@arbiterforge/ca-pi 0.21.5 → 0.21.7

package/README.md

@@ -10,7 +10,7 @@ and durable project context. You decide. codeArbiter enforces.
 <img alt="Claude Code plugin" src="https://img.shields.io/badge/Claude_Code-plugin-d97757">
 <img alt="Codex plugin" src="https://img.shields.io/badge/OpenAI_Codex-plugin-10a37f">
 <img alt="Pi Feature Forge preview" src="https://img.shields.io/badge/ca--pi-Feature_Forge_preview-d97757">
-<img alt="version 3.2.5" src="https://img.shields.io/badge/version-3.2.5-2b7489">
+<img alt="version 3.2.7" src="https://img.shields.io/badge/version-3.2.7-2b7489">
 <img alt="core lanes" src="https://img.shields.io/badge/core_lanes-18-555">
 <img alt="skills" src="https://img.shields.io/badge/skills-22-555">
 <img alt="agents" src="https://img.shields.io/badge/agents-20-555">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.21.5",
+  "version": "0.21.7",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/plugins/ca-pi/CHANGELOG.md

@@ -4,6 +4,30 @@ All notable changes to `ca-pi` are documented in this file.
 
 ## [Unreleased]
 
+## [0.21.7] - 2026-10-21
+
+### Fixed
+
+- Keep ordinary uppercase instructions such as `Approve DATA migration` out of
+  artifact reply capture unless that all-letter code belongs to a retained
+  request. Genuine coded replies and mismatch protection remain intact.
+- Recognize verifier authority only from the actual wrapper invocation, not
+  inert PowerShell data mentioning its filename.
+- Permit bounded literal read-only Python diagnostics using isolated `-I`
+  stdin input and literal `git show HEAD:<protected-path>` or `Path` reads.
+  No arbitrary script, subprocess, shell expansion or write exemption is added.
+
+- Ordinary approval, sprint, prerequisite, and reconciliation instructions no longer enter legacy reply-code capture. Historical requests and actual host permissions retain their checks.
+- Bounded literal JSON sent to the installed read-only diagnostic validator no longer triggers protected-state write guards merely by citing source paths. Ambiguous or executable shell forms remain guarded.
+- Explicit staging in a multiline batch no longer borrows flags from later commands. Every staging command retains wildcard, directory, continuation, and working-directory checks.
+- Explicit draft source refreshes now preserve started work and historical evidence instead of requiring an untouched initial approval pair. Source and plan revision checks and historical approval boundaries remain intact.
+
+## [0.21.6] - 2026-10-19
+
+### Fixed
+
+- Engine model-validation errors now name what the schema accepts. A closed-enum refusal lists the allowed values (for example, applicability `mode` accepts `"conditional"`, `"unconditional"`, `"invariant"` and `"not_applicable"`), and an unknown key lists the record's allowed fields. Before, both said only that the value was refused, so the accepted spelling had to be found in the schema files. The list stays within the 512-byte public diagnostic limit.
+
 ## [0.21.5] - 2026-10-19
 
 ### Fixed

package/plugins/ca-pi/helpers/artifacts/release.json

@@ -6,43 +6,43 @@
   "binaries": {
     "darwin/amd64": {
       "file": "ca-artifact-darwin-amd64",
-      "sha256": "e501ca2b817c882feec23bc3560223f20d88ca372400f950679bfe01ba47cebd",
+      "sha256": "da9898ed084adde20454997c8a94490cc38c210dfe399cfe9e48bf85205e82c4",
       "native_tested": true
     },
     "darwin/arm64": {
       "file": "ca-artifact-darwin-arm64",
-      "sha256": "0fe9c4672486a28db1340c77d9eebf37bc33774fc34b5c055728f135afe4d7e8",
+      "sha256": "8e23e57e617d2c7864c2cba779b2cfd19dbc556e876a68e5c2c150455c58fe1f",
       "native_tested": true
     },
     "linux/amd64": {
       "file": "ca-artifact-linux-amd64",
-      "sha256": "f98d2647144640b226d0fa3fae6369eefbcee477e9d2bb818f767711e6a3e506",
+      "sha256": "3835ecfc7f6172e0d19c79b9c213eb211e530a46384df51b96820712ce471864",
       "native_tested": true
     },
     "linux/arm64": {
       "file": "ca-artifact-linux-arm64",
-      "sha256": "7abc7f188851bde8c082c2b812b74378e9e1848541aeb9029ee8551f4b68fdaa",
+      "sha256": "8564bfec069ab1ce30db37135197e8c4e093a2bc4ce6ea7f308029799f09af09",
       "native_tested": true
     },
     "windows/amd64": {
       "file": "ca-artifact-windows-amd64.exe",
-      "sha256": "3fe0a4b867fbcc8a278248f92697b649f4b9b208d51c5168885ba92fcbb73961",
+      "sha256": "55641212ecde2ddf078e70bcc44940696a68065f2dc323e69b3de804d24611ee",
       "native_tested": true
     },
     "windows/arm64": {
       "file": "ca-artifact-windows-arm64.exe",
-      "sha256": "339210645436d11bca4129f74d4a7885ad12a9489f449669b5f46a6f9cd1056d",
+      "sha256": "7d92b708e52ebbb0a08bb146f6a4c372277b2aa58716ca56b9bad04d671dc995",
       "native_tested": true
     }
   },
   "context_qualification": {
     "darwin/amd64": {
-      "source_commit": "0fc246614c8b0a85188ffcee9284f1942b4b3567",
+      "source_commit": "ddb07a3af1fc56692d1cff3fd4579058ee6c9ef7",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39337812494",
-      "binary_sha256": "e501ca2b817c882feec23bc3560223f20d88ca372400f950679bfe01ba47cebd",
-      "observation_sha256": "c832f3aff1d1c2b553173e16bb4fcd5b7ddf1cbf45c2a57e32840f58232c5a7a",
-      "module_sha256": "537452f67f1105572c4fa3829cec4af7354260a96e1614b66daa8fec7eefc256",
+      "run_id": "39769650796",
+      "binary_sha256": "da9898ed084adde20454997c8a94490cc38c210dfe399cfe9e48bf85205e82c4",
+      "observation_sha256": "ba23366af537c89797803bc21f45368dcbca3ee18871fce020032695a4db70ee",
+      "module_sha256": "ee801a17cb5132ceb5500b62e24e74d593e79feae3db50c07777ef8ff47f567d",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -53,12 +53,12 @@
       ]
     },
     "darwin/arm64": {
-      "source_commit": "0fc246614c8b0a85188ffcee9284f1942b4b3567",
+      "source_commit": "ddb07a3af1fc56692d1cff3fd4579058ee6c9ef7",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39337812494",
-      "binary_sha256": "0fe9c4672486a28db1340c77d9eebf37bc33774fc34b5c055728f135afe4d7e8",
-      "observation_sha256": "8007bb64505d6f4163df70b58d0a52d950f718caf284846b3a79b9936c759dee",
-      "module_sha256": "537452f67f1105572c4fa3829cec4af7354260a96e1614b66daa8fec7eefc256",
+      "run_id": "39769650796",
+      "binary_sha256": "8e23e57e617d2c7864c2cba779b2cfd19dbc556e876a68e5c2c150455c58fe1f",
+      "observation_sha256": "84141d37a93b7c204acb93dd4e043f4cf841ffacad1c0a497eb1d9d9f8852a7c",
+      "module_sha256": "ee801a17cb5132ceb5500b62e24e74d593e79feae3db50c07777ef8ff47f567d",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -69,12 +69,12 @@
       ]
     },
     "linux/amd64": {
-      "source_commit": "0fc246614c8b0a85188ffcee9284f1942b4b3567",
+      "source_commit": "ddb07a3af1fc56692d1cff3fd4579058ee6c9ef7",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39337812494",
-      "binary_sha256": "f98d2647144640b226d0fa3fae6369eefbcee477e9d2bb818f767711e6a3e506",
-      "observation_sha256": "d7c40f95cd3189dee10f26db25d63fbc2891181280efc2403dda058912f80236",
-      "module_sha256": "537452f67f1105572c4fa3829cec4af7354260a96e1614b66daa8fec7eefc256",
+      "run_id": "39769650796",
+      "binary_sha256": "3835ecfc7f6172e0d19c79b9c213eb211e530a46384df51b96820712ce471864",
+      "observation_sha256": "cdc3731052edd16a558fade51587f6fe3679da6c1c3282250d4de5e9eb29658e",
+      "module_sha256": "ee801a17cb5132ceb5500b62e24e74d593e79feae3db50c07777ef8ff47f567d",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -85,12 +85,12 @@
       ]
     },
     "linux/arm64": {
-      "source_commit": "0fc246614c8b0a85188ffcee9284f1942b4b3567",
+      "source_commit": "ddb07a3af1fc56692d1cff3fd4579058ee6c9ef7",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39337812494",
-      "binary_sha256": "7abc7f188851bde8c082c2b812b74378e9e1848541aeb9029ee8551f4b68fdaa",
-      "observation_sha256": "1bd885c3ecb6efacb789404d0d97db91596943de630c1cecbcee25482f2bf26f",
-      "module_sha256": "537452f67f1105572c4fa3829cec4af7354260a96e1614b66daa8fec7eefc256",
+      "run_id": "39769650796",
+      "binary_sha256": "8564bfec069ab1ce30db37135197e8c4e093a2bc4ce6ea7f308029799f09af09",
+      "observation_sha256": "13e4cbf8422754dfa6478785bd9a2d3dd0af1cdfb10e0a654048ee79c4b3787c",
+      "module_sha256": "ee801a17cb5132ceb5500b62e24e74d593e79feae3db50c07777ef8ff47f567d",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -101,12 +101,12 @@
       ]
     },
     "windows/amd64": {
-      "source_commit": "0fc246614c8b0a85188ffcee9284f1942b4b3567",
+      "source_commit": "ddb07a3af1fc56692d1cff3fd4579058ee6c9ef7",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39337812494",
-      "binary_sha256": "3fe0a4b867fbcc8a278248f92697b649f4b9b208d51c5168885ba92fcbb73961",
-      "observation_sha256": "8439eeadb753215c8e5e983091ff61e1920ac12480d9406e9cc6a837faa7725f",
-      "module_sha256": "537452f67f1105572c4fa3829cec4af7354260a96e1614b66daa8fec7eefc256",
+      "run_id": "39769650796",
+      "binary_sha256": "55641212ecde2ddf078e70bcc44940696a68065f2dc323e69b3de804d24611ee",
+      "observation_sha256": "27e759e25cc94f952cea7606423dea542cefce0ae934c25ec1ac21dbc3eed6ee",
+      "module_sha256": "ee801a17cb5132ceb5500b62e24e74d593e79feae3db50c07777ef8ff47f567d",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -117,12 +117,12 @@
       ]
     },
     "windows/arm64": {
-      "source_commit": "0fc246614c8b0a85188ffcee9284f1942b4b3567",
+      "source_commit": "ddb07a3af1fc56692d1cff3fd4579058ee6c9ef7",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39337812494",
-      "binary_sha256": "339210645436d11bca4129f74d4a7885ad12a9489f449669b5f46a6f9cd1056d",
-      "observation_sha256": "062e23804043c352163576ced022881e88e849f1d9b202b14c08958ec9c63ae8",
-      "module_sha256": "537452f67f1105572c4fa3829cec4af7354260a96e1614b66daa8fec7eefc256",
+      "run_id": "39769650796",
+      "binary_sha256": "7d92b708e52ebbb0a08bb146f6a4c372277b2aa58716ca56b9bad04d671dc995",
+      "observation_sha256": "345404cb624bb6a4306e6a838d383fc1d4b99f95db6352ad90fd394edf072f5c",
+      "module_sha256": "ee801a17cb5132ceb5500b62e24e74d593e79feae3db50c07777ef8ff47f567d",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",

package/plugins/ca-pi/hooks/_approvallib.py

@@ -480,6 +480,8 @@ def consume_from_hook(*, root: str | Path, plugin_root: str | Path, prompt: str,
     prepared = _replylib.prepare(raw, "approval")
     prompt = prepared["text"]
     attempted = prepared["attempted"]
+    if not attempted:
+        return ""
 
     def missed(reason: str) -> str:
         _replylib.record_near_miss(root, raw, reason)

package/plugins/ca-pi/hooks/_artifactauthoritylib.py

@@ -1889,12 +1889,16 @@ def _command_name(value: str) -> str:
     return value.replace("\\", "/").rsplit("/", 1)[-1].casefold()
 
 
-def _command_tokens(command: str) -> list[str]:
+def _command_lexer(command: str) -> shlex.shlex:
     lexer = shlex.shlex(command, posix=True)
     lexer.whitespace_split = True
     lexer.commenters = ""
     lexer.escape = ""  # Native Windows paths retain backslashes inside both quotes.
-    return list(lexer)
+    return lexer
+
+
+def _command_tokens(command: str) -> list[str]:
+    return list(_command_lexer(command))
 
 
 def _npm_package(manifest: Path) -> dict[str, Any]:
@@ -2705,6 +2709,17 @@ def _model_id(value: Any, field: str) -> str:
     return value
 
 
+def _verification_wrapper_start(tokens: list[str]) -> bool:
+    return (
+        len(tokens) >= 2
+        and _command_name(tokens[0]) in {
+            "python", "python.exe", "python3", "python3.exe", "py", "py.exe",
+        }
+        and _command_name(tokens[1]) == "artifact-authority.py"
+        and (len(tokens) == 2 or tokens[2] == "verify")
+    )
+
+
 def _verification_selector(event: dict[str, Any]) -> tuple[str, Path, str] | None:
     """Recognize only the closed wrapper selector, never caller-authored child argv."""
     if event.get("tool_name") not in {
@@ -2718,21 +2733,19 @@ def _verification_selector(event: dict[str, Any]) -> tuple[str, Path, str] | Non
     if not isinstance(command, str):
         raise AuthorityError("UNSUPPORTED_HOST_SEAM", "exec command is absent")
     compound = any(marker in command for marker in ("\n", "\r", ";", "&", "|", ">", "<", "`", "$"))
+    tokens: list[str] = []
+    lexer = _command_lexer(command)
     try:
-        tokens = _command_tokens(command)
+        tokens.extend(lexer)
     except ValueError as exc:
-        # An ordinary command with unbalanced quoting is not ours to deny.
-        if "artifact-authority" not in command.casefold():
+        # Retain the parsed selector prefix even when a later argument is
+        # malformed. A filename in ordinary shell source selects no authority.
+        if len(tokens) == 1:
+            tokens.append(lexer.token)  # An unfinished quoted script still refuses.
+        if not _verification_wrapper_start(tokens):
             return None
         raise AuthorityError("UNSUPPORTED_HOST_SEAM", "verifier wrapper command is malformed") from exc
-    wrapper_start = (
-        len(tokens) >= 2
-        and _command_name(tokens[0]) in {
-            "python", "python.exe", "python3", "python3.exe", "py", "py.exe",
-        }
-        and _command_name(tokens[1]) == "artifact-authority.py"
-        and (len(tokens) == 2 or tokens[2] == "verify")
-    )
+    wrapper_start = _verification_wrapper_start(tokens)
     if compound:
         if wrapper_start:
             raise AuthorityError("UNSUPPORTED_HOST_SEAM", "verifier wrapper command is compound")

package/plugins/ca-pi/hooks/_bashguardlib.py

@@ -75,6 +75,7 @@
 #                                         on a shell mutation of a registered
 #                                         protected-state file
 
+import json
 import os
 import re
 import subprocess
@@ -246,7 +247,12 @@ ARGS = r"(?P<args>(?:\"[^\"]*\"|'[^']*'|[^|;&])*)"
 COMMIT_SUBCOMMAND = r"commit(?:-(?!graph(?![-\w]))[\w-]+)?(?![-\w])"
 COMMIT_RE = re.compile(GIT + r"\s+" + COMMIT_SUBCOMMAND + ARGS)
 PUSH_RE = re.compile(GIT + r"\s+push\b" + ARGS)
-ADD_RE = re.compile(GIT + r"\s+add\b" + ARGS)
+# Staging argv ends at an unquoted command newline. Keep quoted multiline
+# filenames intact; otherwise a later `git push -u` becomes a wildcard add.
+# run_guards inspects EVERY match, so narrowing the first capture cannot hide
+# a later unsafe add. Commit/push parsing retains its existing contract.
+ADD_ARGS = r"(?P<args>(?:\"[^\"]*\"|'[^']*'|[^|;&\r\n])*)"
+ADD_RE = re.compile(GIT + r"\s+add\b" + ADD_ARGS)
 # #485 AC-4, the audit of the sibling matchers. Neither needs the same
 # treatment, and both were left alone deliberately:
 #
@@ -1480,10 +1486,12 @@ def _check_h03_wildcard_add(add, cwd):
     src/ just as surely as `git add -A` does."""
     if not add:
         return
-    if WILDCARD_ADD_RE.search(add.group("args")):
+    args = add.group("args")
+    if (WILDCARD_ADD_RE.search(args)
+            or _has_literal_flag(args, {"-A", "--all", "-u", "--update"})):
         block("H-03", "'git add -A' / 'git add .' / 'git add --all' / 'git add -u' "
                       "are prohibited. Stage files explicitly (commit-gate skill).")
-    why = add_violation(add.group("args"), cwd)
+    why = add_violation(args, cwd)
     if why:
         block("H-03", f"Wildcard staging is prohibited — {why} stages a "
                       f"non-explicit file set. Stage files explicitly, one path "
@@ -1844,6 +1852,164 @@ def _check_h14_migration(commit, add, cwd, root):
                           f"bypass a migration gate, /override logs the exception.")
 
 
+def _literal_python_read_view(cmd):
+    """Recognize only isolated, literal Python read diagnostics on stdin.
+
+    This is a closed read grammar, not an exemption for Python/subprocess.
+    Unknown code, import shadowing, shell expansion, and extra commands keep
+    the original guard view. Equivalent literal read commands still traverse
+    every gate. No code is executed or filesystem state consulted here.
+    """
+    if "\n" not in cmd or " -I" not in cmd:
+        return cmd
+    try:
+        if len(cmd.encode("utf-8")) > 32768:
+            return cmd
+    except UnicodeError:
+        return cmd
+    if re.search(r"\r(?!\n)|[\x00\u2018-\u201b]", cmd):
+        return cmd
+    text = cmd.replace("\r\n", "\n")
+    # -I excludes workspace/PYTHONPATH modules: otherwise an apparent
+    # standard-library import could execute a project-authored replacement.
+    invocation = r"(?:python(?:3(?:\.\d+)*)?|py)(?:\.exe)? -I(?: -B)? -"
+    fallback = cmd
+    match = re.fullmatch(
+        r"@'\n(?P<body>[\s\S]*?)\n'@[ \t]*\|[ \t]*(?P<invoke>" + invocation + r")[ \t]*\n?", text)
+    if match:
+        body = match["body"]
+        # The consumer appears after its script in PowerShell. If the
+        # read grammar refuses it, expose that consumer before the intact
+        # source too, so interpreter/write guards cannot miss an earlier path.
+        fallback = match["invoke"] + "\n" + cmd
+        if re.search(r"(?m)^[ \t]*'@", body):
+            return cmd
+    else:
+        match = re.fullmatch(
+            invocation + r"[ \t]+<<(?P<quote>['\"])(?P<end>[A-Za-z_][A-Za-z0-9_]{0,31})"
+            r"(?P=quote)[ \t]*\n(?P<body>[\s\S]*?)\n(?P=end)[ \t]*\n?", text)
+        if not match:
+            return cmd
+        body = match["body"]
+        if any(line == match["end"] for line in body.splitlines()):
+            return cmd
+    # Ordinary commands pay no AST import/parse cost.
+    import ast
+    try:
+        tree = ast.parse(body)
+    except (SyntaxError, ValueError, RecursionError):
+        return fallback
+    if len(tree.body) > 32 or sum(1 for _ in ast.walk(tree)) > 256:
+        return fallback
+
+    def literal(node):
+        return node.value if isinstance(node, ast.Constant) and isinstance(node.value, str) else None
+
+    def read_path(node):
+        value = literal(node)
+        if value is not None and re.fullmatch(
+            r"\.codearbiter/(?:overrides\.log|CONTEXT\.md|decisions/[A-Za-z0-9][A-Za-z0-9._-]*\.(?:md|jsonl))",
+            value,
+        ):
+            return value
+        return None
+
+    imports, reads = set(), []
+    for statement in tree.body:
+        if (isinstance(statement, ast.Import) and len(statement.names) == 1
+                and statement.names[0].name == "subprocess" and statement.names[0].asname is None):
+            imports.add("subprocess")
+            continue
+        if (isinstance(statement, ast.ImportFrom) and statement.level == 0
+                and statement.module == "pathlib" and len(statement.names) == 1
+                and statement.names[0].name == "Path" and statement.names[0].asname is None):
+            imports.add("Path")
+            continue
+        if not (isinstance(statement, ast.Expr) and isinstance(statement.value, ast.Call)
+                and isinstance(statement.value.func, ast.Name) and statement.value.func.id == "print"
+                and len(statement.value.args) == 1 and not statement.value.keywords):
+            return fallback
+        call = statement.value.args[0]
+        if not isinstance(call, ast.Call) or not isinstance(call.func, ast.Attribute):
+            return fallback
+        owner = call.func.value
+        if (isinstance(owner, ast.Name) and owner.id == "subprocess" and "subprocess" in imports
+                and call.func.attr == "check_output" and len(call.args) == 1
+                and isinstance(call.args[0], (ast.List, ast.Tuple)) and len(call.keywords) == 1
+                and call.keywords[0].arg == "text" and isinstance(call.keywords[0].value, ast.Constant)
+                and call.keywords[0].value.value is True):
+            args = [literal(value) for value in call.args[0].elts]
+            if (len(args) != 3 or args[:2] != ["git", "show"] or args[2] is None
+                    or not args[2].startswith("HEAD:") or not read_path(ast.Constant(args[2][5:]))):
+                return fallback
+            reads.append(" ".join(args))
+            continue
+        if (isinstance(owner, ast.Call) and isinstance(owner.func, ast.Name)
+                and owner.func.id == "Path" and "Path" in imports
+                and len(owner.args) == 1 and not owner.keywords and not call.args):
+            path = read_path(owner.args[0])
+            allowed = call.func.attr in {"exists", "is_file", "read_text"} and not call.keywords
+            if call.func.attr == "read_text" and len(call.keywords) == 1:
+                allowed = call.keywords[0].arg == "encoding" and literal(call.keywords[0].value) == "utf-8"
+            if path is not None and allowed:
+                reads.append("cat " + path)
+                continue
+        return fallback
+    return "\n".join(reads) if reads else fallback
+
+
+def _debug_validation_command_view(cmd):
+    """Exclude literal stdin data only for this package's read-only validator.
+
+    Accept one PowerShell single-quoted here-string piped to the exact installed
+    helper with literal ``-B ... validate`` argv. Everything else keeps the raw
+    guard view: expandable strings, wrappers, other helpers, extra commands,
+    redirections and early terminators cannot become an exemption.
+    """
+    # PowerShell accepts lone CR newlines and curly single-quote terminators.
+    # Keep those forms raw rather than missing an early terminator and hiding
+    # executable code. JSON can represent these data characters with escapes.
+    if re.search(r"\r(?!\n)|[\u2018-\u201b]", cmd):
+        return cmd
+    opening = re.match(r"\A@'\r?\n", cmd)
+    if opening is None:
+        return cmd
+    closing = re.search(r"(?m)^[ \t]*'@", cmd[opening.end():])
+    if closing is None or closing.group() != "'@":
+        return cmd
+    body = cmd[opening.end():opening.end() + closing.start()]
+    try:
+        if len(body.encode("utf-8")) > 65536 or not isinstance(json.loads(body), dict):
+            return cmd
+    except (ValueError, UnicodeError, RecursionError):
+        return cmd
+    tail = cmd[opening.end() + closing.end():].strip()
+    if not tail.startswith("|"):
+        return cmd
+    invocation = tail[1:].strip()
+    if re.search(r"[\r\n;&|<>`$%!^*?{}\[\]()]", invocation):
+        return cmd
+    tokens, end = [], 0
+    for match in re.finditer(r'''(?:[^\s'"\x00]|'[^']*'|"[^"]*")+''', invocation):
+        if invocation[end:match.start()].strip():
+            return cmd
+        token = match.group()
+        if len(token) >= 2 and token[0] == token[-1] and token[0] in "\"'":
+            token = token[1:-1]
+        tokens.append(token)
+        end = match.end()
+    if invocation[end:].strip() or len(tokens) != 4 or tokens[1] != "-B" or tokens[3] != "validate":
+        return cmd
+    executable = tokens[0].replace("\\", "/").rsplit("/", 1)[-1]
+    if not re.fullmatch(r"(?:python(?:[23](?:\.\d+)*)?|py)(?:\.exe)?", executable, re.I):
+        return cmd
+    helper = tokens[2]
+    known = os.path.join(os.path.dirname(os.path.abspath(__file__)), "debug-handoff.py")
+    if not os.path.isabs(helper) or os.path.normcase(os.path.normpath(helper)) != os.path.normcase(known):
+        return cmd
+    return invocation
+
+
 def run_guards(payload, root, ti):
     """Run every H-NN gate against `ti` (the already host-normalized Bash/
     PowerShell tool_input — see pre-bash.py's `_run`, which resolves it via
@@ -1853,7 +2019,8 @@ def run_guards(payload, root, ti):
     sys.exit(0). This is the composed body pre-bash.py's `_run` used to run
     inline (issue #320) — moved here verbatim, split into one function per
     gate, each still carrying its H-NN ID."""
-    cmd = ti.get("command", "") or ""
+    cmd = _debug_validation_command_view(ti.get("command", "") or "")
+    cmd = _literal_python_read_view(cmd)
 
     # Heredoc bodies are stdin text, not arguments — match the git command over
     # a body-stripped view so message content (which may contain `;`/`|`/`&`,
@@ -1905,9 +2072,25 @@ def run_guards(payload, root, ti):
         heredoc_shell_fallback and PUSH_RE.search(cmd))
     _check_push_gates(push, cwd)
 
-    add = ADD_RE.search(git_view) or (
-        heredoc_shell_fallback and ADD_RE.search(cmd))
-    _check_h03_wildcard_add(add, cwd)
+    # Preserve quoted literal paths AND check executable continuations inside
+    # nested/double quotes. Outside quotes, join POSIX/PowerShell/cmd escapes
+    # so a split flag remains one argv item. Neither view changes other guards.
+    quoted_staging = re.sub(r'''("[^"]*"|'[^']*')|[\\`^](?:\r\n|\n|\r)''',
+                            lambda match: match.group(1) or "", cmd)
+    joined_staging = re.sub(r"[\\`^](?:\r\n|\n|\r)", "", cmd)
+    adds = []
+    for staging_cmd in dict.fromkeys((quoted_staging, joined_staging)):
+        # Continuations can form the heredoc operator or shell name itself.
+        # Re-evaluate execution per view, without rewriting quoted paths again.
+        staging_view = HEREDOC_RE.sub(r"\3 ", staging_cmd)
+        adds.extend(ADD_RE.finditer(staging_view))
+        if "<<" in staging_cmd and (
+                _heredoc_fed_to_shell(staging_cmd) or _has_shell_executor(staging_cmd)):
+            adds.extend(ADD_RE.finditer(staging_cmd))
+    for staging in adds:
+        _check_h03_wildcard_add(staging, git_cwd(staging.group(0), exec_root))
+    # Commit security/migration checks still see that the batch stages files.
+    add = adds[0] if adds else None
     _check_h05_audit_log(cmd)
     _check_h11_decisions(cmd)
     _check_h18_context_md(cmd)

package/plugins/ca-pi/hooks/_host.py

@@ -11,7 +11,7 @@ import hostapi  # noqa: E402
 class PiHost(hostapi.Host):
     name = "pi"
     adapter_name = "@arbiterforge/ca-pi"
-    adapter_version = "0.21.5"
+    adapter_version = "0.21.7"
     update_target = "ca-pi"
     update_tag_prefix = "ca-pi-v"
     update_command = "pi update npm:@arbiterforge/ca-pi"

package/plugins/ca-pi/hooks/_prerequisitelib.py

@@ -950,6 +950,8 @@ def consume_from_hook(
     prepared = _replylib.prepare(raw, "prerequisite")
     prompt = prepared["text"]
     attempted = prepared["attempted"]
+    if not attempted:
+        return ""
     if prepared["notice"]:
         _replylib.record_near_miss(root, raw, "code")
         return prepared["notice"]

package/plugins/ca-pi/hooks/_replylib.py

@@ -406,19 +406,72 @@ DIAGNOSTICS = Path(".codearbiter/.markers/reply-diagnostics.log")
 DIAGNOSTICS_CAP = 256 * 1024
 
 
+def _capture_attempt(raw, route: str) -> bool:
+    """Recognize an explicit legacy reply, not an ordinary leading verb.
+
+    Keep near-miss diagnostics for a coded/token reply with appended prose,
+    without repairing that prose into an accepted reply. Merely saying
+    ``Approve`` or ``reconcile the plan`` must not start legacy capture.
+    """
+    if not isinstance(raw, str) or not raw or len(raw) > MAX_INPUT:
+        return False
+    words = _clean(raw).split(" ")
+    verb = words[0].lower()
+    if SHORT_ROUTE.get(verb) != route:
+        return False
+    for (candidate, count), shape in GRAMMAR.items():
+        if candidate != verb or len(words) < count:
+            continue
+        fields = list(zip(words[1:count], shape))
+        if any((kind == "I" and not ID_RE.fullmatch(word))
+               or (kind == "M" and word.lower() not in MODES)
+               or (kind == "S" and word.upper() not in STATES)
+               for word, kind in fields[:-1]):
+            continue
+        token = fields[-1][0].rstrip(",.!?")
+        if CODE_RE.fullmatch(token.upper()):
+            if not token.isalpha():
+                return True
+            # Ordinary words overlap the code alphabet in EVERY casing:
+            # "Approve DATA migration" is not a protocol request. Only a
+            # retained matching code makes an all-letter token diagnostic.
+            # Exact armed replies remain case-insensitive; prose is not repaired.
+            if any(value.get("route") == route
+                   and value.get("short_reply", "").rsplit(" ", 1)[-1] == token.upper()
+                   for _path, value, _alive in _entries()):
+                return True
+            continue
+        if "I" in shape and re.fullmatch(r"[A-Za-z0-9_-]{12,128}", token):
+            # The long form's ID/token grammar also fits natural prose such
+            # as "approve the implementation". Require a retained request
+            # for its named subject before classifying it as a near miss.
+            prefix = canonicalize(" ".join(words[:count])).rsplit(" ", 1)[0]
+            if any(value.get("route") == route
+                   and value.get("full_reply", "").rsplit(" ", 1)[0] == prefix
+                   for _path, value, _alive in _entries()):
+                return True
+            # Old full-token routes can predate the short-code registry.
+            import _artifactpromptlib
+            try:
+                return _artifactpromptlib.resolve(route, canonicalize(raw)) is not None
+            except _artifactpromptlib.PromptRouteError:
+                # Let the adapter report the ambiguous legacy route through
+                # its existing capture-failure boundary, never approve it.
+                return True
+    return False
+
+
 def prepare(raw, route: str) -> dict[str, object]:
     """The text an adapter should match, plus a notice owned by ``route``.
 
-    ``attempted`` is true when the prompt is reply-shaped for this route, so
-    the adapter reports a miss instead of staying silent.
+    Only explicit legacy replies enter capture. Ordinary user intent stays
+    byte-for-byte unchanged and never becomes a request for another code.
     """
+    if not _capture_attempt(raw, route):
+        return {"text": raw, "notice": "", "attempted": False}
     canonical = canonicalize(raw)
-    first = canonical.split(" ", 1)[0] if isinstance(canonical, str) and canonical is not raw else ""
-    if not first and looks_like_reply(raw):
-        first = _clean(raw).split(" ", 1)[0].lower()
-    mine = SHORT_ROUTE.get(first) == route
-    expanded = expand(canonical) if mine else {"text": canonical, "notice": ""}
-    return {"text": expanded["text"], "notice": expanded["notice"] if mine else "", "attempted": mine}
+    expanded = expand(canonical)
+    return {"text": expanded["text"], "notice": expanded["notice"], "attempted": True}
 
 
 def miss_notice(example: str) -> str:

package/plugins/ca-pi/hooks/hostapi.py

@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "3.2.5"
+    adapter_version = "3.2.7"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,

package/plugins/ca-pi/includes/artifacts-attestation.md

@@ -93,24 +93,27 @@ approval, dispatch, acceptance, commit proof, or finalization. This is the
 repository's cooperative same-user attestation model, not cryptographic identity
 proof or protection from an unrestricted same-user filesystem writer.
 
-For ordinary sequential planning, create a plan as `draft_preview`, consume existing criterion IDs,
-then `plan-bind` to the approved spec and approve the plan through its existing workflow. Initial
-combined HTML sprint review uses the explicit paired path below instead of separate approvals.
-A normative change invalidates its approval. Rebinding is explicit and preserves
-history; it does not waive coverage or permit silent reinterpretation.
-
-When adversarial review revises a ready initial draft spec after its draft plan exists,
-query both current identities. The installed engine's explicit `plan-bind` request with
+For ordinary planning and resume, create or maintain a plan as `draft_preview` and
+consume existing criterion IDs. Source rebinding records the selected requirements;
+it does not require a new approval or reset existing work. A normative change can make
+historical evidence inapplicable. Preserve that history without relabeling it as current.
+
+When an in-scope correction revises the source spec, query both current identities.
+The installed engine's explicit `plan-bind` request with
 `binding_mode: draft_preview` requires the plan's existing `expected` CAS and the spec's
-`spec_expected` revision/model CAS. It rebinds only that same-ID, same-slug initial pair:
-both artifacts must remain unapproved drafts, tasks pending and unevidenced, prerequisites
-unsatisfied and unevidenced, and scopes empty. Optional typed plan corrections must leave
-both drafts fully ready. The binding remains `draft_preview`; this operation grants no
-approval, delegation, prerequisite satisfaction, execution or acceptance. Revalidate both
-current drafts, repeat the affected review and arm the exact combined approval afterward.
-Inspect the installed operation schema first. An engine without this explicit draft
-request reports a capability gap; never edit HTML, recreate the pair, substitute sequential
-approval or use ordinary approved-source `plan-bind` to repair it.
+`spec_expected` revision/model CAS. It refreshes only the existing same-ID, same-slug
+pair, including plans with started, reviewed, blocked or evidenced work. Optional typed
+plan corrections must leave both documents ready. Execution, stops, observations and
+historical approvals are retained; the refreshed plan has draft governance and a
+`draft_preview` binding. This operation grants no approval, delegation, prerequisite
+satisfaction, execution or acceptance. Revalidate the current pair and reassess only
+affected work and evidence. Do not arm combined approval for ordinary maintenance.
+
+Inspect the installed operation schema first. An engine that rejects this supported
+source refresh has a capability gap; retain the stale binding honestly while continuing
+unaffected authorized work. Never edit generated HTML, recreate the pair or erase history
+to satisfy a legacy initial-approval restriction. The historical initial combined approval
+path still requires an unapproved, unstarted and unevidenced initial pair.
 
 ## Historical paired approval and delegated methods
 

package/plugins/ca-pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.21.5",
+  "version": "0.21.7",
   "private": true,
   "license": "AGPL-3.0-only",
   "type": "module",