@arbiterforge/ca-pi 0.6.2 → 0.8.1

package/README.md

@@ -10,8 +10,8 @@ project context. You decide. codeArbiter enforces.
 <img alt="Claude Code plugin" src="https://img.shields.io/badge/Claude_Code-plugin-d97757">
 <img alt="Codex plugin" src="https://img.shields.io/badge/OpenAI_Codex-plugin-10a37f">
 <img alt="Pi Feature Forge preview" src="https://img.shields.io/badge/ca--pi-Feature_Forge_preview-d97757">
-<img alt="version 2.14.0" src="https://img.shields.io/badge/version-2.14.0-2b7489">
-<img alt="commands" src="https://img.shields.io/badge/commands-40-555">
+<img alt="version 2.15.1" src="https://img.shields.io/badge/version-2.15.1-2b7489">
+<img alt="commands" src="https://img.shields.io/badge/commands-38-555">
 <img alt="skills" src="https://img.shields.io/badge/skills-23-555">
 <img alt="agents" src="https://img.shields.io/badge/agents-18-555">
 <img alt="license AGPL v3" src="https://img.shields.io/badge/license-AGPL_v3-3da639">
@@ -119,7 +119,7 @@ Approve the normal plugin trust prompt, open the target repository, and continue
 
 ### Codex CLI
 
-The public GitHub-slug flow is **available now**. The repository currently ships `ca-codex 0.6.1`;
+The public GitHub-slug flow is **available now**. The repository currently ships `ca-codex 0.7.1`;
 the dated end-to-end public-install record discovered `ca-codex 0.2.4` from release `v2.8.13`.
 Current packaging and shared-core parity are continuously verified, while that dated live-install
 record stays labeled rather than being silently promoted to evidence for a newer adapter:
@@ -163,7 +163,7 @@ pi config
 Replace `<version>` with the numeric suffix from the chosen tag while retaining the full
 `ca-pi-v...` tag in the install source.
 
-Pi 0.80.5 and Pi 0.80.10 are the supported hosts for this release line. Generated aliases use `/ca-*`;
+Pi 0.80.5 and Pi 0.84.1 are the supported hosts for this release line. Generated aliases use `/ca-*`;
 `/skill:ca-*` is the host-native fallback. Every `ca-pi-v*` tag is also published to npm as
 `npm:@arbiterforge/ca-pi` with provenance (ADR-0029); the pinned Git tag remains the reproducible
 install. The [Pi runbook](./docs/pi-parity-testing.md) covers isolated install, trust, verification,
@@ -188,6 +188,17 @@ Follow the complete
 [first-repository walkthrough](https://arbiterforge.github.io/codeArbiter/getting-started/quickstart/)
 for expected output, proof, and recovery.
 
+## Practice before using your own repository
+
+[Arbiter Academy](https://arbiterforge.github.io/arbiter-academy/) is an optional practice course for
+codeArbiter. It starts in a personal fork of the Academy repository, so you can make real commits,
+inspect governed evidence, and recover from a failed attempt without placing your own project at risk.
+
+The Academy website is the lesson surface. Each published lesson identifies whether an action belongs
+in the browser, native terminal, active harness, or with the agent, then provides a copyable command,
+the result to expect, the evidence to inspect, and a safe recovery path. Start there when you want to
+learn the workflow before protecting a production repository.
+
 ## The docs are the operating manual
 
 The site is designed as a continuous path from first contact to source-backed operation:
@@ -255,7 +266,7 @@ explains who creates, reads, and updates every artifact, plus its recovery rules
 - No raw secret stored in the repository, logs, images, or prompts.
 - No direct write to the default branch and no force-push.
 - No ADR outside `/ca:adr`, with explicit user attribution.
-- Every `/ca:override`, `/ca:dev` entry/exit, and sprint auto-decision is durable and attributable.
+- Every `/ca:override`, `mode --dangerous`/`mode --ops` entry/exit, and sprint auto-decision is durable and attributable.
 - H-18 activation protection has no in-session override path; disabling a repository requires an
   external editor and an explicit audit record.
 
@@ -290,12 +301,12 @@ gate bypasses, merges, and unresolved questions remain true stops. See
 
 Claude Code's catalog is [`plugins/ca/COMMANDS.md`](./plugins/ca/COMMANDS.md). Codex uses the
 generated [`plugins/ca-codex/COMMANDS.md`](./plugins/ca-codex/COMMANDS.md), and Pi uses the generated
-[`plugins/ca-pi/COMMANDS.md`](./plugins/ca-pi/COMMANDS.md). Current generated counts are `ca: 40`,
-`ca-codex: 38`, and `ca-pi: 39`. Codex omits `statusline` and `prune`; Pi omits `statusline` and uses
+[`plugins/ca-pi/COMMANDS.md`](./plugins/ca-pi/COMMANDS.md). Current generated counts are `ca: 38`,
+`ca-codex: 36`, and `ca-pi: 37`. Codex omits `statusline` and `prune`; Pi omits `statusline` and uses
 native compaction for pruning.
 
 <details>
-<summary><strong>All 40 Claude Code commands</strong></summary>
+<summary><strong>All 38 Claude Code commands</strong></summary>
 
 ### Implementation
 
@@ -355,13 +366,6 @@ native compaction for pruning.
 | `/ca:prune [status\|dry\|run\|audit\|on\|off]` | Inspect or trim transcript bulk |
 | `/ca:commands` | Show the public catalog |
 
-### Maintainer
-
-| Command | Purpose |
-|---|---|
-| `/ca:dev ["note"]` | Enter the env-gated, logged maintainer override |
-| `/ca:arbiter` | Exit dev mode and restore orchestration |
-
 </details>
 
 ## Trust and host boundaries
@@ -505,8 +509,8 @@ implement the Pi adapter, investigate live failures, review older paths, and con
 across permissions, Windows process-tree cleanup, provenance, audit integrity, generated-source
 drift, CI contracts, and documentation.
 
-The final candidate passed the six Pi platform cells for Pi 0.80.5 and 0.80.10 on Windows, macOS,
-and Linux, plus security analysis, CodeQL, shared-core contracts, generated-surface contracts, and
+The final candidate passed the six Pi platform cells — both then-supported Pi versions on Windows,
+macOS, and Linux (versions recorded in the linked artifacts), plus security analysis, CodeQL, shared-core contracts, generated-surface contracts, and
 the repository's final verifier. Sanitized evidence:
 
 - [`docs/reports/pi-support/promotion.md`](docs/reports/pi-support/promotion.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.6.2",
+  "version": "0.8.1",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/plugins/ca-pi/CHANGELOG.md

@@ -4,6 +4,80 @@ All notable changes to `ca-pi` are documented in this file.
 
 ## [Unreleased]
 
+## [0.8.1] - 2026-08-13
+
+### Changed
+
+- `/ca-spike` now preserves only the committed findings file on the parent before deleting its disposable spike branch. Exploratory spike code and commits never land in implementation history.
+
+## [0.8.0] - 2026-08-12
+
+### Added
+
+- Orchestration **mode plane** (ADR-0030): `arbiter`, `dangerous`, and `ops`. The injected persona is
+  now `safety-core.md` plus the active mode's body, composed rather than a single fixed file.
+  **On Pi this release is read-only:** the footer reports the active mode and the shared store is
+  keyed the same way as on the other hosts, but Pi cannot yet CHANGE the mode — the control token is
+  intercepted on Claude and Codex only. A Pi session runs `arbiter`. The input-event handler, the
+  bridge flip path, and the per-turn persona refresh are tracked and not in this release.
+- `ops` mode: an advisory carve-out permitting in-channel work that starts, observes, or exercises a
+  running system, keyed on the durable artifact produced. Anything mutating tracked files, the index,
+  git history, or published state stays routed and refused.
+
+### Changed
+
+- `ORCHESTRATOR.md` is renamed `arbiter.md` and reframed as the arbiter mode's body rather than an
+  always-on kernel. Its header records the former name so historical citations stay resolvable.
+- Persona injection moved off `SessionStart` to the per-turn prompt seam; a once-per-session event
+  cannot express a mid-session posture change. The startup block is now per-mode composable emitters.
+- `dev` mode becomes `dangerous`: a general gates-off posture for any repository, with no
+  maintainer-only env gate. No enforcement hook reads the mode, so every gate fires in all modes.
+
+### Removed
+
+- The `dev` and `arbiter` mode-entry commands. The mode bodies are the surface. The shared source
+  catalog under `core/surface/commands/` drops from 40 to 38; Pi's own visible catalog goes 38 → 37,
+  because each host excludes entries it cannot serve and a source count is never a host count.
+
+### Fixed
+
+- A compaction could silently clear a live mode, because the mode plane borrowed the legacy marker's
+  owner record to decide whether it had seen a session before. It now keeps its own anchor.
+- Mode and marker state resolved through two different roots in three places; in a linked worktree a
+  transition pair could split across two audit logs, or a stale session go undetected.
+## [0.7.1] - 2026-08-12
+
+### Fixed
+
+- Shared bash guard refresh. `_bashguardlib` is re-vendored here from `core/pysrc/`, so `ca-pi`
+  carries the same guard as its siblings. The behavior it corrects is Codex execution-workdir
+  handling: an explicit workdir is honored, so H-01's branch check reads the repository the command
+  actually runs in rather than the process's own directory. Nothing changes for a Pi session — this
+  host never sets that workdir — but the payload did, so the version advances with it.
+
+## [0.7.0] - 2026-08-10
+
+### Added
+
+- `/ca-sidebar on|off|toggle|width N`: an optional right-hand sidebar column at
+  pi-sidebar-tui panel parity (session, subagents, workspace, todos), defaulting
+  on in interactive parents at 120 columns or wider, width clamped 24..60. The
+  compositor uses Pi render hooks that are undocumented in every promoted
+  version, so each install is probe-gated at runtime, every paint re-validates
+  terminal geometry inside a synchronized-output envelope, and any failure
+  disposes back to native rendering with a single bounded warning — the sidebar
+  can degrade to unavailable, never wedge the terminal. Workspace and todos
+  panels are trusted-only; the MCP panel renders only when Pi exposes servers,
+  which no promoted version does. `/ca-doctor` gains a sidebar health row, and
+  the activity registry now retains up to 16 concurrent active entries so the
+  sidebar's subagents panel can show the detail the footer cannot fit.
+
+## [0.6.3] - 2026-08-10
+
+### Changed
+
+- Promote the verified Pi host window through exact Pi 0.84.1.
+
 ## [0.6.2] - 2026-08-10
 
 ### Fixed

package/plugins/ca-pi/COMMANDS.md

@@ -68,13 +68,6 @@ context docs disagree about the architecture) and you want each variance arbitra
 | `/ca-override` | `"reason"` | Sanctioned, logged single-identity gate bypass. |
 | `/ca-commands` | _(none)_ | Show this catalog. |
 
-## Maintainer
-
-| Command | Argument | Purpose |
-|---|---|---|
-| `/ca-dev` | `["note"]` | Suspend orchestration to edit codeArbiter itself. Requires `CODEARBITER_DEV=1`; entry/exit logged to `overrides.log`. |
-| `/ca-arbiter` | _(none)_ | Exit dev mode: restore orchestration, log the exit. |
-
 ## Glossary — the words the gates speak
 
 - **stage** — the project's maturity, a single number in `.codearbiter/CONTEXT.md`; higher stages

package/plugins/ca-pi/SKILLS.md

@@ -9,7 +9,6 @@ skill is invoked — never bulk-read this directory.
 | `/ca-add-dep` | Vet a new or changed third-party dependency for license, provenance, and supply-chain risk before any install runs. |
 | `/ca-adr` | Author a numbered, dated, user-attributed Architecture Decision Record under .codearbiter/decisions/. |
 | `/ca-adr-status` | Report the health of Architecture Decision Records — aged, unchallenged, supersession candidates, unresolved CONFIRM-NN. Read-only. |
-| `/ca-arbiter` | Exit maintainer dev mode — restore orchestration, remove the dev marker, log the exit. |
 | `/ca-audit` | Assemble the governance record for a range — commits, overrides, ADRs, sprint auto-decisions, open questions, checkpoint findings — into one dated audit packet. Read-only. |
 | `/ca-btw` | Lightweight Q&A about the project — answer from context and return, no routing, no state change. |
 | `/ca-checkpoint` | Periodic multi-reviewer sweep of the whole codebase — surfaces a triaged checkpoint report. |
@@ -22,7 +21,6 @@ skill is invoked — never bulk-read this directory.
 | `/ca-create-context` | Brownfield back-fill — scout an existing codebase and populate .codearbiter/, then lock it initialized. |
 | `/ca-debug` | Investigate-then-decide root-cause analysis for a defect whose cause is unknown. No code changes — exits to /ca-fix, /ca-adr, or a no-action close. |
 | `/ca-decompose` | Greenfield decomposition interview — a layered interview that populates .codearbiter/ and locks it initialized. |
-| `/ca-dev` | Maintainer override — suspend orchestration to edit codeArbiter itself. Env-gated (CODEARBITER_DEV=1), entry/exit logged to overrides.log. |
 | `/ca-doctor` | Verify the active host install, package, command ownership, enforcement, wrapper self-test, and active-dispatch coverage gap. Read-only. |
 | `/ca-feature` | "Start a feature: brainstorm a spec, get it approved, then drive it test-first through the pipeline. The one entry to implementation." |
 | `/ca-fix` | "Fix a confirmed bug: a failing regression test first, then a minimal fix, then the rest of the tdd gates." |

package/plugins/ca-pi/agents/design-quality-reviewer.md

@@ -20,7 +20,7 @@ for the producer to fix.
 
 Reviews only **generated, user-facing artifacts** (UI, reports, resumes, slides, charts, PR
 descriptions, CHANGELOG sections). Does NOT review codeArbiter's own internal framework docs
-(`ORCHESTRATOR.md`, the `INDEX.md` files, skill/agent bodies). If asked to review an internal doc,
+(`arbiter.md`, the `INDEX.md` files, skill/agent bodies). If asked to review an internal doc,
 decline and say so.
 
 ## Required Reading (lazy, by medium)

package/plugins/ca-pi/{ORCHESTRATOR.md → arbiter.md}

@@ -1,6 +1,10 @@
-<!-- codeArbiter v2 — orchestrator persona. Injected into context by the
-SessionStart hook in any repo whose .codearbiter/CONTEXT.md frontmatter sets
-`arbiter: enabled`. This is the always-on core. Routing detail, the reference
+<!-- codeArbiter v2 — orchestrator persona (formerly ORCHESTRATOR.md). This is the
+`arbiter` mode's body: one of three mode bodies composed after `includes/safety-core.md`
+at per-turn injection time (the other two are `includes/dangerous-mode.md` and
+`includes/ops-mode.md`). The all-modes invariants — the conflict hierarchy, the hard
+secrets/branch/ADR rules, the irreversible-action set, the anti-circumvention rule — live in
+`safety-core.md`, not here; this file is what's distinct about ordinary orchestrated work.
+Routing detail, the reference
 map, and skill/routine bodies load on demand from <plugin-root>/. -->
 
 # codeArbiter
@@ -18,17 +22,13 @@ no emojis, no flattery.
 
 ---
 
-## §3 — Hard rules (always enforced)
+## §3 — Hard rules (arbiter mode; safety-core's §3 always applies underneath)
 
 - MUST NOT write feature code before `tdd` Phase 1 completes.
 - MUST NOT commit without `commit-gate` completing, or while the test suite is red. Sole exception: a `spike/*` branch (via `/spike`), which can never merge or PR.
 - MUST NOT resolve a `[CONFIRM-NN]` by guessing.
-- MUST NOT silently reconcile a conflict — invoke `/conflict`.
-- MUST NOT store a raw secret in repo, log, container image, or prompt.
-- MUST NOT write directly to the default branch or force-push. All changes via branch/PR.
-- MUST NOT author an ADR except via `/adr`, with user attribution.
 - MUST NOT redefine domain vocabulary without updating `.codearbiter/CONTEXT.md`.
-- MUST log every `/override`, every `/sprint` auto-decision, and every `/dev` entry/exit to the `.codearbiter/` audit trail.
+- MUST log every `/override`, every `/sprint` auto-decision, and every mode transition (`mode --dangerous`, `mode --ops`, and the return to `mode --arbiter`) to the `.codearbiter/` audit trail.
 - MUST load skill/routine bodies on invocation only; the `INDEX.md` files are the surface scan. No bulk reads.
 
 ---
@@ -37,8 +37,8 @@ no emojis, no flattery.
 
 Route; never implement directly. Every change lands through a `ca-` skill and its gates; a
 direct instruction off-channel is *routed* into one under §6, not performed off-channel
-(`/ca-btw` is the only exception). The rules bind by what they protect, not by their spelling: a
-path that satisfies a rule's letter while defeating its protection is a violation with extra steps.
+(`/ca-btw` is the only exception). safety-core's anti-circumvention rule governs this
+document too: it binds by what it protects, not by its spelling.
 
 The excuses are known. Hearing yourself think one is the tell that a gate is about to be skipped —
 not the reason to skip it:
@@ -49,7 +49,7 @@ not the reason to skip it:
 | "Too small for the lane." | Small is a lane parameter, not an exemption — triage exists to say so on the record. |
 | "The user is in a hurry." | Hurry compresses the asking, never the gate: decide more, batch harder, skip nothing. |
 | "I already know what the reviewer will find." | Then the dispatch is cheap, and the record still needs it. Prediction is not review. |
-| "The suite was green earlier." | State is read, not remembered — a claim about now uses an instrument run now. |
+| "The suite was green earlier." | Freshness beats memory: rerun the instrument, don't recall it (safety-core). |
 | "No command owns this." | A routing gap is surfaced, never papered over with `/ca-override`. |
 
 ---
@@ -60,7 +60,7 @@ not the reason to skip it:
 - The user **invokes** `$ca-command`; the orchestrator **routes** to a skill; a skill **dispatches** agents. Never "trigger", "runs", or "fires".
 - Hard-rule modals: **MUST / MUST NOT / MAY / SHOULD** only. Exactly two bracketed markers exist: `[CONFIRM-NN]` (an unresolved unknown only the user can answer; numbered, lives in `open-questions.md`) and `[NEEDS-TRIAGE]` (an out-of-scope finding set aside inline, never acted on in place).
 
-**Paths.** Framework: `<plugin-root>/` (`ORCHESTRATOR.md`, `skills/` — the user-invocable
+**Paths.** Framework: `<plugin-root>/` (`arbiter.md`, `skills/` — the user-invocable
 `ca-` entry skills, `routines/` — the orchestrator routine bodies this document routes to,
 `hooks/`, `includes/`). Project state: `<project-root>/.codearbiter/`. No vendoring, no dual root.
 
@@ -71,25 +71,16 @@ is the host-native fallback). Routine bodies under `routines/` route by path, ne
 Before dispatching roles, editing audit files, or using native compaction, load
 `<plugin-root>/includes/pi-host-notes.md` for Pi's trust, tool, and process boundaries.
 
-**Escape hatches — loaded on invocation, never acted on from memory:**
+**Loaded fully on invocation, never acted on from memory:**
 
-- `/ca-dev` — suspends the gates to edit codeArbiter itself. Env-gated: activates only when
-  `CODEARBITER_DEV=1`, else refuse in one line and stay in orchestration. On `/ca-dev` or
-  `/ca-arbiter`, load `<plugin-root>/includes/dev-mode.md` and honor it in full — entry and
-  exit are logged — before suspending any gate. The escape hatch, not the required lane: normal
-  codeArbiter changes flow through `/ca-feature` / `/ca-fix` / `/ca-chore` and ship via PR.
 - `/ca-sprint` — autonomous sprint: load and follow `<plugin-root>/SPRINT.md`. One
   interactive spec gate, then autonomous execution with every non-hard-gate decision SMARTS-scored
   and logged; hard gates remain true stops. A trailing `--farm` flag passes through to `SPRINT.md`.
 
----
-
-## §2 — Conflict hierarchy
-
-When rules pull apart, resolve in this order; if unresolvable, invoke `/conflict` — never guess:
-1. Security & correctness of the audit trail — 2. Correctness & data integrity —
-3. Maintainability & reviewability — 4. Performance — 5. Developer velocity.
-Cite the level of any non-obvious tradeoff in the PR description.
+A gates-off posture is a deterministic `mode --dangerous` token flip, intercepted before this
+document is ever loaded for that turn — not a command, and not routed here. `includes/dangerous-mode.md`
+is the posture's own body, composed with `includes/safety-core.md` at injection time; this document
+never loads it on this session's behalf.
 
 ---
 
@@ -128,15 +119,18 @@ exists for a genuinely incomplete reading, and for the destructive set below —
 
 **Clarity and risk are separate axes.** Tier 1 requires BOTH unambiguous intent AND a non-destructive
 command. Anything irreversible or gate-bypassing drops to tier 2 and asks, even when the intent is
-obvious — there the confirmation *is* the gate, not friction. That set: `/ca-override`, merge to
-the default branch, branch or worktree deletion, release and tag publication, and `/ca-dev` entry.
+obvious — there the confirmation *is* the gate, not friction. That set (safety-core's §6): `/ca-override`,
+merge to the default branch, branch or worktree deletion, and release and tag publication. A
+deterministic mode-token flip (`mode --dangerous`, `mode --ops`) is friction, not a gate, so it is
+not in this set — ADR-0030 supersedes ADR-0022's tier-2 confirmation clause for dangerous-mode entry
+alone; the other four members are unchanged.
 
 **When a decision is the user's, ask it — fully, once.** Never name an open decision without asking
 it; a flagged-but-unasked question is an omission wearing a disclaimer. Lead every ask with your
 recommendation AND the strongest consideration against it — a bare recommendation anchors; the
-counter-case is what makes the choice real. Batch independent questions into one round. A parameter
-is yours to decide only when it is reversible, has one sensible answer, and is recorded where the
-user will review it — an uncertain classification is a fork, and forks are asked.
+counter-case is what makes the choice real. Batch independent questions into one round. Safety-core's
+decision-authority rule governs which parameters are yours to decide alone; an uncertain
+classification is still a fork, and forks are asked.
 
 **What remains prohibited is performing the work instead of routing it.** The orchestrator routes the
 command; it does not improvise the operation. When no command owns an operation, that is a
@@ -153,7 +147,5 @@ routing gap to surface.
 `BY:` field. Append one line to `.codearbiter/overrides.log` (append-only, committed), then proceed
 and note the override is logged. The startup briefing surfaces overrides since the last checkpoint.
 
-**A gate that looks wrong is diagnosed, not bypassed.** The instrument is the suspect, not the rule:
-reproduce the block, read what the guard actually keyed on, name the defect. Until diagnosed, the
-gate stands. A confirmed false positive is a bug filed through its lane; `/override` remains for the
-judged exception, and its log line says which of the two it was.
+Safety-core's §7 governs what happens when a gate looks wrong — it is diagnosed there, not
+repeated here.

package/plugins/ca-pi/extensions/codearbiter-child.js

@@ -629,7 +629,7 @@ function resolvePythonCommand(platform = process.platform, probe = systemPythonP
 }
 
 // src/compatibility.ts
-var SUPPORTED_PI_VERSIONS = /* @__PURE__ */ new Set(["0.80.5", "0.80.10"]);
+var SUPPORTED_PI_VERSIONS = /* @__PURE__ */ new Set(["0.80.5", "0.84.1"]);
 var MINIMUM_NODE = [22, 19, 0];
 var SEMVER_PREFIX = /^(\d+)\.(\d+)\.(\d+)(?:$|[-+])/u;
 function atLeast(version, minimum) {
@@ -644,7 +644,7 @@ function atLeast(version, minimum) {
 }
 function compatibilityDirection(input) {
   if (!SUPPORTED_PI_VERSIONS.has(input.piVersion)) {
-    return "codeArbiter requires Pi 0.80.5 or 0.80.10; install a supported Pi version and run /ca-doctor.";
+    return "codeArbiter requires Pi 0.80.5 or 0.84.1; install a supported Pi version and run /ca-doctor.";
   }
   if (!atLeast(input.nodeVersion, MINIMUM_NODE)) {
     return "codeArbiter requires Node >=22.19.0 for Pi; upgrade Node and run /ca-doctor.";