@arbiterforge/ca-pi 0.18.2 → 0.18.4

package/README.md

@@ -10,7 +10,7 @@ and durable project context. You decide. codeArbiter enforces.
 <img alt="Claude Code plugin" src="https://img.shields.io/badge/Claude_Code-plugin-d97757">
 <img alt="Codex plugin" src="https://img.shields.io/badge/OpenAI_Codex-plugin-10a37f">
 <img alt="Pi Feature Forge preview" src="https://img.shields.io/badge/ca--pi-Feature_Forge_preview-d97757">
-<img alt="version 2.26.2" src="https://img.shields.io/badge/version-2.26.2-2b7489">
+<img alt="version 2.26.4" src="https://img.shields.io/badge/version-2.26.4-2b7489">
 <img alt="core lanes" src="https://img.shields.io/badge/core_lanes-18-555">
 <img alt="skills" src="https://img.shields.io/badge/skills-22-555">
 <img alt="agents" src="https://img.shields.io/badge/agents-20-555">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.18.2",
+  "version": "0.18.4",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/plugins/ca-pi/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `ca-pi` are documented in this file.
 
 ## [Unreleased]
 
+## [0.18.4] - 2026-10-13
+
+### Fixed
+
+- Fix task reconciliation for Unicode text while preserving armed requests and prompt-route integrity.
+
+## [0.18.3] - 2026-10-13
+
+### Fixed
+
+- Synchronize the shared authority adapter with the Codex runtime compatibility repair while preserving Pi's existing host contract.
+
 ## [0.18.2] - 2026-10-12
 
 ### Fixed

package/plugins/ca-pi/helpers/artifacts/release.json

@@ -6,43 +6,43 @@
   "binaries": {
     "darwin/amd64": {
       "file": "ca-artifact-darwin-amd64",
-      "sha256": "0641b0b8014cd8498ab81144e631d9712d3eb5224fcd2726e899149d7ade7175",
+      "sha256": "42f302c05c66b22294bff0bdacbd28d5373ddd64b447f087a4532cd99f0a1b6c",
       "native_tested": true
     },
     "darwin/arm64": {
       "file": "ca-artifact-darwin-arm64",
-      "sha256": "9a8bb6a130c8fbd17f0bf20c7f6a9286440e86003ec41eef934fc882a7ae41ca",
+      "sha256": "adf818a92d6d45db8d13a4ec685b2e2e14ddd19d0978c3d820541c45ed5cd4d9",
       "native_tested": true
     },
     "linux/amd64": {
       "file": "ca-artifact-linux-amd64",
-      "sha256": "c0638efca21039ada655c4ebc488c18500eeb0dbc730dd8cb76d878be8a0878e",
+      "sha256": "8090a552d8a40bd3d37075eb81005d4e2bc4cdefac3ecb04cef8d72ef00f64d5",
       "native_tested": true
     },
     "linux/arm64": {
       "file": "ca-artifact-linux-arm64",
-      "sha256": "204f5f549aa2f75d16f194aba964b14a367c9992d5e0b4cc88c262999141251b",
+      "sha256": "0e65ced478bc490e80d6ab5323d307ceffdf42830709563cd6740ef5f35fb069",
       "native_tested": true
     },
     "windows/amd64": {
       "file": "ca-artifact-windows-amd64.exe",
-      "sha256": "1976f22b63679478b1c1f4b5f6b13f1d9ae60c9602e4cbc420073626ce8c20d8",
+      "sha256": "687e362c216634b531371b4238d129a5f09df716d8cf73b6123f20d4c40c9d36",
       "native_tested": true
     },
     "windows/arm64": {
       "file": "ca-artifact-windows-arm64.exe",
-      "sha256": "9d50c8a72029483fc425ac2a27c1f5bfd43362454cc1e8cc8eb28d33ec2fa0db",
+      "sha256": "bc4920311a4e3768439b9c35bd0aca77f1ab964011d7812dd8932fc7360527a0",
       "native_tested": true
     }
   },
   "context_qualification": {
     "darwin/amd64": {
-      "source_commit": "e33bb87b30d4a3ac3286378ad9ec5bff70140392",
+      "source_commit": "045c0812888f20f4c843677cfb37b802e2084770",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "38289702788",
-      "binary_sha256": "0641b0b8014cd8498ab81144e631d9712d3eb5224fcd2726e899149d7ade7175",
-      "observation_sha256": "3c527a2e9eb02e95c49409e3d71d15632d6e7807a3f74fcc56f9b4808bbe2259",
-      "module_sha256": "4c2f7af945966dbe8e0b31459a87bc1f5ebc40de544a3c42508d824ef82eeb23",
+      "run_id": "38575955363",
+      "binary_sha256": "42f302c05c66b22294bff0bdacbd28d5373ddd64b447f087a4532cd99f0a1b6c",
+      "observation_sha256": "e03881ae6e4baf8095597869933ae43dd90b4e1c97bd56dbd83ec57535f6ad7f",
+      "module_sha256": "e482ad7b0c9264711828ac8404c624517b893981b45712d70ead0fb0ef3b5522",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -53,12 +53,12 @@
       ]
     },
     "darwin/arm64": {
-      "source_commit": "e33bb87b30d4a3ac3286378ad9ec5bff70140392",
+      "source_commit": "045c0812888f20f4c843677cfb37b802e2084770",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "38289702788",
-      "binary_sha256": "9a8bb6a130c8fbd17f0bf20c7f6a9286440e86003ec41eef934fc882a7ae41ca",
-      "observation_sha256": "eba5853f45cc7866ff6dcb94059197f753c25f6295a6a45de748a04bf7e273b4",
-      "module_sha256": "4c2f7af945966dbe8e0b31459a87bc1f5ebc40de544a3c42508d824ef82eeb23",
+      "run_id": "38575955363",
+      "binary_sha256": "adf818a92d6d45db8d13a4ec685b2e2e14ddd19d0978c3d820541c45ed5cd4d9",
+      "observation_sha256": "053780b4155a329003e9d8402a90be022ac1750e5f1420ea46a5079931464fd6",
+      "module_sha256": "e482ad7b0c9264711828ac8404c624517b893981b45712d70ead0fb0ef3b5522",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -69,12 +69,12 @@
       ]
     },
     "linux/amd64": {
-      "source_commit": "e33bb87b30d4a3ac3286378ad9ec5bff70140392",
+      "source_commit": "045c0812888f20f4c843677cfb37b802e2084770",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "38289702788",
-      "binary_sha256": "c0638efca21039ada655c4ebc488c18500eeb0dbc730dd8cb76d878be8a0878e",
-      "observation_sha256": "87ac254be4179136dc1f0e02650182dddac6045b28bd2c2e19889abe1af26665",
-      "module_sha256": "4c2f7af945966dbe8e0b31459a87bc1f5ebc40de544a3c42508d824ef82eeb23",
+      "run_id": "38575955363",
+      "binary_sha256": "8090a552d8a40bd3d37075eb81005d4e2bc4cdefac3ecb04cef8d72ef00f64d5",
+      "observation_sha256": "e83da7b877c8e37761b826b6a45bee44e009066a66c18309d2f854ed0d94096b",
+      "module_sha256": "e482ad7b0c9264711828ac8404c624517b893981b45712d70ead0fb0ef3b5522",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -85,12 +85,12 @@
       ]
     },
     "linux/arm64": {
-      "source_commit": "e33bb87b30d4a3ac3286378ad9ec5bff70140392",
+      "source_commit": "045c0812888f20f4c843677cfb37b802e2084770",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "38289702788",
-      "binary_sha256": "204f5f549aa2f75d16f194aba964b14a367c9992d5e0b4cc88c262999141251b",
-      "observation_sha256": "9459a65d3dac40380fd15e853cf1e16d3d41f7e786c9c31a0de232b4a4b569f5",
-      "module_sha256": "4c2f7af945966dbe8e0b31459a87bc1f5ebc40de544a3c42508d824ef82eeb23",
+      "run_id": "38575955363",
+      "binary_sha256": "0e65ced478bc490e80d6ab5323d307ceffdf42830709563cd6740ef5f35fb069",
+      "observation_sha256": "dbaace14fca6456b29dbb71360fe9d2f0ab73738bad9c09486f0964358958a07",
+      "module_sha256": "e482ad7b0c9264711828ac8404c624517b893981b45712d70ead0fb0ef3b5522",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -101,12 +101,12 @@
       ]
     },
     "windows/amd64": {
-      "source_commit": "e33bb87b30d4a3ac3286378ad9ec5bff70140392",
+      "source_commit": "045c0812888f20f4c843677cfb37b802e2084770",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "38289702788",
-      "binary_sha256": "1976f22b63679478b1c1f4b5f6b13f1d9ae60c9602e4cbc420073626ce8c20d8",
-      "observation_sha256": "80800ef282ee480aaeafca21141ee23e2104e5f22948677d020768b7d6cce939",
-      "module_sha256": "4c2f7af945966dbe8e0b31459a87bc1f5ebc40de544a3c42508d824ef82eeb23",
+      "run_id": "38575955363",
+      "binary_sha256": "687e362c216634b531371b4238d129a5f09df716d8cf73b6123f20d4c40c9d36",
+      "observation_sha256": "575df189640f478ffdbc593f4a070c4e407b0f50b7787d20632eb3586bc16cee",
+      "module_sha256": "e482ad7b0c9264711828ac8404c624517b893981b45712d70ead0fb0ef3b5522",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -117,12 +117,12 @@
       ]
     },
     "windows/arm64": {
-      "source_commit": "e33bb87b30d4a3ac3286378ad9ec5bff70140392",
+      "source_commit": "045c0812888f20f4c843677cfb37b802e2084770",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "38289702788",
-      "binary_sha256": "9d50c8a72029483fc425ac2a27c1f5bfd43362454cc1e8cc8eb28d33ec2fa0db",
-      "observation_sha256": "01a8e1b91794dbed3d618dc20dd7adf0dcc9597bf9c42e0ba14278197a384f74",
-      "module_sha256": "4c2f7af945966dbe8e0b31459a87bc1f5ebc40de544a3c42508d824ef82eeb23",
+      "run_id": "38575955363",
+      "binary_sha256": "bc4920311a4e3768439b9c35bd0aca77f1ab964011d7812dd8932fc7360527a0",
+      "observation_sha256": "1b6574772d1e93c2cd59ff43d519e343d44926312cf4d90b840207b0a625d3f9",
+      "module_sha256": "e482ad7b0c9264711828ac8404c624517b893981b45712d70ead0fb0ef3b5522",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",

package/plugins/ca-pi/hooks/_artifactauthoritylib.py

@@ -117,7 +117,11 @@ CLAUDE_REVIEW_PROFILE = "claude-review/0.1.0"
 CODEX_REVIEW_PROFILE = "codex-review/0.1.0"
 CODEX_NATIVE_V1 = "codex-native-v1/0.145.0"
 CODEX_NATIVE_V2 = "codex-native-v2/0.162.0-alpha.2"
-CODEX_NATIVE_PROFILES = frozenset({CODEX_NATIVE_V1, CODEX_NATIVE_V2})
+# This version identifies our evidence protocol, never the host release.
+CODEX_NATIVE_PROTOCOL = "codex-native-collaboration/1.0.0"
+CODEX_COLLABORATION_PROFILES = frozenset({CODEX_NATIVE_V2, CODEX_NATIVE_PROTOCOL})
+CODEX_NATIVE_PROFILES = frozenset({CODEX_NATIVE_V1, *CODEX_COLLABORATION_PROFILES})
+CODEX_RUNTIME_RE = re.compile(r"[0-9]+(?:\.[0-9]+){2}(?:[-+][0-9A-Za-z.+-]+)?", re.ASCII)
 CODEX_UUID_RE = re.compile(r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}")
 CODEX_AGENT_PATH_RE = re.compile(r"/root(?:/[a-z0-9_]+)*")
 CODEX_STEERING_TOOLS = frozenset({
@@ -1179,7 +1183,7 @@ def _reject_overlapping_authority(session_id: str, turn_id: str) -> None:
         launch = request.get("launch") or {}
         if (
             request["state"] in {"LAUNCHING", "RUNNING"}
-            and request.get("codex_review_profile") != CODEX_NATIVE_V2
+            and request.get("codex_review_profile") not in CODEX_COLLABORATION_PROFILES
             and launch.get("parent_session_id") == session_id
             and launch.get("parent_turn_id") == turn_id
         ):
@@ -1500,8 +1504,8 @@ def _dispatch_prompt(request: dict[str, Any], *, legacy_inline: bool = False) ->
         "these settings do not provide an OS sandbox.\n"
         if request.get("codex_review_profile") == CODEX_NATIVE_V1 else ""
     )
-    if request.get("codex_review_profile") == CODEX_NATIVE_V2:
-        profile = (f"Native review profile: {CODEX_NATIVE_V2}. This review was dispatched through "
+    if request.get("codex_review_profile") in CODEX_COLLABORATION_PROFILES:
+        profile = (f"Native review profile: {request['codex_review_profile']}. This review was dispatched through "
                    "collaboration.spawn_agent with default role and fork_turns=none. Read-only conduct "
                    "is cooperative; these settings do not provide an OS sandbox.\n")
     completion = ""
@@ -1600,7 +1604,7 @@ def arm_request(
     if host == "claude" and reviewer_model not in CLAUDE_REVIEWER_MODELS:
         raise AuthorityError("INVALID_AUTHORITY_REQUEST", "reviewer model is unsupported")
     if codex_review_profile is not None and (
-        codex_review_profile not in {"native-v1", "native-v2"} or host != "codex" or activity not in REVIEW_ACTIVITIES
+        codex_review_profile not in {"native", "native-v1", "native-v2"} or host != "codex" or activity not in REVIEW_ACTIVITIES
     ):
         raise AuthorityError("INVALID_AUTHORITY_REQUEST", "Codex review profile is unsupported")
     completion_selection = None
@@ -1652,7 +1656,9 @@ def arm_request(
     if activity == "verification":
         seed_value["context_storage"] = CONTEXT_STORAGE
     if codex_review_profile is not None:
-        seed_value["codex_review_profile"] = CODEX_NATIVE_V1 if codex_review_profile == "native-v1" else CODEX_NATIVE_V2
+        seed_value["codex_review_profile"] = {
+            "native": CODEX_NATIVE_PROTOCOL, "native-v1": CODEX_NATIVE_V1, "native-v2": CODEX_NATIVE_V2,
+        }[codex_review_profile]
         if completion_selection is not None:
             seed_value["context_storage"] = CONTEXT_STORAGE
     seed = _canonical(seed_value)
@@ -3043,6 +3049,16 @@ def _codex_v2_activity(event: dict[str, Any], request: dict[str, Any]) -> dict[s
         raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native activity for exact call is missing or ambiguous")
     activity = matches[0]
     item = activity["item"]
+    if request.get("codex_review_profile") == CODEX_NATIVE_PROTOCOL:
+        # Host records may gain non-authoritative fields. Retained evidence is
+        # closed; required joins, bounds and duplicate-key rejection stay strict.
+        activity = {key: activity[key] for key in (
+            "type", "thread_id", "turn_id", "item", "started_at_ms", "completed_at_ms",
+        ) if key in activity}
+        item = {key: item[key] for key in (
+            "type", "id", "kind", "agent_thread_id", "agent_path",
+        ) if key in item}
+        activity["item"] = item
     if (set(activity) != {"type", "thread_id", "turn_id", "item", "started_at_ms", "completed_at_ms"}
             or set(item) != {"type", "id", "kind", "agent_thread_id", "agent_path"}
             or activity["thread_id"] != anchor["parent_thread_id"] or activity["turn_id"] != launch["parent_turn_id"]
@@ -3054,6 +3070,10 @@ def _codex_v2_activity(event: dict[str, Any], request: dict[str, Any]) -> dict[s
     return activity
 
 
+def _codex_runtime_identity(value: Any) -> bool:
+    return isinstance(value, str) and len(value) <= 128 and CODEX_RUNTIME_RE.fullmatch(value) is not None
+
+
 def _codex_v2_child(event: dict[str, Any]) -> dict[str, Any] | None:
     # Historical V1 lifecycle fixtures/hosts need no native rollout metadata.
     if event.get("transcript_path") is None:
@@ -3065,16 +3085,26 @@ def _codex_v2_child(event: dict[str, Any]) -> dict[str, Any] | None:
         # A V1 Start did not promise native metadata. V2 binding below requires
         # qualified metadata; missing/unsafe bytes still cannot pass V2.
         return None
-    if meta.get("cli_version") != "0.162.0-alpha.2":
+    # Runtime identity is provenance; compatibility comes from the concrete
+    # launch/activity/lifecycle protocol, not a release allowlist.
+    if (not _codex_runtime_identity(meta.get("cli_version"))
+            or not {"id", "parent_thread_id", "session_id", "agent_path"} <= set(meta)):
+        # V1 metadata lacks collaboration fields. Its own lifecycle contract
+        # remains sufficient; collaboration requests require this evidence at bind.
+        return None
+    try:
+        identity = {"cli_version": meta["cli_version"], "thread_id": _codex_uuid(meta.get("id")),
+                    "parent_thread_id": _codex_uuid(meta.get("parent_thread_id")),
+                    "session_id": _host_id(meta.get("session_id"), "session_id"),
+                    "agent_path": meta.get("agent_path"), "metadata_sha256": _digest(raw)}
+    except AuthorityError:
+        # Optional metadata cannot impose collaboration prerequisites on V1.
+        # A collaboration request will reject this absence at profile binding.
         return None
-    identity = {"cli_version": meta["cli_version"], "thread_id": _codex_uuid(meta.get("id")),
-                "parent_thread_id": _codex_uuid(meta.get("parent_thread_id")),
-                "session_id": _host_id(meta.get("session_id"), "session_id"),
-                "agent_path": meta.get("agent_path"), "metadata_sha256": _digest(raw)}
     if (identity["thread_id"] != event["agent_id"] or identity["session_id"] != event.get("session_id")
             or not isinstance(identity["agent_path"], str)
             or CODEX_AGENT_PATH_RE.fullmatch(identity["agent_path"]) is None):
-        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native child metadata differs from its lifecycle")
+        return None
     return identity
 
 
@@ -3085,7 +3115,11 @@ def _codex_v2_bind_child(request: dict[str, Any], child: dict[str, Any]) -> None
             or identity.get("thread_id") != launch["agent_id"]
             or identity.get("session_id") != launch["parent_session_id"]
             or identity.get("agent_path") != launch["task_name"]):
-        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native V2 child runtime or parent association is unqualified")
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native collaboration requires child metadata bound to the exact parent/session/path/UUID")
+    # Only new protocol requests admit differing runtime provenance.
+    if (request.get("codex_review_profile") == CODEX_NATIVE_V2
+            and identity.get("cli_version") != "0.162.0-alpha.2"):
+        raise AuthorityError("UNSUPPORTED_HOST_SEAM", "historical native-v2 request requires its original runtime; arm a new native protocol request")
     launch["native_child"] = identity
 
 
@@ -3173,7 +3207,7 @@ def _read_codex_child(path: Path, agent_id: str, session_id: str) -> dict[str, A
         identity = value["native_v2"]
         if (not isinstance(identity, dict) or set(identity) != {
                 "cli_version", "thread_id", "parent_thread_id", "session_id", "agent_path", "metadata_sha256"}
-                or identity.get("cli_version") != "0.162.0-alpha.2"
+                or not _codex_runtime_identity(identity.get("cli_version"))
                 or identity.get("thread_id") != agent_id or identity.get("session_id") != value["session_id"]
                 or not isinstance(identity.get("parent_thread_id"), str)
                 or CODEX_UUID_RE.fullmatch(identity["parent_thread_id"]) is None
@@ -3224,7 +3258,7 @@ def _codex_native_post(event: dict[str, Any], root: Path, request: dict[str, Any
 
 
 def _codex_native_post_join(event: dict[str, Any], root: Path, request: dict[str, Any]) -> dict[str, Any]:
-    expected_tool = "collaborationspawn_agent" if request.get("codex_review_profile") == CODEX_NATIVE_V2 else "spawn_agent"
+    expected_tool = "collaborationspawn_agent" if request.get("codex_review_profile") in CODEX_COLLABORATION_PROFILES else "spawn_agent"
     if event.get("tool_name") != expected_tool:
         raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native review PostToolUse tool differs from its launch profile")
     if _canonical(event.get("tool_input")) != _canonical(request["launch_envelope"]):
@@ -3238,13 +3272,22 @@ def _codex_native_post_join(event: dict[str, Any], root: Path, request: dict[str
     except ValueError as exc:
         raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native-v1 spawn result is not strict JSON") from exc
     activity = None
-    if request.get("codex_review_profile") == CODEX_NATIVE_V2:
-        if (not isinstance(response, dict) or set(response) not in ({"task_name"}, {"task_name", "nickname"})
+    if request.get("codex_review_profile") in CODEX_COLLABORATION_PROFILES:
+        stable = request.get("codex_review_profile") == CODEX_NATIVE_PROTOCOL
+        if (not isinstance(response, dict)
+                or not stable and set(response) not in ({"task_name"}, {"task_name", "nickname"})
                 or response.get("task_name") != request["codex_native_trace"]["agent_path"]
                 or ("nickname" in response and (not isinstance(response["nickname"], str) or len(response["nickname"]) > 256))):
-            raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native-v2 spawn result fields or canonical task path differ")
+            raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native collaboration spawn result fields or canonical task path differ")
         activity = _codex_v2_activity(event, request)
         agent_id = _codex_uuid(activity["item"]["agent_thread_id"])
+        if stable:
+            # Extra display metadata is inert, but an optional host identity
+            # must agree with the independently observed native activity.
+            identities = {"agent_id": agent_id, "thread_id": agent_id,
+                          "parent_thread_id": request["launch"]["parent_thread_id"]}
+            if any(key in response and response[key] != expected for key, expected in identities.items()):
+                raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native spawn result identity conflicts with its activity")
     elif (not isinstance(response, dict) or set(response) != {"agent_id", "nickname"}
             or (response["nickname"] is not None and (
                 not isinstance(response["nickname"], str) or len(response["nickname"]) > 256))):
@@ -3269,7 +3312,7 @@ def _codex_native_post_join(event: dict[str, Any], root: Path, request: dict[str
         if activity is not None:
             launch.update(native_activity=activity, native_activity_sha256=_engine_digest(activity))
         if child["start"] is not None:
-            if request.get("codex_review_profile") == CODEX_NATIVE_V2:
+            if request.get("codex_review_profile") in CODEX_COLLABORATION_PROFILES:
                 _codex_v2_bind_child(request, child)
             launch.update(child_turn_id=child["start"]["turn_id"], agent_type="default")
             request["state"] = "RUNNING"
@@ -3363,7 +3406,7 @@ def _codex_native_lifecycle_join(event: dict[str, Any]) -> dict[str, Any] | None
         if name == "SubagentStart":
             if request["state"] != "LAUNCHING":
                 _codex_native_refuse(root, request, "native reviewer start was repeated")
-            if request.get("codex_review_profile") == CODEX_NATIVE_V2:
+            if request.get("codex_review_profile") in CODEX_COLLABORATION_PROFILES:
                 _codex_v2_bind_child(request, child)
             launch.update(child_turn_id=event["turn_id"], agent_type="default")
             request["state"] = "RUNNING"
@@ -3419,7 +3462,7 @@ def _codex_native_steering(event: dict[str, Any]) -> None:
                 _write_codex_child(path, child)
         for root, request in _registered_requests(strict=True):
             launch = request.get("launch") or {}
-            if (request.get("codex_review_profile") != CODEX_NATIVE_V2
+            if (request.get("codex_review_profile") not in CODEX_COLLABORATION_PROFILES
                     or request["state"] not in {"LAUNCHING", "RUNNING"}
                     or launch.get("parent_session_id") != event.get("session_id")):
                 continue
@@ -3470,11 +3513,11 @@ def observe_codex_hook(root: str | Path, event: dict[str, Any]) -> dict[str, Any
         message = tool_input.get("message") if isinstance(tool_input, dict) else None
         if isinstance(message, str) and message.startswith("[CODEARBITER_AUTHORITY_REQUEST:"):
             _, candidate = _registered_request(_request_id_from_prompt(message))
-            if candidate.get("codex_review_profile") != CODEX_NATIVE_V2:
+            if candidate.get("codex_review_profile") not in CODEX_COLLABORATION_PROFILES:
                 raise AuthorityError(
                     "UNSUPPORTED_HOST_SEAM",
-                    "Codex v2 requires a fresh qualified native-v2 request with direct activity UUID binding; "
-                    "otherwise qualify native-v1 and arm a fresh request",
+                    "collaboration review requires a fresh native protocol request with direct activity UUID binding; "
+                    "historical requests cannot be relabelled",
                 )
         else:
             turn_id = _host_id(event.get("turn_id"), "turn_id")
@@ -3508,7 +3551,7 @@ def observe_codex_hook(root: str | Path, event: dict[str, Any]) -> dict[str, Any
             raise AuthorityError("UNSUPPORTED_HOST_SEAM", "review request is not launchable")
         if _canonical(tool_input) != _canonical(request.get("launch_envelope")):
             raise AuthorityError("UNSUPPORTED_HOST_SEAM", "review launch envelope was changed")
-        is_v2 = request.get("codex_review_profile") == CODEX_NATIVE_V2
+        is_v2 = request.get("codex_review_profile") in CODEX_COLLABORATION_PROFILES
         if is_v2 != (event["tool_name"] == "collaborationspawn_agent"):
             raise AuthorityError("UNSUPPORTED_HOST_SEAM", "native review profile differs from launch tool")
         _require_frozen_context(root, request)
@@ -3536,7 +3579,7 @@ def observe_codex_hook(root: str | Path, event: dict[str, Any]) -> dict[str, Any
         elif is_v2:
             anchor = _codex_v2_trace_anchor(event, tool_input["task_name"])
             request["codex_native_trace"] = anchor
-            request["launch"].update(codex_review_profile=CODEX_NATIVE_V2, child_turn_id=None,
+            request["launch"].update(codex_review_profile=request["codex_review_profile"], child_turn_id=None,
                 parent_thread_id=anchor["parent_thread_id"], task_name=anchor["agent_path"], fork_turns="none")
         else:
             request["launch"].update(task_name=tool_input["task_name"], fork_turns=tool_input["fork_turns"])

package/plugins/ca-pi/hooks/_host.py

@@ -11,7 +11,7 @@ import hostapi  # noqa: E402
 class PiHost(hostapi.Host):
     name = "pi"
     adapter_name = "@arbiterforge/ca-pi"
-    adapter_version = "0.18.2"
+    adapter_version = "0.18.4"
     update_target = "ca-pi"
     update_tag_prefix = "ca-pi-v"
     update_command = "pi update npm:@arbiterforge/ca-pi"

package/plugins/ca-pi/hooks/_reconciliationlib.py

@@ -498,7 +498,9 @@ def _consume_reconciliation_unlocked(
             raise ReconciliationError("reconciliation target changed after arming")
         payload = {"input_sha256": pending["input_sha256"], "assessment": pending["assessment"]}
         if pending["operation"] == "task-reconcile":
-            payload.update(task_sha256=pending["record_sha256"], target_state=pending["target_state"])
+            # Marker/route integrity retains its legacy serialization; authority
+            # binds the rechecked record to the engine's canonical JSON digest.
+            payload.update(task_sha256=_artifactauthoritylib._engine_digest(record), target_state=pending["target_state"])
         event = {
             "kind": "reconciliation",
             "authority_kind": "user_workflow",

package/plugins/ca-pi/hooks/artifact-authority.py

@@ -52,8 +52,8 @@ def main(argv=None) -> int:
         default="opus", help="Claude reviewer model pinned into the launch envelope",
     )
     arm.add_argument(
-        "--codex-review-profile", choices=("native-v1", "native-v2"), default=None,
-        help="select only after qualifying the actual registered native interface and lifecycle",
+        "--codex-review-profile", choices=("native", "native-v1", "native-v2"), default=None,
+        help="Codex reviews default to the collaboration evidence protocol; legacy profiles are explicit",
     )
     context_arm = sub.add_parser("arm-context")
     context_arm.add_argument("--root", required=True)
@@ -92,10 +92,7 @@ def main(argv=None) -> int:
             )
         if (host == "codex" and args.activity in _artifactauthoritylib.REVIEW_ACTIVITIES
                 and args.codex_review_profile is None):
-            raise _artifactauthoritylib.AuthorityError(
-                "UNSUPPORTED_HOST_SEAM",
-                "Codex review requires an explicit native-v1 or native-v2 profile after live interface qualification",
-            )
+            args.codex_review_profile = "native"
         result = _artifactauthoritylib.arm_request(
             root, client, args.artifact_id, args.record_id, args.activity,
             workspace_roots=workspaces or None, host=host,

package/plugins/ca-pi/hooks/hostapi.py

@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "2.26.2"
+    adapter_version = "2.26.4"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,

package/plugins/ca-pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.18.2",
+  "version": "0.18.4",
   "private": true,
   "license": "AGPL-3.0-only",
   "type": "module",