@arbiterforge/ca-pi 0.18.4 → 0.19.0

package/plugins/ca-pi/hooks/_artifactlib.py

@@ -20,10 +20,10 @@ import threading
 from typing import Any
 
 PROTOCOL = "codearbiter.artifact-api/0.1.0"
-SCHEMA_VERSION = "0.3.1"
+SCHEMA_VERSION = "0.3.2"
 MAX_REQUEST = 8 << 20
 MAX_RESPONSE = 65536
-READ_OPERATIONS = frozenset({"capabilities", "schema", "read", "outline", "identity", "validate", "index", "snapshot", "diff", "repair-preview", "eligible", "farm-verify", "migration-preview"})
+READ_OPERATIONS = frozenset({"capabilities", "schema", "read", "outline", "identity", "validate", "index", "snapshot", "diff", "repair-preview", "eligible", "task-context", "verification-status", "farm-verify", "migration-preview"})
 
 
 class ArtifactError(RuntimeError):
@@ -41,8 +41,8 @@ def _object(pairs):
     return value
 
 
-def _decode(raw: bytes) -> Any:
-    if len(raw) > MAX_RESPONSE:
+def _decode(raw: bytes, *, max_bytes: int = MAX_RESPONSE) -> Any:
+    if len(raw) > max_bytes:
         raise ArtifactError("INVALID_RESPONSE", "oversized JSON envelope")
     # Bound nesting independently of the interpreter's recursion-limit setting.
     depth = 0
@@ -97,7 +97,7 @@ def read_context_preview_request(root: str | Path, request_file: str | Path) ->
             raw = os.read(fd, (1 << 20) + 1)
         finally:
             os.close(fd)
-        value = _decode(raw)
+        value = _decode(raw, max_bytes=1 << 20)
     except (OSError, ValueError) as exc:
         raise ArtifactError("INVALID_CONTEXT_REQUEST", "preview request is unavailable or outside the repository") from exc
     if not isinstance(value, dict):
@@ -140,7 +140,7 @@ def context_writer_qualified() -> bool:
 
 
 def validate_context_writer_request(request: dict[str, Any]) -> tuple[str, dict]:
-    """Parse only the finite preview or receipt request for the native workflow."""
+    """Parse an inert preview or its exact apply reference; never infer approval."""
     if not isinstance(request, dict):
         raise ArtifactError("INVALID_CONTEXT_REQUEST", "context request must be an object")
     operation = request.get("operation")
@@ -161,22 +161,33 @@ def validate_context_writer_request(request: dict[str, Any]) -> tuple[str, dict]
                          for value in preview["expected"].values()))
         if not (regular or final):
             raise ArtifactError("INVALID_CONTEXT_REQUEST", "preview must name one bounded context target")
+    elif operation == "apply" and set(request) == {"operation", "preview_ref", "preview_sha256"}:
+        preview_ref = request["preview_ref"]
+        preview_sha256 = request["preview_sha256"]
+        if (not isinstance(preview_ref, str) or re.fullmatch(
+                r"\.codearbiter/\.artifacts/context-previews/[0-9a-f]{64}\.json", preview_ref) is None
+                or not isinstance(preview_sha256, str)
+                or re.fullmatch(r"[0-9a-f]{64}", preview_sha256) is None):
+            raise ArtifactError("INVALID_CONTEXT_REQUEST", "apply requires an exact retained preview reference and digest")
+        return "apply", {"preview_ref": preview_ref, "preview_sha256": preview_sha256}
     elif operation == "apply" and set(request) == {"operation", "receipt"}:
         receipt = request["receipt"]
         if (not isinstance(receipt, str) or re.fullmatch(
                 r"\.codearbiter/\.artifacts/receipts/[0-9a-f]{64}\.json", receipt) is None):
             raise ArtifactError("INVALID_CONTEXT_REQUEST", "apply requires one receipt reference")
     else:
-        raise ArtifactError("INVALID_CONTEXT_REQUEST", "select a closed preview or receipt apply request")
+        raise ArtifactError("INVALID_CONTEXT_REQUEST", "select a closed preview or exact apply request")
 
     return ("preview", preview) if operation == "preview" else ("apply", {"receipt": receipt})
 
 
 def context_writer_client(root: str | Path) -> "ArtifactClient":
-    """Construct the installed native writer only after strict request validation."""
-    client = ArtifactClient(root, helper_installation(__file__))
-    client.require_context_workflow()
-    return client
+    """Construct the installed writer; each context call checks its capability.
+
+    Avoid a duplicate native probe here. Request validation precedes construction
+    and ArtifactClient.call admits the actual mutation through the pinned binary.
+    """
+    return ArtifactClient(root, helper_installation(__file__))
 
 
 def _open_pinned_regular(path: Path) -> int:
@@ -463,20 +474,6 @@ def _installed_workflow_preflight(installation: Path) -> dict[str, object]:
     return result
 
 
-def _require_host_workflow(client: "ArtifactClient") -> None:
-    readiness = client.workflow_preflight()
-    if readiness["resources_available"] is not True:
-        raise ArtifactError(
-            "HOST_WORKFLOW_UNAVAILABLE",
-            ("installed HTML workflow prerequisites are unavailable: "
-             + ", ".join(readiness["missing"]))[:400]
-            + "; repair this package or use a supported host; no fallback artifacts",
-        )
-
-
-# The native engine ships only through the release distribution channels, never
-# through a main-branch checkout, so the repair is always "install from the
-# channel". Named concretely so the user is not left to guess (ADR-0040).
 PAYLOAD_REPAIR_HINT = (
     "Claude Code: /plugin marketplace update codearbiter, then /plugin update ca@codearbiter; "
     "Codex (registered without --ref): codex plugin remove ca-codex@codearbiter, "
@@ -549,12 +546,6 @@ def _select_authoring_route(
         _require_authoring_capability(client)
         if _resolve_workflow_pair(root, slug) != selected:
             raise ArtifactError("STALE_ROUTE", "artifact namespace changed during the capability probe")
-        _require_host_workflow(client)
-        if _resolve_workflow_pair(root, slug) != selected:
-            raise ArtifactError(
-                "STALE_ROUTE",
-                "artifact namespace changed during the installed host preflight",
-            )
     return {"workflow": workflow, "lane": lane, "mode": "artifact", **selected}
 
 
@@ -566,15 +557,14 @@ def _preflight_plan_authoring(
     spec_normative_sha256: str,
     draft_for_pair: bool = False,
 ) -> Path:
-    """Verify the exact spec. Only initial sprint-pair preparation admits a ready draft.
+    """Resolve the exact source and safe target without an artifact approval.
 
-    Draft preparation never approves the spec or plan and never permits execution.
-    The ordinary feature/sequential path still requires an approved spec.
+    Drafts may be incomplete. This checks structural identity, not ready-state
+    completeness, user consent, command support, or future reviewer availability.
+    draft_for_pair remains a typed compatibility keyword, not an execution mode.
     """
     if type(draft_for_pair) is not bool:
         raise ArtifactError("INVALID_ROUTE", "draft_for_pair must be an explicit boolean")
-    if draft_for_pair and (not isinstance(selected, dict) or selected.get("workflow") != "sprint" or selected.get("lane") != "full"):
-        raise ArtifactError("INVALID_ROUTE", "draft preview is limited to full-lane initial sprint pairs")
     if not isinstance(selected, dict):
         raise ArtifactError("INVALID_ROUTE", "plan authoring requires a selected route")
     slug = selected.get("slug")
@@ -616,7 +606,7 @@ def _preflight_plan_authoring(
     ):
         raise ArtifactError("AUTHORITY_MISMATCH", "spec normative digest is invalid")
 
-    _require_host_workflow(client)
+    _require_authoring_capability(client)
     identity = client.call("identity", {"artifact_id": spec_artifact_id})
     expected_path = f".codearbiter/specs/{slug}.html"
     if (
@@ -629,24 +619,19 @@ def _preflight_plan_authoring(
             "AUTHORITY_MISMATCH",
             "caller spec identity does not match the selected current HTML spec",
         )
-    approved = client.call(
-        "validate",
-        {"artifact_id": spec_artifact_id, "gate": "ready" if draft_for_pair else "approved"},
+    checked = client.call(
+        "validate", {"artifact_id": spec_artifact_id, "gate": "structural"},
         permit_invalid=True,
     )
-    authority = approved.get("authority")
     if (
-        approved.get("valid") is not True
-        or approved.get("artifact_id") != spec_artifact_id
-        or approved.get("normative_sha256") != spec_normative_sha256
-        or not isinstance(authority, dict)
-        or approved.get("model_sha256") != identity.get("model_sha256")
-        or authority.get("state") != ("draft" if draft_for_pair else "approved")
-        or authority.get("authority_verified") is not (not draft_for_pair)
+        checked.get("valid") is not True
+        or checked.get("artifact_id") != spec_artifact_id
+        or checked.get("normative_sha256") != spec_normative_sha256
+        or checked.get("model_sha256") != identity.get("model_sha256")
     ):
         raise ArtifactError(
-            "AUTHORITY_UNVERIFIED",
-            "plan authoring requires the exact current ready and approved spec",
+            "SOURCE_INVALID",
+            "plan authoring requires the selected structurally valid, unchanged spec",
         )
     if _resolve_workflow_pair(root, slug) != current:
         raise ArtifactError(
@@ -754,7 +739,7 @@ def _preflight_current_acceptance(
             )
         identities[kind] = identity
 
-    eligible = client.call("eligible", {"artifact_id": plan_artifact_id})
+    eligible = client.call("verification-status", {"artifact_id": plan_artifact_id})
     if (
         eligible.get("artifact_id") != plan_artifact_id
         or eligible.get("model_sha256") != identities["plan"].get("model_sha256")
@@ -821,7 +806,7 @@ def _preflight_current_acceptance(
 
     final_spec = client.call("identity", {"artifact_id": spec_artifact_id})
     final_plan = client.call("identity", {"artifact_id": plan_artifact_id})
-    final_eligible = client.call("eligible", {"artifact_id": plan_artifact_id})
+    final_eligible = client.call("verification-status", {"artifact_id": plan_artifact_id})
     if (
         final_spec.get("model_sha256") != identities["spec"].get("model_sha256")
         or final_plan.get("model_sha256") != identities["plan"].get("model_sha256")
@@ -967,51 +952,6 @@ def _bounded_child(argv: list[str], request: bytes, fd: int | None, timeout: flo
     return process.returncode, bytes(buffers[0]), bytes(buffers[1])
 
 
-_CONTEXT_NATIVE_CASES = [
-    "TestContextBoundedRender", "TestContextDocumentContract",
-    "TestContextMarkdownPreservation", "TestContextMutationAdmission",
-    "TestContextRecoveryAndPaths", "TestContextRepresentationBoundary",
-]
-
-
-def _context_release_qualified(installation: Path) -> bool:
-    """Require exact context evidence added by the native receipt assembler."""
-    system = {"Linux": "linux", "Darwin": "darwin", "Windows": "windows"}.get(platform.system())
-    arch = {"x86_64": "amd64", "amd64": "amd64", "aarch64": "arm64", "arm64": "arm64"}.get(platform.machine().lower())
-    if system is None or arch is None:
-        return False
-    try:
-        fd = _open_pinned_regular(installation / "release.json")
-        try:
-            if os.fstat(fd).st_size > 65_536:
-                return False
-            manifest = _decode(os.read(fd, 65_537))
-        finally:
-            os.close(fd)
-        entry = manifest["binaries"][f"{system}/{arch}"]
-        record = manifest["context_qualification"][f"{system}/{arch}"]
-        return (
-            isinstance(record, dict)
-            and set(record) == {"source_commit", "workflow", "run_id", "binary_sha256",
-                                "observation_sha256", "module_sha256", "native_cases"}
-            and isinstance(record["source_commit"], str)
-            and re.fullmatch(r"[0-9a-f]{40}", record["source_commit"]) is not None
-            and record["workflow"] == ".github/workflows/ci.yml"
-            and isinstance(record["run_id"], str)
-            and re.fullmatch(r"[1-9][0-9]*", record["run_id"]) is not None
-            and record["binary_sha256"] == entry["sha256"]
-            and all(isinstance(record[field], str)
-                    and re.fullmatch(r"[0-9a-f]{64}", record[field]) is not None
-                    for field in ("observation_sha256", "module_sha256"))
-            and record["native_cases"] == _CONTEXT_NATIVE_CASES
-        )
-    except (ArtifactError, OSError, KeyError, TypeError, ValueError):
-        return False
-
-
-# A whole-tree input snapshot on a large repository can take ~30s on Windows,
-# so the old 30s bound timed out every publish, arm and verify. The bound is a
-# wait limit, never a gate: raising it relaxes no check.
 DEFAULT_ENGINE_TIMEOUT_SECONDS = 120
 ENGINE_TIMEOUT_ENV = "CODEARBITER_ENGINE_TIMEOUT"
 _MAX_ENGINE_TIMEOUT_SECONDS = 3600
@@ -1047,22 +987,26 @@ class ArtifactClient:
         return _installed_workflow_preflight(self.installation)
 
     def require_context_workflow(self) -> dict[str, object]:
-        """Admit only the packaged native context candidate on a supported host."""
-        installed = self.workflow_preflight()
+        """Check the installed writer's API, without a second host approval gate.
+
+        The capabilities call verifies the installation-pinned, native-tested
+        binary through the normal bridge. Package/host observations remain
+        evidence, not permission to update already-authorized context.
+        """
         capability = self.call("capabilities")
         context = capability.get("repository_context")
-        if (installed.get("resources_available") is not True
-                or installed.get("host") not in {"codex", "claude"}
-                or not isinstance(context, dict)
-                or set(context) != {"source_present", "kind_registered", "host_default_enabled", "qualification", "mutation_available"}
-                or context["source_present"] is not True
-                or context["kind_registered"] is not True
-                or context["host_default_enabled"] is not False
-                or context["qualification"] != "package-required"
-                or context["mutation_available"] is not True
-                or not _context_release_qualified(self.installation)):
-            raise ArtifactError("CONTEXT_WORKFLOW_UNAVAILABLE", "installed repository-context workflow is not qualified")
-        return {**context, "host_default_enabled": True, "qualification": "packaged-candidate"}
+        required = {"context-preview", "context-finalize-preview", "context-apply"}
+        operations = capability.get("operations")
+        if (not isinstance(context, dict)
+                or context.get("source_present") is not True
+                or context.get("kind_registered") is not True
+                or context.get("host_default_enabled") is not True
+                or context.get("permission_model") != "host-owned"
+                or context.get("mutation_available") is not True
+                or not isinstance(operations, list)
+                or any(name not in operations for name in required)):
+            raise ArtifactError("CONTEXT_WORKFLOW_UNAVAILABLE", "installed binary lacks the assistive repository-context writer")
+        return dict(context)
 
     def _open_binary(self) -> int:
         system = {"Linux":"linux", "Darwin":"darwin", "Windows":"windows"}.get(platform.system())
@@ -1132,7 +1076,7 @@ class ArtifactClient:
     def call(self, operation: str, request: dict[str, Any] | None = None, *, permit_invalid: bool = False) -> dict:
         if not re.fullmatch(r"[a-z][a-z-]{0,39}", operation):
             raise ArtifactError("UNKNOWN_OPERATION", "invalid internal operation name")
-        if operation in {"context-evidence-context", "context-finalize-evidence-context", "context-apply"}:
+        if operation in {"context-preview", "context-finalize-preview", "context-apply"}:
             self.require_context_workflow()
         request = dict(request or {})
         if "protocol" in request and request["protocol"] != PROTOCOL:
@@ -1258,12 +1202,14 @@ def has_html(root: str | Path) -> bool:
 
 
 def checked_spec_index(root, installation) -> list[dict]:
-    """Fresh per-call authority validation, deliberately not an mtime cache."""
+    """Fresh validated advisory pointers, including receipt-free draft specs."""
     if not has_html(root):
         return []
     client = ArtifactClient(root, installation)
-    return [{"spec": x["artifact_id"], "path": x["path"], "globs": x.get("governs") or [], "artifact_html": True}
-            for x in client.index("spec") if x["authority"]["authority_verified"] and x.get("governs")]
+    return [{"spec": x["artifact_id"], "path": x["path"], "globs": x["governs"],
+             "artifact_html": True, "governance_state": x["authority"]["state"]}
+            for x in client.index("spec")
+            if x["authority"].get("state") in ("draft", "ready", "approved") and x.get("governs")]
 
 
 def resolve_spec_file(filename, installation) -> tuple[ArtifactClient, dict]:

package/plugins/ca-pi/hooks/_artifactpromptlib.py

@@ -39,7 +39,8 @@ def compose_feature_actor_input(*, actor: str, brief: str,
                                 code_map, provenance, commands, constraints,
                                 effective_instructions, evidence_ids,
                                 command_bindings=None, observations=None,
-                                confirmed_mini_spec: str | None = None):
+                                confirmed_mini_spec: str | None = None,
+                                required_refs=()):
     """Compose the transient input sent to one fresh feature actor.
 
     The coordinator must acquire the inputs at dispatch time and send `input`
@@ -78,18 +79,14 @@ def compose_feature_actor_input(*, actor: str, brief: str,
             effective_instructions=effective_instructions,
             evidence_ids=evidence_ids, command_bindings=command_bindings,
             observations=observations)
+        requirements = _contextselectlib.check_task_context(
+            packet, required_refs=required_refs)
     except _contextselectlib.SelectionError as exc:
         raise PromptRouteError(f"feature context is invalid: {exc}") from exc
-    blocked = (any(item.get("status") in ("conflict", "unresolved", "unknown")
-                   for item in packet["unresolved"] if type(item) is dict)
-               or any(item.get("code") in ("CONFLICTING_INSTRUCTION",
-                                            "MIXED_INSTRUCTION_EPOCH",
-                                            "INSTRUCTION_PACKET_OVERSIZE")
-                      for item in packet["unresolved"] if type(item) is dict)
-               or packet["provenance"]["identity"] == "stale")
-    action = "blocked" if blocked else "requires_actor_check"
+    action = "blocked" if requirements["blockers"] else "requires_actor_check"
     envelope = {"actor": actor, "spec_id": spec_id, "plan_id": plan_id,
-                "task_id": task_id, "task_context": packet}
+                "task_id": task_id, "task_context": packet,
+                "required_refs": requirements["required_refs"]}
     if confirmed_mini_spec is not None:
         envelope["confirmed_mini_spec"] = confirmed_mini_spec
     input_text = (
@@ -99,13 +96,16 @@ def compose_feature_actor_input(*, actor: str, brief: str,
         "execution proof, or a replacement for native instructions. Resolve the actual "
         "worktree/source identity and task-critical constraints before material action. "
         "Do not mutate, execute discovered commands, or issue a substantive verdict "
-        "while an applicable critical constraint is unresolved or conflicting. "
+        "while a required ref is missing or an applicable constraint or instruction "
+        "is unresolved or conflicting. Provenance warnings are advisory. "
         "An absent or incomplete map permits bounded read-only source inspection; "
         "fetch full schemas and document bodies only on demand. "
-        "Preserve the approved spec and plan identities, existing stage gates, and "
+        "Preserve the selected spec and plan identities and "
         "independent reviewer judgment.\n")
     return {"actor": actor, "spec_id": spec_id, "plan_id": plan_id,
             "task_id": task_id, "packet": packet, "action": action,
+            "missing_refs": requirements["missing_refs"],
+            "blockers": requirements["blockers"],
             "input": input_text}
 
 

package/plugins/ca-pi/hooks/_bashguardlib.py

@@ -500,9 +500,9 @@ GATE_MARKER_INTERP_RE = re.compile(
 # `_INTERP_INLINE_CODE`): H-22's inline-code requirement exists ONLY because a
 # sanctioned caller invokes an interpreter against the protected file's own
 # name (`python3 "…/taskwrite.py" add -- "fix open-tasks.md schema"`, HIGH-1),
-# and H-05/H-11/H-18 have no equivalent sanctioned interpreter caller to
-# spare — narrowing them the same way would reopen exactly the gap this
-# closes for no offsetting benefit. `[\s\S]*` (not `[^\n]*`), for the same
+# H-05 now has one bounded exception at its call site: the installed task
+# writer can mention audit filenames as task-title data. Arbitrary script
+# argv stays conservative here, as do H-11/H-18. `[\s\S]*` (not `[^\n]*`), for the same
 # reason GATE_MARKER_INTERP_RE carries it: the interpreter token and the
 # target name may sit on different physical lines of the SAME multi-line
 # `-c`/`-e` payload.
@@ -1349,6 +1349,67 @@ def _check_h03_wildcard_add(add, cwd):
                       f"per file (commit-gate skill).")
 
 
+def _is_direct_taskwrite(cmd):
+    """Recognize literal argv to this package's task writer, not shell code.
+
+    This only distinguishes H-05's interpreter match from task-title data.
+    Other H-05 legs and all other guards still inspect the original command.
+    Unknown syntax, wrappers, substitutions and options retain the old refusal.
+    """
+    if re.search(r"[\r\n;&|<>`$%!^*?{}\[\]()]", cmd):
+        return False
+    # A deliberately small literal-token grammar accepts quoted Windows paths
+    # and adjacent single-quoted fragments (PowerShell's doubled apostrophe).
+    # Gaps must be whitespace; an unmatched quote cannot disappear in parsing.
+    tokens, end = [], 0
+    for match in re.finditer(r'''(?:[^\s'"\x00]|'[^']*'|"[^"]*")+''', cmd):
+        if cmd[end:match.start()].strip():
+            return False
+        token = match.group()
+        if len(token) >= 2 and token[0] == token[-1] and token[0] in "\"'":
+            token = token[1:-1]
+        tokens.append(token)
+        end = match.end()
+    if cmd[end:].strip() or len(tokens) < 4:
+        return False
+    executable = tokens.pop(0).replace("\\", "/").rsplit("/", 1)[-1]
+    if not re.fullmatch(r"(?:python(?:[23](?:\.\d+)*)?|py)(?:\.exe)?", executable, re.I):
+        return False
+    if tokens[0] == "-B":
+        tokens.pop(0)
+    helper = tokens.pop(0)
+    known = os.path.join(os.path.dirname(os.path.abspath(__file__)), "taskwrite.py")
+    if not os.path.isabs(helper) or os.path.normcase(os.path.normpath(helper)) != os.path.normcase(known):
+        return False
+    value_options = {
+        "add": {"--from", "--id", "--boundaries", "--desc", "--section"},
+        "start": {"--as", "--date"}, "done": {"--date"}, "archive": set(),
+    }
+    verb = tokens.pop(0) if tokens else ""
+    if verb not in value_options:
+        return False
+    positional, seen, index = 0, set(), 0
+    while index < len(tokens):
+        token = tokens[index]
+        index += 1
+        if token == "--":
+            return positional == 0 and len(tokens) - index == 1 and bool(tokens[index])
+        if token.startswith("-"):
+            if token in seen:
+                return False
+            seen.add(token)
+            if verb == "archive" and token == "--allow-undated":
+                continue
+            if token not in value_options[verb] or index == len(tokens):
+                return False
+            if not tokens[index] or tokens[index].startswith("-"):
+                return False
+            index += 1
+        else:
+            positional += 1
+    return positional == 1
+
+
 def _check_h05_audit_log(cmd):
     """H-05: the audit trail is append-only — block truncation/removal of the
     audit logs via shell verbs (Write/Edit are guarded separately). The
@@ -1368,7 +1429,8 @@ def _check_h05_audit_log(cmd):
                      ADR_LIFECYCLE_LOG_BASENAME.casefold() in folded)
     if enrolled_name and (
             LOG_TRUNC_RE.search(cmd) or LOG_DESTROY_RE.search(cmd)
-            or LOG_GIT_RESTORE_RE.search(cmd) or LOG_INTERP_RE.search(cmd)):
+            or LOG_GIT_RESTORE_RE.search(cmd)
+            or LOG_INTERP_RE.search(cmd) and not _is_direct_taskwrite(cmd)):
         block("H-05", "The .codearbiter audit logs (overrides.log, triage.log, sprint-log.md, "
                       "gate-events.log, decisions/decision-log.md) are append-only "
                       "(ORCHESTRATOR §7). Truncating, overwriting, or deleting the audit "

package/plugins/ca-pi/hooks/_contextselectlib.py

@@ -246,7 +246,7 @@ def prepare_actor_delivery(packet, *, actor, task_id, worktree, source_epoch,
     index. A host receipt is a caller-reported observation; admission to work
     remains with the caller.
     Unknown epochs cannot make a saved receipt current and allow at most two
-    counted deliveries of the same binding before an explicit gap is returned.
+    counted deliveries of the same binding before an advisory gap is returned.
     """
     if (type(packet) is not dict or packet.get('admission') != 'requires_actor_check'
             or type(packet.get('task_paths')) is not list
@@ -312,7 +312,7 @@ def prepare_actor_delivery(packet, *, actor, task_id, worktree, source_epoch,
                 'observation': 'reported', 'attempts_used': count,
                 'delivery_text': None}
     if count >= 2:
-        return {'action': 'blocked', 'binding': binding, 'attempt': None,
+        return {'action': 'advisory', 'binding': binding, 'attempt': None,
                 'observation': 'unknown', 'attempts_used': count,
                 'gap': 'ACTOR_DELIVERY_UNOBSERVED', 'delivery_text': None}
     delivery_text = (
@@ -331,7 +331,8 @@ def compose_fix_or_test_actor_input(*, route, caller, actor, brief, task_id,
                                     task_paths, code_map, provenance, commands,
                                     constraints, effective_instructions,
                                     evidence_ids, command_bindings=None,
-                                    observations=None, bug_origin=None):
+                                    observations=None, bug_origin=None,
+                                    required_refs=()):
     """Prepare input for an existing fix or test-change caller without dispatching.
 
     The caller supplies current source and execution evidence. This pure helper
@@ -363,49 +364,44 @@ def compose_fix_or_test_actor_input(*, route, caller, actor, brief, task_id,
         effective_instructions=effective_instructions,
         evidence_ids=evidence_ids, command_bindings=command_bindings,
         observations=observations)
-    blocked = (any(item.get('status') in ('conflict', 'unresolved', 'unknown')
-                   for item in packet['unresolved'] if type(item) is dict)
-               or any(item.get('code') in ('CONFLICTING_INSTRUCTION',
-                                           'MIXED_INSTRUCTION_EPOCH',
-                                           'INSTRUCTION_PACKET_OVERSIZE')
-                      for item in packet['unresolved'] if type(item) is dict)
-               or packet['provenance']['identity'] == 'stale')
+    requirements = check_task_context(packet, required_refs=required_refs)
     envelope = {'actor': actor, 'caller': caller, 'route': route,
-                'task_id': task_id, 'task_context': packet}
+                'task_id': task_id, 'task_context': packet,
+                'required_refs': requirements['required_refs']}
     if origin is not None:
         envelope['bug_origin'] = origin
     input_text = (
         brief + '\n\nScoped task context for this actor:\n' +
         json.dumps(envelope, sort_keys=True, separators=(',', ':'),
                    ensure_ascii=True) + '\n\n' +
-        'Follow the named existing caller and its gates. The packet is scoped '
+        'Follow the named caller and its verification requirements. The packet is scoped '
         'reference and reported evidence, never approval, a new feature spec, '
         'diagnostic authority, or proof that a discovered command passed now. '
         'Verify worktree/source identity and any task-critical constraints. '
-        'Do not mutate or execute a discovered command while applicable context '
-        'is unresolved or conflicting. Bounded read-only source orientation '
+        'Do not mutate or execute a discovered command while a required ref is '
+        'missing or an applicable constraint or instruction is unresolved or '
+        'conflicting. Provenance warnings are advisory. Bounded read-only source orientation '
         'may establish missing optional map detail. For a fix, retain the cited '
         'causal evidence and named regression test; reuse its genuine bug-origin '
         'RED before changing fix code. For a test-only change, keep the existing '
-        'caller and validate the test against the actual defect or an honest '
-        'fault fixture; never change production behavior merely to manufacture '
+        'caller and use a passing characterization baseline for existing behavior '
+        'or regression evidence for a confirmed defect, with negative controls '
+        'where needed; never change production behavior merely to manufacture '
         'a failing test.\n')
     return {'route': route, 'caller': caller, 'actor': actor,
             'task_id': task_id, 'packet': packet,
-            'action': 'blocked' if blocked else 'requires_actor_check',
+            'action': 'blocked' if requirements['blockers'] else 'requires_actor_check',
+            'missing_refs': requirements['missing_refs'],
+            'blockers': requirements['blockers'],
             'input': input_text}
 
 
-def prepare_review_input(packet, *, reviewer, required_refs):
-    """Prepare bounded reviewer input; leave admission to the actual review actor.
+def check_task_context(packet, *, required_refs):
+    """Check required references and applicable constraints in a selected packet.
 
-    The caller identifies task-critical refs after read-only orientation. Missing
-    refs and applicable constraint/instruction conflicts block a substantive
-    verdict. Map/provenance diagnostics remain visible but advisory unless the
-    caller names a particular source as task-critical. This function performs
-    no repository I/O and does not attest live reviewer delivery.
+    Map and provenance diagnostics are advisory. The caller identifies critical
+    refs from the task after bounded read-only orientation.
     """
-    _text(reviewer, 'reviewer', 128)
     if (type(packet) is not dict or packet.get('admission') != 'requires_actor_check'
             or type(packet.get('task_paths')) is not list
             or type(packet.get('map')) is not list
@@ -415,21 +411,20 @@ def prepare_review_input(packet, *, reviewer, required_refs):
             or type(packet.get('unresolved')) is not list
             or type(required_refs) not in (list, tuple, set, frozenset)
             or len(required_refs) > 64):
-        raise SelectionError('INVALID_REVIEW_CONTEXT')
+        raise SelectionError('INVALID_TASK_CONTEXT')
     required = list(required_refs)
-    if any(type(ref) is not str or len(ref.encode('utf-8')) > 512
-           or not ref.strip() for ref in required):
-        raise SelectionError('INVALID_REQUIRED_REF')
+    for ref in required:
+        _text(ref, 'required_ref')
     available = set()
     blockers = []
     for row in packet['map']:
         if type(row) is not dict:
-            raise SelectionError('INVALID_REVIEW_CONTEXT')
+            raise SelectionError('INVALID_TASK_CONTEXT')
         if type(row.get('path')) is str:
             available.add('map:' + row['path'])
     for constraint in packet['constraints']:
         if type(constraint) is not dict:
-            raise SelectionError('INVALID_REVIEW_CONTEXT')
+            raise SelectionError('INVALID_TASK_CONTEXT')
         source = constraint.get('source_ref')
         if type(source) is str:
             available.add('constraint:' + source)
@@ -437,13 +432,13 @@ def prepare_review_input(packet, *, reviewer, required_refs):
             blockers.append('UNRESOLVED_CONSTRAINT')
     for instruction in packet['instructions']:
         if type(instruction) is not dict:
-            raise SelectionError('INVALID_REVIEW_CONTEXT')
+            raise SelectionError('INVALID_TASK_CONTEXT')
         path = instruction.get('path')
         if type(path) is str and instruction.get('text') is not None:
             available.add('instruction:' + path)
     for command in packet['commands']:
         if type(command) is not dict:
-            raise SelectionError('INVALID_REVIEW_CONTEXT')
+            raise SelectionError('INVALID_TASK_CONTEXT')
         command_id, cwd = command.get('id'), command.get('cwd')
         if type(command_id) is str and type(cwd) is str:
             available.add('command:' + cwd + ':' + command_id)
@@ -456,9 +451,17 @@ def prepare_review_input(packet, *, reviewer, required_refs):
     if missing:
         blockers.append('MISSING_CRITICAL_CONTEXT')
     blockers = list(dict.fromkeys(blockers))
+    return {'required_refs': required, 'missing_refs': missing, 'blockers': blockers}
+
+
+def prepare_review_input(packet, *, reviewer, required_refs):
+    """Prepare bounded input without repository I/O or delivery attestation."""
+    _text(reviewer, 'reviewer', 128)
+    requirements = check_task_context(packet, required_refs=required_refs)
+    blockers = requirements['blockers']
     return {'orientation': 'read_only',
             'verdict_admission': 'blocked' if blockers else 'ready',
-            'missing_refs': missing, 'blockers': blockers,
+            'missing_refs': requirements['missing_refs'], 'blockers': blockers,
             'reviewer_input': None if blockers else {
                 'reviewer': reviewer, 'context': copy.deepcopy(packet),
-                'required_refs': required}}
+                'required_refs': requirements['required_refs']}}