@arbiterforge/ca-pi 0.21.6 → 0.21.7

package/README.md

@@ -10,7 +10,7 @@ and durable project context. You decide. codeArbiter enforces.
 <img alt="Claude Code plugin" src="https://img.shields.io/badge/Claude_Code-plugin-d97757">
 <img alt="Codex plugin" src="https://img.shields.io/badge/OpenAI_Codex-plugin-10a37f">
 <img alt="Pi Feature Forge preview" src="https://img.shields.io/badge/ca--pi-Feature_Forge_preview-d97757">
-<img alt="version 3.2.6" src="https://img.shields.io/badge/version-3.2.6-2b7489">
+<img alt="version 3.2.7" src="https://img.shields.io/badge/version-3.2.7-2b7489">
 <img alt="core lanes" src="https://img.shields.io/badge/core_lanes-18-555">
 <img alt="skills" src="https://img.shields.io/badge/skills-22-555">
 <img alt="agents" src="https://img.shields.io/badge/agents-20-555">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.21.6",
+  "version": "0.21.7",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/plugins/ca-pi/CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to `ca-pi` are documented in this file.
 
 ## [Unreleased]
 
+## [0.21.7] - 2026-10-21
+
+### Fixed
+
+- Keep ordinary uppercase instructions such as `Approve DATA migration` out of
+  artifact reply capture unless that all-letter code belongs to a retained
+  request. Genuine coded replies and mismatch protection remain intact.
+- Recognize verifier authority only from the actual wrapper invocation, not
+  inert PowerShell data mentioning its filename.
+- Permit bounded literal read-only Python diagnostics using isolated `-I`
+  stdin input and literal `git show HEAD:<protected-path>` or `Path` reads.
+  No arbitrary script, subprocess, shell expansion or write exemption is added.
+
+- Ordinary approval, sprint, prerequisite, and reconciliation instructions no longer enter legacy reply-code capture. Historical requests and actual host permissions retain their checks.
+- Bounded literal JSON sent to the installed read-only diagnostic validator no longer triggers protected-state write guards merely by citing source paths. Ambiguous or executable shell forms remain guarded.
+- Explicit staging in a multiline batch no longer borrows flags from later commands. Every staging command retains wildcard, directory, continuation, and working-directory checks.
+- Explicit draft source refreshes now preserve started work and historical evidence instead of requiring an untouched initial approval pair. Source and plan revision checks and historical approval boundaries remain intact.
+
 ## [0.21.6] - 2026-10-19
 
 ### Fixed

package/plugins/ca-pi/helpers/artifacts/release.json

@@ -6,43 +6,43 @@
   "binaries": {
     "darwin/amd64": {
       "file": "ca-artifact-darwin-amd64",
-      "sha256": "9b380f89ce9140ac36959dfd605da990868b2f5cacee9eb28354b27ea64f8b00",
+      "sha256": "da9898ed084adde20454997c8a94490cc38c210dfe399cfe9e48bf85205e82c4",
       "native_tested": true
     },
     "darwin/arm64": {
       "file": "ca-artifact-darwin-arm64",
-      "sha256": "d03006ff6f415d20851241602de366222ee9ff55642829f5db45a7a46fb5ecd6",
+      "sha256": "8e23e57e617d2c7864c2cba779b2cfd19dbc556e876a68e5c2c150455c58fe1f",
       "native_tested": true
     },
     "linux/amd64": {
       "file": "ca-artifact-linux-amd64",
-      "sha256": "884d70bfa568a5661bacbeabc871af0c3507349efd0014df11fbd6da89a51c39",
+      "sha256": "3835ecfc7f6172e0d19c79b9c213eb211e530a46384df51b96820712ce471864",
       "native_tested": true
     },
     "linux/arm64": {
       "file": "ca-artifact-linux-arm64",
-      "sha256": "148e62c1d70b94768c0e77acc4c5f96e7992aaa9aa1ff3dbe4d9eca82ee0d8a4",
+      "sha256": "8564bfec069ab1ce30db37135197e8c4e093a2bc4ce6ea7f308029799f09af09",
       "native_tested": true
     },
     "windows/amd64": {
       "file": "ca-artifact-windows-amd64.exe",
-      "sha256": "c9246accfa753c0aad42df2d22b1652c5bf63bcf2325d8c59e3c08b571ad5aab",
+      "sha256": "55641212ecde2ddf078e70bcc44940696a68065f2dc323e69b3de804d24611ee",
       "native_tested": true
     },
     "windows/arm64": {
       "file": "ca-artifact-windows-arm64.exe",
-      "sha256": "1b8940f08206330146941bf295c21a1706d90b76e1e8a2abe2129792256eb64b",
+      "sha256": "7d92b708e52ebbb0a08bb146f6a4c372277b2aa58716ca56b9bad04d671dc995",
       "native_tested": true
     }
   },
   "context_qualification": {
     "darwin/amd64": {
-      "source_commit": "849a3cf6fa6f4fdf3256cd3095c92499e9c4ec77",
+      "source_commit": "ddb07a3af1fc56692d1cff3fd4579058ee6c9ef7",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39345028289",
-      "binary_sha256": "9b380f89ce9140ac36959dfd605da990868b2f5cacee9eb28354b27ea64f8b00",
-      "observation_sha256": "4d3a285100e275215e1495d3fd0b42dbffac2f9c37047bb6bf7925dd5bec063e",
-      "module_sha256": "3d78fb86150fbd4180be0dbf9b2b5fc6dc9ae19a6f371ef3e4da1fa1c68dd8fa",
+      "run_id": "39769650796",
+      "binary_sha256": "da9898ed084adde20454997c8a94490cc38c210dfe399cfe9e48bf85205e82c4",
+      "observation_sha256": "ba23366af537c89797803bc21f45368dcbca3ee18871fce020032695a4db70ee",
+      "module_sha256": "ee801a17cb5132ceb5500b62e24e74d593e79feae3db50c07777ef8ff47f567d",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -53,12 +53,12 @@
       ]
     },
     "darwin/arm64": {
-      "source_commit": "849a3cf6fa6f4fdf3256cd3095c92499e9c4ec77",
+      "source_commit": "ddb07a3af1fc56692d1cff3fd4579058ee6c9ef7",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39345028289",
-      "binary_sha256": "d03006ff6f415d20851241602de366222ee9ff55642829f5db45a7a46fb5ecd6",
-      "observation_sha256": "08e16937dabe723df59f48799d8e56dfb4afb104d4a2c536448308b85b71355a",
-      "module_sha256": "3d78fb86150fbd4180be0dbf9b2b5fc6dc9ae19a6f371ef3e4da1fa1c68dd8fa",
+      "run_id": "39769650796",
+      "binary_sha256": "8e23e57e617d2c7864c2cba779b2cfd19dbc556e876a68e5c2c150455c58fe1f",
+      "observation_sha256": "84141d37a93b7c204acb93dd4e043f4cf841ffacad1c0a497eb1d9d9f8852a7c",
+      "module_sha256": "ee801a17cb5132ceb5500b62e24e74d593e79feae3db50c07777ef8ff47f567d",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -69,12 +69,12 @@
       ]
     },
     "linux/amd64": {
-      "source_commit": "849a3cf6fa6f4fdf3256cd3095c92499e9c4ec77",
+      "source_commit": "ddb07a3af1fc56692d1cff3fd4579058ee6c9ef7",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39345028289",
-      "binary_sha256": "884d70bfa568a5661bacbeabc871af0c3507349efd0014df11fbd6da89a51c39",
-      "observation_sha256": "001fd9420f806f17155df87f84e1e60f7342e37936001a4badea473f25a89c64",
-      "module_sha256": "3d78fb86150fbd4180be0dbf9b2b5fc6dc9ae19a6f371ef3e4da1fa1c68dd8fa",
+      "run_id": "39769650796",
+      "binary_sha256": "3835ecfc7f6172e0d19c79b9c213eb211e530a46384df51b96820712ce471864",
+      "observation_sha256": "cdc3731052edd16a558fade51587f6fe3679da6c1c3282250d4de5e9eb29658e",
+      "module_sha256": "ee801a17cb5132ceb5500b62e24e74d593e79feae3db50c07777ef8ff47f567d",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -85,12 +85,12 @@
       ]
     },
     "linux/arm64": {
-      "source_commit": "849a3cf6fa6f4fdf3256cd3095c92499e9c4ec77",
+      "source_commit": "ddb07a3af1fc56692d1cff3fd4579058ee6c9ef7",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39345028289",
-      "binary_sha256": "148e62c1d70b94768c0e77acc4c5f96e7992aaa9aa1ff3dbe4d9eca82ee0d8a4",
-      "observation_sha256": "891a448936d6bf5132665a7fe3aa15a2613af0e0f68c47549e60d2cd25ed4308",
-      "module_sha256": "3d78fb86150fbd4180be0dbf9b2b5fc6dc9ae19a6f371ef3e4da1fa1c68dd8fa",
+      "run_id": "39769650796",
+      "binary_sha256": "8564bfec069ab1ce30db37135197e8c4e093a2bc4ce6ea7f308029799f09af09",
+      "observation_sha256": "13e4cbf8422754dfa6478785bd9a2d3dd0af1cdfb10e0a654048ee79c4b3787c",
+      "module_sha256": "ee801a17cb5132ceb5500b62e24e74d593e79feae3db50c07777ef8ff47f567d",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -101,12 +101,12 @@
       ]
     },
     "windows/amd64": {
-      "source_commit": "849a3cf6fa6f4fdf3256cd3095c92499e9c4ec77",
+      "source_commit": "ddb07a3af1fc56692d1cff3fd4579058ee6c9ef7",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39345028289",
-      "binary_sha256": "c9246accfa753c0aad42df2d22b1652c5bf63bcf2325d8c59e3c08b571ad5aab",
-      "observation_sha256": "56933f17c134e122f78e350e7edc87460fd4a44c283a0b2724c3954588da0331",
-      "module_sha256": "3d78fb86150fbd4180be0dbf9b2b5fc6dc9ae19a6f371ef3e4da1fa1c68dd8fa",
+      "run_id": "39769650796",
+      "binary_sha256": "55641212ecde2ddf078e70bcc44940696a68065f2dc323e69b3de804d24611ee",
+      "observation_sha256": "27e759e25cc94f952cea7606423dea542cefce0ae934c25ec1ac21dbc3eed6ee",
+      "module_sha256": "ee801a17cb5132ceb5500b62e24e74d593e79feae3db50c07777ef8ff47f567d",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",
@@ -117,12 +117,12 @@
       ]
     },
     "windows/arm64": {
-      "source_commit": "849a3cf6fa6f4fdf3256cd3095c92499e9c4ec77",
+      "source_commit": "ddb07a3af1fc56692d1cff3fd4579058ee6c9ef7",
       "workflow": ".github/workflows/ci.yml",
-      "run_id": "39345028289",
-      "binary_sha256": "1b8940f08206330146941bf295c21a1706d90b76e1e8a2abe2129792256eb64b",
-      "observation_sha256": "95dcea9f3b5807f164de47447a43b003a614264da7ef40d0ec76c21a57dfb8b1",
-      "module_sha256": "3d78fb86150fbd4180be0dbf9b2b5fc6dc9ae19a6f371ef3e4da1fa1c68dd8fa",
+      "run_id": "39769650796",
+      "binary_sha256": "7d92b708e52ebbb0a08bb146f6a4c372277b2aa58716ca56b9bad04d671dc995",
+      "observation_sha256": "345404cb624bb6a4306e6a838d383fc1d4b99f95db6352ad90fd394edf072f5c",
+      "module_sha256": "ee801a17cb5132ceb5500b62e24e74d593e79feae3db50c07777ef8ff47f567d",
       "native_cases": [
         "TestContextBoundedRender",
         "TestContextDocumentContract",

package/plugins/ca-pi/hooks/_approvallib.py

@@ -480,6 +480,8 @@ def consume_from_hook(*, root: str | Path, plugin_root: str | Path, prompt: str,
     prepared = _replylib.prepare(raw, "approval")
     prompt = prepared["text"]
     attempted = prepared["attempted"]
+    if not attempted:
+        return ""
 
     def missed(reason: str) -> str:
         _replylib.record_near_miss(root, raw, reason)

package/plugins/ca-pi/hooks/_artifactauthoritylib.py

@@ -1889,12 +1889,16 @@ def _command_name(value: str) -> str:
     return value.replace("\\", "/").rsplit("/", 1)[-1].casefold()
 
 
-def _command_tokens(command: str) -> list[str]:
+def _command_lexer(command: str) -> shlex.shlex:
     lexer = shlex.shlex(command, posix=True)
     lexer.whitespace_split = True
     lexer.commenters = ""
     lexer.escape = ""  # Native Windows paths retain backslashes inside both quotes.
-    return list(lexer)
+    return lexer
+
+
+def _command_tokens(command: str) -> list[str]:
+    return list(_command_lexer(command))
 
 
 def _npm_package(manifest: Path) -> dict[str, Any]:
@@ -2705,6 +2709,17 @@ def _model_id(value: Any, field: str) -> str:
     return value
 
 
+def _verification_wrapper_start(tokens: list[str]) -> bool:
+    return (
+        len(tokens) >= 2
+        and _command_name(tokens[0]) in {
+            "python", "python.exe", "python3", "python3.exe", "py", "py.exe",
+        }
+        and _command_name(tokens[1]) == "artifact-authority.py"
+        and (len(tokens) == 2 or tokens[2] == "verify")
+    )
+
+
 def _verification_selector(event: dict[str, Any]) -> tuple[str, Path, str] | None:
     """Recognize only the closed wrapper selector, never caller-authored child argv."""
     if event.get("tool_name") not in {
@@ -2718,21 +2733,19 @@ def _verification_selector(event: dict[str, Any]) -> tuple[str, Path, str] | Non
     if not isinstance(command, str):
         raise AuthorityError("UNSUPPORTED_HOST_SEAM", "exec command is absent")
     compound = any(marker in command for marker in ("\n", "\r", ";", "&", "|", ">", "<", "`", "$"))
+    tokens: list[str] = []
+    lexer = _command_lexer(command)
     try:
-        tokens = _command_tokens(command)
+        tokens.extend(lexer)
     except ValueError as exc:
-        # An ordinary command with unbalanced quoting is not ours to deny.
-        if "artifact-authority" not in command.casefold():
+        # Retain the parsed selector prefix even when a later argument is
+        # malformed. A filename in ordinary shell source selects no authority.
+        if len(tokens) == 1:
+            tokens.append(lexer.token)  # An unfinished quoted script still refuses.
+        if not _verification_wrapper_start(tokens):
             return None
         raise AuthorityError("UNSUPPORTED_HOST_SEAM", "verifier wrapper command is malformed") from exc
-    wrapper_start = (
-        len(tokens) >= 2
-        and _command_name(tokens[0]) in {
-            "python", "python.exe", "python3", "python3.exe", "py", "py.exe",
-        }
-        and _command_name(tokens[1]) == "artifact-authority.py"
-        and (len(tokens) == 2 or tokens[2] == "verify")
-    )
+    wrapper_start = _verification_wrapper_start(tokens)
     if compound:
         if wrapper_start:
             raise AuthorityError("UNSUPPORTED_HOST_SEAM", "verifier wrapper command is compound")

package/plugins/ca-pi/hooks/_bashguardlib.py

@@ -75,6 +75,7 @@
 #                                         on a shell mutation of a registered
 #                                         protected-state file
 
+import json
 import os
 import re
 import subprocess
@@ -246,7 +247,12 @@ ARGS = r"(?P<args>(?:\"[^\"]*\"|'[^']*'|[^|;&])*)"
 COMMIT_SUBCOMMAND = r"commit(?:-(?!graph(?![-\w]))[\w-]+)?(?![-\w])"
 COMMIT_RE = re.compile(GIT + r"\s+" + COMMIT_SUBCOMMAND + ARGS)
 PUSH_RE = re.compile(GIT + r"\s+push\b" + ARGS)
-ADD_RE = re.compile(GIT + r"\s+add\b" + ARGS)
+# Staging argv ends at an unquoted command newline. Keep quoted multiline
+# filenames intact; otherwise a later `git push -u` becomes a wildcard add.
+# run_guards inspects EVERY match, so narrowing the first capture cannot hide
+# a later unsafe add. Commit/push parsing retains its existing contract.
+ADD_ARGS = r"(?P<args>(?:\"[^\"]*\"|'[^']*'|[^|;&\r\n])*)"
+ADD_RE = re.compile(GIT + r"\s+add\b" + ADD_ARGS)
 # #485 AC-4, the audit of the sibling matchers. Neither needs the same
 # treatment, and both were left alone deliberately:
 #
@@ -1480,10 +1486,12 @@ def _check_h03_wildcard_add(add, cwd):
     src/ just as surely as `git add -A` does."""
     if not add:
         return
-    if WILDCARD_ADD_RE.search(add.group("args")):
+    args = add.group("args")
+    if (WILDCARD_ADD_RE.search(args)
+            or _has_literal_flag(args, {"-A", "--all", "-u", "--update"})):
         block("H-03", "'git add -A' / 'git add .' / 'git add --all' / 'git add -u' "
                       "are prohibited. Stage files explicitly (commit-gate skill).")
-    why = add_violation(add.group("args"), cwd)
+    why = add_violation(args, cwd)
     if why:
         block("H-03", f"Wildcard staging is prohibited — {why} stages a "
                       f"non-explicit file set. Stage files explicitly, one path "
@@ -1844,6 +1852,164 @@ def _check_h14_migration(commit, add, cwd, root):
                           f"bypass a migration gate, /override logs the exception.")
 
 
+def _literal_python_read_view(cmd):
+    """Recognize only isolated, literal Python read diagnostics on stdin.
+
+    This is a closed read grammar, not an exemption for Python/subprocess.
+    Unknown code, import shadowing, shell expansion, and extra commands keep
+    the original guard view. Equivalent literal read commands still traverse
+    every gate. No code is executed or filesystem state consulted here.
+    """
+    if "\n" not in cmd or " -I" not in cmd:
+        return cmd
+    try:
+        if len(cmd.encode("utf-8")) > 32768:
+            return cmd
+    except UnicodeError:
+        return cmd
+    if re.search(r"\r(?!\n)|[\x00\u2018-\u201b]", cmd):
+        return cmd
+    text = cmd.replace("\r\n", "\n")
+    # -I excludes workspace/PYTHONPATH modules: otherwise an apparent
+    # standard-library import could execute a project-authored replacement.
+    invocation = r"(?:python(?:3(?:\.\d+)*)?|py)(?:\.exe)? -I(?: -B)? -"
+    fallback = cmd
+    match = re.fullmatch(
+        r"@'\n(?P<body>[\s\S]*?)\n'@[ \t]*\|[ \t]*(?P<invoke>" + invocation + r")[ \t]*\n?", text)
+    if match:
+        body = match["body"]
+        # The consumer appears after its script in PowerShell. If the
+        # read grammar refuses it, expose that consumer before the intact
+        # source too, so interpreter/write guards cannot miss an earlier path.
+        fallback = match["invoke"] + "\n" + cmd
+        if re.search(r"(?m)^[ \t]*'@", body):
+            return cmd
+    else:
+        match = re.fullmatch(
+            invocation + r"[ \t]+<<(?P<quote>['\"])(?P<end>[A-Za-z_][A-Za-z0-9_]{0,31})"
+            r"(?P=quote)[ \t]*\n(?P<body>[\s\S]*?)\n(?P=end)[ \t]*\n?", text)
+        if not match:
+            return cmd
+        body = match["body"]
+        if any(line == match["end"] for line in body.splitlines()):
+            return cmd
+    # Ordinary commands pay no AST import/parse cost.
+    import ast
+    try:
+        tree = ast.parse(body)
+    except (SyntaxError, ValueError, RecursionError):
+        return fallback
+    if len(tree.body) > 32 or sum(1 for _ in ast.walk(tree)) > 256:
+        return fallback
+
+    def literal(node):
+        return node.value if isinstance(node, ast.Constant) and isinstance(node.value, str) else None
+
+    def read_path(node):
+        value = literal(node)
+        if value is not None and re.fullmatch(
+            r"\.codearbiter/(?:overrides\.log|CONTEXT\.md|decisions/[A-Za-z0-9][A-Za-z0-9._-]*\.(?:md|jsonl))",
+            value,
+        ):
+            return value
+        return None
+
+    imports, reads = set(), []
+    for statement in tree.body:
+        if (isinstance(statement, ast.Import) and len(statement.names) == 1
+                and statement.names[0].name == "subprocess" and statement.names[0].asname is None):
+            imports.add("subprocess")
+            continue
+        if (isinstance(statement, ast.ImportFrom) and statement.level == 0
+                and statement.module == "pathlib" and len(statement.names) == 1
+                and statement.names[0].name == "Path" and statement.names[0].asname is None):
+            imports.add("Path")
+            continue
+        if not (isinstance(statement, ast.Expr) and isinstance(statement.value, ast.Call)
+                and isinstance(statement.value.func, ast.Name) and statement.value.func.id == "print"
+                and len(statement.value.args) == 1 and not statement.value.keywords):
+            return fallback
+        call = statement.value.args[0]
+        if not isinstance(call, ast.Call) or not isinstance(call.func, ast.Attribute):
+            return fallback
+        owner = call.func.value
+        if (isinstance(owner, ast.Name) and owner.id == "subprocess" and "subprocess" in imports
+                and call.func.attr == "check_output" and len(call.args) == 1
+                and isinstance(call.args[0], (ast.List, ast.Tuple)) and len(call.keywords) == 1
+                and call.keywords[0].arg == "text" and isinstance(call.keywords[0].value, ast.Constant)
+                and call.keywords[0].value.value is True):
+            args = [literal(value) for value in call.args[0].elts]
+            if (len(args) != 3 or args[:2] != ["git", "show"] or args[2] is None
+                    or not args[2].startswith("HEAD:") or not read_path(ast.Constant(args[2][5:]))):
+                return fallback
+            reads.append(" ".join(args))
+            continue
+        if (isinstance(owner, ast.Call) and isinstance(owner.func, ast.Name)
+                and owner.func.id == "Path" and "Path" in imports
+                and len(owner.args) == 1 and not owner.keywords and not call.args):
+            path = read_path(owner.args[0])
+            allowed = call.func.attr in {"exists", "is_file", "read_text"} and not call.keywords
+            if call.func.attr == "read_text" and len(call.keywords) == 1:
+                allowed = call.keywords[0].arg == "encoding" and literal(call.keywords[0].value) == "utf-8"
+            if path is not None and allowed:
+                reads.append("cat " + path)
+                continue
+        return fallback
+    return "\n".join(reads) if reads else fallback
+
+
+def _debug_validation_command_view(cmd):
+    """Exclude literal stdin data only for this package's read-only validator.
+
+    Accept one PowerShell single-quoted here-string piped to the exact installed
+    helper with literal ``-B ... validate`` argv. Everything else keeps the raw
+    guard view: expandable strings, wrappers, other helpers, extra commands,
+    redirections and early terminators cannot become an exemption.
+    """
+    # PowerShell accepts lone CR newlines and curly single-quote terminators.
+    # Keep those forms raw rather than missing an early terminator and hiding
+    # executable code. JSON can represent these data characters with escapes.
+    if re.search(r"\r(?!\n)|[\u2018-\u201b]", cmd):
+        return cmd
+    opening = re.match(r"\A@'\r?\n", cmd)
+    if opening is None:
+        return cmd
+    closing = re.search(r"(?m)^[ \t]*'@", cmd[opening.end():])
+    if closing is None or closing.group() != "'@":
+        return cmd
+    body = cmd[opening.end():opening.end() + closing.start()]
+    try:
+        if len(body.encode("utf-8")) > 65536 or not isinstance(json.loads(body), dict):
+            return cmd
+    except (ValueError, UnicodeError, RecursionError):
+        return cmd
+    tail = cmd[opening.end() + closing.end():].strip()
+    if not tail.startswith("|"):
+        return cmd
+    invocation = tail[1:].strip()
+    if re.search(r"[\r\n;&|<>`$%!^*?{}\[\]()]", invocation):
+        return cmd
+    tokens, end = [], 0
+    for match in re.finditer(r'''(?:[^\s'"\x00]|'[^']*'|"[^"]*")+''', invocation):
+        if invocation[end:match.start()].strip():
+            return cmd
+        token = match.group()
+        if len(token) >= 2 and token[0] == token[-1] and token[0] in "\"'":
+            token = token[1:-1]
+        tokens.append(token)
+        end = match.end()
+    if invocation[end:].strip() or len(tokens) != 4 or tokens[1] != "-B" or tokens[3] != "validate":
+        return cmd
+    executable = tokens[0].replace("\\", "/").rsplit("/", 1)[-1]
+    if not re.fullmatch(r"(?:python(?:[23](?:\.\d+)*)?|py)(?:\.exe)?", executable, re.I):
+        return cmd
+    helper = tokens[2]
+    known = os.path.join(os.path.dirname(os.path.abspath(__file__)), "debug-handoff.py")
+    if not os.path.isabs(helper) or os.path.normcase(os.path.normpath(helper)) != os.path.normcase(known):
+        return cmd
+    return invocation
+
+
 def run_guards(payload, root, ti):
     """Run every H-NN gate against `ti` (the already host-normalized Bash/
     PowerShell tool_input — see pre-bash.py's `_run`, which resolves it via
@@ -1853,7 +2019,8 @@ def run_guards(payload, root, ti):
     sys.exit(0). This is the composed body pre-bash.py's `_run` used to run
     inline (issue #320) — moved here verbatim, split into one function per
     gate, each still carrying its H-NN ID."""
-    cmd = ti.get("command", "") or ""
+    cmd = _debug_validation_command_view(ti.get("command", "") or "")
+    cmd = _literal_python_read_view(cmd)
 
     # Heredoc bodies are stdin text, not arguments — match the git command over
     # a body-stripped view so message content (which may contain `;`/`|`/`&`,
@@ -1905,9 +2072,25 @@ def run_guards(payload, root, ti):
         heredoc_shell_fallback and PUSH_RE.search(cmd))
     _check_push_gates(push, cwd)
 
-    add = ADD_RE.search(git_view) or (
-        heredoc_shell_fallback and ADD_RE.search(cmd))
-    _check_h03_wildcard_add(add, cwd)
+    # Preserve quoted literal paths AND check executable continuations inside
+    # nested/double quotes. Outside quotes, join POSIX/PowerShell/cmd escapes
+    # so a split flag remains one argv item. Neither view changes other guards.
+    quoted_staging = re.sub(r'''("[^"]*"|'[^']*')|[\\`^](?:\r\n|\n|\r)''',
+                            lambda match: match.group(1) or "", cmd)
+    joined_staging = re.sub(r"[\\`^](?:\r\n|\n|\r)", "", cmd)
+    adds = []
+    for staging_cmd in dict.fromkeys((quoted_staging, joined_staging)):
+        # Continuations can form the heredoc operator or shell name itself.
+        # Re-evaluate execution per view, without rewriting quoted paths again.
+        staging_view = HEREDOC_RE.sub(r"\3 ", staging_cmd)
+        adds.extend(ADD_RE.finditer(staging_view))
+        if "<<" in staging_cmd and (
+                _heredoc_fed_to_shell(staging_cmd) or _has_shell_executor(staging_cmd)):
+            adds.extend(ADD_RE.finditer(staging_cmd))
+    for staging in adds:
+        _check_h03_wildcard_add(staging, git_cwd(staging.group(0), exec_root))
+    # Commit security/migration checks still see that the batch stages files.
+    add = adds[0] if adds else None
     _check_h05_audit_log(cmd)
     _check_h11_decisions(cmd)
     _check_h18_context_md(cmd)

package/plugins/ca-pi/hooks/_host.py

@@ -11,7 +11,7 @@ import hostapi  # noqa: E402
 class PiHost(hostapi.Host):
     name = "pi"
     adapter_name = "@arbiterforge/ca-pi"
-    adapter_version = "0.21.6"
+    adapter_version = "0.21.7"
     update_target = "ca-pi"
     update_tag_prefix = "ca-pi-v"
     update_command = "pi update npm:@arbiterforge/ca-pi"

package/plugins/ca-pi/hooks/_prerequisitelib.py

@@ -950,6 +950,8 @@ def consume_from_hook(
     prepared = _replylib.prepare(raw, "prerequisite")
     prompt = prepared["text"]
     attempted = prepared["attempted"]
+    if not attempted:
+        return ""
     if prepared["notice"]:
         _replylib.record_near_miss(root, raw, "code")
         return prepared["notice"]

package/plugins/ca-pi/hooks/_replylib.py

@@ -406,19 +406,72 @@ DIAGNOSTICS = Path(".codearbiter/.markers/reply-diagnostics.log")
 DIAGNOSTICS_CAP = 256 * 1024
 
 
+def _capture_attempt(raw, route: str) -> bool:
+    """Recognize an explicit legacy reply, not an ordinary leading verb.
+
+    Keep near-miss diagnostics for a coded/token reply with appended prose,
+    without repairing that prose into an accepted reply. Merely saying
+    ``Approve`` or ``reconcile the plan`` must not start legacy capture.
+    """
+    if not isinstance(raw, str) or not raw or len(raw) > MAX_INPUT:
+        return False
+    words = _clean(raw).split(" ")
+    verb = words[0].lower()
+    if SHORT_ROUTE.get(verb) != route:
+        return False
+    for (candidate, count), shape in GRAMMAR.items():
+        if candidate != verb or len(words) < count:
+            continue
+        fields = list(zip(words[1:count], shape))
+        if any((kind == "I" and not ID_RE.fullmatch(word))
+               or (kind == "M" and word.lower() not in MODES)
+               or (kind == "S" and word.upper() not in STATES)
+               for word, kind in fields[:-1]):
+            continue
+        token = fields[-1][0].rstrip(",.!?")
+        if CODE_RE.fullmatch(token.upper()):
+            if not token.isalpha():
+                return True
+            # Ordinary words overlap the code alphabet in EVERY casing:
+            # "Approve DATA migration" is not a protocol request. Only a
+            # retained matching code makes an all-letter token diagnostic.
+            # Exact armed replies remain case-insensitive; prose is not repaired.
+            if any(value.get("route") == route
+                   and value.get("short_reply", "").rsplit(" ", 1)[-1] == token.upper()
+                   for _path, value, _alive in _entries()):
+                return True
+            continue
+        if "I" in shape and re.fullmatch(r"[A-Za-z0-9_-]{12,128}", token):
+            # The long form's ID/token grammar also fits natural prose such
+            # as "approve the implementation". Require a retained request
+            # for its named subject before classifying it as a near miss.
+            prefix = canonicalize(" ".join(words[:count])).rsplit(" ", 1)[0]
+            if any(value.get("route") == route
+                   and value.get("full_reply", "").rsplit(" ", 1)[0] == prefix
+                   for _path, value, _alive in _entries()):
+                return True
+            # Old full-token routes can predate the short-code registry.
+            import _artifactpromptlib
+            try:
+                return _artifactpromptlib.resolve(route, canonicalize(raw)) is not None
+            except _artifactpromptlib.PromptRouteError:
+                # Let the adapter report the ambiguous legacy route through
+                # its existing capture-failure boundary, never approve it.
+                return True
+    return False
+
+
 def prepare(raw, route: str) -> dict[str, object]:
     """The text an adapter should match, plus a notice owned by ``route``.
 
-    ``attempted`` is true when the prompt is reply-shaped for this route, so
-    the adapter reports a miss instead of staying silent.
+    Only explicit legacy replies enter capture. Ordinary user intent stays
+    byte-for-byte unchanged and never becomes a request for another code.
     """
+    if not _capture_attempt(raw, route):
+        return {"text": raw, "notice": "", "attempted": False}
     canonical = canonicalize(raw)
-    first = canonical.split(" ", 1)[0] if isinstance(canonical, str) and canonical is not raw else ""
-    if not first and looks_like_reply(raw):
-        first = _clean(raw).split(" ", 1)[0].lower()
-    mine = SHORT_ROUTE.get(first) == route
-    expanded = expand(canonical) if mine else {"text": canonical, "notice": ""}
-    return {"text": expanded["text"], "notice": expanded["notice"] if mine else "", "attempted": mine}
+    expanded = expand(canonical)
+    return {"text": expanded["text"], "notice": expanded["notice"], "attempted": True}
 
 
 def miss_notice(example: str) -> str:

package/plugins/ca-pi/hooks/hostapi.py

@@ -313,7 +313,7 @@ class Host:
 
     name = "claude"
     adapter_name = "ca"
-    adapter_version = "3.2.6"
+    adapter_version = "3.2.7"
 
     # Update-notifier descriptor. Each independently versioned host overrides
     # these three values in its per-plugin _host.py. Keeping the target,

package/plugins/ca-pi/includes/artifacts-attestation.md

@@ -93,24 +93,27 @@ approval, dispatch, acceptance, commit proof, or finalization. This is the
 repository's cooperative same-user attestation model, not cryptographic identity
 proof or protection from an unrestricted same-user filesystem writer.
 
-For ordinary sequential planning, create a plan as `draft_preview`, consume existing criterion IDs,
-then `plan-bind` to the approved spec and approve the plan through its existing workflow. Initial
-combined HTML sprint review uses the explicit paired path below instead of separate approvals.
-A normative change invalidates its approval. Rebinding is explicit and preserves
-history; it does not waive coverage or permit silent reinterpretation.
-
-When adversarial review revises a ready initial draft spec after its draft plan exists,
-query both current identities. The installed engine's explicit `plan-bind` request with
+For ordinary planning and resume, create or maintain a plan as `draft_preview` and
+consume existing criterion IDs. Source rebinding records the selected requirements;
+it does not require a new approval or reset existing work. A normative change can make
+historical evidence inapplicable. Preserve that history without relabeling it as current.
+
+When an in-scope correction revises the source spec, query both current identities.
+The installed engine's explicit `plan-bind` request with
 `binding_mode: draft_preview` requires the plan's existing `expected` CAS and the spec's
-`spec_expected` revision/model CAS. It rebinds only that same-ID, same-slug initial pair:
-both artifacts must remain unapproved drafts, tasks pending and unevidenced, prerequisites
-unsatisfied and unevidenced, and scopes empty. Optional typed plan corrections must leave
-both drafts fully ready. The binding remains `draft_preview`; this operation grants no
-approval, delegation, prerequisite satisfaction, execution or acceptance. Revalidate both
-current drafts, repeat the affected review and arm the exact combined approval afterward.
-Inspect the installed operation schema first. An engine without this explicit draft
-request reports a capability gap; never edit HTML, recreate the pair, substitute sequential
-approval or use ordinary approved-source `plan-bind` to repair it.
+`spec_expected` revision/model CAS. It refreshes only the existing same-ID, same-slug
+pair, including plans with started, reviewed, blocked or evidenced work. Optional typed
+plan corrections must leave both documents ready. Execution, stops, observations and
+historical approvals are retained; the refreshed plan has draft governance and a
+`draft_preview` binding. This operation grants no approval, delegation, prerequisite
+satisfaction, execution or acceptance. Revalidate the current pair and reassess only
+affected work and evidence. Do not arm combined approval for ordinary maintenance.
+
+Inspect the installed operation schema first. An engine that rejects this supported
+source refresh has a capability gap; retain the stale binding honestly while continuing
+unaffected authorized work. Never edit generated HTML, recreate the pair or erase history
+to satisfy a legacy initial-approval restriction. The historical initial combined approval
+path still requires an unapproved, unstarted and unevidenced initial pair.
 
 ## Historical paired approval and delegated methods
 

package/plugins/ca-pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.21.6",
+  "version": "0.21.7",
   "private": true,
   "license": "AGPL-3.0-only",
   "type": "module",