@arbiterforge/ca-pi 0.6.0

package/plugins/ca-pi/skills/ca-reconcile/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: ca-reconcile
+description: SMARTS arbitration — reconcile architectural artifacts against the scaffold and prior decisions; every variance resolved by an explicit, user-attributed choice.
+argument-hint: "(none) | \"<ADR-id | artifact | scope>\""
+---
+
+# /ca-reconcile — architectural arbitration
+
+Reconciles the project's architectural artifacts against the scaffold and prior decisions, or challenges a specific ADR that is wrong, stale, or in conflict with another. Presents SMARTS analyses and recommendations but never arbitrates — every variance is resolved by an explicit user choice recorded in the decision log with user attribution. With no argument it runs a full reconciliation pass; an argument scopes it to a named ADR, conflict, or artifact.
+
+## Routes to
+
+The `decision-variance` skill (`<plugin-root>/routines/decision-variance/SKILL.md`). It locates
+the three architectural artifacts by exact filename — `01-architecture-breakdown.md`,
+`02-phased-build-plan.md`, `03-task-backlog.md` (under `<project-root>/.codearbiter/plans/`) —
+and indexes the append-only decision log at
+`<project-root>/.codearbiter/decisions/decision-log.md`. It MAY dispatch the
+`decision-challenger` agent (`<plugin-root>/agents/decision-challenger.md`) to stress-test an
+in-scope ADR — optional, not forced. Each variance ends in one of three user-chosen outcomes:
+
+1. **Ratify** — the existing decision stands; the SMARTS analysis and re-affirmation are logged.
+2. **Supersede** — a new decision is recorded by appending a log entry whose `Supersedes:` references
+   the prior one; a replacement ADR is authored via `/ca-adr`.
+3. **Surface as `[CONFIRM-NN]`** — unresolvable now; a numbered placeholder is added to
+   `<project-root>/.codearbiter/open-questions.md`.
+
+## When NOT to use
+
+- Author a brand-new ADR with no prior conflict → `/ca-adr`.
+- Check ADR health (aged, unchallenged, unresolved CONFIRM-NN) → `/ca-adr-status`.
+- A general architectural discussion without recording a decision → `/ca-btw`.
+- A rule conflict between project docs and code → `/ca-conflict`.
+- Routine git text-merge conflicts — this is architectural reconciliation, not merge resolution.
+
+## Hard gate
+
+MUST NOT record an arbitration decision without an explicit user choice; decline "you decide" /
+"use your best judgment" with a structural refusal (the only delegation is the user verbatim accepting
+the recommendation, logged as such in `Decided by:`). MUST match the three artifacts by exact
+filename. The decision log is append-only — MUST NOT edit or rebuild a prior entry; supersede by
+appending. MUST NOT modify the artifacts, scaffold, or code to "fix" a variance. MUST NOT author an
+ADR as the disposition of a routine finding — ADRs are authored only via `/ca-adr` with user
+attribution.

package/plugins/ca-pi/skills/ca-refactor/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: ca-refactor
+description: Restructure code with behavioral parity proven through unmodified pre-existing tests, then refactor. No behavior change.
+argument-hint: "<surface and motivation>"
+---
+
+# /ca-refactor — behavior-preserving restructure
+
+The only permitted entry to refactor work. A refactor that cannot prove parity through unmodified pre-existing tests is a feature change in disguise and routes to `/ca-feature`. Two required parts: the **surface** (exact files, functions, classes, or methods — vague surfaces like "the auth module" are rejected) and the **motivation** (why the restructure is worth doing).
+
+## Flow
+
+Routes to the `refactor` skill — six phases:
+
+1. **Surface identification** — lock the exact files, symbols, and public signatures.
+2. **Parity coverage proof** — demonstrate pre-existing tests already cover the named surface, with at
+   least one direct test per public method.
+3. **Red parity tests (conditional)** — if the refactor exposes a new test seam, route to `tdd` (`<plugin-root>/routines/tdd/SKILL.md`)
+   Phase 1 to write failing tests pinning the seam's contract first.
+4. **Implementation** — apply the restructure mechanically within the surface table; no new behavior,
+   branches, error paths, or side effects.
+5. **Parity verification** — the full pre-existing suite passes with zero edits to any pre-existing
+   test file.
+6. **Lint / coverage gate** — lint, type-check, and coverage clear; surface coverage MUST NOT regress.
+
+## Routes to
+
+`refactor` (`<plugin-root>/routines/refactor/SKILL.md`) — all six phases.
+
+## When NOT to use
+
+- New behavior — a new branch, error path, side effect, public method beyond a Phase 3 seam, or a
+  change to what any input maps to → `/ca-feature`.
+- A change motivated by "the current behavior is wrong" → `/ca-fix`.
+- Questions or discussion → `/ca-btw`.
+- Persisting an already-completed refactor → `/ca-commit`.
+
+## Hard gate
+
+No refactor proceeds without behavioral-parity coverage proof in Phase 2; if the surface is
+under-covered, the skill halts and routes to `tdd` Phase 1 to backfill before resuming. A Phase 4 diff
+that would classify as `feat`, or a Phase 5 verification that depends on edits to a pre-existing test,
+terminates the refactor and re-routes to `/ca-feature` or `/ca-fix`.

package/plugins/ca-pi/skills/ca-release/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: ca-release
+description: Cut a release the only sanctioned way — SemVer bump from the commit log, a CHANGELOG section, an annotated tag. Takes the declared target's name as its only argument, or --dry-run to preview one with no write. The only path to a version tag.
+argument-hint: "[target] | --dry-run"
+---
+
+# /ca-release — tagged release
+
+The only permitted path to a version tag. A release is a deployment-readiness assertion: the codebase at this SHA satisfies the bar for shipping. `/ca-release` aggregates existing compliance — it does not duplicate it.
+
+## Flow
+
+Routes to the `release` skill, which resolves everything about the release from the project's **declared target file**, `<project-root>/.codearbiter/release-targets.md` — the tag prefix, the manifests, the changelog, the payload scope, and the optional checks. Nothing about any target is written here.
+
+`/ca-release` takes the target's name as its only argument. When the declared file names exactly one target, a bare `/ca-release` uses it; when it names more, the argument is required and the skill STOPs rather than guessing. A project with no declared file at all enters the skill's own back-fill lane, which proposes a row and writes nothing without explicit confirmation.
+
+1. **Pre-flight** — declared row resolved, working tree clean, not on the default branch, suite green, no blocking `[CONFIRM-NN]` open. Resolve `LAST_TAG` within that target's own tag series and scope the commit window to the row's declared payload, so a sibling target's commit never bumps this one or lands in its changelog.
+2. **Version** — classify the window by Conventional Commits type and apply the highest-precedence bump, against a base that accounts for both the last tag and every declared manifest. Every bumping commit must carry a `CHANGELOG:` footer; a missing one BLOCKs and is never auto-filled.
+3. **Surfaces** — roll the section into the declared changelog, update every declared manifest, and run the row's declared `pre-tag` checks. Those checks are check-only: one that mutates the tree BLOCKs.
+4. **Tag** — commit the release edits, then compose the annotated tag. Never push it or publish a Release without explicit user authorization — publication is a separate decision.
+
+## Dry run
+
+`/ca-release --dry-run [target]` runs Flow steps 1 and 2 above — Pre-flight in full, then Version's
+read-only derivation: resolving the row, deriving the bump, classifying the window, and verifying
+`CHANGELOG:` footer completeness — then stops before step 3 and reports exactly what a real run would
+do: the target, the derived version and its rationale, the per-commit classification, and any blocker
+Pre-flight or Version would itself have hit. Steps 3 (Surfaces) and 4 (Tag) never run: no changelog
+edit, no manifest bump, no commit, no declared `pre-tag` check execution, no tag. The report also
+prints the resolved row's fields verbatim, which doubles as a way to validate a freshly authored
+`<project-root>/.codearbiter/release-targets.md` without tagging anything. Declared `pre-tag` checks
+are listed, not run — they assert against the manifests AFTER the bump this mode never performs, so
+running them early would report false failures against files `--dry-run` deliberately leaves
+untouched, not a preview of anything real. `release`'s own SKILL.md is authoritative for the exact
+stopping point.
+
+## Arguments
+
+- **`[target]`** — the name of a row in the declared target file (e.g. the name in `[ca]`). Optional only when exactly one target is declared. An unrecognised name STOPs; it is never resolved to a guess.
+- **`--dry-run`** — preview a release with no write; see "Dry run" above. Combines with `[target]` exactly as a real run does — required only when more than one target is declared.
+
+There is no version or `--auto` argument. The version is always derived from the commit log and the declared manifests — supplying one by hand is the thing this lane exists to prevent.
+
+## Routes to
+
+`release` (`<plugin-root>/routines/release/SKILL.md`), which is authoritative for the phase contents and gates summarized above.
+
+## When NOT to use
+
+- Tagging an in-progress branch → land work first via `/ca-feature` / `/ca-fix`.
+- Pushing an already-composed tag → that is a separate user-authorized step.
+- A changelog only → it is a phase output, not a standalone deliverable.
+- Creating a declared target file ahead of a release → that is `context-creation`'s job, or the skill's back-fill lane at release time.
+
+## Hard gate
+
+MUST NOT compose a tag on a red suite. MUST NOT guess the version — it is derived from the commit log and the declared manifests. MUST NOT auto-fill a missing `CHANGELOG:` footer. MUST NOT resolve an unrecognised or ambiguous target to a guess. MUST NOT write to the default branch or force-push. MUST NOT push the tag or publish a Release without explicit user authorization. MUST NOT write, commit, or tag anything under `--dry-run` — it stops before Version step 3's writes even reach the working tree. Any BLOCK may be bypassed only via `/ca-override`.

package/plugins/ca-pi/skills/ca-review/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: ca-review
+description: Review a diff with the reviewer fleet, funneled to one triaged verdict. Targets the current working diff, a path, or an inbound GitHub PR.
+argument-hint: "[path | #<pr> | <pr-url>] (defaults to the current diff)"
+---
+
+# /ca-review — diff review
+
+Read-only review of a change. Routes to `dispatching-parallel-agents` (`<plugin-root>/routines/dispatching-parallel-agents/SKILL.md`): dispatches the reviewer fleet by path matrix, dedupes, then funnels through `finding-triage` → `checkpoint-aggregator` to a single verdict. No code is modified.
+
+**The change under review does not have to be yours.** `/ca-review #123` reviews an inbound pull request through the same fleet, the same matrix, and the same triage. That is the point of issue #80: a tool that only reviews the diff you just wrote is a linter for authors, not a gate for a team, and reviewing code you did NOT write is where a governance gate earns its keep.
+
+It is an ARGUMENT, not a second command. The scope resolver already took one, the fleet is scope-agnostic, and every phase downstream operates on a diff regardless of where it came from — so a `/ca-review-pr` would be a whole public surface (catalog, three host projections, README counts, sidebar) whose only distinguishing feature is where the diff was fetched from.
+
+## Flow
+
+1. Resolve scope from `$ARGUMENTS`:
+   - **empty** → the current working diff (unchanged default).
+   - **a path** → that path (unchanged).
+   - **`#<number>`, a bare number, or a GitHub PR URL** → an INBOUND PR. Fetch its diff with
+     `gh pr diff <number>` and review that. If `gh` is missing or unauthenticated, STOP and say so —
+     do NOT silently fall back to the working diff, which would report a verdict on the wrong change
+     under the PR's name.
+
+   For a PR target, resolve the diff ONCE and review that text. Do not re-fetch per reviewer: the
+   fleet runs in parallel, and a PR updated mid-review would otherwise have different reviewers
+   reading different code and a triage that reconciles findings from two versions.
+2. Build the unit list by path matrix; each matched reviewer is one read-only unit:
+
+   | Reviewer | Dispatched when scope touches |
+   |---|---|
+   | `security-reviewer` | auth, middleware, secrets, deploy/CI, any security-sensitive path |
+   | `auth-crypto-reviewer` | authn, crypto, key handling, secrets |
+   | `dependency-reviewer` | `package.json`, lockfiles, base images, dependency manifests |
+   | `migration-reviewer` | DB migration file add/modify |
+   | `coverage-auditor` | any source change (test coverage vs. obligations) |
+   | `architecture-drift-reviewer` | code that may diverge from accepted ADRs in `.codearbiter/decisions/` |
+
+3. Route to `dispatching-parallel-agents` with that unit list (read-only batch — no collision check).
+   It dedupes overlapping findings, then funnels through `finding-triage` (severity + inline
+   `[NEEDS-TRIAGE]` on out-of-scope items) → `checkpoint-aggregator` (single verdict).
+4. Surface the aggregated verdict: findings by severity, file:line, remediation, and the applicable
+   control from `<project-root>/.codearbiter/security-controls.md` for security findings.
+5. **For a PR target, posting the verdict is a separate, confirmed step.** Report locally first; post only on explicit instruction, with `gh pr review <number> --comment --body-file <file>`. A review comment on someone else's PR is outward-facing and effectively public the moment it lands — it notifies subscribers and cannot be un-sent. Never `--request-changes` or `--approve` from here: those carry merge authority, and this command produces a finding list, not a maintainer's decision.
+
+## Severity
+
+- **CRITICAL** — exploitable vuln, secret exposure, banned primitive, data-integrity breach.
+- **HIGH** — significant compliance gap or unsafe pattern.
+- **MEDIUM** — standards deviation or coverage gap.
+- **LOW** — informational or style.
+
+## Hard gate
+
+Read-only — MUST NOT modify a file, and MUST NOT check out, merge, or otherwise move the repository to the PR's branch: reviewing an inbound PR means reading its DIFF, not adopting its code, and a checkout would run its content through hooks that trust the working tree. BLOCK on any CRITICAL or HIGH finding on your OWN change: it must be resolved before `/ca-pr`. On an inbound PR there is nothing local to block — the verdict is the deliverable. MUST NOT consume raw reviewer output — only the `finding-triage` → `checkpoint-aggregator`
+verdict. MUST NOT resolve a `[CONFIRM-NN]` surfaced during review by guessing.
+
+## When NOT to use
+
+- Opening a PR (reviews dispatch automatically) → `/ca-pr`.
+- A periodic full-codebase sweep → `/ca-checkpoint`.
+- A pre-implementation threat model → `/ca-threat-model`.
+- A question about the code → `/ca-btw`.

package/plugins/ca-pi/skills/ca-spike/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: ca-spike
+description: Exploratory spike on a throwaway branch — answer a named question with disposable code. Never merges; exits to a findings note or /ca-feature.
+argument-hint: "<question to answer> [timebox]"
+---
+
+# /ca-spike — exploratory spike
+
+The sanctioned lane for "I need to write code to find out." Spike code is disposable by contract:
+it never merges, never PRs, and never becomes the implementation. What survives a spike is the
+*answer*, written down — the code is burned.
+
+## Flow
+
+1. **Name the question** — a spike without a falsifiable question is just freelancing. Restate
+   `$ARGUMENTS` as the question the spike answers and the timebox (default: one session). STOP for
+   the user's confirmation.
+2. **Branch** — create `spike/<slug>` from the current branch. All spike work stays on it.
+3. **Explore** — no `tdd`, no plan, no review fleet. Two rules survive even here: no secret leaves
+   the approved store, and no irreversible operation (prod data, destructive migration) runs from a
+   spike.
+4. **Exit — exactly one of:**
+   - **Answered** → write the findings to `<project-root>/.codearbiter/spikes/<slug>.md`
+     (the question, what was tried, the answer, what it implies), then delete the branch. If the
+     answer warrants building, hand the findings to `/ca-feature` — the spike file seeds
+     `brainstorming` (`<plugin-root>/routines/brainstorming/SKILL.md`); the spike code is reference material, never the implementation.
+   - **Timebox expired, no answer** → record that too (a dead end is a finding), delete the branch.
+
+## Hard gate
+
+MUST NOT merge or PR a `spike/*` branch — its only exits are a findings file and deletion. MUST NOT
+copy spike code into an implementation branch wholesale; implementation re-enters through
+`/ca-feature` and `tdd`. Secret-handling and irreversibility rules hold even in a spike. Commits on
+a `spike/*` branch are exempt from `commit-gate` — the exemption is safe precisely because nothing
+on the branch can ever land.
+
+## When NOT to use
+
+- You already know what to build → `/ca-feature`.
+- Diagnosing a defect → `/ca-debug` (investigation with a structured exit).
+- A question answerable by reading code or docs → `/ca-btw`.

package/plugins/ca-pi/skills/ca-sprint/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: ca-sprint
+description: Autonomous sprint — one interactive spec gate, then plan-to-PR execution with every auto-decision SMARTS-scored and logged. Hard gates remain true stops.
+argument-hint: "[goal] [--farm]"
+---
+
+# /ca-sprint — autonomous sprint
+
+The autonomy mode. Brainstorm a sprint spec with the user — the one interactive gate — then execute
+the approved plan end-to-end without per-batch checkpoints, deciding "as the user" via SMARTS on
+every non-hard-gate point. Every auto-decision lands in `.codearbiter/sprint-log.md` (append-only)
+with a confidence flag; the `low`-confidence entries are exactly what the user reviews afterward.
+Nothing is hidden behind autonomy.
+
+## Flow
+
+Load and follow `<plugin-root>/SPRINT.md` — it is the procedure. In brief:
+
+1. **Sprint spec (STOP)** — `brainstorming` scoped to a sprint, then `writing-plans`. Explicit user
+   approval of spec AND plan before autonomy begins.
+2. **Autonomous execution (BLOCK)** — `subagent-driven-development` runs the plan; test-first via
+   `tdd`, two-pass reviewed, fresh-run verified. SMARTS decides non-hard-gate points; everything logs.
+3. **Land & summarize (BLOCK)** — `commit-gate`, then `finishing-a-development-branch`, which
+   auto-selects open-PR. `/ca-sprint` never merges and never discards; the merge decision is the user's.
+
+Hard gates — `security-controls`, crypto/secrets/auth, irreversible ops, `/override`, an
+unresolvable `[CONFIRM-NN]`, merge-to-default — are NEVER auto-decided. They halt and surface.
+
+## Arguments
+
+- **`"goal"`** — seed for the sprint-spec brainstorm.
+- **`--farm`** — cost-arbitrage backend: cheap workers implement under the same gates; Claude still
+  authors spec, failing tests, plan, and reviews everything. Pre-flights `FARM_API_KEY`.
+
+## Routes to
+
+`<plugin-root>/SPRINT.md` (mode body), which routes through `brainstorming`,
+`writing-plans`, `subagent-driven-development`, `commit-gate`, `finishing-a-development-branch`.
+
+## When NOT to use
+
+- A single feature with human checkpoints → `/ca-feature`.
+- Work whose spec cannot be made concrete up front — the one interactive gate is load-bearing;
+  a thin spec makes hard-gate stops frequent instead of rare.

package/plugins/ca-pi/skills/ca-standup/SKILL.md

@@ -0,0 +1,112 @@
+---
+name: ca-standup
+description: Daily repo hygiene — review the day's repo state, then perform the cleanups under per-action confirmation. Fast-forward only, never destructive without a yes.
+argument-hint: (none)
+---
+
+# /ca-standup — daily hygiene
+
+The best-practice checklist you run when you sit down to code, made routine and
+gated. The SessionStart briefing *reports* hygiene state read-only; this command is
+where the *actions* happen — each one confirmed individually, none taken unbidden.
+Arbiter gathers and proposes; you decide every mutation.
+
+## Flow
+
+The orchestrator reads the current repo state (reusing the briefing's read-only
+computation — branch, ahead/behind, dirty tree, stashes, prune-candidate branches,
+stale worktrees) and presents it, then offers each applicable action in turn. Skip
+an action that has no candidates; never bundle confirmations across different
+actions or items — branch deletions always stay per-item, and the sole exception
+is step 3's explicitly enumerated worktree group, which is still one confirmation
+that names every member, never an implied yes.
+
+1. **Fetch + fast-forward pull** — kick `git fetch`, then offer a **`--ff-only`**
+   pull of the current branch. Eligibility is the briefing summary's
+   `ff_pull_eligible` flag (SH-6: clean working tree AND behind upstream) — the same
+   pure helper the SessionStart briefing computes, not a condition re-derived here.
+   On a dirty tree the pull is withheld and the dirty state is reported instead. A
+   diverged branch (would need a merge) is refused with a diverged-branch message —
+   never a merge commit.
+2. **Prune merged local branches** — list local branches already merged on remote
+   (the `: gone]` upstream set), excluding the current branch and the default
+   (`main`). Delete a listed branch only after an explicit per-branch confirmation;
+   declining leaves it in place.
+
+   A `: gone]` branch that was squash-merged will typically **refuse** plain
+   `git branch -d` — its upstream is already pruned, so `-d` has nothing to test
+   reachability against. Before reporting that as a stop, check for a merged PR
+   record: `gh pr list --head <branch> --state merged --json headRefOid`. When a
+   `MERGED` PR's `headRefOid` equals that branch's local tip, containment is
+   proven and `git branch -D` is permitted — with the proof stated and the
+   branch named in the confirmation — mirroring the `post-merge-cleanup` Phase 5
+   contract. Without that proof, a refusal stays a report-and-stop; never guess.
+3. **Remove stale worktrees** — list stale/merged worktrees (branch gone-or-merged,
+   or path missing on disk), never the main worktree. Present the full stale list
+   together with each item's evidence, then offer removal as an explicitly
+   **enumerated group** — one confirmation that names every member — as well as
+   per-item confirmation for anyone who wants to keep some. Declining the group
+   falls back to per-item confirmation, and declining any item leaves it intact.
+4. **Surface stashes / dirty / un-pushed** — list stashes, uncommitted changes, and
+   un-pushed commits, each with a suggested next step (`/ca-commit`, `git push`,
+   `git stash show`). Report-and-route only: never discard a stash, reset, or push.
+5. **Advisory board-drift sweep** — run `git log` over the recent merge window
+   (since the last `ca`-scoped tag, or a rolling 30-day window when no tag exists)
+   and pipe that text to `"$PY" "<plugin-root>/hooks/boardsync.py" reconcile`. Resolve `$PY`
+   once by presence — `PY=python3; { command -v python3 >/dev/null 2>&1 && python3 --version >/dev/null 2>&1; } || PY=python`
+   — never `python3 X || python X`, which reruns X on any nonzero exit (#577); this resolution
+   covers step 6's helper call too.
+   Display the advisory drift report as-is: DRIFTED tasks (work merged but board
+   state not `[x]`) and informational UNKNOWN ids (in the log but absent from the
+   board). This step is read-only and best-effort — the dotted-id grep can miss a
+   task never named in a commit. The board is never mutated here; `open-tasks.md`
+   is never written. Any drifted task must be resolved explicitly through
+   `/ca-task done <id>` — the only blessed board writer. State this clearly to the
+   user; do not auto-flip.
+
+6. **Archival sweep — proposed per item, never batched** (B-24). Long-done tasks
+   accumulate on the board and inflate the in-flight count until it stops meaning
+   anything. List the done items older than the cutoff, then ask about **each one
+   separately** and archive only the ones the user says yes to:
+   `"$PY" "<plugin-root>/hooks/taskwrite.py" archive <id>`.
+
+   One confirmation per item, one helper call per item — the two map 1:1 on
+   purpose. A batched "archive all 12?" turns twelve decisions into one, and the
+   helper's own per-item ordering (append to `done-tasks.md` first, then remove
+   from `open-tasks.md`) is what makes an interrupted sweep recoverable; a batch
+   loop that answered once would throw that away.
+
+   An item marked `[x]` with **no `(done YYYY-MM-DD)` stamp** cannot be aged, so
+   it is never in the proposed set. Offer it only if the user asks, and only with
+   `--allow-undated` — both `/ca-task done` and the board classifier require
+   the stamp, so an unstamped entry is legacy or override-era and its real age is
+   unknown.
+
+   Declining is always available and costs nothing: an unarchived task stays
+   exactly where it is. Never archive without a yes.
+
+Present a one-line summary of what was done and what was declined.
+
+## When NOT to use
+
+- A read-only state snapshot without acting → `/ca-status`.
+- Install health (interpreter, payload, hooks) → `/ca-doctor`.
+- Committing staged work → `/ca-commit`.
+
+## Hard gate
+
+- MUST pull with `--ff-only` and ONLY on a clean working tree — never a merge
+  commit, never on a dirty tree, never a rebase.
+- MUST exclude the current branch and the default branch from branch pruning, and
+  the main worktree from worktree cleanup.
+- MUST confirm branch deletions individually — no batched or implied yes.
+  Worktree removals MAY be confirmed as one explicitly enumerated group (naming
+  every member) or individually; either way there is no implied yes, and
+  declining the group falls back to per-item confirmation rather than removing
+  anything.
+- MUST treat stash / dirty / un-pushed state as report-and-route only — never
+  discard, reset, force, or push on the user's behalf.
+- MUST NOT write to or force-push the default branch.
+- MUST NOT auto-flip any board entry during the drift sweep — the sweep is advisory
+  and read-only; resolving a drifted task is the user's decision and routes
+  exclusively through `/ca-task done <id>`.

package/plugins/ca-pi/skills/ca-status/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: ca-status
+description: Show the project's current state at a glance — stage, open tasks, open questions, overrides since the last checkpoint, current branch. Read-only.
+argument-hint: (none)
+---
+
+# /ca-status — state snapshot
+
+A read-only summary of `.codearbiter/` state. No skill is routed to; no file is modified.
+
+## Flow
+
+The orchestrator reads and presents:
+
+1. **Stage** — the `stage:` maturity value from `<project-root>/.codearbiter/CONTEXT.md` frontmatter.
+2. **Pipelines** — every slug in `<project-root>/.codearbiter/specs/` and `plans/`, with how
+   far each got: spec awaiting approval, spec approved / no plan, plan in progress (`ACCEPTED` count
+   vs. total from the plan's status column), or complete. An interrupted pipeline is resumable via
+   `/ca-feature` — say so on its line.
+3. **Open tasks** — the in-flight count from `<project-root>/.codearbiter/open-tasks.md`
+   (top-level `- ` bullets excluding done `- [x]`; the same `_taskboardlib` count the
+   SessionStart hook uses).
+4. **Open questions** — the count of unresolved `[CONFIRM-NN]` placeholders in
+   `<project-root>/.codearbiter/open-questions.md`.
+5. **Overrides since last checkpoint** — entries in `<project-root>/.codearbiter/overrides.log`
+   newer than the marker in `<project-root>/.codearbiter/last-checkpoint`.
+6. **Current branch** — from git.
+
+## Output
+
+```
+## Project status — YYYY-MM-DD
+
+Stage:            N
+Branch:           <current branch>
+Pipelines:
+  <slug>          plan 3/7 ACCEPTED — resume with /ca-feature "<slug>"
+  <slug>          spec approved, no plan
+Open tasks:       N
+Open questions:   N ([CONFIRM-NN] unresolved)
+Overrides since last checkpoint: N
+```
+
+No specs and no plans → `Pipelines: none`.
+
+If `[CONFIRM-NN]` placeholders are open, surface them — do not resolve them here.
+
+## When NOT to use
+
+- A full cross-cutting review → `/ca-checkpoint`.
+- A specific question → `/ca-btw`.
+
+## Hard gate
+
+Read-only. MUST NOT modify any file. MUST NOT resolve a `[CONFIRM-NN]` it surfaces. No skill is routed
+to by this command.

package/plugins/ca-pi/skills/ca-task/SKILL.md

@@ -0,0 +1,61 @@
+---
+name: ca-task
+description: The sanctioned task-board mutator — add a queued task, start one (flips to in-progress and stamps the date, minting a dotted ID on pick-up), or mark an in-progress task done. The only blessed write to open-tasks.md.
+argument-hint: "add \"<desc>\" | start <id|\"title\"> | done <id|\"title\">"
+---
+
+# /ca-task — task-board writer
+
+The one blessed way to mutate `<project-root>/.codearbiter/open-tasks.md`
+(resolves D-1). Hand-editing the board is no longer the only path; this command keeps
+every entry schema-conformant and every transition dated. The board LOGIC lives in the
+pure `_taskboardlib` transforms; this command runs the thin writer
+`<plugin-root>/hooks/taskwrite.py`.
+
+## Verbs
+
+Always put `--` before user text (a desc or title) so a value beginning with `-` is not
+parsed as a flag. Resolve the interpreter once by presence — `PY=python3; { command -v python3 >/dev/null 2>&1 && python3 --version >/dev/null 2>&1; } || PY=python`
+— never `python3 … || python …`, which reruns the helper on any nonzero exit and reports the
+second run's code instead of the first's (#577) — then invoke `"$PY"` below.
+
+- **add** — append a queued task. ID-less by default; pass `--id <group>.<type>` to mint
+  a dotted ID now, `--from <origin>` for a harvest back-ref, `--boundaries a,b` for the
+  security/trust boundaries it touches. The description must be nonblank and
+  single-line; origin and boundary values must also stay on one line.
+  - `"$PY" "<plugin-root>/hooks/taskwrite.py" add [--id group.type] [--from origin] [--boundaries a,b] -- "<desc>"`
+- **start** — flip a task to in-progress and **stamp the started date** (so it can never
+  be a dateless `[~]`). On an ID-less item, pass `--as <group>.<type>` to mint its dotted
+  ID at pick-up. `--date YYYY-MM-DD` overrides today.
+  - `"$PY" "<plugin-root>/hooks/taskwrite.py" start [--as group.type] [--date YYYY-MM-DD] -- "<id|title>"`
+- **done** — flip an in-progress task to done and stamp the done date (`--date`
+  overrides today). A queued task must be `start`ed first.
+  - `"$PY" "<plugin-root>/hooks/taskwrite.py" done [--date YYYY-MM-DD] -- "<id|title>"`
+
+A missing target, an already-matching state, an out-of-order transition, a malformed
+add field or `--date`, or an invalid `GROUP.TYPE` namespace is reported and writes
+nothing (exit 1).
+A queued `done` identifies the task as queued and tells the caller to `start` it first.
+**Targeting by title is best-effort:**
+prefer the dotted ID, and
+note that if two ID-less items share a title, `start`/`done` act on the first — give one
+an ID (`/ca-task start --as <group>.<type> -- "<title>"`) to disambiguate.
+
+## When NOT to use
+
+- Promoting workflow follow-ups in bulk → that is the harvest
+  (`<plugin-root>/includes/harvest.md`), which calls this writer for you.
+- Reading the board / counts → `/ca-status` (read-only).
+- Archiving long-settled done items → deferred (D-2); done items stay in-place for now.
+- Filing a separate `chore(board)` PR just to flip a task state → task-board transitions
+  (`[x]` done-flip, `[~]` start-flip, new `[ ]` add) ride the **work commit** via
+  commit-gate, co-located atomically with the code that completes, starts, or spawns the
+  task (ADR-0008). A lagging board-only PR is the anti-pattern this design eliminates.
+
+## Hard gate
+
+- MUST write the board only through `taskwrite.py` (the pure transforms), never a
+  free-hand Edit that can malform the schema.
+- `start` MUST stamp a started date — never leave a dateless `[~]`.
+- `done` MUST target an in-progress task — a queued task must go through `start` first.
+- MUST NOT delete a task to "complete" it — mark it `done` so the record survives.

package/plugins/ca-pi/skills/ca-threat-model/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: ca-threat-model
+description: Opt-in lightweight STRIDE pass for a sensitive feature before implementation. Not a routine gate — invoke it when a change warrants security thought.
+argument-hint: "<scope description>"
+---
+
+# /ca-threat-model — STRIDE pass (opt-in)
+
+Optional, lightweight pre-implementation security review for a sensitive change — new external endpoints, new secrets-handling paths, new auth/authz flows. **Opt-in, not a routine gate**: nothing routes here automatically. Invoke it when a change warrants the thought; skip it otherwise. Read-only — modifies no file. Describe what the component does, what data it handles, and which actors interact with it.
+
+## Routes to
+
+`security-architecture` (`<plugin-root>/routines/security-architecture/SKILL.md`). The skill reads:
+
+- `<project-root>/.codearbiter/security-controls.md` — compliance requirements.
+- `<project-root>/.codearbiter/decisions/` — existing security-relevant ADRs.
+
+## Output
+
+```
+## Scope
+<what is being analyzed>
+
+## STRIDE findings
+| Threat | Category    | Likelihood | Impact | Control                      |
+|--------|-------------|------------|--------|------------------------------|
+| ...    | S/T/R/I/D/E | H/M/L      | H/M/L  | <control or NONE — needs one> |
+
+## Recommended controls before implementation
+- <control 1>
+
+## Clearance
+CLEAR TO IMPLEMENT | BLOCKED — resolve findings first
+```
+
+## When NOT to use
+
+- Reviewing already-written code → `/ca-review`.
+- A full cross-cutting review → `/ca-checkpoint`.
+- A security question → `/ca-btw`.
+
+## Hard gate
+
+Read-only — modifies no file. This is an advisory pass, not a routine gate; it never runs unless
+invoked.

package/plugins/ca-pi/skills/ca-tribunal/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: ca-tribunal
+description: Deep, rarely-convened whole-codebase audit — eleven specialist lenses, a resumable on-disk audit log, findings filed as GitHub issues on approval. Expensive; estimates cost and STOPs before running. Never a required gate.
+argument-hint: "[scope-path] [--tag <label>]"
+---
+# /ca-tribunal — deep codebase audit
+
+The deepest, most expensive review codeArbiter offers, convened rarely and on demand. Routes to the tribunal skill. Eleven lenses judge the codebase; every finding persists to its own file (plus append-only triage/run logs) under `.codearbiter/reports/<run-id>/`, so an interrupted run resumes from disk. Never a required gate — critical/high are blocking-severity findings, not a pipeline halt.
+
+Cost first — this lane routinely costs millions of tokens on a large repo. Phase 0 sizes the codebase, prints a token-cost band, recommends the highest-reasoning model, and STOPs for your acknowledgement before dispatching anything. Nothing runs unacknowledged.
+
+## Flow
+
+Load and follow the tribunal skill (`<plugin-root>/routines/tribunal/SKILL.md`). In brief:
+
+Phase 0 (STOP) — cost estimate, model recommendation, resume check.
+Phase 1 (BLOCK) — map the codebase; risk-rank and mark trust boundaries; record AI-authorship markers and iteration depth.
+Phase 2 (BLOCK) — dispatch `tribunal-lens-reviewer` once per active lens in priority waves (≤5 in flight); each dispatch writes one file per finding under its own `findings/<lens>/` dir.
+Phase 3 (BLOCK) — triage per wave from disk: dedup, independent calibration, decision vocabulary.
+Phase 4 (BLOCK) — project the human-readable report from the logs.
+Phase 5 (BLOCK) — on explicit selection, file findings as GitHub issues; idempotent against the tracker.
+Phase 6 (STOP) — optional, opt-in KPI telemetry to the public codeArbiter repo.
+
+## Arguments
+
+`"scope-path"` — focus the audit on a subtree (default: repository root). The full lens roster still runs; only the scope narrows.
+
+`--tag <label>` — freeform run label recorded in telemetry (see `references/telemetry.md`).
+
+## Routes to
+
+`<plugin-root>/routines/tribunal/SKILL.md` — dispatches `tribunal-lens-reviewer` once per active lens (and, on a large repo, the optional map-structure / map-deps mappers).
+
+## When NOT to use
+
+- A review of the current diff → `/ca-review` (gate-blocking, fast).
+- A lean periodic sweep → `/ca-checkpoint` (cheap, frequent; tribunal is its rare, deep counterpart).
+- An adversarial STRIDE pass on one sensitive feature → `/ca-threat-model`.
+- A governance packet for a window → `/ca-audit`.
+- Anything on a schedule or in a hot loop — tribunal is a rare, deliberate, expensive convening, not a routine gate.
+
+## Hard gate
+
+MUST NOT dispatch any lens before you acknowledge the Phase 0 cost estimate. MUST NOT act as a required gate or block a merge/commit. MUST NOT file an issue or send telemetry without explicit authorization. Read-only on project code until the filing gate; findings file as GitHub issues, never the task board.