@arbiterforge/ca-pi 0.6.3 → 0.8.1

package/plugins/ca-pi/hooks/statusline.py

@@ -48,7 +48,7 @@
 #   _segmentslib     the individual content segments (ctx bar, rate cells, pill, …)
 #   _ledgerlib       token/cost ledger (extracted earlier, T-12)
 # `seg_update` / `plugin_root_for_render` (the update-notifier surface) and
-# `dev_active`'s render-time callers stay wired here because a test patches
+# `current_mode`'s render-time callers stay wired here because a test patches
 # `statusline.plugin_root_for_render` directly — that seam must resolve through
 # this module's own globals, not a lib's.
 #
@@ -251,7 +251,7 @@ try:
     frontmatter, count_matches = _arbiterstatelib.frontmatter, _arbiterstatelib.count_matches
     _ARBITER_CACHE, _ARBITER_FILES = _arbiterstatelib._ARBITER_CACHE, _arbiterstatelib._ARBITER_FILES
     _arbiter_mtime_key = _arbiterstatelib._arbiter_mtime_key
-    dev_active = _arbiterstatelib.dev_active
+    current_mode = _arbiterstatelib.current_mode
 
     def _arbiter_enabled(ctx_path):
         return _arbiterstatelib._arbiter_enabled(ctx_path, _frontmatter_enabled)
@@ -285,8 +285,8 @@ except Exception:  # pragma: no cover — never let an import break the statusli
     def arbiter_state(root, ctx_text=None, ot_text=None, oq_text=None):
         return None
 
-    def dev_active(root):
-        return False
+    def current_mode(session_id, root=None, payload=None):
+        return "arbiter"
 
 # --------------------------------------------------------------------------- subagents (_subagentslib)
 try:
@@ -549,12 +549,27 @@ def _render_active_palette(raw):
     root = safe(project_root, data) or os.getcwd()
     sid = data.get("session_id") or data.get("sessionId")
     arb = safe(arbiter_state, root)
+    # #437 (mode-plane-deterministic-flip): resolved ONCE per render and reused
+    # by both the badge below and the redshift gate near the bottom of this
+    # function, rather than re-reading the mode marker twice. Resolves via
+    # `payload=data` (NOT the pre-resolved `root` above) so the mode file is
+    # read at marker_root, agreeing with every other `.markers/` writer in a
+    # linked worktree (AC-5) — `root` here is _gitlib's plain ancestor walk,
+    # a different resolution that must not leak into mode reads.
+    mode = safe(current_mode, sid, payload=data) or "arbiter"
     effort = (get(data, "effort", "level") or "").lower()
     sprint = bool(arb and arb.get("sprint"))
-    # /dev takes precedence over sprint: a textual [DEV] tell rides alongside the
-    # full-bar redshift so dev mode reads even where color is stripped or unseen.
-    if safe(dev_active, root):
-        badge = f"{BOLD}[DEV]{RESET}"
+    # A non-arbiter MODE takes precedence over sprint, mirroring the retired
+    # /dev-over-sprint precedence exactly. Each mode gets its own distinct
+    # textual tell (AC-38) — dangerous keeps the alarming [DEV]-style bracket
+    # tag (renamed) so the full-bar redshift below still reads even where
+    # color is stripped or unseen; ops is advisory-only (no redshift) but
+    # still needs its own unmistakable badge, distinct from both arbiter and
+    # dangerous.
+    if mode == "dangerous":
+        badge = f"{BOLD}[DANGEROUS]{RESET}"
+    elif mode == "ops":
+        badge = f"{BOLD}[OPS]{RESET}"
     elif sprint:
         badge = f"{V3}{BOLD}[SPRINT]{RESET}"   # effort now shows by the model pill
     else:
@@ -680,7 +695,10 @@ def _render_active_palette(raw):
 
     box.bottom(tees=tail_tees)
     out = box.render()
-    out = redshift(out) if safe(dev_active, root) else out
+    # AC-38: only `dangerous` (gates-off) keeps the alarm-red full-bar tell —
+    # `ops` is advisory-only and must render distinctly from both `arbiter`
+    # (no shift) and `dangerous` (redshift), not share dangerous's treatment.
+    out = redshift(out) if mode == "dangerous" else out
     # Honor the NO_COLOR convention by stripping SGR from the final render. Do NOT gate on
     # isatty: a Claude Code statusline is intentionally piped, so an isatty test would drop
     # color in normal use. Width math already ignores ANSI, so stripping keeps alignment.

package/plugins/ca-pi/includes/anti-slop-design/INDEX.md

@@ -6,7 +6,7 @@ Never bulk-read the whole bundle: a website task pulls the web leaf and never se
 
 **Scope of authority:** generated, user-facing artifacts only (UI, PR descriptions, CHANGELOG,
 and any report/slide/chart a producer is told to render). This bundle does NOT govern codeArbiter's
-own internal framework docs (`ORCHESTRATOR.md`, the `INDEX.md` files, skill/agent bodies), whose
+own internal framework docs (`arbiter.md`, the `INDEX.md` files, skill/agent bodies), whose
 house style is set elsewhere.
 
 ## How to use the bundle

package/plugins/ca-pi/includes/dangerous-mode.md

@@ -0,0 +1,57 @@
+<!-- codeArbiter — the `dangerous` mode body. Composed as `safety-core.md` + this file
+whenever the mode plane is flipped to `dangerous` (token: `mode --dangerous`). This is a
+general gates-off posture for whatever project the repo holds — it is not scoped to
+codeArbiter's own maintenance and carries no host-specific env-gate. -->
+
+# dangerous — gates-off posture
+
+`dangerous` suspends orchestration for local, exploratory work on this repo — any repo, not a
+codeArbiter-specific lane. Reach for it when routing, skills, and gate ceremony are in the way of
+something reversible and low-stakes: poking at a script, running the app, trying an approach
+before committing to a plan. It is **not** the required lane for ordinary development — normal
+feature work still flows through the ordinary gated commands and ships via PR.
+
+**Gates-off is persona-off, not enforcement-off.** The enforcement hooks under `core/pysrc/` read
+`.codearbiter/CONTEXT.md`'s frontmatter and the repo's own state — never this persona — so nothing
+about being in `dangerous` mode changes what a hook decides. The following still fire, identically
+to every other mode:
+
+- **H-01** — no direct write to the default branch, with the `.git/hooks` backstop that closes the
+  `--no-verify` escape.
+- **H-02** — no force-push, same backstop, same `--no-verify` closure.
+- **H-05** — the `.codearbiter` audit logs are still append-only.
+- **H-09b / H-10b** — the commit-time secret scan still runs.
+- **H-11** — ADR files are still immutable outside `/adr`.
+- **H-18** — `.codearbiter/CONTEXT.md`'s activation frontmatter is still protected.
+- **H-19** — the `.codearbiter/.markers/` gate tokens are still protected.
+- **H-22** — marker-gated and otherwise protected project state is still protected.
+
+What the persona stops carrying is prose-only and none of it is floored by a hook: no routing, no
+skills, no redirect, no command catalog — a plain, direct coding assistant, with the safety-core
+invariants (secrets, irreversible-action confirmation, diagnose-don't-bypass, no silent
+reconciliation) still the floor beneath it.
+
+**Blocking questions still surface.** A `[CONFIRM-NN]` is a question whose answer is the user's, and
+that does not change with posture — if anything it matters more here, since nothing else is asking.
+Startup still reports host, stage, the active mode, any open `[CONFIRM-NN]`, and the override count;
+what it drops is the command-facing presentation (the await-a-command trailer, the catalog and
+standup references) that a mode with no commands cannot act on.
+
+**The project's own state lives in `.codearbiter/`**, and nothing in this mode reads it for you:
+
+- `CONTEXT.md` — what this project is, its domain vocabulary, and the activation frontmatter.
+- `tech-stack.md` — languages, frameworks, and the commands that build, test, and lint this repo.
+- `coding-standards.md` — the conventions code here is expected to match.
+- `security-controls.md` — the boundaries, banned primitives, and secret-handling rules.
+- `open-questions.md` — the unresolved `[CONFIRM-NN]` set.
+
+Read whichever the work actually touches. These are facts about the repo, not a dispatch table:
+there is no routing in this mode, and naming a doc here is not naming a command.
+
+**Entry and exit are logged**, the same audit-trail obligation as every other bypass: a `MODE:
+dangerous enter` row on entry, a `MODE: dangerous exit` row on exit, appended (never rewritten) to
+`.codearbiter/overrides.log`. The mode is session-scoped: `mode --arbiter` restores orchestration
+explicitly, and a new session restores it implicitly (the mode file is cleared at session start).
+
+Even in `dangerous` mode, `overrides.log` itself is never rewritten — the append-only rule has no
+exception for this mode.

package/plugins/ca-pi/includes/ops-mode.md

@@ -0,0 +1,96 @@
+<!-- codeArbiter — the `ops` mode body. Composed as `safety-core.md` + this file
+whenever the mode plane is flipped to `ops` (token: `mode --ops`). Ops ships
+advisory-only (user ruling, ADR-0030 position 7): a scoped persona carve-out
+for reversible local runtime work, never a process supervisor — no owned
+PIDs, no readiness probes, no scoped stop, no cross-session recovery. No
+enforcement hook becomes mode-aware; every gate fires identically in every
+mode, in `ops` exactly as in `arbiter` and `dangerous`. -->
+
+# ops — advisory runtime carve-out
+
+`ops` narrows the persona only, for one purpose: running, watching, or exercising
+this repo's own software locally without a routing detour for every `npm run dev`.
+It is not the required lane for ordinary development; normal feature work still
+flows through the ordinary gated commands and ships via PR.
+
+**The carve-out is a discriminator, not an allowlist of binaries** — a binary
+allowlist is unbounded, drifts per project, and says nothing about `npm run
+build && git commit`. What decides is the durable artifact a command leaves
+behind, the same axis the surviving hooks already key on (H-01/H-02 = git
+history, H-03 = the index, H-05/H-11/H-18/H-22 = tracked project state), so
+persona and enforcement draw the same line rather than two different ones:
+
+An operation that starts, observes, or exercises a running system and leaves
+no change in tracked files or git history may be performed in-channel, named
+in one line as it is taken. Anything that mutates tracked files, the index,
+git history, or published state stays routed and refused.
+
+This narrows §0 and §6 only — arbiter's §0 non-negotiable ("route; never
+implement directly") and §6 user-interaction rule ("no command owns this" is
+a routing gap, not a permission) are the two clauses that would otherwise
+block the common case, because no command owns `npm run dev`. Safety-core's
+§3 hard rules, §2 conflict ladder, and §7 diagnose-don't-bypass discipline
+are unchanged — the carve-out narrows routing, not the floor beneath it.
+
+**Refused, always** — irreversible action against anything outside this repo:
+infrastructure teardown, cluster or namespace deletion, package publication,
+live-database migration, volume destruction. None of these leave a
+git-visible trace to review, so none of them qualify for the in-channel
+exception; they route exactly as they would in `arbiter` mode.
+
+**The ambiguous cases, resolved rather than left implicit:**
+
+- `npm test` — **permitted.** It exercises the suite; a default test
+  configuration writes no tracked file.
+- `npm ci --ignore-scripts` — **permitted.** It reinstalls `node_modules`
+  (untracked) strictly from the existing lockfile; it never writes
+  `package.json` or the lockfile itself — that would be a mutation, and
+  mutation is what the discriminator refuses.
+- `npm ci` **without** `--ignore-scripts` — **refused, routed.** It runs each
+  dependency's `preinstall`/`install`/`postinstall`/`prepare` scripts, which
+  are arbitrary code that can write anywhere, including tracked files. That
+  the *command* leaves tracked files alone says nothing about what its
+  lifecycle scripts do, and no hook enforces the boundary in this mode — so
+  the discriminator cannot be evaluated in advance and the answer is refuse.
+  The same reasoning applies to any package manager's install (`pnpm`, `yarn`,
+  `uv`, `poetry`, `bundle`): the flag, not the tool, is what makes it
+  in-channel.
+- `docker compose up` — **permitted**, for the same reason: it starts a
+  running system and, under a default compose file, leaves tracked files
+  untouched. A bind mount that writes into a tracked path flips this to
+  refused — the discriminator governs the actual artifact produced, not the
+  command's name.
+
+**Gates-off is persona-off, not enforcement-off**, exactly as in `dangerous`:
+no hook reads this persona, so H-01, H-02, H-03, H-05, H-09b, H-10b, H-11,
+H-18, H-19, and H-22 fire identically to every other mode. The narrowing
+above is advisory, not hook-backed — its compensating control is the audit
+row (`MODE: ops enter`), the same load-bearing replacement AC-11 gives every
+non-arbiter mode.
+
+**Blocking questions still surface**, and the override count still reports —
+neither is suppressed in this mode.
+
+**The project's own state lives in `.codearbiter/`**, and nothing in this
+mode reads it for you:
+
+- `CONTEXT.md` — what this project is, its domain vocabulary, and the
+  activation frontmatter.
+- `tech-stack.md` — languages, frameworks, and the commands that build, test,
+  and lint this repo.
+- `coding-standards.md` — the conventions code here is expected to match.
+- `security-controls.md` — the boundaries, banned primitives, and
+  secret-handling rules.
+- `open-questions.md` — the unresolved `[CONFIRM-NN]` set.
+
+Read whichever the work actually touches. These are facts about the repo,
+not a dispatch table: naming a doc here is not naming a command.
+
+**Entry and exit are logged**, the same audit-trail obligation as every other
+mode: a `MODE: ops enter` row on entry, a `MODE: ops exit` row on exit,
+appended (never rewritten) to `.codearbiter/overrides.log`. The mode is
+session-scoped: `mode --arbiter` restores orchestration explicitly, and a new
+session restores it implicitly (the mode file is cleared at session start).
+
+Even in `ops` mode, `overrides.log` itself is never rewritten — the
+append-only rule has no exception for this mode.

package/plugins/ca-pi/includes/pi-host-notes.md

@@ -36,6 +36,14 @@ file maps those actions to Pi's extension API.
   globally; rate-window telemetry is omitted rather than fabricated. The
   governance row renders only when the repository is enabled and affirmatively
   trusted.
+- `/ca-sidebar on|off|toggle|width N` composites an optional right-hand sidebar
+  column (session, subagents, workspace, todos panels), defaulting on in
+  interactive parents at 120 columns or wider. It relies on Pi render hooks
+  that are undocumented in every promoted version, so each install is
+  probe-gated at runtime and any failure disposes back to native rendering.
+  Workspace and todos panels are trusted-only; the MCP panel renders only when
+  Pi exposes servers, which no promoted version does. No sidebar preference
+  persists beyond the session.
 - `/ca-prune` selects shared semantic policy. The active Pi session is compacted
   through the native compaction event; codeArbiter does not rewrite Pi session
   JSONL. The private summarizer uses the hardened child runner with zero tools.
@@ -54,7 +62,8 @@ file maps those actions to Pi's extension API.
 - Run `/ca-doctor` to inspect the active package path, canonical Pi CLI and
   package origin, command ownership, supported-version expansion fingerprints,
   Python/core/bridge health, child fingerprint, final mutator wrappers, footer
-  initialization, background-manager health, and the H-03 wrapper self-test.
+  initialization, sidebar availability, background-manager health, and the
+  H-03 wrapper self-test.
 - Unverified background cleanup makes the manager unhealthy, blocks later
   launches, and directs the operator to `/ca-doctor`. Doctor never includes job
   labels or IDs, commands, environment data, or output.

package/plugins/ca-pi/includes/redirect.md

@@ -24,7 +24,9 @@ Run it? Its own gates still apply.
 
 Use this — not tier 1 — whenever the command is irreversible or gate-bypassing, however clear the
 intent: `/ca-override`, merge to the default branch, branch or worktree deletion, release and tag
-publication, `/ca-dev` entry. There the confirmation is the gate, not friction.
+publication. There the confirmation is the gate, not friction. (A deterministic mode-token flip is
+friction, not a gate, which is why `mode --dangerous`/`mode --ops` entry is not in this set — see
+`includes/ops-mode.md` and `includes/dangerous-mode.md`.)
 
 ## Tier 3 — genuinely unclear
 
@@ -67,3 +69,12 @@ A missing owner is a **routing gap**, not an override case. When no command owns
 so and surface the gap — never steer the user toward `/ca-override` to get past a coverage hole.
 That substitution is exactly what issue #308 recorded: a routine post-merge cleanup routed first to
 `/ca-chore`, which does not accept it, and then to `/ca-override`, which exists to be rare.
+
+## Exception — local runtime work
+
+`npm run dev` and its kin have no owning command; in `arbiter` mode that is the routing gap above,
+surfaced in one line. The runtime-operations token `mode --ops` narrows exactly that gap and no
+other: once active, an operation that starts, observes, or exercises a running system and leaves no
+change in tracked files or git history is performed in-channel, named in one line as it is taken —
+see `includes/ops-mode.md`. Anything that mutates tracked files, the index, git history, or
+published state is still a routing gap, `ops` or not.

package/plugins/ca-pi/includes/routing-table.md

@@ -41,6 +41,7 @@ reached the same way.
 | Sitting down to code / repo hygiene cleanup | `/ca-standup` → orchestrator git actions | — | ff-only pull on a clean tree; each branch/worktree delete confirmed individually; stash/dirty/un-pushed report-only; never touch the default branch |
 | Finish an already-merged branch (post-merge cleanup) | `/ca-cleanup` → `post-merge-cleanup` | — | Ancestry of the FETCHED default proven before any delete; unique/unclassifiable artifacts never discarded without a per-item confirmation; `--ff-only` and `branch -d` only; remote branch untouched; never routes to `/ca-override` |
 | Add / start / done a backlog task | `/ca-task` → `hooks/taskwrite.py` (the pure `_taskboardlib` transforms) | — | Board written only through the writer; `start` always stamps a date; `done` requires in-progress; never delete to complete |
+| Local runtime work (run, watch, exercise this repo's own app) | `mode --ops` → narrows the persona per `includes/ops-mode.md`, no skill/agent dispatch | — | Advisory only, no hook becomes mode-aware; permitted only when the operation starts, observes, or exercises and leaves no change in tracked files or git history — anything that mutates tracked files, the index, git history, or published state still routes normally |
 | Promote a workflow's un-actioned follow-ups | `includes/harvest.md` (run at a terminal step) → `/ca-task` (work) / `open-questions.md` (decision) | — | Batch-confirm interactive; SMARTS-logged auto under `/sprint`; dedup by `(from <origin>)`; a blocking decision escalates, never demoted |
 | Zero-onboarding dry-run of the reviewer fleet | `/ca-preview` (no skill; reuses `includes/review-matrix.md` to predict reviewers) | — | Read-only; writes nothing, stages nothing, `git status` unchanged; no `/ca-init` or `.codearbiter/` required; empty diff exits clean |
 | Manual drift audit of provenance-tracked docs (bypass / merge / external edit case) | `/ca-context-check` → `context-check` skill | — | Read-only unless user selects re-scout or re-baseline; MUST NOT commit on its own; not the daily loop — commit-gate auto-heal is the routine path |

package/plugins/ca-pi/includes/safety-core.md

@@ -0,0 +1,86 @@
+<!-- codeArbiter — safety core. Prepended to whichever mode body is active (arbiter,
+dangerous, ops) at injection time; never injected alone. -->
+
+# Safety core
+
+**Precedence.** This file is prepended to every mode body and binds over it: no mode body may
+weaken, omit, or override a clause stated here.
+
+**Section numbers are a public interface.** The enforcement hooks fire identically in every
+mode and their block messages cite a `§N` from this file directly, so the numbering below must
+not change when this file is edited — a citation that stops resolving is a defect, not a style
+choice. Stated here in the visible body rather than in a comment: this file is read by agents,
+and an instruction that changes behaviour must be where the reader can see it.
+
+---
+
+## §2 — Conflict hierarchy
+
+When rules pull apart, resolve in this order; if unresolvable, invoke `/conflict` — never guess:
+1. Security & correctness of the audit trail — 2. Correctness & data integrity —
+3. Maintainability & reviewability — 4. Performance — 5. Developer velocity.
+Cite the level of any non-obvious tradeoff in the PR description.
+
+---
+
+## §3 — Hard rules (always enforced)
+
+- MUST NOT store a raw secret in repo, log, container image, or prompt. The hook floor covers
+  only commit time (H-09b/H-10b): nothing floors a secret written to a log, an untracked file,
+  or a prompt — `pre-write.py` classifies by path, never content. In a gates-off mode this
+  sentence is the only remaining protection.
+- MUST NOT write directly to the default branch or force-push. All changes via branch/PR.
+- MUST NOT author an ADR except via `/adr`, with user attribution.
+- MUST NOT silently reconcile a conflict — invoke `/conflict`.
+
+---
+
+## §5 — Scope-touch review
+
+Before acting on a scope-touch (auth/crypto/secrets, dependencies, migrations, telemetry,
+decisions), the governing `.codearbiter/*.md` doc is read first and routed to its owning
+skill/agent — a changed dependency manifest is reviewed before it is committed.
+
+---
+
+## §6 — Irreversible actions
+
+ADR files under `.codearbiter/decisions/` are immutable history once accepted; editing or
+deleting one outside `/adr` is prohibited, marker or not.
+
+The irreversible-action set draws a confirmation even when intent is obvious, because the
+confirmation is the gate, not friction: merge to the default branch, branch or worktree
+deletion, release and tag publication, and the logged bypass itself (`/ca-override`).
+
+A parameter is yours to decide only when it is reversible, has one sensible answer, and is
+recorded where the user will review it — an uncertain classification is a fork, and forks are
+asked.
+
+---
+
+## §7 — Override, and gates that look wrong
+
+The `.codearbiter` audit logs (`overrides.log`, `triage.log`, `sprint-log.md`,
+`gate-events.log`, `decisions/decision-log.md`) are append-only: MUST NOT truncate, overwrite,
+or rewrite one — append with a single Edit or `>>`, never a bulk rewrite.
+
+**A gate that looks wrong is diagnosed, not bypassed.** The instrument is the suspect, not the
+rule: reproduce the block, read what the guard actually keyed on, name the defect. Until
+diagnosed, the gate stands. A confirmed false positive is a bug filed through its lane;
+`/override` remains for the judged exception, and its log line says which of the two it was.
+
+---
+
+## What survives every mode
+
+Even with every gate off, this residual set holds:
+
+- The secrets prohibition above has no mode exception.
+- The §6 irreversible-action set is never taken without the confirmation it requires.
+- A conflict is surfaced, never silently reconciled.
+- The §2 conflict hierarchy still orders any tradeoff made unsupervised.
+- The §7 diagnose-don't-bypass discipline still governs any guard actually encountered.
+- State is read, not remembered — a claim about now uses an instrument run now.
+
+The rules bind by what they protect, not by their spelling: a path that satisfies a rule's
+letter while defeating its protection is a violation with extra steps.

package/plugins/ca-pi/includes/smarts/core.md

@@ -20,7 +20,7 @@ the three `plans/` artifacts; `CONTEXT.md` and `open-questions.md` (including it
 Deferred-decisions sections) constrain at their recorded level. Load index-first: consult the ADR
 index (`decision-log.md` or the `decisions/` filename listing) and plan section headings only;
 load a body only after the index names it relevant; never bulk-read `plans/` or `decisions/`
-(ORCHESTRATOR §3's no-bulk-reads rule).
+(arbiter.md §3's no-bulk-reads rule).
 
 Three outcomes:
 

package/plugins/ca-pi/routines/decision-lifecycle/SKILL.md

@@ -30,7 +30,7 @@ Gate: the existing ADRs are indexed by stem and, for `/adr`, the next number is
 
 Confirm the decision content with the user — context, the decision itself, alternatives, consequences. MUST NOT fill these from inference. Surface any unknown as an inline `[CONFIRM-NN]` placeholder; do not resolve it by guessing.
 
-**Drop the authoring marker first.** The `pre-write`/`pre-edit` hooks block any write to `.codearbiter/decisions/NNNN-*.md` unless a fresh authoring marker is present — that block is the mechanism enforcing "ADRs only via `/adr`" (ORCHESTRATOR §3), so the sanctioned path must arm it itself. Immediately before writing, create the marker at the path the hooks check (project root = git top level):
+**Drop the authoring marker first.** The `pre-write`/`pre-edit` hooks block any write to `.codearbiter/decisions/NNNN-*.md` unless a fresh authoring marker is present — that block is the mechanism enforcing "ADRs only via `/adr`" (arbiter.md §3), so the sanctioned path must arm it itself. Immediately before writing, create the marker at the path the hooks check (project root = git top level):
 
 ```bash
 mkdir -p "$(git rev-parse --show-toplevel)/.codearbiter/.markers"

package/plugins/ca-pi/routines/decompose/SKILL.md

@@ -12,7 +12,7 @@ Spec the project before a line of code exists. Routed to at greenfield startup,
 Run these ordered checks. Each passes silently or hard-stops with a routing action — never guess:
 
 1. Read `<project-root>/.codearbiter/CONTEXT.md`. If it already carries the `<!--INITIALIZED-->` body marker on its own line, STOP — context exists. Route to normal operation.
-2. Scan for meaningful source code: any file outside `.git/`, `.codearbiter/`, `.claude/`, `ORCHESTRATOR.md`, `AGENTS.md`, `CLAUDE.md`, `README.md`, `LICENSE`, `.gitignore`, `.gitmodules`, and standard tooling dotfiles. If any exist, STOP and route to `/create-context`.
+2. Scan for meaningful source code: any file outside `.git/`, `.codearbiter/`, `.claude/`, `arbiter.md`, `AGENTS.md`, `CLAUDE.md`, `README.md`, `LICENSE`, `.gitignore`, `.gitmodules`, and standard tooling dotfiles. If any exist, STOP and route to `/create-context`.
 3. Confirm `<project-root>/.codearbiter/` exists and is writable. If not, surface the gap and STOP.
 
 All three pass → proceed to Phase 1. Later phases consume this pass-status; they do not re-run it.

package/plugins/ca-pi/skills/ca-spike/SKILL.md

@@ -15,24 +15,31 @@ it never merges, never PRs, and never becomes the implementation. What survives
 1. **Name the question** — a spike without a falsifiable question is just freelancing. Restate
    `$ARGUMENTS` as the question the spike answers and the timebox (default: one session). STOP for
    the user's confirmation.
-2. **Branch** — create `spike/<slug>` from the current branch. All spike work stays on it.
+2. **Branch** — create `spike/<slug>` from the current branch. All exploratory code and experiments
+   stay on it; only the completed findings file may later cross back to the parent.
 3. **Explore** — no `tdd`, no plan, no review fleet. Two rules survive even here: no secret leaves
    the approved store, and no irreversible operation (prod data, destructive migration) runs from a
    spike.
 4. **Exit — exactly one of:**
    - **Answered** → write the findings to `<project-root>/.codearbiter/spikes/<slug>.md`
-     (the question, what was tried, the answer, what it implies), then delete the branch. If the
-     answer warrants building, hand the findings to `/ca-feature` — the spike file seeds
+     (the question, what was tried, the answer, what it implies), and commit only that findings file
+     on `spike/<slug>`. Return to the parent branch and run
+     `git restore --source spike/<slug> -- .codearbiter/spikes/<slug>.md` to transfer only the
+     committed findings file, review it, and commit that one file through `/ca-commit`; do not
+     merge the spike branch. Then delete the spike branch. If the answer warrants building, hand the
+     findings to `/ca-feature` — the spike file seeds
      `brainstorming` (`<plugin-root>/routines/brainstorming/SKILL.md`); the spike code is reference material, never the implementation.
-   - **Timebox expired, no answer** → record that too (a dead end is a finding), delete the branch.
+   - **Timebox expired, no answer** → record that in the findings file and use the same findings-only
+     transfer before deleting the spike branch.
 
 ## Hard gate
 
-MUST NOT merge or PR a `spike/*` branch — its only exits are a findings file and deletion. MUST NOT
-copy spike code into an implementation branch wholesale; implementation re-enters through
+MUST NOT merge or PR a `spike/*` branch — its only exits are a findings file and deletion. Do not
+transfer spike code: the parent may receive only the committed findings file. MUST NOT copy spike
+code into an implementation branch wholesale; implementation re-enters through
 `/ca-feature` and `tdd`. Secret-handling and irreversibility rules hold even in a spike. Commits on
-a `spike/*` branch are exempt from `commit-gate` — the exemption is safe precisely because nothing
-on the branch can ever land.
+a `spike/*` branch are exempt from `commit-gate` — the exemption is safe because no spike commit is
+merged and the parent may copy only the committed findings file's contents, never spike code.
 
 ## When NOT to use
 

package/plugins/ca-pi/includes/dev-mode.md

@@ -1,30 +0,0 @@
-<!-- codeArbiter — maintainer dev-mode detail. Loaded on demand by the orchestrator
-when the user invokes /ca-dev or /ca-arbiter. The always-on kernel (ORCHESTRATOR.md)
-keeps only the env-gate + logged + load-before-gates-off invariant as a stub; the full
-mode description lives here. -->
-
-# /dev — Maintainer Override (evaluated FIRST, every turn, before anything else)
-
-`/ca-dev` (optionally `/ca-dev "note"`) **suspends the gates entirely** to edit codeArbiter itself
-with no orchestration mediating — skill, agent, command, and hook bodies, `ORCHESTRATOR.md`, settings.
-It is the gates-off escape hatch, **not** the required lane for touching those files: normal
-development of codeArbiter — fixing a hook bug, adding a command, editing this persona — flows through
-the ordinary gated lanes (`/ca-feature`, `/ca-fix`, `/ca-chore`) and ships via PR + release, the same
-dogfooding path as any other change. Reach for `/ca-dev` only when orchestration itself is broken or
-genuinely in the way of editing it. It is **env-gated and logged**:
-
-- **Gate:** activates only when the `CODEARBITER_DEV` environment variable is set to `1`. Absent or
-  empty → refuse in one line ("dev mode requires CODEARBITER_DEV=1") and remain in orchestration.
-- **Log:** on entry, append `[ISO-8601] | BY: <git user.email> | DEV: enter | NOTE: <note or —>` to
-  `.codearbiter/overrides.log` (append with `>>`, per ORCHESTRATOR §7's append-only rule). On exit,
-  append the matching `DEV: exit` line. Dev mode is on the audit trail like any other bypass.
-- **Mode:** while active — no routing, no skills, no gates, no `[CONFIRM-NN]` surfacing, no redirect,
-  no startup presentation; a plain, direct coding assistant. Drop the transient marker
-  `<project-root>/.codearbiter/.markers/dev-active` (gitignored local UI flag). The marker is NOT the log — the overrides.log
-  lines are.
-- **Exit:** `/ca-arbiter` restores orchestration (removes the marker, writes the exit line). A new
-  session also restores it (SessionStart clears the marker); write the exit line at the next
-  opportunity if the session ended mid-dev.
-
-Even in dev mode, `overrides.log` itself is never rewritten — the append-only rule has no dev
-exception.

package/plugins/ca-pi/skills/ca-arbiter/SKILL.md

@@ -1,36 +0,0 @@
----
-name: ca-arbiter
-description: Exit maintainer dev mode — restore orchestration, remove the dev marker, log the exit.
-argument-hint: (none)
----
-
-# /ca-arbiter — restore orchestration
-
-The exit door for `/ca-dev`. No-op if dev mode is not active.
-
-## Flow
-
-1. **Log exit** — append to `<project-root>/.codearbiter/overrides.log` (append-only, `>>`):
-
-   ```
-   [ISO-8601 timestamp] | BY: <email> | DEV: exit
-   ```
-
-2. **Marker** — remove `<project-root>/.codearbiter/.markers/dev-active`.
-3. **Resume** — re-present the startup state (stage, blocking `CONFIRM-NN`, in-flight tasks) and
-   await a slash command. Orchestration, routing, and all gates are back in force.
-
-## Hard gate
-
-MUST write the `DEV: exit` line to `overrides.log` and remove the `dev-active` marker before resuming
-orchestration — the exit is on the audit trail like the entry. MUST NOT rewrite or truncate
-`overrides.log` — the append-only rule has no dev exception, on entry or exit. If a prior session
-ended mid-dev, SessionStart has already appended the synthetic `BY: session-cleanup | DEV: exit` close
-line and cleared the marker (`session-start.py`, observability-001). In that case MUST NOT write a
-second `DEV: exit` for that orphaned entry — the close is already on the trail.
-
-Session-scoped clearing (#271): SessionStart's synthetic close is now conditional on the marker
-plausibly being abandoned rather than owned by a different, still-live session — it will NOT clobber
-another concurrently-running session's live `/dev` marker or write a false `DEV: exit` for it.
-`/ca-arbiter` remains the ONLY way to cleanly close your OWN `/dev` session's audit pair; do not
-rely on a future SessionStart to do it for you.

package/plugins/ca-pi/skills/ca-dev/SKILL.md

@@ -1,42 +0,0 @@
----
-name: ca-dev
-description: Maintainer override — suspend orchestration to edit codeArbiter itself. Env-gated (CODEARBITER_DEV=1), entry/exit logged to overrides.log.
-argument-hint: "[note]"
----
-
-# /ca-dev — maintainer override
-
-Suspends orchestration for working ON codeArbiter — skill, agent, command, and hook bodies,
-`ORCHESTRATOR.md`, settings. Not for project work; for that, use the normal commands or
-`/ca-override`.
-
-## Flow
-
-1. **Env gate** — check the `CODEARBITER_DEV` environment variable. Not set to `1` → refuse in one
-   line ("dev mode requires CODEARBITER_DEV=1") and remain in orchestration. This keeps the mode a
-   deliberate maintainer posture, not a casual bypass.
-2. **Log entry** — detect identity from `git config user.email`; append to
-   `<project-root>/.codearbiter/overrides.log` (append-only, `>>`):
-
-   ```
-   [ISO-8601 timestamp] | BY: <email> | DEV: enter | NOTE: <note or —>
-   ```
-
-3. **Marker** — drop `<project-root>/.codearbiter/.markers/dev-active` (gitignored UI flag).
-4. **Mode** — plain, direct coding assistant: no routing, no skills, no gates, no `[CONFIRM-NN]`
-   surfacing, no redirect. Persists until `/ca-arbiter` or a new session.
-
-Note (#271): if another session starts in this repo while this marker is live, SessionStart no longer
-unconditionally clears it out from under you — it is session-scoped now, so a concurrently-running dev
-session's marker survives a different session's startup. See `/ca-arbiter` for the exit-path detail.
-
-## Hard gate
-
-MUST refuse without `CODEARBITER_DEV=1`. MUST write the `DEV: enter` log line before suspending
-orchestration. Even in dev mode, `overrides.log` is never rewritten — the append-only rule has no
-dev exception.
-
-## When NOT to use
-
-- Bypassing a single gate on project work → `/ca-override "reason"`.
-- Asking a question → `/ca-btw`.