@arbiterforge/ca-pi 0.6.2 → 0.8.1

package/plugins/ca-pi/generated/command-catalog.json

@@ -14,11 +14,6 @@
     "description": "Report the health of Architecture Decision Records — aged, unchallenged, supersession candidates, unresolved CONFIRM-NN. Read-only.",
     "skillPath": "skills/ca-adr-status/SKILL.md"
   },
-  {
-    "name": "arbiter",
-    "description": "Exit maintainer dev mode — restore orchestration, remove the dev marker, log the exit.",
-    "skillPath": "skills/ca-arbiter/SKILL.md"
-  },
   {
     "name": "audit",
     "description": "Assemble the governance record for a range — commits, overrides, ADRs, sprint auto-decisions, open questions, checkpoint findings — into one dated audit packet. Read-only.",
@@ -79,11 +74,6 @@
     "description": "Greenfield decomposition interview — a layered interview that populates .codearbiter/ and locks it initialized.",
     "skillPath": "skills/ca-decompose/SKILL.md"
   },
-  {
-    "name": "dev",
-    "description": "Maintainer override — suspend orchestration to edit codeArbiter itself. Env-gated (CODEARBITER_DEV=1), entry/exit logged to overrides.log.",
-    "skillPath": "skills/ca-dev/SKILL.md"
-  },
   {
     "name": "doctor",
     "description": "Verify the active host install, package, command ownership, enforcement, wrapper self-test, and active-dispatch coverage gap. Read-only.",

package/plugins/ca-pi/hooks/_arbiterstatelib.py

@@ -27,7 +27,9 @@
 #   count_matches_text(text, pattern) -> int          same count, given already-read text (performance-003)
 #   arbiter_state(root, count_in_flight=None, read_board=None, frontmatter_enabled=None,
 #                 ctx_text=None, ot_text=None, oq_text=None) -> dict|None
-#   dev_active(root) -> bool                        True when the /dev marker is present
+#   current_mode(session_id, root=None, payload=None) -> str   one of _modelib.MODES
+#                                                    (#437, mode-plane-deterministic-flip; replaces
+#                                                    the retired dev_active(root) presence check)
 #
 # performance-003 (#194): SessionStart's main() already reads CONTEXT.md,
 # open-tasks.md, and open-questions.md before the display-only governance line
@@ -42,6 +44,15 @@
 import os
 import re
 
+# #437 (mode-plane-deterministic-flip, T-51): the mode plane replaces the old
+# presence-only 'dev-active' marker this module used to read. Imported
+# unguarded (like every other sibling import in this file) — statusline.py,
+# this module's only external caller, already wraps `import _arbiterstatelib`
+# in its own try/except, so a failure here degrades the whole module import,
+# exactly like a failure to import `os` would. No circularity risk: _modelib
+# imports _activationlib and _hooklib, neither of which imports this module.
+from _modelib import current_mode as _modelib_current_mode
+
 # mtime-keyed memo: statusline.py is a short-lived subprocess, but a single render
 # can resolve arbiter_state more than once (safe() probes), and the StopHook fires
 # the whole script on every tool-call completion. Caching on max(input mtime) makes
@@ -155,6 +166,22 @@ def arbiter_state(root, count_in_flight=None, read_board=None, frontmatter_enabl
     return result
 
 
+# AC-40: MODE: <name> enter|exit and legacy DEV: enter|exit rows are ledger
+# bookkeeping (the #437 mode-plane audit trail), not overrides — they must not
+# inflate the statusline's "over:" counter. Mode transitions are about to
+# become routine traffic in overrides.log, so an uncorrected counter would
+# turn from noisy into actively WRONG. Mirrors _metricslib._MODE_TRANSITION_RE's
+# exact matched fragment (kept as an independent literal, not an import: this
+# module has no other reason to depend on _metricslib, and one small regex
+# fragment is cheaper to duplicate than to add a cross-module coupling for).
+_MODE_TRANSITION_FRAGMENT = (
+    r"\|\s*(?:MODE:\s*\S+\s+(?:enter|exit)|DEV:\s*(?:enter|exit))\s*(?:\||$)"
+)
+_OVERRIDE_LINE_RE = (
+    r"^(?!\s*#)(?!\s*$)(?!.*" + _MODE_TRANSITION_FRAGMENT + r").+"
+)
+
+
 def _arbiter_state_uncached(cad, count_in_flight=None, read_board=None, frontmatter_enabled=None,
                              ctx_text=None, ot_text=None, oq_text=None):
     ctx_path = os.path.join(cad, "CONTEXT.md")
@@ -164,7 +191,7 @@ def _arbiter_state_uncached(cad, count_in_flight=None, read_board=None, frontmat
     # open-questions.md text when supplied, instead of a second disk read. `None`
     # (the default) preserves the exact original read-from-disk behavior.
     fm = frontmatter_text(ctx_text) if ctx_text is not None else frontmatter(ctx_path)
-    total_over = count_matches(os.path.join(cad, "overrides.log"), r"^(?!\s*#)(?!\s*$).+")
+    total_over = count_matches(os.path.join(cad, "overrides.log"), _OVERRIDE_LINE_RE)
     # last-checkpoint holds the override COUNT at the last /ca:checkpoint. A value
     # outside [0, total] is not a valid count (e.g. a timestamp from a stale writer)
     # -> fail safe to 0 so overrides are surfaced, never silently hidden.
@@ -196,13 +223,34 @@ def _arbiter_state_uncached(cad, count_in_flight=None, read_board=None, frontmat
     }
 
 
-def dev_active(root):
-    """True when /dev developer-override mode is on — signalled by a transient marker
-    the orchestrator drops on /dev and clears on /arbiter (a local UI flag, not a log).
+def current_mode(session_id, root=None, payload=None):
+    """The session's current orchestration posture — one of `_modelib.MODES`
+    ('arbiter' | 'dangerous' | 'ops') — read off the mode plane (#437,
+    mode-plane-deterministic-flip). Replaces the retired `dev_active(root)`
+    presence check: the 'dev-active' marker is not dual-written (Decided
+    parameters: "Single source of truth" — every reader migrates to the mode
+    file), so a reader that kept checking for that marker would silently and
+    permanently report inactive the moment nothing writes it anymore.
+
+    Deliberately resolves through `_activationlib.marker_root` — via
+    `_modelib.current_mode`'s own `root=None` contract — rather than this
+    module's OTHER readers' pre-resolved `root` (arbiter_state's caller
+    passes a project root suitable for reading CONTEXT.md/overrides.log
+    in-place). `.codearbiter/.markers/` is gitignored, so a linked
+    worktree's own checkout never has a fresh copy of it, and every other
+    `.markers/` writer (security-pass.py, migration-pass.py, the mode flip
+    itself) already resolves through marker_root — the mode marker must
+    agree with them or a linked-worktree session silently reads the wrong
+    file (#604, AC-5).
+
+    Pass `payload` (the raw hook/status-line JSON) for production-correct
+    resolution; `root` is a test-only escape hatch that mirrors
+    `_modelib.current_mode`'s own contract exactly — an explicit root
+    bypasses payload/host resolution entirely and is read verbatim.
 
-    Presence-only by design, unaffected by #271 C-5's session-scoped clearing:
-    the marker still means "dev mode is on for SOMEONE" regardless of which
-    session owns it. Session-scoping only changes WHEN SessionStart is willing
-    to clear a live marker (never a different, possibly still-live session's
-    own marker) — it does not change what "present" means to this reader."""
-    return os.path.exists(os.path.join(root, ".codearbiter", ".markers", "dev-active"))
+    Never raises: an absent/unreadable/malformed marker, or an unrecognized
+    per-session value, degrades to 'arbiter' — the diagnostic half of
+    `_modelib.current_mode`'s return is a maintainer/audit concern, not this
+    render-facing reader's; callers here need only the mode, never why."""
+    mode, _diag = _modelib_current_mode(session_id, root=root, payload=payload)
+    return mode

package/plugins/ca-pi/hooks/_bashguardlib.py

@@ -804,6 +804,11 @@ def git_cwd(cmd, root):
     return acc
 
 
+_CODEX_EXPLICIT_WORKDIR_TOOLS = frozenset({
+    "shell_command", "exec_command", "unified_exec",
+})
+
+
 def _effective_exec_root(payload, root):
     """The git root that a `-C`-less git command in THIS Bash call actually
     runs against — the command's effective cwd — rather than always the
@@ -841,7 +846,13 @@ def _effective_exec_root(payload, root):
     unchanged — the overwhelmingly common (non-worktree) case sees zero
     behavioral difference. It returns the climbed root only when it names a
     genuinely DIFFERENT filesystem location."""
-    exec_root = _gitlib.project_root(payload if isinstance(payload, dict) else {})
+    data = payload if isinstance(payload, dict) else {}
+    tool_input = data.get("tool_input")
+    workdir = tool_input.get("workdir") if isinstance(tool_input, dict) else None
+    if (data.get("tool_name") in _CODEX_EXPLICIT_WORKDIR_TOOLS
+            and isinstance(workdir, str) and os.path.isdir(workdir)):
+        data = {"cwd": workdir}
+    exec_root = _gitlib.project_root(data)
     if os.path.normpath(os.path.abspath(exec_root)) == os.path.normpath(os.path.abspath(root)):
         return root
     return exec_root

package/plugins/ca-pi/hooks/_hooklib.py

@@ -532,30 +532,69 @@ def warn(msg):
 # active long-running flow's marker has sat around past `window_minutes` with
 # no matching activity in its expected audit log.
 #
-# Only /dev and /sprint have a persistent "in-progress" marker today
-# (.codearbiter/.markers/dev-active and .codearbiter/sprint-active — the same
-# state _arbiterstatelib.dev_active()/arbiter_state() already read). /override
-# is a single synchronous action (announce-then-log in one turn, per
-# override.md) with no analogous "still in progress" marker anywhere in the
-# framework, so per CONFIRM-09's own "do not invent new state" constraint it
-# is not tracked here — there is no existing signal to detect it from.
+# Only the mode plane and /sprint have a persistent "in-progress" marker
+# today (.codearbiter/.markers/mode and .codearbiter/sprint-active — the same
+# state _arbiterstatelib.current_mode()/arbiter_state() already read; the
+# mode marker is #437's direct successor to the retired dev-active marker
+# this comment originally described). /override is a single synchronous
+# action (announce-then-log in one turn, per override.md) with no analogous
+# "still in progress" marker anywhere in the framework, so per CONFIRM-09's
+# own "do not invent new state" constraint it is not tracked here — there is
+# no existing signal to detect it from.
 #
-# #271 C-5: this staleness WARN is presence + age based (marker mtime vs. an
-# audit-log write), which is unaffected by session-start.py's newer
-# session-scoped CLEARING decision for the SAME dev-active marker — the two
-# consumers ask different questions ("has this sat around too long with no
-# matching log activity?" vs. "am I sure enough this belongs to nobody live
-# right now that I should force-close it?") and neither needs to agree with
-# the other's answer. A dev marker owned by a still-live different session
-# can legitimately trip THIS warning (it really has been open a while) even
-# though session-start.py correctly declines to clobber it.
+# #271 C-5 (pre-#437): this staleness WARN is presence + age based (marker
+# mtime vs. an audit-log write), which was unaffected by session-start.py's
+# then-newer session-scoped CLEARING decision for the SAME dev-active
+# marker — the two consumers ask different questions ("has this sat around
+# too long with no matching log activity?" vs. "am I sure enough this
+# belongs to nobody live right now that I should force-close it?") and
+# neither needs to agree with the other's answer. The same reasoning now
+# applies to the mode marker: a non-arbiter entry owned by a still-live
+# different session can legitimately trip THIS warning even though
+# SessionStart correctly declines to clobber a live session's own entry.
 _STALE_FLOWS = (
     # (flow name, marker path parts, expected-log path parts)
-    ("dev", (".markers", "dev-active"), ("overrides.log",)),
+    #
+    # #437 (mode-plane-deterministic-flip): the 'dev'/'dev-active' entry this
+    # tuple used to carry is RENAMED, not removed — the mode marker is the
+    # direct successor of dev-active (Decided parameters: dev-active is not
+    # dual-written; every reader migrates to the mode file). Missing this
+    # rename is the one hazard this whole registry exists to avoid: it is a
+    # WARN, not a gate, so a stale matcher fails PERMANENTLY SILENT with an
+    # otherwise green suite — nothing else in the repo would ever notice.
+    ("mode", (".markers", "mode"), ("overrides.log",)),
     ("sprint", ("sprint-active",), ("sprint-log.md",)),
 )
 
 
+def _mode_marker_has_non_arbiter_entry(marker):
+    """AC-36: True iff the mode marker JSON names at least one session in a
+    non-'arbiter' posture. Presence alone is NOT "active" for this flow the
+    way it was for the old boolean dev-active marker — the mode file is a
+    persistent `{session_id: mode}` map (#437's State: decided parameter)
+    that legitimately keeps existing, with plenty of purely-'arbiter'
+    entries, long after every non-arbiter session has flipped back or
+    ended. Warning on mere file presence would trip AC-36's negative arm
+    (never warn for arbiter) permanently, for every repo that has ever used
+    the mode plane at all — exactly the "warns on everything" matcher the
+    negative-arm assertion exists to catch.
+
+    Deliberately duplicates the literal 'arbiter' value here rather than
+    importing `_modelib.MODES[0]`: `_modelib` imports `write_text_atomic`
+    FROM this module, so importing back the other way would be circular.
+    Never raises: an absent/corrupt/malformed marker answers False — the
+    same fail-toward-silent convention `staleness_warning`'s own try/except
+    already applies to every other stat/read in this loop."""
+    try:
+        with open(marker, encoding="utf-8") as f:
+            data = json.load(f)
+    except Exception:  # noqa: BLE001 — unreadable/corrupt -> nothing provably active
+        return False
+    if not isinstance(data, dict):
+        return False
+    return any(v != "arbiter" for v in data.values())
+
+
 def staleness_warning(root, now=None, window_minutes=30):
     """(CONFIRM-09) One WARN message per active flow (see _STALE_FLOWS) whose
     marker has existed for at least `window_minutes` with no audit-log
@@ -575,6 +614,8 @@ def staleness_warning(root, now=None, window_minutes=30):
             marker = os.path.join(cad, *marker_parts)
             if not os.path.isfile(marker):
                 continue
+            if name == "mode" and not _mode_marker_has_non_arbiter_entry(marker):
+                continue  # AC-36: never warn for arbiter — presence alone isn't "active"
             marker_mtime = os.path.getmtime(marker)
             if now - marker_mtime < window_minutes * 60:
                 continue  # flow started too recently to call it stale yet

package/plugins/ca-pi/hooks/_metricslib.py

@@ -247,6 +247,17 @@ def commit_timeline(root):
 import re as _re
 _OVERRIDE_TS_RE = _re.compile(r"^\[([^\]]+)\]")
 
+# Mode-transition rows are ledger bookkeeping, not overrides, and must be
+# excluded from override_rate (AC-40). Two forms appear in overrides.log:
+#   - new:    "MODE: <name> enter" / "MODE: <name> exit"
+#   - legacy: "DEV: enter" / "DEV: exit"
+# Both are matched as a pipe-delimited field (bounded by "|" or end-of-line),
+# the same shape as _SMALL_LANE_RE's field match below, so a REASON/NOTE
+# sentence that merely mentions "mode" or "dev" cannot false-positive.
+_MODE_TRANSITION_RE = _re.compile(
+    r"\|\s*(?:MODE:\s*\S+\s+(?:enter|exit)|DEV:\s*(?:enter|exit))\s*(?:\||$)"
+)
+
 
 def override_rate(lines_or_text, windows):
     """Compute the override rate for the current and prior windows.
@@ -274,6 +285,10 @@ def override_rate(lines_or_text, windows):
         - Lines that start with "#" (after stripping leading whitespace) are
           comment lines and are excluded.
         - Blank and whitespace-only lines are excluded.
+        - Mode-transition rows are excluded: the new form
+          "MODE: <name> enter|exit" and the legacy form "DEV: enter|exit"
+          (AC-40). These are ledger bookkeeping, not overrides — genuine
+          "GATE:" / "SECURITY-OVERRIDE" / other override rows still count.
         - Entries whose parsed timestamp maps to BEFORE_HISTORY are excluded
           from all window counts.
     """
@@ -300,6 +315,11 @@ def override_rate(lines_or_text, windows):
         if not line or line.startswith("#"):
             continue
 
+        # Skip mode-transition rows (new MODE: and legacy DEV: forms) — see
+        # AC-40 and _MODE_TRANSITION_RE above.
+        if _MODE_TRANSITION_RE.search(line):
+            continue
+
         # Extract the leading timestamp token "[<ts>]".
         m = _OVERRIDE_TS_RE.match(line)
         if not m: