@arbiterforge/ca-pi 0.6.3 → 0.10.0

package/README.md

@@ -10,10 +10,10 @@ project context. You decide. codeArbiter enforces.
 <img alt="Claude Code plugin" src="https://img.shields.io/badge/Claude_Code-plugin-d97757">
 <img alt="Codex plugin" src="https://img.shields.io/badge/OpenAI_Codex-plugin-10a37f">
 <img alt="Pi Feature Forge preview" src="https://img.shields.io/badge/ca--pi-Feature_Forge_preview-d97757">
-<img alt="version 2.14.0" src="https://img.shields.io/badge/version-2.14.0-2b7489">
-<img alt="commands" src="https://img.shields.io/badge/commands-40-555">
+<img alt="version 2.17.0" src="https://img.shields.io/badge/version-2.17.0-2b7489">
+<img alt="core lanes" src="https://img.shields.io/badge/core_lanes-18-555">
 <img alt="skills" src="https://img.shields.io/badge/skills-23-555">
-<img alt="agents" src="https://img.shields.io/badge/agents-18-555">
+<img alt="agents" src="https://img.shields.io/badge/agents-19-555">
 <img alt="license AGPL v3" src="https://img.shields.io/badge/license-AGPL_v3-3da639">
 
 [Start learning](https://arbiterforge.github.io/codeArbiter/learn/)
@@ -26,12 +26,6 @@ project context. You decide. codeArbiter enforces.
 
 </div>
 
-> [!IMPORTANT]
-> **License notice.** Since v2.6.0, codeArbiter is licensed under the
-> [GNU AGPLv3](LICENSE), a change from its earlier MIT license. Copyright (C) 2026 SUaDtL, who
-> reserves the right to dual-license under separate proprietary terms; commercial licenses are not
-> offered at this time. See [License and contributions](#license-and-contributions).
-
 ## Agentic coding, with a record
 
 codeArbiter is for teams and power users who let coding agents do consequential work and need more
@@ -105,7 +99,9 @@ stability, command syntax, trust, and platform differences.
 **Prerequisites:** Python 3 on `PATH` and `git config user.email` set. Pi also requires Node.js
 22.19+. If Python is missing, Pi installs its final wrappers but blocks mutating calls and points to
 `/ca-doctor`; Claude Code and Codex surface an interpreter breadcrumb instead of silently claiming
-governance is active.
+governance is active. The [compatibility matrix](https://arbiterforge.github.io/codeArbiter/getting-started/compatibility/)
+defines the supported native Git/runtime and linked-worktree boundary; mixed Windows Git and WSL Git
+over one shared repository are not supported.
 
 ### Claude Code
 
@@ -119,7 +115,7 @@ Approve the normal plugin trust prompt, open the target repository, and continue
 
 ### Codex CLI
 
-The public GitHub-slug flow is **available now**. The repository currently ships `ca-codex 0.6.1`;
+The public GitHub-slug flow is **available now**. The repository currently ships `ca-codex 0.9.0`;
 the dated end-to-end public-install record discovered `ca-codex 0.2.4` from release `v2.8.13`.
 Current packaging and shared-core parity are continuously verified, while that dated live-install
 record stays labeled rather than being silently promoted to evidence for a newer adapter:
@@ -188,6 +184,17 @@ Follow the complete
 [first-repository walkthrough](https://arbiterforge.github.io/codeArbiter/getting-started/quickstart/)
 for expected output, proof, and recovery.
 
+## Practice before using your own repository
+
+[Arbiter Academy](https://arbiterforge.github.io/arbiter-academy/) is an optional practice course for
+codeArbiter. It starts in a personal fork of the Academy repository, so you can make real commits,
+inspect governed evidence, and recover from a failed attempt without placing your own project at risk.
+
+The Academy website is the lesson surface. Each published lesson identifies whether an action belongs
+in the browser, native terminal, active harness, or with the agent, then provides a copyable command,
+the result to expect, the evidence to inspect, and a safe recovery path. Start there when you want to
+learn the workflow before protecting a production repository.
+
 ## The docs are the operating manual
 
 The site is designed as a continuous path from first contact to source-backed operation:
@@ -255,7 +262,7 @@ explains who creates, reads, and updates every artifact, plus its recovery rules
 - No raw secret stored in the repository, logs, images, or prompts.
 - No direct write to the default branch and no force-push.
 - No ADR outside `/ca:adr`, with explicit user attribution.
-- Every `/ca:override`, `/ca:dev` entry/exit, and sprint auto-decision is durable and attributable.
+- Every `/ca:override`, `mode --dangerous`/`mode --ops` entry/exit, and sprint auto-decision is durable and attributable.
 - H-18 activation protection has no in-session override path; disabling a repository requires an
   external editor and an explicit audit record.
 
@@ -276,93 +283,29 @@ gate bypasses, merges, and unresolved questions remain true stops. See
 
 ## Core lanes
 
-| Intent | Claude Code | What the lane proves |
-|---|---|---|
-| New behavior | `/ca:feature "desc"` | approved spec and plan, test-first implementation, review, commit, PR |
-| Autonomous delivery | `/ca:sprint "goal"` | one interactive design gate, persisted work, logged SMARTS decisions |
-| Confirmed defect | `/ca:fix "bug"` | failing regression test before the minimal fix |
-| Unknown cause | `/ca:debug "symptom"` | investigation and root-cause decision before any fix lane |
-| Structural change | `/ca:refactor "surface"` | behavioral parity through unchanged pre-existing tests |
-| Dependency | `/ca:add-dep "pkg"` | license, provenance, maintenance, CVE, and supply-chain review |
-| Architecture decision | `/ca:adr "title"` | numbered, dated, user-attributed decision record |
-| Commit | `/ca:commit` | the full commit gate and selective staging |
-| Pull request | `/ca:pr` | cleared BLOCK findings and a draft PR, never a direct default-branch write |
-
-Claude Code's catalog is [`plugins/ca/COMMANDS.md`](./plugins/ca/COMMANDS.md). Codex uses the
-generated [`plugins/ca-codex/COMMANDS.md`](./plugins/ca-codex/COMMANDS.md), and Pi uses the generated
-[`plugins/ca-pi/COMMANDS.md`](./plugins/ca-pi/COMMANDS.md). Current generated counts are `ca: 40`,
-`ca-codex: 38`, and `ca-pi: 39`. Codex omits `statusline` and `prune`; Pi omits `statusline` and uses
-native compaction for pruning.
+Choose the workflow first. The canonical lanes keep daily work compact; advanced operations and
+compatibility routes remain available in the complete reference.
 
-<details>
-<summary><strong>All 40 Claude Code commands</strong></summary>
-
-### Implementation
-
-| Command | Purpose |
-|---|---|
-| `/ca:feature "desc"` | Spec-driven feature; the only entry to new implementation |
-| `/ca:sprint "goal"` | Autonomous spec-to-PR sprint with SMARTS-scored decisions |
-| `/ca:fix "bug"` | Regression-test-first defect fix |
-| `/ca:refactor "surface"` | Behavior-preserving restructure behind a parity gate |
-| `/ca:debug "symptom"` | Investigate, identify root cause, then choose the owning lane |
-| `/ca:chore <docs\|deps\|revert>` | Type-scaled non-behavioral lane |
-| `/ca:spike "question"` | Throwaway exploration that never merges |
-
-### Commit and ship
-
-| Command | Purpose |
-|---|---|
-| `/ca:commit` | The only path to a commit |
-| `/ca:pr` | Clear review findings and open or finish a pull request |
-| `/ca:watch <PR>` | Watch hosted CI, diagnose red, offer merge on green |
-| `/ca:review [path]` | Reviewer-fleet pass over the current diff |
-| `/ca:checkpoint` | Lean periodic whole-codebase reviewer sweep |
-| `/ca:tribunal [scope-path]` | Deep, resumable eleven-lens audit; never a routine gate |
-| `/ca:release [--dry-run]` | Target-aware SemVer, changelog, and annotated tag |
-| `/ca:add-dep "pkg"` | Vet license, provenance, maintenance, CVEs, and supply chain |
-
-### Decisions
-
-| Command | Purpose |
-|---|---|
-| `/ca:adr "title"` | Author a numbered, user-attributed ADR |
-| `/ca:adr-status [--adr N]` | Inspect ADR health and supersession chains |
-| `/ca:reconcile ["scope"]` | Reconcile architectural artifacts through SMARTS |
-| `/ca:conflict "description"` | Stop work and surface an unresolvable rule conflict |
-| `/ca:threat-model "scope"` | Optional lightweight STRIDE pass |
-
-### Project and meta
-
-| Command | Purpose |
-|---|---|
-| `/ca:decompose` | Greenfield interview that populates `.codearbiter/` |
-| `/ca:create-context` | Brownfield source scout and context backfill |
-| `/ca:init` | Scaffold the shared project-state store |
-| `/ca:status` | Show stage, branch, tasks, questions, and recent overrides |
-| `/ca:task` | The only sanctioned writer for `open-tasks.md` |
-| `/ca:statusline` | Install or remove the Claude Code statusline |
-| `/ca:doctor` | Prove interpreter, payload, hooks, cache, and live-fire behavior |
-| `/ca:preview` | Read-only prediction of reviewers plus a state-free secret scan |
-| `/ca:context-check` | Manual provenance-drift audit |
-| `/ca:standup` | Read repo hygiene, then confirm safe cleanup actions one by one |
-| `/ca:cleanup` | Finish an already-merged branch with ancestry proof |
-| `/ca:new-skill "gap"` | Author a new skill only after proving the gap |
-| `/ca:btw "question"` | Lightweight project Q&A with no state change |
-| `/ca:override "reason"` | Logged, attributed bypass for one immediate action when the gate permits it; never H-18 |
-| `/ca:audit [range]` | Assemble a dated governance packet |
-| `/ca:metrics [--window N]` | Read-only override, small-lane, and confidence trends |
-| `/ca:prune [status\|dry\|run\|audit\|on\|off]` | Inspect or trim transcript bulk |
-| `/ca:commands` | Show the public catalog |
-
-### Maintainer
-
-| Command | Purpose |
-|---|---|
-| `/ca:dev ["note"]` | Enter the env-gated, logged maintainer override |
-| `/ca:arbiter` | Exit dev mode and restore orchestration |
-
-</details>
+<!-- core-lane-chooser:start -->
+| Workflow | Choose | Use it for |
+|---|---|---|
+| Evaluate | `/ca:preview` | Predict reviewers and run a read-only secret scan |
+| Initialize | `/ca:init` | Create or inspect the repository-owned state store |
+| Change | `/ca:feature`, `/ca:sprint`, `/ca:fix`, `/ca:refactor`, `/ca:chore`, `/ca:spike`, `/ca:add-dep` | Build, repair, restructure, explore, or change the supply chain through the owning gate |
+| Review | `/ca:review` | Run the reviewer fleet over a diff or bounded path |
+| Decide | `/ca:adr` | Record a numbered, user-attributed architecture decision |
+| Ship | `/ca:commit`, `/ca:pr`, `/ca:release` | Commit, stage a pull request, or prepare an authorized release |
+| Operate | `/ca:status`, `/ca:task`, `/ca:doctor`, `/ca:override` | Inspect state, manage the task board, verify enforcement, or log an allowed bypass |
+<!-- core-lane-chooser:end -->
+
+[Complete command reference](https://arbiterforge.github.io/codeArbiter/reference/commands/) includes
+advanced operations, compatibility routes, internal protocols, deprecation guidance, and host
+availability. The generated host catalogs remain inspectable in
+[`plugins/ca/COMMANDS.md`](./plugins/ca/COMMANDS.md),
+[`plugins/ca-codex/COMMANDS.md`](./plugins/ca-codex/COMMANDS.md), and
+[`plugins/ca-pi/COMMANDS.md`](./plugins/ca-pi/COMMANDS.md). Claude Code includes `statusline` and
+`prune`; Codex intentionally omits both. Pi omits `statusline` and uses native compaction through
+its `prune` route.
 
 ## Trust and host boundaries
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiterforge/ca-pi",
-  "version": "0.6.3",
+  "version": "0.10.0",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/plugins/ca-pi/CHANGELOG.md

@@ -4,6 +4,151 @@ All notable changes to `ca-pi` are documented in this file.
 
 ## [Unreleased]
 
+## [0.10.0] - 2026-09-02
+
+### Added
+
+- Command discovery now groups the supported core lanes while retaining
+  advanced operations and compatibility routes in the generated Pi catalog.
+- Pi rejects malformed alias graphs at runtime, and release-state plus
+  documentation-inventory drift now fail closed against canonical source;
+  tag-only or unverified Releases are rejected.
+
+## [0.9.0] - 2026-09-02
+
+### Added
+
+- Accepted ADRs now have content-bound lifecycle records, sealed obligation
+  sets, and evidence-derived implementation and verification states.
+- Destructive-operation policy now uses one four-item registry with generated
+  host parity and item-for-item enforcement.
+
+## [0.8.9] - 2026-09-02
+
+### Fixed
+
+- Hook registration and doctor now bind every Git probe to the requested
+  repository, resolve effective hook paths through Git, and fail closed when
+  linked-worktree ownership cannot be proven.
+
+## [0.8.8] - 2026-09-02
+
+### Fixed
+
+- Release-note reconstruction now accepts only exact changelog headings,
+  rejects ambiguous `Unreleased` and duplicate sections, and reads the
+  regular-file blob from the exact tag and repository root without inherited
+  Git repository overrides or replacement objects.
+
+## [0.8.7] - 2026-09-01
+
+### Added
+
+- Review and generic parallel batches now terminate at a read-only verdict
+  aggregator, while checkpoint persistence remains a separate non-overwriting
+  writer invoked only by the explicit checkpoint workflow.
+
+## [0.8.6] - 2026-09-01
+
+### Fixed
+
+- The update notifier now ignores unrelated release series, keeps `ca-pi-v*`
+  state independent from Claude and Codex, and emits Pi's native package
+  update command.
+
+## [0.8.5] - 2026-08-26
+
+### Changed
+
+- The shared generated root kernel now derives its internal package root from the executing module and validates containment independently of host-native boundaries; Pi remains Forge-only and keeps its module/file-location semantics.
+- Generated status-line and hook payloads were refreshed in lockstep with the Claude and Codex adapters without adding a separate runtime core package.
+
+## [0.8.4] - 2026-08-24
+
+### Fixed
+
+- The shared Git enforcement hook now resolves linked-worktree security and migration markers through the main-checkout marker root while preserving worktree-local commit inspection.
+
+## [0.8.3] - 2026-08-21
+
+### Fixed
+
+- Shared hook payload refresh: the explicit-workdir recognition added for Codex desktop wrapped execution is carried by the common guard. Pi does not set this field, so its runtime behavior is unchanged.
+
+## [0.8.2] - 2026-08-13
+
+### Fixed
+
+- Shared-core mode-plane fix: the orchestration mode is stored one file per session under `.codearbiter/.markers/mode.d/` instead of a single shared map, so sessions sharing one `.codearbiter/` store can no longer overwrite each other's posture. Pi reports the mode read-only, and now reports a value no concurrent session can have silently reverted.
+
+## [0.8.1] - 2026-08-13
+
+### Changed
+
+- `/ca-spike` now preserves only the committed findings file on the parent before deleting its disposable spike branch. Exploratory spike code and commits never land in implementation history.
+
+## [0.8.0] - 2026-08-12
+
+### Added
+
+- Orchestration **mode plane** (ADR-0030): `arbiter`, `dangerous`, and `ops`. The injected persona is
+  now `safety-core.md` plus the active mode's body, composed rather than a single fixed file.
+  **On Pi this release is read-only:** the footer reports the active mode and the shared store is
+  keyed the same way as on the other hosts, but Pi cannot yet CHANGE the mode — the control token is
+  intercepted on Claude and Codex only. A Pi session runs `arbiter`. The input-event handler, the
+  bridge flip path, and the per-turn persona refresh are tracked and not in this release.
+- `ops` mode: an advisory carve-out permitting in-channel work that starts, observes, or exercises a
+  running system, keyed on the durable artifact produced. Anything mutating tracked files, the index,
+  git history, or published state stays routed and refused.
+
+### Changed
+
+- `ORCHESTRATOR.md` is renamed `arbiter.md` and reframed as the arbiter mode's body rather than an
+  always-on kernel. Its header records the former name so historical citations stay resolvable.
+- Persona injection moved off `SessionStart` to the per-turn prompt seam; a once-per-session event
+  cannot express a mid-session posture change. The startup block is now per-mode composable emitters.
+- `dev` mode becomes `dangerous`: a general gates-off posture for any repository, with no
+  maintainer-only env gate. No enforcement hook reads the mode, so every gate fires in all modes.
+
+### Removed
+
+- The `dev` and `arbiter` mode-entry commands. The mode bodies are the surface. The shared source
+  catalog under `core/surface/commands/` drops from 40 to 38; Pi's own visible catalog goes 38 → 37,
+  because each host excludes entries it cannot serve and a source count is never a host count.
+
+### Fixed
+
+- A compaction could silently clear a live mode, because the mode plane borrowed the legacy marker's
+  owner record to decide whether it had seen a session before. It now keeps its own anchor.
+- Mode and marker state resolved through two different roots in three places; in a linked worktree a
+  transition pair could split across two audit logs, or a stale session go undetected.
+## [0.7.1] - 2026-08-12
+
+### Fixed
+
+- Shared bash guard refresh. `_bashguardlib` is re-vendored here from `core/pysrc/`, so `ca-pi`
+  carries the same guard as its siblings. The behavior it corrects is Codex execution-workdir
+  handling: an explicit workdir is honored, so H-01's branch check reads the repository the command
+  actually runs in rather than the process's own directory. Nothing changes for a Pi session — this
+  host never sets that workdir — but the payload did, so the version advances with it.
+
+## [0.7.0] - 2026-08-10
+
+### Added
+
+- `/ca-sidebar on|off|toggle|width N`: an optional right-hand sidebar column at
+  pi-sidebar-tui panel parity (session, subagents, workspace, todos), defaulting
+  on in interactive parents at 120 columns or wider, width clamped 24..60. The
+  compositor uses Pi render hooks that are undocumented in every promoted
+  version, so each install is probe-gated at runtime, every paint re-validates
+  terminal geometry inside a synchronized-output envelope, and any failure
+  disposes back to native rendering with a single bounded warning — the sidebar
+  can degrade to unavailable, never wedge the terminal. Workspace and todos
+  panels are trusted-only; the MCP panel renders only when Pi exposes servers,
+  which no promoted version does. `/ca-doctor` gains a sidebar health row, and
+  the activity registry now retains up to 16 concurrent active entries so the
+  sidebar's subagents panel can show the detail the footer cannot fit.
+
 ## [0.6.3] - 2026-08-10
 
 ### Changed

package/plugins/ca-pi/COMMANDS.md

@@ -1,90 +1,160 @@
-# codeArbiter — commands
+# codeArbiter commands
 
-All user intent flows through these commands. A direct instruction outside a command channel gets a
-redirect to the closest command (see the §6 redirect). Every command ships as a `ca-`-prefixed
-skill — invoke `$ca-<name>`.
+Start with the job in front of you. A direct instruction outside a command channel routes to the
+closest supported lane; installed legacy entry points remain listed under [Compatibility
+routes](#compatibility-routes). Each route ships as a `ca-`-prefixed skill; invoke it as
+`$ca-<name>`.
 
-This table is the surface scan. A command body (`<plugin-root>/skills/ca-<name>/SKILL.md`) loads
-ONLY when that command is invoked — never bulk-read the directory.
+A command body (`<plugin-root>/skills/ca-<name>/SKILL.md`)
+loads only when that route is invoked. Never bulk-read the directory.
 
-## Implementation
+## Installed surface
+
+| Visibility | Count |
+|---|---:|
+| Core | 18 |
+| Advanced | 12 |
+| Canonical total | 30 |
+| Compatibility aliases | 5 |
+| Internal | 1 |
+| Deprecated | 1 |
+| **Total** | **37** |
+
+## Core lanes
+
+### Evaluate
+
+| Command | Argument | Purpose |
+|---|---|---|
+| `/ca-preview` | _(none)_ | Predict the reviewer fleet and run a state-free secret scan without writing. |
+
+### Initialize
+
+| Command | Argument | Purpose |
+|---|---|---|
+| `/ca-init` | `[--stage N] [--greenfield\|--brownfield] \| --check` | Scaffold or inspect `.codearbiter/`; explicit strategies enter the existing greenfield or brownfield workflows. |
+
+### Change
+
+| Command | Argument | Purpose |
+|---|---|---|
+| `/ca-feature` | `"description"` | Approve a spec and plan, then build test-first. This is the entry to new behavior. |
+| `/ca-sprint` | `["goal"] [--farm]` | Run one approved spec through plan-to-PR execution with SMARTS-scored decisions. `--farm` is an off-by-default Feature Forge preview that requires `FARM_API_KEY`. |
+| `/ca-fix` | `"bug description"` | Prove a confirmed defect with a failing regression test, then make the smallest fix. |
+| `/ca-refactor` | `"surface and motivation"` | Restructure behind behavioral parity proven by unchanged pre-existing tests. |
+| `/ca-chore` | `<docs\|deps\|revert> …` | Route non-behavioral work through type-scaled gates. |
+| `/ca-spike` | `"question" [timebox]` | Explore on a disposable branch and exit to findings or `/ca-feature`; never merge the spike. |
+| `/ca-add-dep` | `"package"` | Vet license, provenance, maintenance, known vulnerabilities, and supply-chain risk before install. |
+
+### Review
+
+| Command | Argument | Purpose |
+|---|---|---|
+| `/ca-review` | `[path or scope]` | Run the reviewer fleet over the current diff and block on CRITICAL or HIGH findings. |
+
+### Decide
 
 | Command | Argument | Purpose |
 |---|---|---|
-| `/ca-feature` | `"description"` | Spec-driven feature: brainstorm → plan → test-first build → commit → finish. The only path to implementation. |
-| `/ca-sprint` | `["goal"] [--farm]` | Autonomous sprint: one interactive spec gate, then plan-to-PR execution; every auto-decision SMARTS-scored and logged with a confidence flag. Hard gates still stop. `--farm` is a Feature Forge `preview` (off by default, needs `FARM_API_KEY`; not yet validated). |
-| `/ca-fix` | `"bug description"` | Fix a defect via `tdd`, regression-test-first. |
-| `/ca-refactor` | `"surface and motivation"` | Behavior-preserving restructure behind a parity-coverage gate. |
-| `/ca-debug` | `"symptom"` | Investigate-then-decide root-cause analysis; exits to `/ca-fix`, `/ca-adr`, or a no-action close. |
-| `/ca-chore` | `<docs\|deps\|revert> …` | Non-behavioral lane: docs edits, dependency bumps, reverts — type-scaled gates, no TDD demanded of prose. |
-| `/ca-spike` | `"question" [timebox]` | Throwaway exploration on a `spike/*` branch. Never merges; exits to a findings note or `/ca-feature`. |
+| `/ca-adr` | `"title"` | Author a numbered, dated, user-attributed architecture decision. |
 
-## Commit & ship
+### Ship
 
 | Command | Argument | Purpose |
 |---|---|---|
-| `/ca-commit` | _(none)_ | The only path to a commit; routes to `commit-gate` (nine gates). |
-| `/ca-pr` | `["title"]` | Finish a branch: open-PR / merge-via-PR / discard. No direct-to-default. |
-| `/ca-watch` | `<PR number\|url\|branch>` | Babysit a PR's CI server-side: diagnose on red, notify + offer the merge on green. Never auto-merges. Auto-attaches from `/ca-pr` when `CODEARBITER_BABYSIT` is on. |
-| `/ca-review` | `[path or scope]` | Dispatch the reviewer fleet over the diff; BLOCK on CRITICAL/HIGH. |
-| `/ca-checkpoint` | `[focus]` | Lean periodic reviewer sweep; surfaces a triaged report. |
-| `/ca-tribunal` | `[scope-path] [--tag <label>]` | Deep, rarely-run whole-codebase audit across eleven specialist lenses; one file per finding plus append-only run/triage logs, resumable from disk; files GitHub issues on approval. Never a required gate. |
-| `/ca-release` | `[--dry-run]` | Lean SemVer release: bump-from-commits + changelog + annotated tag. |
-| `/ca-add-dep` | `"package"` | Vet a dependency (license, provenance, supply chain) before install. |
+| `/ca-commit` | _(none)_ | Run the full commit gate and stage only the reviewed paths. |
+| `/ca-pr` | `["title"] \| --watch [PR] \| --cleanup` | Open or finish a pull request; watch hosted CI; or clean a proven merged branch. Never write directly to the default branch. |
+| `/ca-release` | `[--dry-run]` | Prepare a target-aware SemVer bump, changelog, and annotated tag when release authority is explicit. |
 
-## Decisions
+### Operate
 
 | Command | Argument | Purpose |
 |---|---|---|
-| `/ca-adr` | `"title"` | Author a numbered, user-attributed ADR. |
-| `/ca-adr-status` | `[--adr N]` | List/inspect ADR status and supersede chains. |
-| `/ca-reconcile` | `["scope"]` | Reconcile artifacts vs. scaffold; arbitrate via SMARTS, user-attributed. |
-| `/ca-conflict` | `"description"` | Stop all work and surface a rule conflict. |
-| `/ca-threat-model` | `"scope"` | Optional lightweight STRIDE pass for a sensitive feature. |
+| `/ca-status` | `(none) \| drift` | Show project state, or explicitly inspect provenance drift. The default path is read-only. |
+| `/ca-task` | `add "<desc>" \| start <id\|"title"> \| done <id\|"title">` | Add, start, or complete task-board entries through the only sanctioned writer. |
+| `/ca-doctor` | _(none)_ | Verify the active install, payload, package ownership, enforcement, and a harmless live-fire probe. |
+| `/ca-override` | `"reason"` | Log one attributed bypass when the governing hard rule permits it. |
+
+<details>
+<summary><strong>Advanced operations</strong></summary>
+
+### Change
 
-Which one? `/ca-conflict` when two *rules* contradict (persona vs. docs vs. code) and work cannot
-safely continue — it halts everything. `/ca-reconcile` when *artifacts* have drifted (ADRs, scaffold,
-context docs disagree about the architecture) and you want each variance arbitrated — work continues.
+| Command | Argument | Purpose |
+|---|---|---|
+| `/ca-debug` | `"symptom"` | Investigate an unknown cause, then exit to `/ca-fix`, `/ca-adr`, or a no-action close. |
 
-## Project & meta
+### Review
 
 | Command | Argument | Purpose |
 |---|---|---|
-| `/ca-decompose` | _(none)_ | Greenfield: layered interview to populate `.codearbiter/`. |
-| `/ca-create-context` | _(none)_ | Brownfield: back-fill `.codearbiter/` from existing source. |
-| `/ca-init` | `[--stage N \| --check]` | Scaffold the root-level `.codearbiter/` state store, or `--check` to report detection state without writing. |
-| `/ca-status` | _(none)_ | Show maturity, open tasks, unresolved `CONFIRM-NN`, overrides since checkpoint. |
-| `/ca-task` | `add "<desc>" \| start <id\|"title"> \| done <id\|"title">` | The sanctioned task-board writer: add a queued task, start one (flips to in-progress + stamps the date, minting a dotted ID on pick-up), or mark an in-progress task done. The only blessed write to `open-tasks.md`. |
-| `/ca-audit` | `[range]` | Assemble the governance packet for a window — commits, overrides, ADRs, sprint decisions, open items — into `.codearbiter/audits/`. Read-only. |
-| `/ca-metrics` | `[--window N]` | Read-only governance trend glance: override rate, small-lane rate, sprint low-confidence ratio, each with a direction arrow vs. the prior 20-commit window. Not a second `/ca-audit` packet. |
-| `/ca-prune` | `status \| dry \| run <path> \| audit <path> \| on \| off` | Select shared semantic prune policy and use Pi native compaction without rewriting the active session. |
-| `/ca-doctor` | _(none)_ | Verify the install is enforcing: interpreter, payload, cache staleness, repo state, wrapper self-test and active-dispatch coverage gap. |
-| `/ca-preview` | _(none)_ | Zero-onboarding read-only dry-run of the reviewer fleet on the current diff: predicts reviewers by path, runs the state-free secret scan, writes nothing. |
-| `/ca-context-check` | _(none)_ | Optional manual drift audit: report stale provenance-tracked docs, then per stale doc offer re-scout, re-baseline, or defer. Not the daily loop — commit-gate auto-heal owns routine maintenance. |
-| `/ca-standup` | _(none)_ | Daily hygiene: review repo state, then ff-only pull / prune merged branches / remove stale worktrees / surface stashes — each under per-action confirmation. |
-| `/ca-cleanup` | _(none)_ | Finish an already-merged branch: prove ancestry of the fetched default, classify leftover artifacts as unique/redundant/superseded, `--ff-only` to the default branch, delete the merged local branch. Every discard confirmed per item. |
-| `/ca-new-skill` | `"gap"` | Author a new skill after the gap is proven uncovered. |
-| `/ca-btw` | `"question"` | Lightweight Q&A; no state change. |
-| `/ca-override` | `"reason"` | Sanctioned, logged single-identity gate bypass. |
-| `/ca-commands` | _(none)_ | Show this catalog. |
-
-## Maintainer
+| `/ca-checkpoint` | `[focus]` | Run a periodic whole-codebase reviewer sweep and return a triaged report. |
+| `/ca-threat-model` | `"scope"` | Run an opt-in lightweight STRIDE pass for a sensitive feature. |
+| `/ca-tribunal` | `[scope-path] [--tag <label>]` | Run a deep, resumable eleven-lens audit. It is expensive and never a routine gate. |
+
+### Decide
 
 | Command | Argument | Purpose |
 |---|---|---|
-| `/ca-dev` | `["note"]` | Suspend orchestration to edit codeArbiter itself. Requires `CODEARBITER_DEV=1`; entry/exit logged to `overrides.log`. |
-| `/ca-arbiter` | _(none)_ | Exit dev mode: restore orchestration, log the exit. |
-
-## Glossary — the words the gates speak
-
-- **stage** — the project's maturity, a single number in `.codearbiter/CONTEXT.md`; higher stages
-  demand stricter coverage and review.
-- **skill** — a gated routine a command routes to (e.g. `tdd`, `commit-gate`).
-- **phase** — one step inside a skill; each ends in a gate.
-- **gate** — a phase exit condition. **STOP** waits for you; **BLOCK** halts until the condition is met.
-- **severity** — a review finding's class (CRITICAL/HIGH/MEDIUM/LOW), independent of gate action.
-- **`[CONFIRM-NN]`** — a numbered open question only you can answer; dependent work pauses until
-  it is resolved in `.codearbiter/open-questions.md`.
-- **SMARTS** — the six-lens scoring rubric used to arbitrate decisions; every arbitration is
-  attributed to you, never decided silently.
-- **ADR** — an Architecture Decision Record under `.codearbiter/decisions/`, authored only via `/ca-adr`.
+| `/ca-adr-status` | `[--adr N]` | Inspect ADR health, age, challenges, and supersession chains without writing. |
+| `/ca-reconcile` | `["scope"]` | Reconcile architectural artifacts through explicit, user-attributed SMARTS choices. |
+
+### Operate
+
+| Command | Argument | Purpose |
+|---|---|---|
+| `/ca-standup` | _(none)_ | Review repository hygiene, then confirm each safe cleanup action separately. |
+| `/ca-audit` | `[range]` | Assemble a dated governance packet from source records. Read-only. |
+| `/ca-metrics` | `[--window N]` | Report override, small-lane, and low-confidence trends against the prior window. |
+| `/ca-prune` | `status \| dry \| run <path> \| audit <path> \| on \| off` | Select shared prune policy and use Pi native compaction without rewriting the active session. |
+
+### Extend
+
+| Command | Argument | Purpose |
+|---|---|---|
+| `/ca-new-skill` | `"gap"` | Prove a capability gap, approve a spec, then author a new skill. |
+
+### Help
+
+| Command | Argument | Purpose |
+|---|---|---|
+| `/ca-commands` | _(none)_ | Show this grouped catalog. |
+
+</details>
+
+<details>
+<summary><strong>Compatibility routes</strong></summary>
+
+These entry points remain installed for the declared compatibility window. New work should use the
+canonical form; each legacy route continues to execute its original workflow.
+
+| Existing route | Canonical form | Purpose |
+|---|---|---|
+| `/ca-watch` | `/ca-pr --watch [PR]` | Watch hosted CI, diagnose red, and offer the merge on green. |
+| `/ca-cleanup` | `/ca-pr --cleanup` | Finish a proven merged branch under per-item discard consent. |
+| `/ca-decompose` | `/ca-init --greenfield` | Populate a new project through the layered decomposition interview. |
+| `/ca-create-context` | `/ca-init --brownfield` | Scout an existing codebase and backfill repository context. |
+| `/ca-context-check` | `/ca-status drift` | Inspect provenance-tracked document drift and offer explicit follow-up choices. |
+
+</details>
+
+<details>
+<summary><strong>Internal and deprecated routes</strong></summary>
+
+| Status | Command | Argument | Purpose |
+|---|---|---|---|
+| Internal protocol | `/ca-conflict` | `"description"` | Stop work when governing rules contradict and surface both sides for the user. |
+| Deprecated | `/ca-btw` | `"question"` | Ask a lightweight project question without state change. Prefer asking the question directly. |
+
+</details>
+
+## Glossary
+
+- **stage:** the project's maturity level in `.codearbiter/CONTEXT.md`; higher stages demand stricter coverage and review.
+- **skill:** a gated routine that a command routes to, such as `tdd` or `commit-gate`.
+- **phase:** one step inside a skill. Each phase ends at a gate.
+- **gate:** a phase exit condition. **STOP** waits for the user; **BLOCK** halts until the condition is met.
+- **severity:** a review finding's CRITICAL, HIGH, MEDIUM, or LOW classification, independent of gate action.
+- **`[CONFIRM-NN]`:** a numbered question only the user can resolve; dependent work pauses until `.codearbiter/open-questions.md` records the answer.
+- **SMARTS:** the Scalable, Maintainable, Available, Reliable, Testable, and Securable lenses used for attributed arbitration.
+- **ADR:** an Architecture Decision Record under `.codearbiter/decisions/`, authored only through `/ca-adr`.