing Phase 6 diff-review.** Propose only the affected doc or code-map edit required to reflect its changed claim. The user reviews that edit in the normal diff, and Phase 7 stages approved paths explicitly; do not silently rewrite or add unrelated documentation.
 
-For reviewed legacy code-map metadata, use the shipped fixed-target helper at
-`<plugin-root>/hooks/resolve-context-conflict.py`. Run `--root "<project-root>"
-inspect-claims`, then `--root "<project-root>" refresh-claims --expected <binding>
---claims <json-array>` with one to four reviewed records containing exactly
+For reviewed legacy code-map metadata in codeArbiter's source layout, use the
+shipped fixed-target helper at `<plugin-root>/hooks/resolve-context-conflict.py`.
+This claim-refresh lane reads all three fixed source manifests:
+`<project-root>/plugins/ca/.claude-plugin/plugin.json`,
+`<project-root>/plugins/ca-codex/.codex-plugin/plugin.json`, and `<project-root>/plugins/ca-pi/package.json`,
+even for a date-only refresh. Other repository layouts and arbitrary manifest
+claims are unsupported.
+
+Resolve the interpreter once by presence, then inspect:
+
+```sh
+PY=python3; { command -v python3 >/dev/null 2>&1 && python3 --version >/dev/null 2>&1; } || PY=python
+"$PY" "<plugin-root>/hooks/resolve-context-conflict.py" --root "<project-root>" inspect-claims
+```
+
+Pass the returned `binding` to the same helper and interpreter:
+
+```sh
+"$PY" "<plugin-root>/hooks/resolve-context-conflict.py" --root "<project-root>" refresh-claims --expected '<binding>' --claims '<json-array>'
+```
+
+Supply one to four reviewed records containing exactly
 `field`, `before`, and `after`. The supported existing fields are `ca_version`,
 `codex_version`, `pi_version`, and `metadata_date`. Use the inspection's exact
 current claim as `before`; a version's `after` must match its fixed source
-manifest, and the date must match `inspection_date`. Select the interpreter once
-by presence and use it for both calls; never retry a failed operation under
-another interpreter.
+manifest, and the date must match `inspection_date`. Use the selected interpreter
+for both calls; never retry a failed operation under another interpreter.
 
 This operation requires resolved, tracked legacy schema-1 document/provenance
 and no native or uncertain journal ownership. It binds document, provenance,

package/plugins/ca-pi/skills/ca-init/SKILL.md

@@ -52,8 +52,9 @@ a qualified host.
 When these prerequisites are unavailable or unknown, report the missing
 capability before invoking the scaffolder. Keep a fresh repository unactivated
 and retain every byte of any existing partial state. Name the loaded package,
-actual host limitation, selected population route and next missing prerequisite
-in the handoff; leave unobserved qualification and prior operation identities
+observed host limitation or explicitly unknown qualification, selected
+population route and next missing prerequisite in the handoff; leave
+unobserved qualification and prior operation identities
 unknown. Resume on a host only after fresh containment and writer qualification,
 using the existing interrupted-population recovery procedure. No supported
 destination is implied by this guidance.

package/plugins/ca-pi/skills/ca-pr/SKILL.md

@@ -169,9 +169,20 @@ qualification remains unchanged. Re-run the current-head review and CI
 requirements after integration; previous green evidence does not bind new code.
 
 For an explicitly selected per-block resolution, use the same shipped helper
-with `--root "<project-root>" inspect-blocks`, then `--root "<project-root>"
-resolve-blocks --expected <binding> --choices <json-array>`. Review each block
-and supply exactly one `"ours"` or `"theirs"` choice in its displayed order. The
+and the interpreter already selected by presence:
+
+```sh
+"$PY" "<plugin-root>/hooks/resolve-context-conflict.py" --root "<project-root>" inspect-blocks
+```
+
+Pass the returned `binding` to the same helper and interpreter:
+
+```sh
+"$PY" "<plugin-root>/hooks/resolve-context-conflict.py" --root "<project-root>" resolve-blocks --expected '<binding>' --choices '<json-array>'
+```
+
+Review each block and supply exactly one `"ours"` or `"theirs"` choice in its
+displayed order. The
 inspection returns the block count and side hashes; read the conflict document
 to review the actual text. This is a separate operation: `restore-head` keeps
 its original single-block exact-HEAD contract.