@arbiterforge/ca-pi 0.6.3 → 0.8.1

package/plugins/ca-pi/hooks/_prunelib.py

@@ -30,10 +30,16 @@ import sys
 import time
 
 import _hooklib
+import _modelib
 import _prunepolicy as _policy
 
 BOM = b"\xef\xbb\xbf"
 MARKER_PREFIX = _policy.MARKER_PREFIX
+# R-5 (#437, mode-plane-deterministic-flip): the sentinel embedded in every
+# composed persona injection. A line whose serialized content carries it is
+# the injected persona -- built here into SemanticEntry(pinned=True) (T-50)
+# so `_prunepolicy` (AC-26) refuses to fold/condense/evict it at any tier.
+PERSONA_SENTINEL = _modelib.PERSONA_SENTINEL
 
 
 def _dumps(o):
@@ -127,7 +133,7 @@ def _tool_result_ids(o):
 
 class Index:
     __slots__ = ("protected_from", "last_assistant_idx", "tu_ids", "tr_ids",
-                 "edited_paths", "edited_at", "tool_meta")
+                 "edited_paths", "edited_at", "tool_meta", "pinned_ordinals")
 
 
 def build_index(lines, cfg):
@@ -171,14 +177,35 @@ def build_index(lines, cfg):
     semantic = []
     for ln in lines:
         o = ln.obj if isinstance(ln.obj, dict) else {}
+        # T-50: a line whose serialized content carries the injected-persona
+        # sentinel is pinned -- AC-26 requires it survive every strategy at
+        # every tier, not just the recent-turn protected tail (the persona is
+        # typically injected once, early in the transcript, and stays live
+        # for the rest of the session -- well outside `protected_from` by the
+        # time pruning runs). Same _dumps(o)-based check _has_marker already
+        # uses for the elision marker, so re-serialization quirks can't make
+        # the two disagree about the same line.
+        dumped = _dumps(o) if o else ""
         semantic.append(_policy.SemanticEntry(
             id=str(ln.idx), ordinal=ln.idx, role=str(o.get("type", "other")),
             kind=("tool-result" if _tool_result_ids(o) else "message"),
             byte_size=len(ln.raw), tool_bearing=bool(_tool_use_ids(o)),
-            marked=_has_marker(_dumps(o)) if o else False,
+            marked=_has_marker(dumped) if o else False,
+            # A TOOL RESULT that merely quotes the sentinel is not an injected
+            # persona. The literal lives in this repo's own sources
+            # (`_modelib.py`, `prompt-submit.py`, `extension.ts`, their tests),
+            # so a Read of any of them, or a Grep for the sentinel itself,
+            # produced a result that pinned permanently at every tier — the
+            # transcript kept growing while the pruner reported it protected.
+            # Agents here read and grep those files routinely, so this was
+            # reachable rather than theoretical. AC-26 needs the INJECTION
+            # pinned, not every copy of the string; the injection arrives as a
+            # message, never as a tool result.
+            pinned=(PERSONA_SENTINEL in dumped and not _tool_result_ids(o)) if o else False,
         ))
     prot = _policy.protected_ordinal(semantic, cfg.keep_recent)
     idx.protected_from = prot
+    idx.pinned_ordinals = frozenset(e.ordinal for e in semantic if e.pinned)
     idx.last_assistant_idx = last_assistant
     idx.tu_ids = tu
     idx.tr_ids = tr
@@ -196,6 +223,17 @@ def _is_small_scalar(v, limit=200):
     return False
 
 
+def _protected(ln, index):
+    """True iff `ln` must not be touched by ANY strategy at ANY tier: either
+    it sits in the recent-turn protected tail, or it is PINNED (T-50/AC-26 --
+    the injected persona, which is typically well before `protected_from` by
+    the time pruning runs). Every strategy's skip-guard below routes through
+    this single predicate so the two protection reasons can never drift
+    apart -- a strategy that checked `ln.idx >= index.protected_from` alone
+    would silently reach a pinned line sitting earlier in the transcript."""
+    return ln.idx >= index.protected_from or ln.idx in index.pinned_ordinals
+
+
 # --------------------------------------------------------------------------- #
 # Strategies (Phase 1). Each mutates obj, sets dirty, records a report row.
 # All obey the net-negative guard: a strategy is a no-op on any unit whose
@@ -216,7 +254,7 @@ def s_sidecar_collapse(lines, index, cfg, report):
     small scalar fields worth keeping (status, exit codes, agentId, paths)."""
     touched = before = after = 0
     for ln in lines:
-        if ln.idx >= index.protected_from or not isinstance(ln.obj, dict):
+        if _protected(ln, index) or not isinstance(ln.obj, dict):
             continue
         tur = ln.obj.get("toolUseResult")
         if not isinstance(tur, (dict, list, str)):
@@ -260,7 +298,7 @@ def s_oversize_result_clamp(lines, index, cfg, report):
     touched = before = after = 0
     mb, ml = cfg.max_bytes, 100
     for ln in lines:
-        if ln.idx >= index.protected_from or not isinstance(ln.obj, dict):
+        if _protected(ln, index) or not isinstance(ln.obj, dict):
             continue
         msg = ln.obj.get("message")
         if not isinstance(msg, dict) or not isinstance(msg.get("content"), list):
@@ -341,7 +379,7 @@ def s_reasoning_fold(lines, index, cfg, report):
     most recent assistant turn is always inside the protected tail."""
     touched = before = 0
     for ln in lines:
-        if ln.idx >= index.protected_from or not isinstance(ln.obj, dict):
+        if _protected(ln, index) or not isinstance(ln.obj, dict):
             continue
         if ln.obj.get("type") != "assistant":
             continue
@@ -369,7 +407,7 @@ def s_aged_result_condense(lines, index, cfg, report):
     tail. Specific handlers (shell/superseded) run earlier and mark their own."""
     touched = before = after = 0
     for ln in lines:
-        if ln.idx >= index.protected_from or not isinstance(ln.obj, dict):
+        if _protected(ln, index) or not isinstance(ln.obj, dict):
             continue
         content = _content_list(ln.obj)
         if not content:
@@ -394,7 +432,7 @@ def s_mcp_payload_condense(lines, index, cfg, report):
     """Condense the bulky `input` of mcp__ tool_use blocks (older turns)."""
     touched = before = after = 0
     for ln in lines:
-        if ln.idx >= index.protected_from or not isinstance(ln.obj, dict):
+        if _protected(ln, index) or not isinstance(ln.obj, dict):
             continue
         content = _content_list(ln.obj)
         if not content:
@@ -435,7 +473,7 @@ def s_shell_tail_keep(lines, index, cfg, report):
     keep_lines = 30
     touched = before = after = 0
     for ln in lines:
-        if ln.idx >= index.protected_from or not isinstance(ln.obj, dict):
+        if _protected(ln, index) or not isinstance(ln.obj, dict):
             continue
         content = _content_list(ln.obj)
         if not content:
@@ -487,7 +525,7 @@ def s_superseded_read_condense(lines, index, cfg, report):
     transcript — that snapshot is stale; the later edit is the source of truth."""
     touched = before = after = 0
     for ln in lines:
-        if ln.idx >= index.protected_from or not isinstance(ln.obj, dict):
+        if _protected(ln, index) or not isinstance(ln.obj, dict):
             continue
         content = _content_list(ln.obj)
         if not content:
@@ -536,8 +574,9 @@ def s_repeat_reminder_fold(lines, index, cfg, report):
             if key not in seen:
                 seen.add(key)
                 continue
-            # A later duplicate: fold it (only past the protected tail).
-            if ln.idx >= index.protected_from:
+            # A later duplicate: fold it (only past the protected tail, and
+            # never a pinned line -- T-50/AC-26).
+            if _protected(ln, index):
                 continue
             marker = _marker(txt)
             if len(marker.encode("utf-8")) >= len(txt.encode("utf-8")):
@@ -576,7 +615,7 @@ def s_inline_image_evict(lines, index, cfg, report):
                     changed = True
         return changed
     for ln in lines:
-        if ln.idx >= index.protected_from or not isinstance(ln.obj, dict):
+        if _protected(ln, index) or not isinstance(ln.obj, dict):
             continue
         content = _content_list(ln.obj)
         if not content:

package/plugins/ca-pi/hooks/_prunepolicy.py

@@ -73,6 +73,16 @@ class SemanticEntry:
     byte_size: int
     tool_bearing: bool = False
     marked: bool = False
+    # R-5 / AC-26 (#437, mode-plane-deterministic-flip): True for the entry
+    # carrying an injected persona (`_modelib.PERSONA_SENTINEL` -- set by the
+    # codec that builds SemanticEntry values, e.g. `_prunelib.build_index`,
+    # T-50). A pinned entry is retained at EVERY tier including aggressive,
+    # regardless of where it sits relative to the recent-turn protected tail
+    # -- see plan_prune below. Distinct from `marked`: `marked` means "already
+    # condensed by a prior pass" (still eligible to be LEFT alone, but not
+    # load-bearing the way a pin is); `pinned` means "must never be folded,
+    # condensed, or evicted," full stop.
+    pinned: bool = False
 
 
 @dataclass(frozen=True)
@@ -198,19 +208,35 @@ def plan_prune(entries, policy):
     if [entry.ordinal for entry in entries] != list(range(len(entries))):
         raise ValueError("semantic entry ordinals must be contiguous and ordered")
     boundary = protected_ordinal(entries, policy.keep_recent)
-    protected = tuple(entry.id for entry in entries if entry.ordinal >= boundary)
+    # AC-26: a pinned entry (the injected persona) is protected regardless of
+    # ordinal -- it need not sit in the recent-turn tail at all (the persona
+    # is typically injected once, early, and stays pinned for the rest of the
+    # session). Protection holds at EVERY tier, including aggressive: pinning
+    # is checked before tier selection even runs, so no strategy set can ever
+    # reach a pinned entry.
+    protected = tuple(entry.id for entry in entries
+                      if entry.ordinal >= boundary or entry.pinned)
     selected = select_strategies(policy.tier, policy.strategies)
-    actions = tuple((entry.id, _action_for(entry, selected, policy))
-                    for entry in entries if entry.ordinal < boundary)
-    marked = sum(1 for entry in entries if entry.ordinal < boundary and entry.marked)
+    # `candidates` is named once and reused for the actions, the counts and the
+    # audit code, because those three drifted apart the moment pinning arrived:
+    # `marked` excluded pinned entries while `boundary` still counted them, so
+    # a single pinned entry below the boundary capped `marked` at `boundary-1`
+    # and made CA-PRUNE-IDEMPOTENT unreachable — a fully condensed transcript
+    # reporting CA-PRUNE-PLAN forever. That is the normal case, not an edge:
+    # the persona is injected once, early, which puts a pinned entry below the
+    # boundary in essentially every governed session.
+    candidates = tuple(entry for entry in entries
+                       if entry.ordinal < boundary and not entry.pinned)
+    actions = tuple((entry.id, _action_for(entry, selected, policy)) for entry in candidates)
+    marked = sum(1 for entry in candidates if entry.marked)
     metrics = {
         "entries_before": len(entries),
-        "candidate_entries": boundary,
+        "candidate_entries": len(candidates),
         "protected_entries": len(protected),
         "marked_candidates": marked,
     }
-    audit_codes = (("CA-PRUNE-NOOP",) if boundary == 0
-                   else ("CA-PRUNE-IDEMPOTENT",) if marked == boundary
+    audit_codes = (("CA-PRUNE-NOOP",) if not candidates
+                   else ("CA-PRUNE-IDEMPOTENT",) if marked == len(candidates)
                    else ("CA-PRUNE-PLAN",))
     fingerprint_source = {
         "boundary": boundary,

package/plugins/ca-pi/hooks/_readinjectlib.py

@@ -827,7 +827,7 @@ def governing_docs(rel, index, runner=None):
 # ---------------------------------------------------------------------------
 
 
-def marker_path(root, session_id, rel):
+def marker_path(root, session_id, rel, prefix="readinject-"):
     """Return the absolute path of the dedup marker for (session_id, rel).
 
     The marker lives under <root>/.codearbiter/.markers/ with a filename
@@ -835,9 +835,15 @@ def marker_path(root, session_id, rel):
     null-byte separator ensures ('ab', 'c') and ('a', 'bc') hash to different
     filenames.
 
+    `prefix` selects the marker namespace within the shared .markers/
+    directory. Defaults to 'readinject-' so every existing caller is
+    unaffected; a second consumer (e.g. mode-flip injection) can pass
+    prefix='modeinject-' to keep its markers distinct from the 790+
+    readinject- markers already on disk.
+
     PURE — no filesystem access of any kind.  Inputs are coerced to str so any
     type is accepted.  Never raises; on the (essentially impossible) error path,
-    returns a fallback path whose last segment is 'readinject-error.marker'
+    returns a fallback path whose last segment is '<prefix>error.marker'
     which will not match any normally-written marker.
     """
     try:
@@ -848,11 +854,11 @@ def marker_path(root, session_id, rel):
             str(root),
             ".codearbiter",
             ".markers",
-            "readinject-{}.marker".format(digest),
+            "{}{}.marker".format(prefix, digest),
         )
     except Exception:  # noqa: BLE001
         return os.path.join(
-            str(root), ".codearbiter", ".markers", "readinject-error.marker"
+            str(root), ".codearbiter", ".markers", "{}error.marker".format(prefix)
         )
 
 

package/plugins/ca-pi/hooks/doctor.py

@@ -26,7 +26,8 @@ import _githooks  # noqa: E402 — #556: git-hook drop-in registry freshness
 from _hooklib import frontmatter_enabled, get_host, set_host, utf8_stdio  # noqa: E402
 
 HOOK_SCRIPTS = ("session-start.py", "pre-bash.py", "pre-write.py",
-                "pre-edit.py", "post-write-edit.py", "prune-transcript.py")
+                "pre-edit.py", "post-write-edit.py", "prune-transcript.py",
+                "prompt-submit.py")
 PI_BRIDGE_SCRIPTS = ("pi-bridge.py", "git-enforce.py", "_githooks.py")
 
 # MCP config files are read whole to be counted. `~/.claude.json` also carries

package/plugins/ca-pi/hooks/pi-bridge.py

@@ -20,6 +20,7 @@ from _prunepolicy import PrunePolicy, SemanticEntry, plan_prune  # noqa: E402
 import _arbiterstatelib  # noqa: E402
 import _hooklib  # noqa: E402
 import _ledgerlib  # noqa: E402
+import _modelib  # noqa: E402
 import _planfilelib  # noqa: E402
 import _segmentslib  # noqa: E402
 import _taskboardlib  # noqa: E402
@@ -402,11 +403,16 @@ def _footer_status_snapshot(request):
             prune = _bounded_footer_text(_segmentslib.seg_prune({}, session_id), FOOTER_MAX_PRUNE)
         except Exception:  # noqa: BLE001 - prune is an independent optional segment
             prune = None
+    # #437: the mode plane replaced the `dev-active` presence check. The
+    # marker is NOT dual-written, so a reader still probing for it would
+    # report inactive forever the moment nothing writes it. `current_mode`
+    # resolves through marker_root, matching every other `.markers/` reader
+    # — a linked worktree must not read a different file (#604).
     try:
-        dev = _arbiterstatelib.dev_active(request["cwd"])
-    except Exception:  # noqa: BLE001 - dev is a fail-soft display fact
+        mode = _arbiterstatelib.current_mode(session_id, root=request["cwd"])
+    except Exception:  # noqa: BLE001 - mode is a fail-soft display fact
         return unavailable
-    if type(dev) is not bool:
+    if mode not in _modelib.MODES:
         return unavailable
     return {
         "version": 1,
@@ -419,7 +425,7 @@ def _footer_status_snapshot(request):
             "questions": counts[1],
             "overrides": counts[2],
             "sprint": sprint,
-            "dev": dev,
+            "mode": mode,
             "prune": prune,
         }},
     }