@arbiterforge/ca-pi 0.6.3 → 0.10.0

package/plugins/ca-pi/hooks/_protectedlib.py

@@ -89,9 +89,17 @@ AUDIT_LOG_FLAT_BASENAMES = ("overrides.log", "triage.log", "gate-events.log", "s
 # from the H-11 set below leaves the append blocked, because classify_protected
 # reports every class a path hits and pre-write checks them independently.
 DECISION_LOG_BASENAME = "decision-log.md"
+ADR_LIFECYCLE_LOG_BASENAME = "adr-lifecycle.jsonl"
+DECISION_AUDIT_LOG_BASENAMES = (DECISION_LOG_BASENAME, ADR_LIFECYCLE_LOG_BASENAME)
+DECISION_AUDIT_LOG_NAMES = "(?:" + "|".join(
+    re.escape(n) for n in DECISION_AUDIT_LOG_BASENAMES) + ")"
 DECISION_LOG_RE = re.compile(
     r"\.codearbiter[\\/]+decisions[\\/]+" + re.escape(DECISION_LOG_BASENAME) + r"$"
 )
+ADR_LIFECYCLE_LOG_RE = re.compile(
+    r"\.codearbiter[\\/]+decisions[\\/]+" + re.escape(ADR_LIFECYCLE_LOG_BASENAME) + r"$",
+    re.I,
+)
 # AUDIT_LOG_BASENAMES stays the SINGLE AUTHORITATIVE BASENAME LIST, and the
 # arbitration log is in it. _bashguardlib's H-05 shell check pre-filters with
 # `any(n in cmd for n in AUDIT_LOG_BASENAMES)` precisely so a newly added audit
@@ -99,7 +107,7 @@ DECISION_LOG_RE = re.compile(
 # alternation below would sail past that pre-filter and leave the log deletable
 # from the shell. (Caught by test_hook_guards.py, which the comment on that
 # pre-filter predicted verbatim.)
-AUDIT_LOG_BASENAMES = AUDIT_LOG_FLAT_BASENAMES + (DECISION_LOG_BASENAME,)
+AUDIT_LOG_BASENAMES = AUDIT_LOG_FLAT_BASENAMES + DECISION_AUDIT_LOG_BASENAMES
 AUDIT_LOG_NAMES = "(?:" + "|".join(re.escape(n) for n in AUDIT_LOG_BASENAMES) + ")"
 # The path anchor stays scoped to the FLAT logs — those sit directly under
 # .codearbiter/, the arbitration log one level deeper — so is_audit_log() tests
@@ -148,9 +156,10 @@ GATE_MARKER_NAMES = r"(?:security-gate-passed|migration-gate-passed)"
 def is_audit_log(rel):
     """True iff `rel` is one of the append-only .codearbiter audit logs
     (overrides.log, triage.log, sprint-log.md, gate-events.log) or the SMARTS
-    arbitration log decisions/decision-log.md (#528) — the H-05 guard set."""
+    decision ledgers under decisions/ — the H-05 guard set."""
     n = norm_path(rel)
-    return bool(AUDIT_LOG_RE.search(n) or DECISION_LOG_RE.search(n))
+    return bool(AUDIT_LOG_RE.search(n) or DECISION_LOG_RE.search(n)
+                or ADR_LIFECYCLE_LOG_RE.search(n))
 
 
 def is_tail_append(current, old, new):
@@ -190,7 +199,7 @@ def is_decisions_path(rel):
     cannot launder itself out of the marker gate. (`decision-log.md.bak` is in
     NEITHER set: it does not end in `.md`, so it was never an H-11 path either.)"""
     n = norm_path(rel)
-    if DECISION_LOG_RE.search(n):
+    if DECISION_LOG_RE.search(n) or ADR_LIFECYCLE_LOG_RE.search(n):
         return False
     return bool(DECISIONS_PATH_RE.search(n))
 

package/plugins/ca-pi/hooks/_prunelib.py

@@ -30,10 +30,16 @@ import sys
 import time
 
 import _hooklib
+import _modelib
 import _prunepolicy as _policy
 
 BOM = b"\xef\xbb\xbf"
 MARKER_PREFIX = _policy.MARKER_PREFIX
+# R-5 (#437, mode-plane-deterministic-flip): the sentinel embedded in every
+# composed persona injection. A line whose serialized content carries it is
+# the injected persona -- built here into SemanticEntry(pinned=True) (T-50)
+# so `_prunepolicy` (AC-26) refuses to fold/condense/evict it at any tier.
+PERSONA_SENTINEL = _modelib.PERSONA_SENTINEL
 
 
 def _dumps(o):
@@ -127,7 +133,7 @@ def _tool_result_ids(o):
 
 class Index:
     __slots__ = ("protected_from", "last_assistant_idx", "tu_ids", "tr_ids",
-                 "edited_paths", "edited_at", "tool_meta")
+                 "edited_paths", "edited_at", "tool_meta", "pinned_ordinals")
 
 
 def build_index(lines, cfg):
@@ -171,14 +177,35 @@ def build_index(lines, cfg):
     semantic = []
     for ln in lines:
         o = ln.obj if isinstance(ln.obj, dict) else {}
+        # T-50: a line whose serialized content carries the injected-persona
+        # sentinel is pinned -- AC-26 requires it survive every strategy at
+        # every tier, not just the recent-turn protected tail (the persona is
+        # typically injected once, early in the transcript, and stays live
+        # for the rest of the session -- well outside `protected_from` by the
+        # time pruning runs). Same _dumps(o)-based check _has_marker already
+        # uses for the elision marker, so re-serialization quirks can't make
+        # the two disagree about the same line.
+        dumped = _dumps(o) if o else ""
         semantic.append(_policy.SemanticEntry(
             id=str(ln.idx), ordinal=ln.idx, role=str(o.get("type", "other")),
             kind=("tool-result" if _tool_result_ids(o) else "message"),
             byte_size=len(ln.raw), tool_bearing=bool(_tool_use_ids(o)),
-            marked=_has_marker(_dumps(o)) if o else False,
+            marked=_has_marker(dumped) if o else False,
+            # A TOOL RESULT that merely quotes the sentinel is not an injected
+            # persona. The literal lives in this repo's own sources
+            # (`_modelib.py`, `prompt-submit.py`, `extension.ts`, their tests),
+            # so a Read of any of them, or a Grep for the sentinel itself,
+            # produced a result that pinned permanently at every tier — the
+            # transcript kept growing while the pruner reported it protected.
+            # Agents here read and grep those files routinely, so this was
+            # reachable rather than theoretical. AC-26 needs the INJECTION
+            # pinned, not every copy of the string; the injection arrives as a
+            # message, never as a tool result.
+            pinned=(PERSONA_SENTINEL in dumped and not _tool_result_ids(o)) if o else False,
         ))
     prot = _policy.protected_ordinal(semantic, cfg.keep_recent)
     idx.protected_from = prot
+    idx.pinned_ordinals = frozenset(e.ordinal for e in semantic if e.pinned)
     idx.last_assistant_idx = last_assistant
     idx.tu_ids = tu
     idx.tr_ids = tr
@@ -196,6 +223,17 @@ def _is_small_scalar(v, limit=200):
     return False
 
 
+def _protected(ln, index):
+    """True iff `ln` must not be touched by ANY strategy at ANY tier: either
+    it sits in the recent-turn protected tail, or it is PINNED (T-50/AC-26 --
+    the injected persona, which is typically well before `protected_from` by
+    the time pruning runs). Every strategy's skip-guard below routes through
+    this single predicate so the two protection reasons can never drift
+    apart -- a strategy that checked `ln.idx >= index.protected_from` alone
+    would silently reach a pinned line sitting earlier in the transcript."""
+    return ln.idx >= index.protected_from or ln.idx in index.pinned_ordinals
+
+
 # --------------------------------------------------------------------------- #
 # Strategies (Phase 1). Each mutates obj, sets dirty, records a report row.
 # All obey the net-negative guard: a strategy is a no-op on any unit whose
@@ -216,7 +254,7 @@ def s_sidecar_collapse(lines, index, cfg, report):
     small scalar fields worth keeping (status, exit codes, agentId, paths)."""
     touched = before = after = 0
     for ln in lines:
-        if ln.idx >= index.protected_from or not isinstance(ln.obj, dict):
+        if _protected(ln, index) or not isinstance(ln.obj, dict):
             continue
         tur = ln.obj.get("toolUseResult")
         if not isinstance(tur, (dict, list, str)):
@@ -260,7 +298,7 @@ def s_oversize_result_clamp(lines, index, cfg, report):
     touched = before = after = 0
     mb, ml = cfg.max_bytes, 100
     for ln in lines:
-        if ln.idx >= index.protected_from or not isinstance(ln.obj, dict):
+        if _protected(ln, index) or not isinstance(ln.obj, dict):
             continue
         msg = ln.obj.get("message")
         if not isinstance(msg, dict) or not isinstance(msg.get("content"), list):
@@ -341,7 +379,7 @@ def s_reasoning_fold(lines, index, cfg, report):
     most recent assistant turn is always inside the protected tail."""
     touched = before = 0
     for ln in lines:
-        if ln.idx >= index.protected_from or not isinstance(ln.obj, dict):
+        if _protected(ln, index) or not isinstance(ln.obj, dict):
             continue
         if ln.obj.get("type") != "assistant":
             continue
@@ -369,7 +407,7 @@ def s_aged_result_condense(lines, index, cfg, report):
     tail. Specific handlers (shell/superseded) run earlier and mark their own."""
     touched = before = after = 0
     for ln in lines:
-        if ln.idx >= index.protected_from or not isinstance(ln.obj, dict):
+        if _protected(ln, index) or not isinstance(ln.obj, dict):
             continue
         content = _content_list(ln.obj)
         if not content:
@@ -394,7 +432,7 @@ def s_mcp_payload_condense(lines, index, cfg, report):
     """Condense the bulky `input` of mcp__ tool_use blocks (older turns)."""
     touched = before = after = 0
     for ln in lines:
-        if ln.idx >= index.protected_from or not isinstance(ln.obj, dict):
+        if _protected(ln, index) or not isinstance(ln.obj, dict):
             continue
         content = _content_list(ln.obj)
         if not content:
@@ -435,7 +473,7 @@ def s_shell_tail_keep(lines, index, cfg, report):
     keep_lines = 30
     touched = before = after = 0
     for ln in lines:
-        if ln.idx >= index.protected_from or not isinstance(ln.obj, dict):
+        if _protected(ln, index) or not isinstance(ln.obj, dict):
             continue
         content = _content_list(ln.obj)
         if not content:
@@ -487,7 +525,7 @@ def s_superseded_read_condense(lines, index, cfg, report):
     transcript — that snapshot is stale; the later edit is the source of truth."""
     touched = before = after = 0
     for ln in lines:
-        if ln.idx >= index.protected_from or not isinstance(ln.obj, dict):
+        if _protected(ln, index) or not isinstance(ln.obj, dict):
             continue
         content = _content_list(ln.obj)
         if not content:
@@ -536,8 +574,9 @@ def s_repeat_reminder_fold(lines, index, cfg, report):
             if key not in seen:
                 seen.add(key)
                 continue
-            # A later duplicate: fold it (only past the protected tail).
-            if ln.idx >= index.protected_from:
+            # A later duplicate: fold it (only past the protected tail, and
+            # never a pinned line -- T-50/AC-26).
+            if _protected(ln, index):
                 continue
             marker = _marker(txt)
             if len(marker.encode("utf-8")) >= len(txt.encode("utf-8")):
@@ -576,7 +615,7 @@ def s_inline_image_evict(lines, index, cfg, report):
                     changed = True
         return changed
     for ln in lines:
-        if ln.idx >= index.protected_from or not isinstance(ln.obj, dict):
+        if _protected(ln, index) or not isinstance(ln.obj, dict):
             continue
         content = _content_list(ln.obj)
         if not content:

package/plugins/ca-pi/hooks/_prunepolicy.py

@@ -73,6 +73,16 @@ class SemanticEntry:
     byte_size: int
     tool_bearing: bool = False
     marked: bool = False
+    # R-5 / AC-26 (#437, mode-plane-deterministic-flip): True for the entry
+    # carrying an injected persona (`_modelib.PERSONA_SENTINEL` -- set by the
+    # codec that builds SemanticEntry values, e.g. `_prunelib.build_index`,
+    # T-50). A pinned entry is retained at EVERY tier including aggressive,
+    # regardless of where it sits relative to the recent-turn protected tail
+    # -- see plan_prune below. Distinct from `marked`: `marked` means "already
+    # condensed by a prior pass" (still eligible to be LEFT alone, but not
+    # load-bearing the way a pin is); `pinned` means "must never be folded,
+    # condensed, or evicted," full stop.
+    pinned: bool = False
 
 
 @dataclass(frozen=True)
@@ -198,19 +208,35 @@ def plan_prune(entries, policy):
     if [entry.ordinal for entry in entries] != list(range(len(entries))):
         raise ValueError("semantic entry ordinals must be contiguous and ordered")
     boundary = protected_ordinal(entries, policy.keep_recent)
-    protected = tuple(entry.id for entry in entries if entry.ordinal >= boundary)
+    # AC-26: a pinned entry (the injected persona) is protected regardless of
+    # ordinal -- it need not sit in the recent-turn tail at all (the persona
+    # is typically injected once, early, and stays pinned for the rest of the
+    # session). Protection holds at EVERY tier, including aggressive: pinning
+    # is checked before tier selection even runs, so no strategy set can ever
+    # reach a pinned entry.
+    protected = tuple(entry.id for entry in entries
+                      if entry.ordinal >= boundary or entry.pinned)
     selected = select_strategies(policy.tier, policy.strategies)
-    actions = tuple((entry.id, _action_for(entry, selected, policy))
-                    for entry in entries if entry.ordinal < boundary)
-    marked = sum(1 for entry in entries if entry.ordinal < boundary and entry.marked)
+    # `candidates` is named once and reused for the actions, the counts and the
+    # audit code, because those three drifted apart the moment pinning arrived:
+    # `marked` excluded pinned entries while `boundary` still counted them, so
+    # a single pinned entry below the boundary capped `marked` at `boundary-1`
+    # and made CA-PRUNE-IDEMPOTENT unreachable — a fully condensed transcript
+    # reporting CA-PRUNE-PLAN forever. That is the normal case, not an edge:
+    # the persona is injected once, early, which puts a pinned entry below the
+    # boundary in essentially every governed session.
+    candidates = tuple(entry for entry in entries
+                       if entry.ordinal < boundary and not entry.pinned)
+    actions = tuple((entry.id, _action_for(entry, selected, policy)) for entry in candidates)
+    marked = sum(1 for entry in candidates if entry.marked)
     metrics = {
         "entries_before": len(entries),
-        "candidate_entries": boundary,
+        "candidate_entries": len(candidates),
         "protected_entries": len(protected),
         "marked_candidates": marked,
     }
-    audit_codes = (("CA-PRUNE-NOOP",) if boundary == 0
-                   else ("CA-PRUNE-IDEMPOTENT",) if marked == boundary
+    audit_codes = (("CA-PRUNE-NOOP",) if not candidates
+                   else ("CA-PRUNE-IDEMPOTENT",) if marked == len(candidates)
                    else ("CA-PRUNE-PLAN",))
     fingerprint_source = {
         "boundary": boundary,

package/plugins/ca-pi/hooks/_readinjectlib.py

@@ -827,7 +827,7 @@ def governing_docs(rel, index, runner=None):
 # ---------------------------------------------------------------------------
 
 
-def marker_path(root, session_id, rel):
+def marker_path(root, session_id, rel, prefix="readinject-"):
     """Return the absolute path of the dedup marker for (session_id, rel).
 
     The marker lives under <root>/.codearbiter/.markers/ with a filename
@@ -835,9 +835,15 @@ def marker_path(root, session_id, rel):
     null-byte separator ensures ('ab', 'c') and ('a', 'bc') hash to different
     filenames.
 
+    `prefix` selects the marker namespace within the shared .markers/
+    directory. Defaults to 'readinject-' so every existing caller is
+    unaffected; a second consumer (e.g. mode-flip injection) can pass
+    prefix='modeinject-' to keep its markers distinct from the 790+
+    readinject- markers already on disk.
+
     PURE — no filesystem access of any kind.  Inputs are coerced to str so any
     type is accepted.  Never raises; on the (essentially impossible) error path,
-    returns a fallback path whose last segment is 'readinject-error.marker'
+    returns a fallback path whose last segment is '<prefix>error.marker'
     which will not match any normally-written marker.
     """
     try:
@@ -848,11 +854,11 @@ def marker_path(root, session_id, rel):
             str(root),
             ".codearbiter",
             ".markers",
-            "readinject-{}.marker".format(digest),
+            "{}{}.marker".format(prefix, digest),
         )
     except Exception:  # noqa: BLE001
         return os.path.join(
-            str(root), ".codearbiter", ".markers", "readinject-error.marker"
+            str(root), ".codearbiter", ".markers", "{}error.marker".format(prefix)
         )