@arbiterforge/ca-pi 0.8.1 → 0.10.2

package/plugins/ca-pi/hooks/hostapi.py

@@ -27,11 +27,114 @@
 # Behavioral contract for M1: under Claude Code, everything routed through
 # this seam resolves to byte-identical results as the pre-seam inline code.
 
+import json
 import os
+import re
 import subprocess
 import sys
 
-from _gitexec import git_executable
+from _gitexec import git_executable, root_bound_git_env
+
+
+class PluginRootError(RuntimeError):
+    """A host adapter's installed package boundary cannot be authenticated."""
+
+
+_VERSION_RE = re.compile(
+    r"^\d+\.\d+\.\d+(?:-[0-9A-Za-z][0-9A-Za-z.-]*)?(?:\+[0-9A-Za-z][0-9A-Za-z.-]*)?$")
+
+
+def _safe_relative_path(value, label):
+    """Reject an absolute or traversing adapter-relative path before joining."""
+    if not isinstance(value, str) or not value:
+        raise PluginRootError(f"{label} must be a non-empty relative path")
+    normalized = os.path.normpath(value)
+    if (os.path.isabs(value) or normalized == os.pardir or
+            normalized.startswith(os.pardir + os.sep)):
+        raise PluginRootError(f"{label} escapes the adapter: {value!r}")
+    return normalized
+
+
+def _inside(root, candidate):
+    """Whether normalized ``candidate`` is contained by normalized ``root``."""
+    try:
+        return os.path.commonpath((root, candidate)) == root
+    except ValueError:  # distinct Windows volumes are never contained
+        return False
+
+
+def resolve_plugin_root(authority_file, *, adapter_name, adapter_version, manifest_relpath,
+                        anchor_relpath, environment=None, signal_names=(),
+                        required_signal_names=(), legacy_signal_names=()):
+    """Return the authenticated root of the executing adapter, or fail closed.
+
+    The authority is the file/module that is already executing. Environment
+    variables may only corroborate that exact real path; none can select a
+    different, merely plausible package. ``anchor_relpath`` and the manifest
+    are constrained inside that root so traversal and symlink escapes cannot
+    authenticate an external file.
+    """
+    if not isinstance(adapter_name, str) or not adapter_name:
+        raise PluginRootError("adapter name must be a non-empty string")
+    if not isinstance(adapter_version, str) or not _VERSION_RE.fullmatch(adapter_version):
+        raise PluginRootError("adapter version must be an exact SemVer string")
+    manifest_relpath = _safe_relative_path(manifest_relpath, "manifest path")
+    anchor_relpath = _safe_relative_path(anchor_relpath, "anchor path")
+    env = os.environ if environment is None else environment
+
+    # Keep the package boundary lexical until after its parent directories are
+    # derived. If hooks/hostapi.py itself is a symlink, realpathing it first
+    # would re-home this adapter in a complete, matching foreign package.
+    lexical_authority = os.path.abspath(authority_file)
+    root = os.path.realpath(os.path.dirname(os.path.dirname(lexical_authority)))
+    source = os.path.realpath(lexical_authority)
+    anchor = os.path.realpath(os.path.join(root, anchor_relpath))
+    if (not _inside(root, source) or not _inside(root, anchor) or
+            anchor != source or not os.path.isfile(anchor)):
+        raise PluginRootError(
+            f"executing adapter anchor is outside or missing from its package: {source}")
+
+    manifest = os.path.realpath(os.path.join(root, manifest_relpath))
+    if not _inside(root, manifest) or not os.path.isfile(manifest):
+        raise PluginRootError(
+            f"{adapter_name}: required manifest is missing or outside the adapter: {manifest}")
+    try:
+        with open(manifest, encoding="utf-8") as handle:
+            data = json.load(handle)
+    except (OSError, ValueError) as error:
+        raise PluginRootError(
+            f"{adapter_name}: required manifest is unreadable: {manifest} ({error})") from error
+    name = data.get("name") if isinstance(data, dict) else None
+    version = data.get("version") if isinstance(data, dict) else None
+    if name != adapter_name:
+        raise PluginRootError(
+            f"adapter manifest mismatch at {manifest}: expected {adapter_name!r}, got {name!r}")
+    if not isinstance(version, str) or not _VERSION_RE.fullmatch(version):
+        raise PluginRootError(
+            f"adapter manifest has invalid version at {manifest}: {version!r}")
+    if version != adapter_version:
+        raise PluginRootError(
+            f"adapter manifest version mismatch at {manifest}: "
+            f"expected {adapter_version!r}, got {version!r}")
+
+    for signal in required_signal_names:
+        if not env.get(signal):
+            raise PluginRootError(
+                f"{adapter_name}: required {signal} is absent; executing root is {root}")
+    for signal in signal_names:
+        value = env.get(signal)
+        if not value:
+            continue
+        claimed = os.path.realpath(os.path.abspath(value))
+        if claimed != root:
+            raise PluginRootError(
+                f"{adapter_name}: {signal} root {claimed} disagrees with "
+                f"executing adapter root {root}")
+        if signal in legacy_signal_names:
+            sys.stderr.write(
+                f"codeArbiter: {signal} is deprecated for {adapter_name}; "
+                "accepted only as matching corroboration.\n")
+    return root
 
 
 def git_toplevel(cwd=None):
@@ -52,7 +155,7 @@ def git_toplevel(cwd=None):
     try:
         out = subprocess.run(
             args, capture_output=True, text=True, encoding="utf-8",
-            errors="replace", timeout=5,
+            errors="replace", timeout=5, env=root_bound_git_env(),
         )
         if out.returncode == 0:
             top = out.stdout.strip()
@@ -63,6 +166,38 @@ def git_toplevel(cwd=None):
     return None
 
 
+def _root_bound_git_env():
+    """Compatibility seam for callers of the former local helper."""
+    return root_bound_git_env()
+
+
+def _has_enabled_context(root):
+    """Whether a real CONTEXT.md satisfies the canonical activation parser."""
+    canonical_root = os.path.realpath(root)
+    state_dir = os.path.join(canonical_root, ".codearbiter")
+    if os.path.islink(state_dir) or not os.path.isdir(state_dir):
+        return False
+    context = os.path.join(state_dir, "CONTEXT.md")
+    canonical_context = os.path.realpath(context)
+    try:
+        contained = os.path.normcase(os.path.commonpath(
+            [canonical_root, canonical_context])) == os.path.normcase(canonical_root)
+    except (TypeError, ValueError):
+        contained = False
+    if (not contained or os.path.islink(context)
+            or not os.path.isfile(canonical_context)):
+        return False
+    try:
+        # Deferred to avoid hostapi <-> _activationlib's import-time cycle.
+        # This must remain the single parser for the activation contract,
+        # including its accepted UTF-8 BOM spelling.
+        from _activationlib import frontmatter_enabled
+        enabled, malformed = frontmatter_enabled(canonical_context)
+        return enabled and not malformed
+    except Exception:  # noqa: BLE001 - root selection must fail closed
+        return False
+
+
 def git_worktree_main_root(root):
     """When `root` (an already-resolved project root — a `project_root()`
     answer, NOT necessarily a fresh `git_toplevel` call) is itself the
@@ -100,24 +235,71 @@ def git_worktree_main_root(root):
     FILE, but only a worktree's `gitdir:` pointer names a path under
     `.git/worktrees/<name>`; a submodule's names `.git/modules/<name>`, which
     is not a "main root" to climb to and must fall through untouched (mirrors
-    `_durabilitylib._gitfile_points_at_worktree`'s same distinction)."""
+    `_durabilitylib._gitfile_points_at_worktree`'s same distinction).
+
+    The selected Git binary is the authority for accepting and resolving the
+    worktree metadata. That keeps native relative pointers aligned with Git,
+    rejects incomplete or foreign-dialect metadata Git itself cannot use, and
+    avoids translating a path grammar in Python. Only Git-confirmed linked
+    worktrees whose common directory is the main checkout's `.git` directory,
+    and whose linked and reported-main checkouts are both independently
+    arbiter-enabled, can escalate the marker root."""
     git_meta = os.path.join(root, ".git")
     if not os.path.isfile(git_meta):
         return None
     try:
-        with open(git_meta, encoding="utf-8", errors="replace") as f:
-            pointer = f.read().strip()
-    except OSError:
+        probe = subprocess.run(
+            [git_executable(), "-C", root, "rev-parse", "--path-format=absolute",
+             "--git-dir", "--git-common-dir"],
+            capture_output=True, text=True, encoding="utf-8", errors="replace",
+            timeout=5, env=_root_bound_git_env(),
+        )
+    except Exception:  # noqa: BLE001 - root selection must fail closed
+        return None
+    lines = [line.strip() for line in probe.stdout.splitlines() if line.strip()]
+    if probe.returncode != 0 or len(lines) != 2:
+        return None
+    git_dir = os.path.normpath(lines[0])
+    common_dir = os.path.normpath(lines[1])
+    if not os.path.isabs(git_dir) or not os.path.isabs(common_dir):
+        return None
+    real_git_dir = os.path.normcase(os.path.realpath(git_dir))
+    real_common_dir = os.path.normcase(os.path.realpath(common_dir))
+    if real_git_dir == real_common_dir:
+        return None  # ordinary checkout or submodule, not a linked worktree
+    expected_admin_parent = os.path.normcase(
+        os.path.realpath(os.path.join(common_dir, "worktrees")))
+    if os.path.normcase(os.path.realpath(os.path.dirname(git_dir))) != expected_admin_parent:
+        return None
+    if os.path.basename(common_dir) != ".git" or not os.path.isdir(common_dir):
+        return None
+    main_root = os.path.dirname(common_dir)
+    if not os.path.isdir(main_root):
+        return None
+    try:
+        main_probe = subprocess.run(
+            [git_executable(), "-C", main_root, "rev-parse", "--path-format=absolute",
+             "--show-toplevel", "--git-common-dir"],
+            capture_output=True, text=True, encoding="utf-8", errors="replace",
+            timeout=5, env=_root_bound_git_env(),
+        )
+    except Exception:  # noqa: BLE001 - root selection must fail closed
+        return None
+    main_lines = [line.strip() for line in main_probe.stdout.splitlines() if line.strip()]
+    if main_probe.returncode != 0 or len(main_lines) != 2:
+        return None
+    main_toplevel = os.path.normpath(main_lines[0])
+    confirmed_common = os.path.normpath(main_lines[1])
+    if not os.path.isabs(main_toplevel) or not os.path.isabs(confirmed_common):
+        return None
+    if os.path.normcase(os.path.realpath(main_toplevel)) != os.path.normcase(
+            os.path.realpath(main_root)):
         return None
-    if not pointer.startswith("gitdir: "):
+    if os.path.normcase(os.path.realpath(confirmed_common)) != real_common_dir:
         return None
-    gitdir = pointer[len("gitdir: "):].strip().replace("\\", "/")
-    marker = "/.git/worktrees/"
-    idx = gitdir.find(marker)
-    if idx == -1:
-        return None  # not a linked worktree (e.g. a submodule) — nothing to climb to
-    main_git_dir = gitdir[:idx + len("/.git")]
-    return os.path.dirname(main_git_dir) or None
+    if not _has_enabled_context(root) or not _has_enabled_context(main_root):
+        return None
+    return main_root.replace("\\", "/") if os.name == "nt" else main_root
 
 
 class Host:
@@ -130,6 +312,17 @@ class Host:
     """
 
     name = "claude"
+    adapter_name = "ca"
+    adapter_version = "2.17.1"
+
+    # Update-notifier descriptor. Each independently versioned host overrides
+    # these three values in its per-plugin _host.py. Keeping the target,
+    # release prefix, and remediation command together on the active Host
+    # prevents the shared notifier from comparing or instructing for a sibling
+    # product line (RA-02).
+    update_target = "ca"
+    update_tag_prefix = "v"
+    update_command = "/plugin marketplace update codearbiter"
 
     # Capability flags — what surfaces this host actually has. A hook that
     # heals/queries a statusline gates on has_statusline; a hook registered
@@ -220,14 +413,16 @@ class Host:
         return git_worktree_main_root(root) or root
 
     def plugin_root(self):
-        """The plugin payload root: CLAUDE_PLUGIN_ROOT when set, else derived
-        from this file's own location (<root>/hooks/hostapi.py -> <root>) —
-        exactly the pre-seam per-entry-script derivation, which resolved
-        relative to a file in the same hooks/ directory."""
-        env = os.environ.get("CLAUDE_PLUGIN_ROOT")
-        if env:
-            return env
-        return os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+        """The authenticated payload root derived from this executing module.
+
+        CLAUDE_PLUGIN_ROOT may corroborate that derived root, but can never
+        select a different adapter package.
+        """
+        return resolve_plugin_root(
+            __file__, adapter_name=self.adapter_name, adapter_version=self.adapter_version,
+            manifest_relpath=self.manifest_relpath(), anchor_relpath="hooks/hostapi.py",
+            signal_names=("CLAUDE_PLUGIN_ROOT",),
+        )
 
     def manifest_relpath(self):
         """The plugin manifest's path, relative to plugin_root() (#263,
@@ -402,6 +597,9 @@ class FailClosedHost(Host):
     silent (observability-002)."""
 
     name = "unknown"
+    update_target = None
+    update_tag_prefix = None
+    update_command = None
     has_statusline = False
     has_read_tool = False
     has_prunable_transcript = False

package/plugins/ca-pi/hooks/session-start.py

@@ -754,16 +754,18 @@ def clear_mode_marker(root, host_name=None, session_id=None, now=None):
         # "No opinion yet" is the ABSENCE of an entry, not the arbiter VALUE:
         # `current_mode` answers `arbiter` for both "never flipped" and
         # "deliberately flipped back", and only the first may be migrated over.
-        # The raw state map is the only place that distinction survives.
-        # A corrupt or unreadable state file returns `{}` WITH a diagnostic,
-        # which reads as "no entry" and would migrate `dangerous` back on top
+        # `session_has_entry` is the only reader that keeps that distinction
+        # (it also consults the pre-#681 shared map, so a session that chose
+        # before the per-session split still counts as having chosen).
+        # A corrupt or unreadable entry answers False WITH a diagnostic, which
+        # would otherwise read as "no entry" and migrate `dangerous` back on top
         # of a user who had explicitly returned to `arbiter`. Absence is the
         # only clean "nothing to convert over"; anything we could not read is
         # not evidence of anything, and guessing gates-off from unreadable
         # state is the one direction ADR-0030 forbids.
-        mode_state, state_diag = _modelib._read_mode_state(root)
+        has_entry, state_diag = _modelib.session_has_entry(session_id, root=root)
         readable = state_diag in (None, _modelib.MODE_DIAG_ABSENT)
-        unconverted = readable and str(session_id) not in mode_state
+        unconverted = readable and not has_entry
         if marker_live and unconverted and _modelib.write_mode(session_id, "dangerous", root=root):
             try:
                 os.remove(marker)
@@ -883,7 +885,7 @@ def update_notice_line(plugin):
     no network call itself."""
     try:
         state = _updatelib.read_state(_updatelib.state_path())
-        latest = state.get("latest") if isinstance(state, dict) else None
+        latest = _updatelib.target_state(state).get("latest")
         installed = _updatelib.installed_version(plugin)
         return _updatelib.notice_line(installed, latest) or ""
     except Exception:  # noqa: BLE001 — never crash session startup

package/plugins/ca-pi/hooks/statusline.py

@@ -431,7 +431,7 @@ def seg_update(plugin=None):
     try:
         plugin = plugin if plugin is not None else plugin_root_for_render()
         state = _updatelib.read_state(_updatelib.state_path())
-        latest = state.get("latest") if isinstance(state, dict) else None
+        latest = _updatelib.target_state(state).get("latest")
         installed = _updatelib.installed_version(plugin)
         if not _updatelib.update_available(installed, latest):
             return None

package/plugins/ca-pi/hooks/wire-statusline.py

@@ -68,14 +68,19 @@ ARBITER_SPINNER_VERBS = {
 
 
 def plugin_root(opt):
-    if opt:
-        return os.path.abspath(opt)
-    # Host seam (ADR-0011): CLAUDE_PLUGIN_ROOT then this script's parent —
-    # exactly the prior inline lookup (hostapi.py lives in the same hooks/ dir,
-    # so its file-relative fallback names the same root). get_host() (#257),
-    # not a direct hostapi.load_host(): resolves the SAME Host run(host)
-    # injected instead of triggering a second disk load.
-    return os.path.abspath(_hooklib.get_host().plugin_root())
+    # The host seam authenticates the package currently executing this hook.
+    # --plugin-root remains test/operator corroboration, never an authority
+    # able to select a different executable for settings.json.
+    authenticated = os.path.realpath(
+        os.path.abspath(_hooklib.get_host().plugin_root()))
+    if not opt:
+        return authenticated
+    requested = os.path.realpath(os.path.abspath(opt))
+    if requested != authenticated:
+        raise SystemExit(
+            "ERROR: --plugin-root must match the authenticated executing "
+            f"adapter root ({authenticated}); got {requested}.")
+    return authenticated
 
 
 def settings_path(opt):

package/plugins/ca-pi/includes/command-compatibility.md

@@ -0,0 +1,16 @@
+# Command-route compatibility
+
+A compatibility alias is an installed legacy route with a preferred canonical form. The legacy
+route keeps its argument grammar, confirmation gates, side effects, durable outputs, and host
+availability; its migration notice does not invoke or forward to another host command.
+
+The registry permanently declares ca 2.17.0, ca-codex 0.9.0, and ca-pi 0.10.0 as the first-containing
+candidates. Each payload's deprecation clock becomes effective only when GitHub's Release API confirms
+an exact, non-draft Release for that candidate tag and the tag's commit contains both the matching
+registry declaration and matching payload version.
+A tag alone, a draft, unavailable API evidence, or any tag/Release/payload mismatch does not start a
+clock. Published releases ca 2.16.0, ca-codex 0.8.0, and ca-pi 0.9.0 predate this registry and do not
+contain the compatibility metadata. ca retains these routes through every 2.x release, with no removal
+before a separately approved 3.0.0. ca-codex and ca-pi retain them through every later 0.x release,
+with no removal before a separately approved 1.0.0. Passing a version floor never authorizes removal:
+removal needs a new governed decision and fresh compatibility evidence.

package/plugins/ca-pi/includes/routing-table.md

@@ -1,14 +1,22 @@
 # Routing table
 
 Loaded on a scope-touch or `/command`, not every turn. This table is the authoritative trigger→route
-surface: it answers *what to invoke or route given a trigger*; for *what doc to read before touching a
-scope*, use `reference-map.md`. Follow the primary route; the gate is a hard stop, not a suggestion. A
-command is **invoked**; the orchestrator **routes** to a skill; a skill **dispatches** an agent.
+surface and destructive-operation registry: it answers *what to invoke or route given a trigger* and
+*which operations always require tier-2 confirmation*; for *what doc to read before touching a scope*,
+use `reference-map.md`. Follow the primary route; the gate is a hard stop, not a suggestion. A command
+is **invoked**; the orchestrator **routes** to a skill; a skill **dispatches** an agent.
 Routing to a skill means loading its body from `<plugin-root>/routines/<name>/SKILL.md` — a route
 cell names the skill; this path convention locates it. That resolution never depends on the host's
 skill registry: a chain-internal skill hidden from the registry (`disable-model-invocation`) is
 reached the same way.
 
+## Destructive operations (tier-2 regardless of cue)
+
+- Logged bypass (`/override`)
+- Merge to the default branch
+- Branch or worktree deletion
+- Release and tag publication
+
 | Invocation cue | Primary route | Also dispatch | Hard gate |
 |---|---|---|---|
 | New feature | `/feature` Step 0 triage → full lane `brainstorming` → `writing-plans` → `executing-plans` → `tdd`, or logged small lane straight to `tdd` | `backend-`/`frontend-`/`infra-author` | No spec, no code; no code before `tdd` Phase 1; small lane only on all triage criteria, logged to `triage.log` |
@@ -21,8 +29,8 @@ reached the same way.
 | Commit | `/commit` → `commit-gate` | — | No commit without all nine gates green |
 | Open a PR / finish a branch | `/pr` → `finishing-a-development-branch` | reviewer fleet per path; PR-body prose applies `anti-slop-design` (`core` + `medium-documents` §7.A.1) | PR only; no direct-to-default, no force-push |
 | Watch a PR's CI / babysit checks | `/watch` → detached `gh pr checks --watch` | on-red diagnose (propose\|branch) | Never auto-merges; green → notify + offer; merge-to-default routes through the hard gate; no poll loop |
-| Code review of the diff | `/review` → `dispatching-parallel-agents` | reviewer fleet → `finding-triage` → `checkpoint-aggregator` | BLOCK on any CRITICAL/HIGH |
-| Periodic sweep | `/checkpoint` → `dispatching-parallel-agents` | reviewer fleet → triage → aggregator | Surfaces a triaged report; not a promotion gate |
+| Code review of the diff | `/review` → `dispatching-parallel-agents` | reviewer fleet → `finding-triage` → `verdict-aggregator` | BLOCK on any CRITICAL/HIGH |
+| Periodic sweep | `/checkpoint` → `dispatching-parallel-agents` | reviewer fleet → finding-triage → read-only verdict; then explicit `checkpoint-aggregator` persistence | Surfaces and persists a triaged report; not a promotion gate |
 | Governance record for a window | `/audit` | — | Read-only; never overwrites a packet; audit lines quoted verbatim |
 | Release / version tag | `/release` → `release` skill | `commit-gate` (release commit); CHANGELOG prose applies `anti-slop-design` (`core` §3.A/§3.B) | No tag on a red suite; tag not pushed unbidden |
 | Code uses crypto / hashing / signing / TLS / random | `crypto-compliance` skill | `auth-crypto-reviewer` | BLOCK on any banned primitive |

package/plugins/ca-pi/routines/INDEX.md

@@ -18,7 +18,7 @@ Skill bodies load on routing only. This index is the surface scan; never bulk-re
 | [writing-plans](writing-plans/SKILL.md) | `/feature`, `/sprint` (after the spec) | Decomposes an approved spec into small tasks, each with a path + a verification that maps to a `tdd` obligation; writes `plans/<slug>.md` with bijective criterion↔task coverage. |
 | [executing-plans](executing-plans/SKILL.md) | `/feature` | Checkpoint coordinator — groups tasks into batches, delegates each to `subagent-driven-development` (fresh author agent per task, full review chain), stops for user acknowledgement between batches. |
 | [subagent-driven-development](subagent-driven-development/SKILL.md) | `/sprint` (engine), `executing-plans` (batch scope) | Fresh subagent per task → spec-compliance then quality review → fresh-run verification; accepts only on proof. Hard-stops on `tdd` BLOCK, security CRITICAL, `[CONFIRM-NN]`. |
-| [dispatching-parallel-agents](dispatching-parallel-agents/SKILL.md) | `subagent-driven-development`, `/sprint`, parallel `/review` | Reusable fan-out primitive: bound concurrency, collect, dedupe, funnel through `finding-triage`→`checkpoint-aggregator`. Results unused until the funnel runs. |
+| [dispatching-parallel-agents](dispatching-parallel-agents/SKILL.md) | `subagent-driven-development`, `/sprint`, parallel `/review` | Reusable fan-out primitive: bound concurrency, collect, dedupe, funnel through `finding-triage`→`verdict-aggregator`. Results unused until the read-only funnel runs. |
 | [finishing-a-development-branch](finishing-a-development-branch/SKILL.md) | `/feature`, `/sprint` (terminal) | The terminal step after `commit-gate`: open-PR / merge-via-PR / discard. No direct-to-main, no force-push; `/sprint` auto-selects open-PR and never merges. |
 | [using-git-worktrees](using-git-worktrees/SKILL.md) | `subagent-driven-development`, `dispatching-parallel-agents` (opt-in) | OPTIONAL per-unit filesystem isolation for parallel work; integrates accepted units back onto the caller's working branch for its single `commit-gate` + finish. Never the default path. |
 | [secret-handling](secret-handling/SKILL.md) | changed code reads/writes/passes a secret | The secret-source gate: identify → source → sinks/persistence. Secrets only from the approved store in `security-controls.md`; never in source, log, error, telemetry, image, or LLM prompt. Dispatches `auth-crypto-reviewer`. |

package/plugins/ca-pi/routines/decision-lifecycle/SKILL.md

@@ -57,9 +57,59 @@ rm -f "$(git rev-parse --show-toplevel)/.codearbiter/.markers/adr-authoring-acti
 
 Gate: the ADR file is written with a real `decided-by` user attribution, numbered without a gap, and its log entry is appended. An ADR with no user attribution, or authored as the disposition of a finding, does not pass — STOP.
 
+### Accepted/Planned binding
+
+`accepted` means **Accepted/Planned**. It records the user's governance decision; it does not claim
+that any obligation is Implemented or Verified. When the user explicitly authorizes acceptance:
+
+1. Change only the ADR's status fields to accepted. Derive stable, stem-scoped obligations from every
+   normative clause in its immutable record, bind each obligation to exact ADR
+   text, and obtain independent review that the sealed obligation set is complete.
+2. Route through `commit-gate` to commit the accepted ADR and decision-log append. Do not add the
+   acceptance binding to that commit: its `source_commit` cannot truthfully name a commit that does
+   not exist yet.
+3. From that exact commit, hash the committed Git blob bytes and the separately canonicalized
+   immutable record: strict UTF-8 with LF-normalized line endings, containing the complete ADR while
+   replacing only the recognized status value in the strictly parsed frontmatter `status:` field and
+   `## Status` section with fixed sentinels. The two values must agree. All remaining Status prose,
+   including approval attribution, stays bound alongside title, date, `decided-by`, supersession,
+   governed paths, H1, and every other section. Malformed or duplicate frontmatter, status, or
+   headings fail closed. Append one
+   `acceptance` event to
+   `<project-root>/.codearbiter/decisions/adr-lifecycle.jsonl`, then persist that acceptance binding
+   in a subsequent commit. The event uses schema `adr-lifecycle/v1` and records `adr` (full stem),
+   `recorded_at`, `source_commit`, `blob_sha256`, `body_sha256`, `obligations`,
+   `obligations_sha256`, and `obligations_sealed: true`. A second acceptance or baseline binding for
+   the same stem is invalid.
+
+The lifecycle ledger is append-only. A legacy accepted ADR receives a `baseline` with no fabricated
+acceptance commit, an `observed_commit` whose Git blob is rechecked as the migration snapshot, an
+empty or incrementally mapped obligation list, and
+`obligations_sealed: false`; it remains Accepted/Planned. Later delivery evidence appends records:
+`implemented` binds one declared obligation to a source commit and relevant input digests;
+`verified` additionally binds a unique event ID, explicit proof contract, repository-scoped claim,
+producer, command/workflow identity, timezone-aware observation and expiry times, and the same current
+inputs. Evidence paths and digests are recomputed from the named Git commit, never trusted from the
+caller. A later uniquely identified event may renew expired or changed-input evidence; an append-only
+invalidation event may withdraw a prior evidence event. Only a complete,
+sealed obligation set with current implementation inputs and fresh verification inputs derives
+Implemented or Verified. Changed inputs invalidate the derived state; history is never rewritten.
+
+After acceptance, do not edit any bound ADR content. A later user-authorized stored status transition
+may change only the recognized status value in the strictly parsed frontmatter `status:` and
+`## Status`; approval prose remains immutable. Supersession remains a forward reference in the new
+ADR. The acceptance commit retains the exact original blob while the immutable-record digest proves
+every other byte-equivalent field did not change.
+
 ## Phase 3 — Status (/adr-status) · gate: BLOCK
 
-Read-only. For each ADR (or the `--adr N` target), report: stem, title, status, date, and supersession state — found by scanning forward for any later ADR whose `supersedes:` **resolves to** it.
+Read-only. For each ADR (or the `--adr N` target), report: stem, title, stored governance status,
+derived delivery state, date, and supersession state. Read `adr-lifecycle.jsonl` when present. Display
+stored `accepted` as **Accepted/Planned**. Display Implemented or Verified only when every obligation
+in a sealed binding has the required current, input-bound evidence; otherwise name the narrow reason
+(unsealed, incomplete, stale, expired, or mismatched) and do not promote the ADR. Repository evidence
+never implies live-host, publication, support, legal, or other external truth. Find supersession by
+scanning forward for any later ADR whose `supersedes:` **resolves to** it.
 
 Resolve a `supersedes:` value like this, and never guess:
 
@@ -75,7 +125,7 @@ If a supersession candidate contradicts an `accepted` ADR with no clear directio
 ## ADR Status — YYYY-MM-DD
 
 ### Active
-- ADR-NNNN-<slug> — <title> — <status> (<date>)
+- ADR-NNNN-<slug> — <title> — governance: <status>; delivery: <Accepted/Planned | Implemented | Verified> (<date>)
 
 ### Superseded
 - ADR-NNNN-<slug> — <title> — superseded by ADR-MMMM-<slug>
@@ -97,6 +147,8 @@ Gate: every indexed ADR appears with its current status and supersession state;
 - MUST NOT record a decision the user did not explicitly make. "Use your best judgment," "I trust you" are declined.
 - MUST NOT resolve a `[CONFIRM-NN]` placeholder by guessing. Surface it and stop.
 - MUST NOT advance an ADR's status without explicit user instruction.
+- MUST NOT report accepted as Implemented or Verified without complete, sealed, current lifecycle evidence.
+- MUST NOT rewrite or truncate a committed `adr-lifecycle.jsonl`, create a second binding, or fabricate legacy acceptance evidence.
 - MUST NOT edit a prior ADR or a prior decision-log entry to add a back-reference — supersession is a forward-only chain; append a new record whose `supersedes:` names the prior one.
 - **The never-edit rule protects decision CONTENT, not identifiers.** Rewriting what was decided corrupts the record; disambiguating *which document a pointer names* repairs it. Maintainer ruling, 2026-07-25: *"the never edit rule is meant to prevent this situation, not prevent this situation from being fixed."* So a correction that is provably identifier-only — a `supersedes:` value changed from a number to the stem it already meant — is permissible, and nothing else about the file is. Any such correction MUST be a single-line diff that alters not one word of any decision, MUST be visible in its own commit, and still requires the maintainer-armed `adr-authoring-active` marker. MUST NOT touch Context, Decision, Alternatives, Consequences, Risks, `status:`, `date:`, `decided-by:`, or `title:` under this allowance.
 - MUST NOT number an ADR with a gap, and MUST NOT reuse a number an existing stem already holds — a shared number makes every bare reference to it ambiguous.

package/plugins/ca-pi/routines/decision-lifecycle/references/adr-template.md

@@ -55,8 +55,16 @@ governs: <optional, comma-separated path globs this decision constrains — e.g.
   mirrors it for human readers. Keep the two in agreement.
 - **Status lifecycle:** `proposed → accepted → superseded | rejected`. `decompose` authors Layer 4
   ADRs as **`status: draft`** during the interview and promotes each to `status: accepted` at its
-  Phase 5 (a frontmatter `status:` edit only — never a body rewrite). Status transitions otherwise
+  Phase 5 in one sanctioned status edit that changes both the frontmatter `status:` field and the `## Status` value,
+  without changing any other body content. Status transitions otherwise
   require explicit user instruction; never advance status on the skill's own judgment.
+- **`accepted` means Accepted/Planned.** It records an approved governance decision and does not imply
+  implementation. Implemented and Verified are derived delivery states from the separate append-only
+  `adr-lifecycle.jsonl`; they are never written into ADR frontmatter. After acceptance, the decision
+  record is immutable except for the recognized, agreeing status value in the strictly parsed
+  frontmatter `status:` field and `## Status` section. Approval attribution and all other Status prose
+  remain bound with title, date, `decided-by`, supersession, governed paths, H1, and every other
+  section. A later explicit status transition changes only those recognized status values.
 - **`decided-by:`** names the user who made the decision — real attribution, never inferred.
 - **`supersedes:`** names the prior ADR's full filename stem — `supersedes:
   0014-githook-shim-dropin-fail-closed`, not `supersedes: 0014` — or `none`. A bare number is

package/plugins/ca-pi/routines/dispatching-parallel-agents/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: dispatching-parallel-agents
-description: "The parallel fan-out primitive. Routed to by any skill or command that splits work across independent units and dispatches an agent per unit — subagent-driven-development, /sprint, parallel /review. It owns the dispatch/collect/funnel discipline: bound concurrency, isolate units, collect every result, dedupe overlap, and funnel through finding-triage then checkpoint-aggregator. Raw agent output is never consumed before the funnel runs; an agent that errors drops its unit without corrupting the batch."
+description: "The parallel fan-out primitive. Routed to by any skill or command that splits work across independent units and dispatches an agent per unit — subagent-driven-development, /sprint, parallel /review. It owns the dispatch/collect/funnel discipline: bound concurrency, isolate units, collect every result, dedupe overlap, and funnel through finding-triage then the read-only verdict-aggregator. Raw agent output is never consumed before the funnel runs; an agent that errors records its unit as incomplete without corrupting the batch."
 disable-model-invocation: true
 ---
 
@@ -59,8 +59,8 @@ Gate: the result set is deduped, contradictions surfaced, and completion claims
 
 The batch is consumed only here, through the fixed funnel — never directly by the caller.
 
-1. Dispatch `finding-triage` (`<plugin-root>/agents/finding-triage.md`) over the deduped result set: it classifies severity, marks out-of-scope items with an inline `[NEEDS-TRIAGE]` marker, and discards noise.
-2. Hand the triaged set to `checkpoint-aggregator` (`<plugin-root>/agents/checkpoint-aggregator.md`): it aggregates into the single batch verdict the caller consumes — pass, or a blocking finding list.
+1. Dispatch `finding-triage` (`<plugin-root>/agents/finding-triage.md`) over the deduped result set and batch completion contract: it classifies severity and marks out-of-scope items with an inline `[NEEDS-TRIAGE]` marker. Every reviewer finding reaches the verdict; only non-finding transport metadata may be omitted.
+2. Hand the triaged set to `verdict-aggregator` (`<plugin-root>/agents/verdict-aggregator.md`): it composes the single read-only batch verdict the caller consumes — `PASS`, `BLOCKING_FINDINGS`, or `INCOMPLETE`.
 
 The errored and deferred units from Phase 3 ride through the funnel as findings — an `ERRORED` unit is a finding the caller must see, not a silent gap.
 
@@ -71,6 +71,6 @@ Gate: the caller receives only the aggregated verdict. Bypassing the funnel —
 - MUST NOT dispatch two units that mutate the same path in one batch; isolate via `using-git-worktrees` or serialize.
 - MUST NOT fan out unbounded; dispatch within the concurrency bound.
 - MUST NOT let one `ERRORED` unit discard or corrupt the rest of the batch.
-- MUST NOT consume agent output before the `finding-triage` → `checkpoint-aggregator` funnel runs.
+- MUST NOT consume agent output before the `finding-triage` → `verdict-aggregator` funnel runs.
 - MUST NOT trust a subagent's self-reported completion; verify with a fresh proving command.
 - MUST NOT silently drop a unit — every unit terminates with a recorded state that rides through the funnel.

package/plugins/ca-pi/routines/release/SKILL.md

@@ -269,7 +269,7 @@ The tag and the GitHub Release publish together, and only after the user explici
 On authorization:
 
 1. Push the tag: `git push origin ${TAG_PREFIX}${VERSION}`.
-2. **Resolve `<Phase-1 section file>` fresh in every Phase-3 invocation — never assume Phase 1's scratch file survived** (HIGH, blind exercise run 19). That file was created with `mktemp` outside the working tree and discarded once Phase 3 no longer needed it; on the `resume_publish` path (tag composed in a prior invocation, published now) it is normally already gone, and there was previously no stated way to get it back that did not read as the "re-derive or hand-write" the hard rules forbid. There is one sanctioned, mechanical way: `"$PY" "<plugin-root>/hooks/_releaselib.py" changelog-section $CHANGELOG ${VERSION}` prints the `## [${VERSION}] …` section back out of the COMMITTED `$CHANGELOG` verbatim — guaranteed present, because Phase 1 step 7 committed it before any tag existed. Redirect its stdout to a fresh local file and use that as `<Phase-1 section file>` for every step below; this is reading the exact text back from its one permanent home, not composing new notes. Exit 1 (no heading for `${VERSION}`) means `$CHANGELOG` and the tag have drifted — STOP and investigate; never compose a substitute section by hand. On a same-session fresh publish the Phase 1 scratch file is still there and this reconstruction is redundant but harmless — run it anyway, so Phase 3 does not need to know which case it is in. **Guard the notes-file first:** assert its first heading matches the tag — `"$PY" "<plugin-root>/hooks/_releaselib.py" notes-match ${TAG_PREFIX}${VERSION} <Phase-1 section file>` (exit 0). A stale notes-file (`notes_heading_matches` False) would publish the wrong changelog section under the right tag — STOP on mismatch. Then create the GitHub Release from the **same changelog section composed in Phase 1** — reuse it as the notes, never re-derive or hand-write them. **`--latest` follows the declared row:** assert it only when `$TARGET`'s row declares `latest-eligible: true`, and only when this tag is also the newest release across every declared series (compare against `gh release list`; vacuously satisfied when only one series is declared); every other target passes `--latest=false`. GitHub has one repo-wide "Latest"; a declared file may name several series, so a target claiming it wrongly hides another's current release from every visitor. `gh release create ${TAG_PREFIX}${VERSION} --title "<title>" --notes-file <Phase-1 section file> --latest --verify-tag` when the row qualifies per the rule above, otherwise `gh release create ${TAG_PREFIX}${VERSION} --title "<title>" --notes-file <Phase-1 section file> --latest=false --verify-tag` — two distinct, individually runnable commands, never the bracket notation `--latest[=false]`, which is prose shorthand and not shell `gh` accepts. The title convention is `<$DISPLAY_NAME> ${VERSION}: <summary>` — `$DISPLAY_NAME` is the row's declared `display-name`, or `$TARGET` itself when the row declares none — with no em-dash separator. **`<summary>` is derived, not invented** (MEDIUM, adversarial review 2026-07-31, run 3: it appeared exactly once in this file and was never defined, so it was whatever the agent made up): take the single highest-precedence entry from the Phase 1 section — the first bullet under `### Added` if the window bumped minor, otherwise the first bullet under `### Fixed`, else the first bullet of the first non-empty group — and compress it to a noun phrase under ten words, in the entry's own words. If that yields nothing usable because the section has one group with one terse bullet, use that bullet verbatim. Never write a summary that names a change absent from the section.
+2. **Resolve `<Phase-1 section file>` fresh in every Phase-3 invocation — never assume Phase 1's scratch file survived** (HIGH, blind exercise run 19). That file was created with `mktemp` outside the working tree and discarded once Phase 3 no longer needed it; on the `resume_publish` path (tag composed in a prior invocation, published now) it is normally already gone, and there was previously no stated way to get it back that did not read as the "re-derive or hand-write" the hard rules forbid. There is one sanctioned, mechanical way: `"$PY" "<plugin-root>/hooks/_releaselib.py" changelog-section "<project-root>" "${TAG_PREFIX}${VERSION}" "$CHANGELOG" "$VERSION"` prints the `## [${VERSION}] …` section back out of the exact regular-file blob committed under the already-composed tag — guaranteed present, because Phase 1 step 7 committed it before the tag was created. The project root and every value are separate quoted arguments; the helper rejects a nested or unrelated root, an absolute or escaping changelog path, a non-regular Git tree entry, a malformed heading, `Unreleased` in a released position, and duplicate target sections. It resolves the tag to a commit hash before reading the blob, so a dirty/deleted working file, a changed current `HEAD`, or an unrelated current directory cannot substitute Release notes after the tag is composed. Redirect stdout to a fresh local file and use that as `<Phase-1 section file>` for every step below; this is reading the exact text back from its one permanent home, not composing new notes. Exit 1 (no heading for `${VERSION}`) means the committed changelog and tag version disagree; exit 3 means the root/revision/path/blob binding could not be proven; exit 4 means the changelog is malformed or ambiguous. Every one STOPs for investigation; never compose a substitute section by hand. On a same-session fresh publish the Phase 1 scratch file is still there and this reconstruction is redundant but harmless — run it anyway, so Phase 3 does not need to know which case it is in. **Guard the notes-file first:** assert its first heading matches the tag — `"$PY" "<plugin-root>/hooks/_releaselib.py" notes-match "${TAG_PREFIX}${VERSION}" <Phase-1 section file>` (exit 0). A stale notes-file (`notes_heading_matches` False) would publish the wrong changelog section under the right tag — STOP on mismatch. Then create the GitHub Release from the **same changelog section composed in Phase 1** — reuse it as the notes, never re-derive or hand-write them. **`--latest` follows the declared row:** assert it only when `$TARGET`'s row declares `latest-eligible: true`, and only when this tag is also the newest release across every declared series (compare against `gh release list`; vacuously satisfied when only one series is declared); every other target passes `--latest=false`. GitHub has one repo-wide "Latest"; a declared file may name several series, so a target claiming it wrongly hides another's current release from every visitor. `gh release create "${TAG_PREFIX}${VERSION}" --title "<title>" --notes-file <Phase-1 section file> --latest --verify-tag` when the row qualifies per the rule above, otherwise `gh release create "${TAG_PREFIX}${VERSION}" --title "<title>" --notes-file <Phase-1 section file> --latest=false --verify-tag` — two distinct, individually runnable commands, never the bracket notation `--latest[=false]`, which is prose shorthand and not shell `gh` accepts. The title convention is `<$DISPLAY_NAME> ${VERSION}: <summary>` — `$DISPLAY_NAME` is the row's declared `display-name`, or `$TARGET` itself when the row declares none — with no em-dash separator. **`<summary>` is derived, not invented** (MEDIUM, adversarial review 2026-07-31, run 3: it appeared exactly once in this file and was never defined, so it was whatever the agent made up): take the single highest-precedence entry from the Phase 1 section — the first bullet under `### Added` if the window bumped minor, otherwise the first bullet under `### Fixed`, else the first bullet of the first non-empty group — and compress it to a noun phrase under ten words, in the entry's own words. If that yields nothing usable because the section has one group with one terse bullet, use that bullet verbatim. Never write a summary that names a change absent from the section.
 3. Handle edge cases explicitly, never silently: if a Release for the tag already exists, report it and skip creation (the tag push may already have landed); if `gh` is missing, unauthenticated, or the call fails, STOP and print the exact `gh release create` command so publication can be finished by hand rather than left half-done.
 4. **Verify publication — never assume it.** Read the Release back: `gh release view ${TAG_PREFIX}${VERSION} --json url,isDraft,tagName`. STOP unless it returns a **non-draft** Release on the correct tag; `gh release create` can partially succeed (tag pushed, Release rejected for an empty notes-file or a permissions/`--verify-tag` race), and an unverified publish is not a published release. Report the Release URL only once the read-back confirms it.
 5. **Record the tag's provenance, when the row declares one.** A git tag is a mutable ref, and the commit a tag was *originally* published at is not recoverable from the API once it moves — a moved tag looks exactly like a tag that was always there. So, when `$TARGET`'s row declares `$PROVENANCE_MANIFEST`, write it down: add the new tag to that file under `tags`, as `{"object_sha": <the ref's sha>, "object_type": "tag", "commit_sha": <the commit it dereferences to>}`. Read both mechanically from the remote you just pushed to, never from local state: `git ls-remote --tags origin ${TAG_PREFIX}${VERSION}` for the ref sha and `git rev-parse ${TAG_PREFIX}${VERSION}^{commit}` for the commit. If this project runs an automated tag-drift check in CI against that file, an unrecorded tag is an unguarded tag there. **A row declaring no `$PROVENANCE_MANIFEST` skips this step — say so explicitly in the report** rather than silently doing nothing (a skipped step and a forgotten one must never look the same to the person reading the report). The entry rides in a normal commit through `commit-gate` on the release branch.

package/plugins/ca-pi/skills/ca-checkpoint/SKILL.md

@@ -23,8 +23,8 @@ Periodic sweep of the entire codebase with the reviewer fleet, funneled to a sin
    | `architecture-drift-reviewer` | `decisions/`; drift between code and accepted ADRs |
 
 2. Route to `dispatching-parallel-agents` (`<plugin-root>/routines/dispatching-parallel-agents/SKILL.md`) with that unit list (read-only batch). It dedupes, then
-   funnels through `finding-triage` → `checkpoint-aggregator`.
-3. `checkpoint-aggregator` writes the dated report to
+   funnels through `finding-triage` → `verdict-aggregator` and returns the single read-only verdict.
+3. After the verdict returns, separately dispatch `checkpoint-aggregator` with that verdict. It writes the dated report to
    `<project-root>/.codearbiter/checkpoints/YYYY-MM-DD.md`: findings by severity with
    file:line, and out-of-scope items marked inline `[NEEDS-TRIAGE]`.
 4. Write the current override **count** to `<project-root>/.codearbiter/last-checkpoint` — the
@@ -38,8 +38,9 @@ Periodic sweep of the entire codebase with the reviewer fleet, funneled to a sin
 ## Hard gate
 
 Read-only except writing the checkpoint doc and `last-checkpoint` — MUST NOT modify code. MUST NOT
-consume raw reviewer output — only the `finding-triage` → `checkpoint-aggregator` verdict. MUST NOT
-resolve a `[CONFIRM-NN]` surfaced during the sweep by guessing. The report surfaces findings; it does
+consume raw reviewer output — only the `finding-triage` → `verdict-aggregator` verdict. Checkpoint
+persistence MUST remain the separate `checkpoint-aggregator` step and MUST NOT run for `/ca-review`
+or another generic parallel batch. MUST NOT resolve a `[CONFIRM-NN]` surfaced during the sweep by guessing. The report surfaces findings; it does
 not block or sign off anything.
 
 ## When NOT to use