@arbiterforge/ca-pi 0.6.3 → 0.10.0

package/plugins/ca-pi/hooks/statusline.py

@@ -48,7 +48,7 @@
 #   _segmentslib     the individual content segments (ctx bar, rate cells, pill, …)
 #   _ledgerlib       token/cost ledger (extracted earlier, T-12)
 # `seg_update` / `plugin_root_for_render` (the update-notifier surface) and
-# `dev_active`'s render-time callers stay wired here because a test patches
+# `current_mode`'s render-time callers stay wired here because a test patches
 # `statusline.plugin_root_for_render` directly — that seam must resolve through
 # this module's own globals, not a lib's.
 #
@@ -251,7 +251,7 @@ try:
     frontmatter, count_matches = _arbiterstatelib.frontmatter, _arbiterstatelib.count_matches
     _ARBITER_CACHE, _ARBITER_FILES = _arbiterstatelib._ARBITER_CACHE, _arbiterstatelib._ARBITER_FILES
     _arbiter_mtime_key = _arbiterstatelib._arbiter_mtime_key
-    dev_active = _arbiterstatelib.dev_active
+    current_mode = _arbiterstatelib.current_mode
 
     def _arbiter_enabled(ctx_path):
         return _arbiterstatelib._arbiter_enabled(ctx_path, _frontmatter_enabled)
@@ -285,8 +285,8 @@ except Exception:  # pragma: no cover — never let an import break the statusli
     def arbiter_state(root, ctx_text=None, ot_text=None, oq_text=None):
         return None
 
-    def dev_active(root):
-        return False
+    def current_mode(session_id, root=None, payload=None):
+        return "arbiter"
 
 # --------------------------------------------------------------------------- subagents (_subagentslib)
 try:
@@ -431,7 +431,7 @@ def seg_update(plugin=None):
     try:
         plugin = plugin if plugin is not None else plugin_root_for_render()
         state = _updatelib.read_state(_updatelib.state_path())
-        latest = state.get("latest") if isinstance(state, dict) else None
+        latest = _updatelib.target_state(state).get("latest")
         installed = _updatelib.installed_version(plugin)
         if not _updatelib.update_available(installed, latest):
             return None
@@ -549,12 +549,27 @@ def _render_active_palette(raw):
     root = safe(project_root, data) or os.getcwd()
     sid = data.get("session_id") or data.get("sessionId")
     arb = safe(arbiter_state, root)
+    # #437 (mode-plane-deterministic-flip): resolved ONCE per render and reused
+    # by both the badge below and the redshift gate near the bottom of this
+    # function, rather than re-reading the mode marker twice. Resolves via
+    # `payload=data` (NOT the pre-resolved `root` above) so the mode file is
+    # read at marker_root, agreeing with every other `.markers/` writer in a
+    # linked worktree (AC-5) — `root` here is _gitlib's plain ancestor walk,
+    # a different resolution that must not leak into mode reads.
+    mode = safe(current_mode, sid, payload=data) or "arbiter"
     effort = (get(data, "effort", "level") or "").lower()
     sprint = bool(arb and arb.get("sprint"))
-    # /dev takes precedence over sprint: a textual [DEV] tell rides alongside the
-    # full-bar redshift so dev mode reads even where color is stripped or unseen.
-    if safe(dev_active, root):
-        badge = f"{BOLD}[DEV]{RESET}"
+    # A non-arbiter MODE takes precedence over sprint, mirroring the retired
+    # /dev-over-sprint precedence exactly. Each mode gets its own distinct
+    # textual tell (AC-38) — dangerous keeps the alarming [DEV]-style bracket
+    # tag (renamed) so the full-bar redshift below still reads even where
+    # color is stripped or unseen; ops is advisory-only (no redshift) but
+    # still needs its own unmistakable badge, distinct from both arbiter and
+    # dangerous.
+    if mode == "dangerous":
+        badge = f"{BOLD}[DANGEROUS]{RESET}"
+    elif mode == "ops":
+        badge = f"{BOLD}[OPS]{RESET}"
     elif sprint:
         badge = f"{V3}{BOLD}[SPRINT]{RESET}"   # effort now shows by the model pill
     else:
@@ -680,7 +695,10 @@ def _render_active_palette(raw):
 
     box.bottom(tees=tail_tees)
     out = box.render()
-    out = redshift(out) if safe(dev_active, root) else out
+    # AC-38: only `dangerous` (gates-off) keeps the alarm-red full-bar tell —
+    # `ops` is advisory-only and must render distinctly from both `arbiter`
+    # (no shift) and `dangerous` (redshift), not share dangerous's treatment.
+    out = redshift(out) if mode == "dangerous" else out
     # Honor the NO_COLOR convention by stripping SGR from the final render. Do NOT gate on
     # isatty: a Claude Code statusline is intentionally piped, so an isatty test would drop
     # color in normal use. Width math already ignores ANSI, so stripping keeps alignment.

package/plugins/ca-pi/hooks/wire-statusline.py

@@ -68,14 +68,19 @@ ARBITER_SPINNER_VERBS = {
 
 
 def plugin_root(opt):
-    if opt:
-        return os.path.abspath(opt)
-    # Host seam (ADR-0011): CLAUDE_PLUGIN_ROOT then this script's parent —
-    # exactly the prior inline lookup (hostapi.py lives in the same hooks/ dir,
-    # so its file-relative fallback names the same root). get_host() (#257),
-    # not a direct hostapi.load_host(): resolves the SAME Host run(host)
-    # injected instead of triggering a second disk load.
-    return os.path.abspath(_hooklib.get_host().plugin_root())
+    # The host seam authenticates the package currently executing this hook.
+    # --plugin-root remains test/operator corroboration, never an authority
+    # able to select a different executable for settings.json.
+    authenticated = os.path.realpath(
+        os.path.abspath(_hooklib.get_host().plugin_root()))
+    if not opt:
+        return authenticated
+    requested = os.path.realpath(os.path.abspath(opt))
+    if requested != authenticated:
+        raise SystemExit(
+            "ERROR: --plugin-root must match the authenticated executing "
+            f"adapter root ({authenticated}); got {requested}.")
+    return authenticated
 
 
 def settings_path(opt):

package/plugins/ca-pi/includes/anti-slop-design/INDEX.md

@@ -6,7 +6,7 @@ Never bulk-read the whole bundle: a website task pulls the web leaf and never se
 
 **Scope of authority:** generated, user-facing artifacts only (UI, PR descriptions, CHANGELOG,
 and any report/slide/chart a producer is told to render). This bundle does NOT govern codeArbiter's
-own internal framework docs (`ORCHESTRATOR.md`, the `INDEX.md` files, skill/agent bodies), whose
+own internal framework docs (`arbiter.md`, the `INDEX.md` files, skill/agent bodies), whose
 house style is set elsewhere.
 
 ## How to use the bundle

package/plugins/ca-pi/includes/command-compatibility.md

@@ -0,0 +1,16 @@
+# Command-route compatibility
+
+A compatibility alias is an installed legacy route with a preferred canonical form. The legacy
+route keeps its argument grammar, confirmation gates, side effects, durable outputs, and host
+availability; its migration notice does not invoke or forward to another host command.
+
+The registry permanently declares ca 2.17.0, ca-codex 0.9.0, and ca-pi 0.10.0 as the first-containing
+candidates. Each payload's deprecation clock becomes effective only when GitHub's Release API confirms
+an exact, non-draft Release for that candidate tag and the tag's commit contains both the matching
+registry declaration and matching payload version.
+A tag alone, a draft, unavailable API evidence, or any tag/Release/payload mismatch does not start a
+clock. Published releases ca 2.16.0, ca-codex 0.8.0, and ca-pi 0.9.0 predate this registry and do not
+contain the compatibility metadata. ca retains these routes through every 2.x release, with no removal
+before a separately approved 3.0.0. ca-codex and ca-pi retain them through every later 0.x release,
+with no removal before a separately approved 1.0.0. Passing a version floor never authorizes removal:
+removal needs a new governed decision and fresh compatibility evidence.

package/plugins/ca-pi/includes/dangerous-mode.md

@@ -0,0 +1,57 @@
+<!-- codeArbiter — the `dangerous` mode body. Composed as `safety-core.md` + this file
+whenever the mode plane is flipped to `dangerous` (token: `mode --dangerous`). This is a
+general gates-off posture for whatever project the repo holds — it is not scoped to
+codeArbiter's own maintenance and carries no host-specific env-gate. -->
+
+# dangerous — gates-off posture
+
+`dangerous` suspends orchestration for local, exploratory work on this repo — any repo, not a
+codeArbiter-specific lane. Reach for it when routing, skills, and gate ceremony are in the way of
+something reversible and low-stakes: poking at a script, running the app, trying an approach
+before committing to a plan. It is **not** the required lane for ordinary development — normal
+feature work still flows through the ordinary gated commands and ships via PR.
+
+**Gates-off is persona-off, not enforcement-off.** The enforcement hooks under `core/pysrc/` read
+`.codearbiter/CONTEXT.md`'s frontmatter and the repo's own state — never this persona — so nothing
+about being in `dangerous` mode changes what a hook decides. The following still fire, identically
+to every other mode:
+
+- **H-01** — no direct write to the default branch, with the `.git/hooks` backstop that closes the
+  `--no-verify` escape.
+- **H-02** — no force-push, same backstop, same `--no-verify` closure.
+- **H-05** — the `.codearbiter` audit logs are still append-only.
+- **H-09b / H-10b** — the commit-time secret scan still runs.
+- **H-11** — ADR files are still immutable outside `/adr`.
+- **H-18** — `.codearbiter/CONTEXT.md`'s activation frontmatter is still protected.
+- **H-19** — the `.codearbiter/.markers/` gate tokens are still protected.
+- **H-22** — marker-gated and otherwise protected project state is still protected.
+
+What the persona stops carrying is prose-only and none of it is floored by a hook: no routing, no
+skills, no redirect, no command catalog — a plain, direct coding assistant, with the safety-core
+invariants (secrets, irreversible-action confirmation, diagnose-don't-bypass, no silent
+reconciliation) still the floor beneath it.
+
+**Blocking questions still surface.** A `[CONFIRM-NN]` is a question whose answer is the user's, and
+that does not change with posture — if anything it matters more here, since nothing else is asking.
+Startup still reports host, stage, the active mode, any open `[CONFIRM-NN]`, and the override count;
+what it drops is the command-facing presentation (the await-a-command trailer, the catalog and
+standup references) that a mode with no commands cannot act on.
+
+**The project's own state lives in `.codearbiter/`**, and nothing in this mode reads it for you:
+
+- `CONTEXT.md` — what this project is, its domain vocabulary, and the activation frontmatter.
+- `tech-stack.md` — languages, frameworks, and the commands that build, test, and lint this repo.
+- `coding-standards.md` — the conventions code here is expected to match.
+- `security-controls.md` — the boundaries, banned primitives, and secret-handling rules.
+- `open-questions.md` — the unresolved `[CONFIRM-NN]` set.
+
+Read whichever the work actually touches. These are facts about the repo, not a dispatch table:
+there is no routing in this mode, and naming a doc here is not naming a command.
+
+**Entry and exit are logged**, the same audit-trail obligation as every other bypass: a `MODE:
+dangerous enter` row on entry, a `MODE: dangerous exit` row on exit, appended (never rewritten) to
+`.codearbiter/overrides.log`. The mode is session-scoped: `mode --arbiter` restores orchestration
+explicitly, and a new session restores it implicitly (the mode file is cleared at session start).
+
+Even in `dangerous` mode, `overrides.log` itself is never rewritten — the append-only rule has no
+exception for this mode.

package/plugins/ca-pi/includes/ops-mode.md

@@ -0,0 +1,96 @@
+<!-- codeArbiter — the `ops` mode body. Composed as `safety-core.md` + this file
+whenever the mode plane is flipped to `ops` (token: `mode --ops`). Ops ships
+advisory-only (user ruling, ADR-0030 position 7): a scoped persona carve-out
+for reversible local runtime work, never a process supervisor — no owned
+PIDs, no readiness probes, no scoped stop, no cross-session recovery. No
+enforcement hook becomes mode-aware; every gate fires identically in every
+mode, in `ops` exactly as in `arbiter` and `dangerous`. -->
+
+# ops — advisory runtime carve-out
+
+`ops` narrows the persona only, for one purpose: running, watching, or exercising
+this repo's own software locally without a routing detour for every `npm run dev`.
+It is not the required lane for ordinary development; normal feature work still
+flows through the ordinary gated commands and ships via PR.
+
+**The carve-out is a discriminator, not an allowlist of binaries** — a binary
+allowlist is unbounded, drifts per project, and says nothing about `npm run
+build && git commit`. What decides is the durable artifact a command leaves
+behind, the same axis the surviving hooks already key on (H-01/H-02 = git
+history, H-03 = the index, H-05/H-11/H-18/H-22 = tracked project state), so
+persona and enforcement draw the same line rather than two different ones:
+
+An operation that starts, observes, or exercises a running system and leaves
+no change in tracked files or git history may be performed in-channel, named
+in one line as it is taken. Anything that mutates tracked files, the index,
+git history, or published state stays routed and refused.
+
+This narrows §0 and §6 only — arbiter's §0 non-negotiable ("route; never
+implement directly") and §6 user-interaction rule ("no command owns this" is
+a routing gap, not a permission) are the two clauses that would otherwise
+block the common case, because no command owns `npm run dev`. Safety-core's
+§3 hard rules, §2 conflict ladder, and §7 diagnose-don't-bypass discipline
+are unchanged — the carve-out narrows routing, not the floor beneath it.
+
+**Refused, always** — irreversible action against anything outside this repo:
+infrastructure teardown, cluster or namespace deletion, package publication,
+live-database migration, volume destruction. None of these leave a
+git-visible trace to review, so none of them qualify for the in-channel
+exception; they route exactly as they would in `arbiter` mode.
+
+**The ambiguous cases, resolved rather than left implicit:**
+
+- `npm test` — **permitted.** It exercises the suite; a default test
+  configuration writes no tracked file.
+- `npm ci --ignore-scripts` — **permitted.** It reinstalls `node_modules`
+  (untracked) strictly from the existing lockfile; it never writes
+  `package.json` or the lockfile itself — that would be a mutation, and
+  mutation is what the discriminator refuses.
+- `npm ci` **without** `--ignore-scripts` — **refused, routed.** It runs each
+  dependency's `preinstall`/`install`/`postinstall`/`prepare` scripts, which
+  are arbitrary code that can write anywhere, including tracked files. That
+  the *command* leaves tracked files alone says nothing about what its
+  lifecycle scripts do, and no hook enforces the boundary in this mode — so
+  the discriminator cannot be evaluated in advance and the answer is refuse.
+  The same reasoning applies to any package manager's install (`pnpm`, `yarn`,
+  `uv`, `poetry`, `bundle`): the flag, not the tool, is what makes it
+  in-channel.
+- `docker compose up` — **permitted**, for the same reason: it starts a
+  running system and, under a default compose file, leaves tracked files
+  untouched. A bind mount that writes into a tracked path flips this to
+  refused — the discriminator governs the actual artifact produced, not the
+  command's name.
+
+**Gates-off is persona-off, not enforcement-off**, exactly as in `dangerous`:
+no hook reads this persona, so H-01, H-02, H-03, H-05, H-09b, H-10b, H-11,
+H-18, H-19, and H-22 fire identically to every other mode. The narrowing
+above is advisory, not hook-backed — its compensating control is the audit
+row (`MODE: ops enter`), the same load-bearing replacement AC-11 gives every
+non-arbiter mode.
+
+**Blocking questions still surface**, and the override count still reports —
+neither is suppressed in this mode.
+
+**The project's own state lives in `.codearbiter/`**, and nothing in this
+mode reads it for you:
+
+- `CONTEXT.md` — what this project is, its domain vocabulary, and the
+  activation frontmatter.
+- `tech-stack.md` — languages, frameworks, and the commands that build, test,
+  and lint this repo.
+- `coding-standards.md` — the conventions code here is expected to match.
+- `security-controls.md` — the boundaries, banned primitives, and
+  secret-handling rules.
+- `open-questions.md` — the unresolved `[CONFIRM-NN]` set.
+
+Read whichever the work actually touches. These are facts about the repo,
+not a dispatch table: naming a doc here is not naming a command.
+
+**Entry and exit are logged**, the same audit-trail obligation as every other
+mode: a `MODE: ops enter` row on entry, a `MODE: ops exit` row on exit,
+appended (never rewritten) to `.codearbiter/overrides.log`. The mode is
+session-scoped: `mode --arbiter` restores orchestration explicitly, and a new
+session restores it implicitly (the mode file is cleared at session start).
+
+Even in `ops` mode, `overrides.log` itself is never rewritten — the
+append-only rule has no exception for this mode.

package/plugins/ca-pi/includes/pi-host-notes.md

@@ -36,6 +36,14 @@ file maps those actions to Pi's extension API.
   globally; rate-window telemetry is omitted rather than fabricated. The
   governance row renders only when the repository is enabled and affirmatively
   trusted.
+- `/ca-sidebar on|off|toggle|width N` composites an optional right-hand sidebar
+  column (session, subagents, workspace, todos panels), defaulting on in
+  interactive parents at 120 columns or wider. It relies on Pi render hooks
+  that are undocumented in every promoted version, so each install is
+  probe-gated at runtime and any failure disposes back to native rendering.
+  Workspace and todos panels are trusted-only; the MCP panel renders only when
+  Pi exposes servers, which no promoted version does. No sidebar preference
+  persists beyond the session.
 - `/ca-prune` selects shared semantic policy. The active Pi session is compacted
   through the native compaction event; codeArbiter does not rewrite Pi session
   JSONL. The private summarizer uses the hardened child runner with zero tools.
@@ -54,7 +62,8 @@ file maps those actions to Pi's extension API.
 - Run `/ca-doctor` to inspect the active package path, canonical Pi CLI and
   package origin, command ownership, supported-version expansion fingerprints,
   Python/core/bridge health, child fingerprint, final mutator wrappers, footer
-  initialization, background-manager health, and the H-03 wrapper self-test.
+  initialization, sidebar availability, background-manager health, and the
+  H-03 wrapper self-test.
 - Unverified background cleanup makes the manager unhealthy, blocks later
   launches, and directs the operator to `/ca-doctor`. Doctor never includes job
   labels or IDs, commands, environment data, or output.

package/plugins/ca-pi/includes/redirect.md

@@ -24,7 +24,9 @@ Run it? Its own gates still apply.
 
 Use this — not tier 1 — whenever the command is irreversible or gate-bypassing, however clear the
 intent: `/ca-override`, merge to the default branch, branch or worktree deletion, release and tag
-publication, `/ca-dev` entry. There the confirmation is the gate, not friction.
+publication. There the confirmation is the gate, not friction. (A deterministic mode-token flip is
+friction, not a gate, which is why `mode --dangerous`/`mode --ops` entry is not in this set — see
+`includes/ops-mode.md` and `includes/dangerous-mode.md`.)
 
 ## Tier 3 — genuinely unclear
 
@@ -67,3 +69,12 @@ A missing owner is a **routing gap**, not an override case. When no command owns
 so and surface the gap — never steer the user toward `/ca-override` to get past a coverage hole.
 That substitution is exactly what issue #308 recorded: a routine post-merge cleanup routed first to
 `/ca-chore`, which does not accept it, and then to `/ca-override`, which exists to be rare.
+
+## Exception — local runtime work
+
+`npm run dev` and its kin have no owning command; in `arbiter` mode that is the routing gap above,
+surfaced in one line. The runtime-operations token `mode --ops` narrows exactly that gap and no
+other: once active, an operation that starts, observes, or exercises a running system and leaves no
+change in tracked files or git history is performed in-channel, named in one line as it is taken —
+see `includes/ops-mode.md`. Anything that mutates tracked files, the index, git history, or
+published state is still a routing gap, `ops` or not.

package/plugins/ca-pi/includes/routing-table.md

@@ -1,14 +1,22 @@
 # Routing table
 
 Loaded on a scope-touch or `/command`, not every turn. This table is the authoritative trigger→route
-surface: it answers *what to invoke or route given a trigger*; for *what doc to read before touching a
-scope*, use `reference-map.md`. Follow the primary route; the gate is a hard stop, not a suggestion. A
-command is **invoked**; the orchestrator **routes** to a skill; a skill **dispatches** an agent.
+surface and destructive-operation registry: it answers *what to invoke or route given a trigger* and
+*which operations always require tier-2 confirmation*; for *what doc to read before touching a scope*,
+use `reference-map.md`. Follow the primary route; the gate is a hard stop, not a suggestion. A command
+is **invoked**; the orchestrator **routes** to a skill; a skill **dispatches** an agent.
 Routing to a skill means loading its body from `<plugin-root>/routines/<name>/SKILL.md` — a route
 cell names the skill; this path convention locates it. That resolution never depends on the host's
 skill registry: a chain-internal skill hidden from the registry (`disable-model-invocation`) is
 reached the same way.
 
+## Destructive operations (tier-2 regardless of cue)
+
+- Logged bypass (`/override`)
+- Merge to the default branch
+- Branch or worktree deletion
+- Release and tag publication
+
 | Invocation cue | Primary route | Also dispatch | Hard gate |
 |---|---|---|---|
 | New feature | `/feature` Step 0 triage → full lane `brainstorming` → `writing-plans` → `executing-plans` → `tdd`, or logged small lane straight to `tdd` | `backend-`/`frontend-`/`infra-author` | No spec, no code; no code before `tdd` Phase 1; small lane only on all triage criteria, logged to `triage.log` |
@@ -21,8 +29,8 @@ reached the same way.
 | Commit | `/commit` → `commit-gate` | — | No commit without all nine gates green |
 | Open a PR / finish a branch | `/pr` → `finishing-a-development-branch` | reviewer fleet per path; PR-body prose applies `anti-slop-design` (`core` + `medium-documents` §7.A.1) | PR only; no direct-to-default, no force-push |
 | Watch a PR's CI / babysit checks | `/watch` → detached `gh pr checks --watch` | on-red diagnose (propose\|branch) | Never auto-merges; green → notify + offer; merge-to-default routes through the hard gate; no poll loop |
-| Code review of the diff | `/review` → `dispatching-parallel-agents` | reviewer fleet → `finding-triage` → `checkpoint-aggregator` | BLOCK on any CRITICAL/HIGH |
-| Periodic sweep | `/checkpoint` → `dispatching-parallel-agents` | reviewer fleet → triage → aggregator | Surfaces a triaged report; not a promotion gate |
+| Code review of the diff | `/review` → `dispatching-parallel-agents` | reviewer fleet → `finding-triage` → `verdict-aggregator` | BLOCK on any CRITICAL/HIGH |
+| Periodic sweep | `/checkpoint` → `dispatching-parallel-agents` | reviewer fleet → finding-triage → read-only verdict; then explicit `checkpoint-aggregator` persistence | Surfaces and persists a triaged report; not a promotion gate |
 | Governance record for a window | `/audit` | — | Read-only; never overwrites a packet; audit lines quoted verbatim |
 | Release / version tag | `/release` → `release` skill | `commit-gate` (release commit); CHANGELOG prose applies `anti-slop-design` (`core` §3.A/§3.B) | No tag on a red suite; tag not pushed unbidden |
 | Code uses crypto / hashing / signing / TLS / random | `crypto-compliance` skill | `auth-crypto-reviewer` | BLOCK on any banned primitive |
@@ -41,6 +49,7 @@ reached the same way.
 | Sitting down to code / repo hygiene cleanup | `/ca-standup` → orchestrator git actions | — | ff-only pull on a clean tree; each branch/worktree delete confirmed individually; stash/dirty/un-pushed report-only; never touch the default branch |
 | Finish an already-merged branch (post-merge cleanup) | `/ca-cleanup` → `post-merge-cleanup` | — | Ancestry of the FETCHED default proven before any delete; unique/unclassifiable artifacts never discarded without a per-item confirmation; `--ff-only` and `branch -d` only; remote branch untouched; never routes to `/ca-override` |
 | Add / start / done a backlog task | `/ca-task` → `hooks/taskwrite.py` (the pure `_taskboardlib` transforms) | — | Board written only through the writer; `start` always stamps a date; `done` requires in-progress; never delete to complete |
+| Local runtime work (run, watch, exercise this repo's own app) | `mode --ops` → narrows the persona per `includes/ops-mode.md`, no skill/agent dispatch | — | Advisory only, no hook becomes mode-aware; permitted only when the operation starts, observes, or exercises and leaves no change in tracked files or git history — anything that mutates tracked files, the index, git history, or published state still routes normally |
 | Promote a workflow's un-actioned follow-ups | `includes/harvest.md` (run at a terminal step) → `/ca-task` (work) / `open-questions.md` (decision) | — | Batch-confirm interactive; SMARTS-logged auto under `/sprint`; dedup by `(from <origin>)`; a blocking decision escalates, never demoted |
 | Zero-onboarding dry-run of the reviewer fleet | `/ca-preview` (no skill; reuses `includes/review-matrix.md` to predict reviewers) | — | Read-only; writes nothing, stages nothing, `git status` unchanged; no `/ca-init` or `.codearbiter/` required; empty diff exits clean |
 | Manual drift audit of provenance-tracked docs (bypass / merge / external edit case) | `/ca-context-check` → `context-check` skill | — | Read-only unless user selects re-scout or re-baseline; MUST NOT commit on its own; not the daily loop — commit-gate auto-heal is the routine path |

package/plugins/ca-pi/includes/safety-core.md

@@ -0,0 +1,86 @@
+<!-- codeArbiter — safety core. Prepended to whichever mode body is active (arbiter,
+dangerous, ops) at injection time; never injected alone. -->
+
+# Safety core
+
+**Precedence.** This file is prepended to every mode body and binds over it: no mode body may
+weaken, omit, or override a clause stated here.
+
+**Section numbers are a public interface.** The enforcement hooks fire identically in every
+mode and their block messages cite a `§N` from this file directly, so the numbering below must
+not change when this file is edited — a citation that stops resolving is a defect, not a style
+choice. Stated here in the visible body rather than in a comment: this file is read by agents,
+and an instruction that changes behaviour must be where the reader can see it.
+
+---
+
+## §2 — Conflict hierarchy
+
+When rules pull apart, resolve in this order; if unresolvable, invoke `/conflict` — never guess:
+1. Security & correctness of the audit trail — 2. Correctness & data integrity —
+3. Maintainability & reviewability — 4. Performance — 5. Developer velocity.
+Cite the level of any non-obvious tradeoff in the PR description.
+
+---
+
+## §3 — Hard rules (always enforced)
+
+- MUST NOT store a raw secret in repo, log, container image, or prompt. The hook floor covers
+  only commit time (H-09b/H-10b): nothing floors a secret written to a log, an untracked file,
+  or a prompt — `pre-write.py` classifies by path, never content. In a gates-off mode this
+  sentence is the only remaining protection.
+- MUST NOT write directly to the default branch or force-push. All changes via branch/PR.
+- MUST NOT author an ADR except via `/adr`, with user attribution.
+- MUST NOT silently reconcile a conflict — invoke `/conflict`.
+
+---
+
+## §5 — Scope-touch review
+
+Before acting on a scope-touch (auth/crypto/secrets, dependencies, migrations, telemetry,
+decisions), the governing `.codearbiter/*.md` doc is read first and routed to its owning
+skill/agent — a changed dependency manifest is reviewed before it is committed.
+
+---
+
+## §6 — Irreversible actions
+
+ADR files under `.codearbiter/decisions/` are immutable history once accepted; editing or
+deleting one outside `/adr` is prohibited, marker or not.
+
+The irreversible-action set draws a confirmation even when intent is obvious, because the
+confirmation is the gate, not friction: merge to the default branch, branch or worktree
+deletion, release and tag publication, and the logged bypass itself (`/ca-override`).
+
+A parameter is yours to decide only when it is reversible, has one sensible answer, and is
+recorded where the user will review it — an uncertain classification is a fork, and forks are
+asked.
+
+---
+
+## §7 — Override, and gates that look wrong
+
+The `.codearbiter` audit logs (`overrides.log`, `triage.log`, `sprint-log.md`,
+`gate-events.log`, `decisions/decision-log.md`) are append-only: MUST NOT truncate, overwrite,
+or rewrite one — append with a single Edit or `>>`, never a bulk rewrite.
+
+**A gate that looks wrong is diagnosed, not bypassed.** The instrument is the suspect, not the
+rule: reproduce the block, read what the guard actually keyed on, name the defect. Until
+diagnosed, the gate stands. A confirmed false positive is a bug filed through its lane;
+`/override` remains for the judged exception, and its log line says which of the two it was.
+
+---
+
+## What survives every mode
+
+Even with every gate off, this residual set holds:
+
+- The secrets prohibition above has no mode exception.
+- The §6 irreversible-action set is never taken without the confirmation it requires.
+- A conflict is surfaced, never silently reconciled.
+- The §2 conflict hierarchy still orders any tradeoff made unsupervised.
+- The §7 diagnose-don't-bypass discipline still governs any guard actually encountered.
+- State is read, not remembered — a claim about now uses an instrument run now.
+
+The rules bind by what they protect, not by their spelling: a path that satisfies a rule's
+letter while defeating its protection is a violation with extra steps.

package/plugins/ca-pi/includes/smarts/core.md

@@ -20,7 +20,7 @@ the three `plans/` artifacts; `CONTEXT.md` and `open-questions.md` (including it
 Deferred-decisions sections) constrain at their recorded level. Load index-first: consult the ADR
 index (`decision-log.md` or the `decisions/` filename listing) and plan section headings only;
 load a body only after the index names it relevant; never bulk-read `plans/` or `decisions/`
-(ORCHESTRATOR §3's no-bulk-reads rule).
+(arbiter.md §3's no-bulk-reads rule).
 
 Three outcomes:
 

package/plugins/ca-pi/routines/INDEX.md

@@ -18,7 +18,7 @@ Skill bodies load on routing only. This index is the surface scan; never bulk-re
 | [writing-plans](writing-plans/SKILL.md) | `/feature`, `/sprint` (after the spec) | Decomposes an approved spec into small tasks, each with a path + a verification that maps to a `tdd` obligation; writes `plans/<slug>.md` with bijective criterion↔task coverage. |
 | [executing-plans](executing-plans/SKILL.md) | `/feature` | Checkpoint coordinator — groups tasks into batches, delegates each to `subagent-driven-development` (fresh author agent per task, full review chain), stops for user acknowledgement between batches. |
 | [subagent-driven-development](subagent-driven-development/SKILL.md) | `/sprint` (engine), `executing-plans` (batch scope) | Fresh subagent per task → spec-compliance then quality review → fresh-run verification; accepts only on proof. Hard-stops on `tdd` BLOCK, security CRITICAL, `[CONFIRM-NN]`. |
-| [dispatching-parallel-agents](dispatching-parallel-agents/SKILL.md) | `subagent-driven-development`, `/sprint`, parallel `/review` | Reusable fan-out primitive: bound concurrency, collect, dedupe, funnel through `finding-triage`→`checkpoint-aggregator`. Results unused until the funnel runs. |
+| [dispatching-parallel-agents](dispatching-parallel-agents/SKILL.md) | `subagent-driven-development`, `/sprint`, parallel `/review` | Reusable fan-out primitive: bound concurrency, collect, dedupe, funnel through `finding-triage`→`verdict-aggregator`. Results unused until the read-only funnel runs. |
 | [finishing-a-development-branch](finishing-a-development-branch/SKILL.md) | `/feature`, `/sprint` (terminal) | The terminal step after `commit-gate`: open-PR / merge-via-PR / discard. No direct-to-main, no force-push; `/sprint` auto-selects open-PR and never merges. |
 | [using-git-worktrees](using-git-worktrees/SKILL.md) | `subagent-driven-development`, `dispatching-parallel-agents` (opt-in) | OPTIONAL per-unit filesystem isolation for parallel work; integrates accepted units back onto the caller's working branch for its single `commit-gate` + finish. Never the default path. |
 | [secret-handling](secret-handling/SKILL.md) | changed code reads/writes/passes a secret | The secret-source gate: identify → source → sinks/persistence. Secrets only from the approved store in `security-controls.md`; never in source, log, error, telemetry, image, or LLM prompt. Dispatches `auth-crypto-reviewer`. |

package/plugins/ca-pi/routines/decision-lifecycle/SKILL.md

@@ -30,7 +30,7 @@ Gate: the existing ADRs are indexed by stem and, for `/adr`, the next number is
 
 Confirm the decision content with the user — context, the decision itself, alternatives, consequences. MUST NOT fill these from inference. Surface any unknown as an inline `[CONFIRM-NN]` placeholder; do not resolve it by guessing.
 
-**Drop the authoring marker first.** The `pre-write`/`pre-edit` hooks block any write to `.codearbiter/decisions/NNNN-*.md` unless a fresh authoring marker is present — that block is the mechanism enforcing "ADRs only via `/adr`" (ORCHESTRATOR §3), so the sanctioned path must arm it itself. Immediately before writing, create the marker at the path the hooks check (project root = git top level):
+**Drop the authoring marker first.** The `pre-write`/`pre-edit` hooks block any write to `.codearbiter/decisions/NNNN-*.md` unless a fresh authoring marker is present — that block is the mechanism enforcing "ADRs only via `/adr`" (arbiter.md §3), so the sanctioned path must arm it itself. Immediately before writing, create the marker at the path the hooks check (project root = git top level):
 
 ```bash
 mkdir -p "$(git rev-parse --show-toplevel)/.codearbiter/.markers"
@@ -57,9 +57,59 @@ rm -f "$(git rev-parse --show-toplevel)/.codearbiter/.markers/adr-authoring-acti
 
 Gate: the ADR file is written with a real `decided-by` user attribution, numbered without a gap, and its log entry is appended. An ADR with no user attribution, or authored as the disposition of a finding, does not pass — STOP.
 
+### Accepted/Planned binding
+
+`accepted` means **Accepted/Planned**. It records the user's governance decision; it does not claim
+that any obligation is Implemented or Verified. When the user explicitly authorizes acceptance:
+
+1. Change only the ADR's status fields to accepted. Derive stable, stem-scoped obligations from every
+   normative clause in its immutable record, bind each obligation to exact ADR
+   text, and obtain independent review that the sealed obligation set is complete.
+2. Route through `commit-gate` to commit the accepted ADR and decision-log append. Do not add the
+   acceptance binding to that commit: its `source_commit` cannot truthfully name a commit that does
+   not exist yet.
+3. From that exact commit, hash the committed Git blob bytes and the separately canonicalized
+   immutable record: strict UTF-8 with LF-normalized line endings, containing the complete ADR while
+   replacing only the recognized status value in the strictly parsed frontmatter `status:` field and
+   `## Status` section with fixed sentinels. The two values must agree. All remaining Status prose,
+   including approval attribution, stays bound alongside title, date, `decided-by`, supersession,
+   governed paths, H1, and every other section. Malformed or duplicate frontmatter, status, or
+   headings fail closed. Append one
+   `acceptance` event to
+   `<project-root>/.codearbiter/decisions/adr-lifecycle.jsonl`, then persist that acceptance binding
+   in a subsequent commit. The event uses schema `adr-lifecycle/v1` and records `adr` (full stem),
+   `recorded_at`, `source_commit`, `blob_sha256`, `body_sha256`, `obligations`,
+   `obligations_sha256`, and `obligations_sealed: true`. A second acceptance or baseline binding for
+   the same stem is invalid.
+
+The lifecycle ledger is append-only. A legacy accepted ADR receives a `baseline` with no fabricated
+acceptance commit, an `observed_commit` whose Git blob is rechecked as the migration snapshot, an
+empty or incrementally mapped obligation list, and
+`obligations_sealed: false`; it remains Accepted/Planned. Later delivery evidence appends records:
+`implemented` binds one declared obligation to a source commit and relevant input digests;
+`verified` additionally binds a unique event ID, explicit proof contract, repository-scoped claim,
+producer, command/workflow identity, timezone-aware observation and expiry times, and the same current
+inputs. Evidence paths and digests are recomputed from the named Git commit, never trusted from the
+caller. A later uniquely identified event may renew expired or changed-input evidence; an append-only
+invalidation event may withdraw a prior evidence event. Only a complete,
+sealed obligation set with current implementation inputs and fresh verification inputs derives
+Implemented or Verified. Changed inputs invalidate the derived state; history is never rewritten.
+
+After acceptance, do not edit any bound ADR content. A later user-authorized stored status transition
+may change only the recognized status value in the strictly parsed frontmatter `status:` and
+`## Status`; approval prose remains immutable. Supersession remains a forward reference in the new
+ADR. The acceptance commit retains the exact original blob while the immutable-record digest proves
+every other byte-equivalent field did not change.
+
 ## Phase 3 — Status (/adr-status) · gate: BLOCK
 
-Read-only. For each ADR (or the `--adr N` target), report: stem, title, status, date, and supersession state — found by scanning forward for any later ADR whose `supersedes:` **resolves to** it.
+Read-only. For each ADR (or the `--adr N` target), report: stem, title, stored governance status,
+derived delivery state, date, and supersession state. Read `adr-lifecycle.jsonl` when present. Display
+stored `accepted` as **Accepted/Planned**. Display Implemented or Verified only when every obligation
+in a sealed binding has the required current, input-bound evidence; otherwise name the narrow reason
+(unsealed, incomplete, stale, expired, or mismatched) and do not promote the ADR. Repository evidence
+never implies live-host, publication, support, legal, or other external truth. Find supersession by
+scanning forward for any later ADR whose `supersedes:` **resolves to** it.
 
 Resolve a `supersedes:` value like this, and never guess:
 
@@ -75,7 +125,7 @@ If a supersession candidate contradicts an `accepted` ADR with no clear directio
 ## ADR Status — YYYY-MM-DD
 
 ### Active
-- ADR-NNNN-<slug> — <title> — <status> (<date>)
+- ADR-NNNN-<slug> — <title> — governance: <status>; delivery: <Accepted/Planned | Implemented | Verified> (<date>)
 
 ### Superseded
 - ADR-NNNN-<slug> — <title> — superseded by ADR-MMMM-<slug>
@@ -97,6 +147,8 @@ Gate: every indexed ADR appears with its current status and supersession state;
 - MUST NOT record a decision the user did not explicitly make. "Use your best judgment," "I trust you" are declined.
 - MUST NOT resolve a `[CONFIRM-NN]` placeholder by guessing. Surface it and stop.
 - MUST NOT advance an ADR's status without explicit user instruction.
+- MUST NOT report accepted as Implemented or Verified without complete, sealed, current lifecycle evidence.
+- MUST NOT rewrite or truncate a committed `adr-lifecycle.jsonl`, create a second binding, or fabricate legacy acceptance evidence.
 - MUST NOT edit a prior ADR or a prior decision-log entry to add a back-reference — supersession is a forward-only chain; append a new record whose `supersedes:` names the prior one.
 - **The never-edit rule protects decision CONTENT, not identifiers.** Rewriting what was decided corrupts the record; disambiguating *which document a pointer names* repairs it. Maintainer ruling, 2026-07-25: *"the never edit rule is meant to prevent this situation, not prevent this situation from being fixed."* So a correction that is provably identifier-only — a `supersedes:` value changed from a number to the stem it already meant — is permissible, and nothing else about the file is. Any such correction MUST be a single-line diff that alters not one word of any decision, MUST be visible in its own commit, and still requires the maintainer-armed `adr-authoring-active` marker. MUST NOT touch Context, Decision, Alternatives, Consequences, Risks, `status:`, `date:`, `decided-by:`, or `title:` under this allowance.
 - MUST NOT number an ADR with a gap, and MUST NOT reuse a number an existing stem already holds — a shared number makes every bare reference to it ambiguous.

package/plugins/ca-pi/routines/decision-lifecycle/references/adr-template.md

@@ -55,8 +55,16 @@ governs: <optional, comma-separated path globs this decision constrains — e.g.
   mirrors it for human readers. Keep the two in agreement.
 - **Status lifecycle:** `proposed → accepted → superseded | rejected`. `decompose` authors Layer 4
   ADRs as **`status: draft`** during the interview and promotes each to `status: accepted` at its
-  Phase 5 (a frontmatter `status:` edit only — never a body rewrite). Status transitions otherwise
+  Phase 5 in one sanctioned status edit that changes both the frontmatter `status:` field and the `## Status` value,
+  without changing any other body content. Status transitions otherwise
   require explicit user instruction; never advance status on the skill's own judgment.
+- **`accepted` means Accepted/Planned.** It records an approved governance decision and does not imply
+  implementation. Implemented and Verified are derived delivery states from the separate append-only
+  `adr-lifecycle.jsonl`; they are never written into ADR frontmatter. After acceptance, the decision
+  record is immutable except for the recognized, agreeing status value in the strictly parsed
+  frontmatter `status:` field and `## Status` section. Approval attribution and all other Status prose
+  remain bound with title, date, `decided-by`, supersession, governed paths, H1, and every other
+  section. A later explicit status transition changes only those recognized status values.
 - **`decided-by:`** names the user who made the decision — real attribution, never inferred.
 - **`supersedes:`** names the prior ADR's full filename stem — `supersedes:
   0014-githook-shim-dropin-fail-closed`, not `supersedes: 0014` — or `none`. A bare number is

package/plugins/ca-pi/routines/decompose/SKILL.md

@@ -12,7 +12,7 @@ Spec the project before a line of code exists. Routed to at greenfield startup,
 Run these ordered checks. Each passes silently or hard-stops with a routing action — never guess:
 
 1. Read `<project-root>/.codearbiter/CONTEXT.md`. If it already carries the `<!--INITIALIZED-->` body marker on its own line, STOP — context exists. Route to normal operation.
-2. Scan for meaningful source code: any file outside `.git/`, `.codearbiter/`, `.claude/`, `ORCHESTRATOR.md`, `AGENTS.md`, `CLAUDE.md`, `README.md`, `LICENSE`, `.gitignore`, `.gitmodules`, and standard tooling dotfiles. If any exist, STOP and route to `/create-context`.
+2. Scan for meaningful source code: any file outside `.git/`, `.codearbiter/`, `.claude/`, `arbiter.md`, `AGENTS.md`, `CLAUDE.md`, `README.md`, `LICENSE`, `.gitignore`, `.gitmodules`, and standard tooling dotfiles. If any exist, STOP and route to `/create-context`.
 3. Confirm `<project-root>/.codearbiter/` exists and is writable. If not, surface the gap and STOP.
 
 All three pass → proceed to Phase 1. Later phases consume this pass-status; they do not re-run it.