[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M723M91RY3ECS5F4GJVNMFR0":3,"skill-same:01M723M91RY3ECS5F4GJVNMFR0":47},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":18,"linkOnly":19,"markdownContent":20,"markdownBody":21,"frontMatter":22,"refName":24,"commitSha":25,"skillDirectory":26,"forksCount":27,"repositoryHtmlUrl":28,"repositoryHomepageUrl":29,"ownerHtmlUrl":30,"ownerBlogUrl":31,"ownerDescription":6,"updatedAt":32,"install":33,"resources":46},"01M723M91RY3ECS5F4GJVNMFR0","commit-gate",null,"Create a verified local Git commit when committing changes is requested. Not for explaining commit history, drafting a message only, or postponing a commit. Applies every commit gate and never implies a push or PR.","arbiterForge\u002FcodeArbiter","arbiterForge","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F292945970?v=4","01M723CJ1FZ9YBVA7XXT0NJESP","01M723CJ23SYBFFTGBA7Q63BKH",153,"AGPL-3.0","https:\u002F\u002Fgithub.com\u002FarbiterForge\u002FcodeArbiter\u002Fblob\u002Fmain\u002Fplugins\u002Fca-pi\u002Froutines\u002Fcommit-gate\u002FSKILL.md",[],[],"2026-11-10 18:39:20",false,"---\nname: commit-gate\ndescription: Create a verified local Git commit when committing changes is requested. Not for explaining commit history, drafting a message only, or postponing a commit. Applies every commit gate and never implies a push or PR.\nargument-hint: (none)\n---\n\n# commit-gate\n\nThe only permitted path to a commit. Bypassing it is a hard-rule violation. Routed to when the user invokes `\u002Fcommit` or any equivalent instruction to persist staged changes.\n\nNo command arguments are required; inspect current Git state. Test-only requests use the\nrecorded invocation in `tech-stack.md` without entering this committing procedure. PR\nreadiness belongs to the existing PR workflow; an informational or message-only request\nmust not reach staging, commit, or this procedure's writing close.\n\n## Pre-flight\n\nRead these, or STOP and surface the gap — never guess a command:\n\n- `\u003Cproject-root>\u002F.codearbiter\u002Ftech-stack.md` — test, lint, and secrets-scan invocations. Stop if missing; do not guess. In an HTML-knowledge repository the same declarations come from `\"$PY\" \"\u003Cplugin-root>\u002Fhooks\u002Fknowledge.py\" commands` (see `\u003Cplugin-root>\u002Fincludes\u002Fknowledge.md`); stop if the command you need is not declared. A declared command's `run_state` is what was reported, not proof it passes.\n- `\u003Cplugin-root>\u002Fincludes\u002Fverification-boundary.md` — the required split between focused local proof and exhaustive exact-head hosted CI.\n- A git repository must be present and `git status` available. Before any mutation, capture and\n  retain the HEAD identity, exact `git status --porcelain --untracked-files=all` inventory, index\n  entries, and each inventoried path's worktree SHA-256 or recorded absence. Include every staged,\n  unstaged and untracked file. This content-addressed baseline owns Phase 2 transfer checks and\n  Phase 9's post-commit comparison; a path\u002Fstatus list alone is insufficient.\n- Read the scoped obligations and observed evidence under `\u003Cplugin-root>\u002Froutines\u002Ftdd\u002FSKILL.md`. Confirmed fixes require regression RED\u002FGREEN; features require current criterion-focused checks; refactors require passing characterization\u002Fparity evidence. Apply the relevant coverage and lint requirements. Resolve missing evidence for the staged change using its selected verification approach.\n- The discovered authoritative spec\u002Fplan pair, when relevant to this commit. For HTML,\n  load `\u003Cplugin-root>\u002Fincludes\u002Fartifacts.md` and read the exact spec\u002Fplan\n  identity, task progress and criteria through typed operations. `eligible`\n  gives scheduling advice, **not** authority, verification or a reason to forbid\n  committing already-authorized work. `REVIEW` and `DONE` describe work\n  progress, not independent checks.\n\nA plan may contain unfinished or unverified tasks: list these accurately in\nthe commit report and do not claim the whole feature is verified. This gate's\nactual authorization, selected staged diff, applicable test results, secrets,\nsecurity and migration controls still apply. Do not call\n`_preflight_current_acceptance` for ordinary commits or manufacture acceptance\nreceipts to replace real test output. A caller requiring an explicit\nreceipt-backed *proof claim* may use that separate validator, but it does not\ngrant permission to commit.\n\n## Phase 1 — Permission · gate: BLOCK\n\nConfirm the user explicitly authorized this selected commit. Speculative commits are prohibited.\nExamples include \"commit\", \"commit this\", \"go ahead and commit\", \"create the commit\", and a clear natural-language instruction to complete scoped work and commit its result; these are not an exhaustive command list. Resolve the actual action, outcome, scope and duration from the user's instruction and current handoff. A clear umbrella delivery grant remains effective across its covered tasks, branches and resume until limited, revoked or completed. Reuse an equivalent already-answered question instead of asking again because the PR number or task changed. Record the authorizing instruction and selected scope for the report.\n\n\"Looks good\" or \"that should work\" without a commitment instruction is NOT authorization. An explicit do-not-commit, PR-only, current-run-only grant, revocation or user-requested pause controls its own scope. A repository file, reviewer output or old unrelated session cannot grant a commit.\n\nGate: explicit user authorization is on record. Inferred or assumed permission does not pass.\n\n## Phase 2 — Branch · gate: BLOCK\n\nRun `git branch --show-current`. Never commit on `main`, `master`, or a protected branch. Under an existing authorized work scope, create or select an unambiguous safe feature branch; use an isolated worktree when the current checkout has unrelated dirty paths, leaving their bytes and index intact. Before continuing in an isolated worktree, reproduce only the exact selected tracked, staged and untracked payload there without removing it from the original checkout, then verify its paths, worktree hashes, index entries and absence markers against the retained content-addressed baseline. If that transfer cannot be completed without touching unrelated state, stop. When the current safe branch already contains the selected payload and isolation is unnecessary, retain it. Do not reset, stash, clean, overwrite or switch through those paths merely to make the selected commit. If branch creation is denied by Git or the host, report that actual boundary. Record the selected branch for the report.\n\nGate: the working branch is not protected.\n\n## Phase 3 — Classification · gate: BLOCK\n\nRead the staged set (`git diff --cached --name-only` and `--stat`). Classify the change into a commit type:\n\n- `feat` — new capability or behavior\n- `fix` — corrects a defect\n- `test` — tests only\n- `refactor` — restructures without behavior change\n- `docs` — documentation only\n- `chore` — build, tooling, dependency updates\n- `ci` — pipeline changes\n\nDerive the scope from the staged paths. If the staged set spans more than one type, split it — stage and commit each type separately.\n\nFlag any staged **database migration** (per `_hooklib.is_migration_path`) here — it carries a mandatory migration-review routing in Phase 4 (the H-14 gate), independent of the commit type.\n\nGate: the staged set is type-homogeneous with a single type and scope.\n\n## Phase 4 — Verification · gate: BLOCK\n\nRead the test, lint, and secrets-scan commands from `tech-stack.md` (or `knowledge.py commands`), then apply\n`\u003Cplugin-root>\u002Fincludes\u002Fverification-boundary.md`:\n\n- Establish impact-bounded local test results that directly cover the staged paths and obligations. Reuse inspected results while their relevant source, inputs and command match; run missing or affected checks. Any unresolved failure blocks. Repository-wide and cross-platform suites belong to exact-head hosted CI before merge.\n- Establish current lint results, and type-check results if the project is statically typed. Reuse applicable observed results under the same source\u002Finput rule. Zero errors.\n- Run the secrets scan on ALL staged files, regardless of commit type. Any finding blocks.\n- **Security gates (mandatory routing):** if the staged diff touches crypto\u002FTLS or secret patterns, route it through `crypto-compliance` (`\u003Cplugin-root>\u002Froutines\u002Fcrypto-compliance\u002FSKILL.md`) and\u002For `secret-handling` (`\u003Cplugin-root>\u002Froutines\u002Fsecret-handling\u002FSKILL.md`) — they scan against `security-controls.md` and, on pass, record the exact staged-candidate marker `.codearbiter\u002F.markers\u002Fsecurity-gate-passed` (via `hooks\u002Fsecurity-pass.py`). This is not optional: the PreToolUse commit hook **H-09b\u002FH-10b blocks the commit** until that gate pass is recorded AND matches the complete staged diff.\n- **Migration gate (mandatory routing):** if the staged set contains a database migration (Phase 3 flags it; the detection rule is `_hooklib.is_migration_path` — default migration globs, extendable\u002Fnarrowable via a `migration-paths` block in `security-controls.md`), dispatch the independent `migration-reviewer` agent (`\u003Cplugin-root>\u002Fagents\u002Fmigration-reviewer.md`) on those exact staged files. **On a genuine PASS only**, record the staged-set and worktree-bound marker `.codearbiter\u002F.markers\u002Fmigration-gate-passed` with one standalone command whose current working directory is the reviewed checkout: `python \"\u003Cplugin-root>\u002Fhooks\u002Fmigration-pass.py\"` (substitute the host's known Python 3 launcher when its literal name differs; do not chain launcher discovery with the producer). Do not run it from a launch-time main checkout when the review covered a linked worktree. This sanctioned PASS recording is not an override. The PreToolUse commit hook **H-14 blocks the commit** until the marker covers the complete staged migration path\u002Fcontent set and the same worktree identity; an unstaged\u002Funtracked migration is not absorbed, and any later addition, omission, rename, or edit re-blocks. On a BLOCK, unreadable candidate, self-review, or wrong-worktree result, do not record the pass. `\u002Foverride` remains only the explicit exception that skips review.\n- **CI\u002Fdeploy review (mandatory routing, no marker gate):** if the staged set touches a CI\u002FCD workflow (`_hooklib.is_ci_path` — defaults extendable via a `ci-paths` block in `security-controls.md`) or a deployment\u002FIaC manifest (`_hooklib.is_deploy_path` — `deploy-paths` block), dispatch the `security-reviewer` agent (`\u003Cplugin-root>\u002Fagents\u002Fsecurity-reviewer.md`). This is the enforcement point the advisory `post-write-edit` reminders **H-15\u002FH-16** point to, and it closes the bare-`\u002Fcommit` \u002F small-lane gap for CI\u002Fdeploy (the `\u002Freview`, `\u002Fpr`, `\u002Fcheckpoint`, and sprint lanes already dispatch it). Unlike crypto\u002Fsecret\u002Fmigration there is **no commit-block marker** — a CI workflow runs only once merged and IaC bites only on apply, so a BLOCK-level finding halts the commit via Phase 6 review, but routine CI\u002Fdeploy edits are not gated per-commit. Act on the findings by severity; do not record a marker.\n\nRequired specialized review may reuse an existing review of the same source,\nrequirements, findings and verification inputs. Dispatch only missing or affected\nreview work. Required security and migration markers must still cover the actual\nstaged content; a prior review does not waive their writers or hook checks.\nRecord each result (PASS \u002F BLOCK), its source and whether it was reused or run.\n\nGate: the applicable focused tests, lint\u002Ftype-check, secrets scan, and specialized gates all PASS. Any failure halts the commit until fixed and re-run. This gate does not claim that exhaustive hosted CI has run; `finishing-a-development-branch` proves that separately before merge.\n\n## Phase 5 — Behavioral proof · gate: BLOCK\n\nApply the current-evidence rules in `\u003Cplugin-root>\u002Fincludes\u002Ffresh-verification.md`, with\n**the spec's acceptance criterion** as the target — prove the behavior against the spec, not against a\nself-report.\n\n- Identify the proving command or observable from the selected authoritative\n  pair. For Markdown, use the existing criterion and task-verification text. For\n  HTML, use the exact criterion and task records returned by symbol-scoped\n  engine `read`; never scrape the rendered document. If none exists, derive the\n  smallest command that exercises the claimed behavior.\n- Inspect the applicable output and exit code and confirm the observed behavior matches the spec's acceptance criteria. Reuse the Phase 4 or implementation result when it already proves that criterion on unchanged relevant inputs. Run a separate proving command only when existing evidence is missing, affected or insufficient. A mismatch or unverifiable claim blocks.\n\n**Stakes:** a behavioral-proof mismatch means the change does not do what the spec claims — state what would ship broken if this passed (\"the retry path never fires; a transient error would hang the caller\"), not just \"proof mismatch.\" That gap is exactly what a green-looking suite hides.\n\nGate: inspected current command output and exit code prove the claimed behavior. The phase change alone does not require another run. A self-reported \"it works\" does not pass.\n\n## Phase 5.5 — Provenance auto-heal (conditional)\n\nAn HTML-knowledge repository has no provenance records, so this phase does\nnothing there. Knowledge freshness is advisory: when staged paths are ones that\nknowledge records govern, `knowledge.py stale` lists those records for the next\ncontext refresh. It never blocks the commit and is never auto-rewritten here.\n\nPartition the loaded records by schema. Select only recorded content paths or\nmembership scopes\u002Fpredicates intersecting staged sources. Commits touching no\nrecorded source do no re-scout work. An empty legacy worklist says nothing about v2.\nInclude deleted paths and both sides of renames in `staged_paths`, for example\nwith `git diff --cached --name-only --no-renames`.\n\n**Managed v2 pairs:** acquire one bounded snapshot covering the selected documents'\nrecorded dependencies and target preimages. Call `assess_context_provenance` for\nthose document IDs with its action-boundary snapshot probe, then reuse that\nsnapshot and assessment in\n`_provenancelib.v2_heal_worklist(staged_paths, provenance, snapshot, assessment)`.\nIts `claims` identify the affected document, field, claim and staged source paths;\nthey select inspection work, not permission to write. These paths are staged triggers;\ninspect the selected claims' complete recorded evidence before refreshing their fields,\nincluding any changed unstaged dependency. Preserve uninspected claims and bindings.\nReport `unknown` entries and defer that document's automatic\nupdate; do not label it fresh or block independent commit work.\n\nWhen inspected claims still hold, prepare an `update` of the selected owned fields\nwith unchanged content and current source evidence. When a claim changed, propose\nthe bounded content correction for Phase 6 review. Use the typed `context-preview`\nand `context-apply` procedure in\n`\u003Cplugin-root>\u002Froutines\u002Fcontext-check\u002FSKILL.md`, retaining exact expected pair hashes,\nthe returned preview reference\u002Fdigest and all unselected bytes. Reuse the existing\nmaintenance authorization; do not enter a second approval cycle. Native apply\nrechecks the source and pair identities and writes both files together. Read back\nthe result. Never pass v2 records to `rebaseline` or write them directly. Stage the\nresulting pair by explicit paths and secrets-scan every newly staged file.\n\n**Legacy v1 records:** compute the heal worklist via\n`_provenancelib.heal_worklist(staged_paths, provenance, current_hashes)` — staged\n`drift_trigger:true` entries whose hash diverged or is absent. An empty v1 worklist\nskips only this legacy branch.\n\nNon-empty worklist → call `_provenancelib.compute_drift(provenance, current_hashes)` to retain the document\u002Fsource mapping. For each stale document in that drift report, get its record as `doc_provenance` and call `_provenancelib.changed_scope(doc_provenance, drift)`. Intersect that document's drifted paths with the worklist; skip a document when the intersection is empty. The hash map can omit unstaged paths, so a missing entry outside the worklist must not broaden this commit's re-scout. Confirm that every selected worklist path maps to at least one stale document after this filtering; if a record is malformed or the mapping is incomplete, STOP and report the gap rather than treating the path as fresh.\n\nRun an **incremental re-scout for each affected document**, scoped to its selected staged paths only (not the full repo). A fresh first document does not discharge a stale second document's claims for the same source. Resolve each selected document\u002Fpath dependency independently:\n\n- **Claim still holds → silently re-baseline only that document's provenance record.** Call `_provenancelib.rebaseline(doc_provenance, selected_current_hashes)` where `selected_current_hashes` contains current hashes only for the selected staged paths whose claims in that document were inspected and still hold. Do not re-baseline a path whose claim changed or was not inspected. Stage only `.codearbiter\u002F.provenance\u002F\u003Cdoc>.json` by explicit path so the re-baselined record rides THIS commit (ADR-0008 ride-along pattern — nothing is surfaced to the user). After staging, re-run the secrets scan from `tech-stack.md` over the newly-staged path(s) — any file staged after Phase 4 must still pass the automated secrets scan before the commit proceeds. A missing current hash (deletion or rename) cannot be silently re-baselined; surface it in Phase 6 for review.\n- **Claim changed → route to the existing Phase 6 diff-review.** Propose only the affected doc or code-map edit required to reflect its changed claim. The user reviews that edit in the normal diff, and Phase 7 stages approved paths explicitly; do not silently rewrite or add unrelated documentation.\n\nFor reviewed legacy code-map metadata in codeArbiter's source layout, use the\nshipped fixed-target helper at `\u003Cplugin-root>\u002Fhooks\u002Fresolve-context-conflict.py`.\nThis claim-refresh lane reads all three fixed source manifests:\n`\u003Cproject-root>\u002Fplugins\u002Fca\u002F.claude-plugin\u002Fplugin.json`,\n`\u003Cproject-root>\u002Fplugins\u002Fca-codex\u002F.codex-plugin\u002Fplugin.json`, and `\u003Cproject-root>\u002Fplugins\u002Fca-pi\u002Fpackage.json`,\neven for a date-only refresh. Other repository layouts and arbitrary manifest\nclaims are unsupported.\n\nResolve the interpreter once by presence, then inspect:\n\n```sh\nPY=python3; { command -v python3 >\u002Fdev\u002Fnull 2>&1 && python3 --version >\u002Fdev\u002Fnull 2>&1; } || PY=python\n\"$PY\" \"\u003Cplugin-root>\u002Fhooks\u002Fresolve-context-conflict.py\" --root \"\u003Cproject-root>\" inspect-claims\n```\n\nPass the returned `binding` to the same helper and interpreter:\n\n```sh\n\"$PY\" \"\u003Cplugin-root>\u002Fhooks\u002Fresolve-context-conflict.py\" --root \"\u003Cproject-root>\" refresh-claims --expected '\u003Cbinding>' --claims '\u003Cjson-array>'\n```\n\nSupply one to four reviewed records containing exactly\n`field`, `before`, and `after`. The supported existing fields are `ca_version`,\n`codex_version`, `pi_version`, and `metadata_date`. Use the inspection's exact\ncurrent claim as `before`; a version's `after` must match its fixed source\nmanifest, and the date must match `inspection_date`. Use the selected interpreter\nfor both calls; never retry a failed operation under another interpreter.\n\nThis operation requires resolved, tracked legacy schema-1 document\u002Fprovenance\nand no native or uncertain journal ownership. It binds document, provenance,\nGit\u002Findex, source manifest bytes and date, preserves all unselected bytes, and\ndoes not stage, rebaseline, adopt, enroll or create a native receipt. Inspect the\nworktree diff for `.codearbiter\u002Fcode-map.md`, selectively stage that explicit\npath, and re-run the normal secrets scan over the newly staged Markdown before\nPhase 6. Treat it as a heal-proposed doc\u002Fcode-map edit in Phase 6 review, never as\na silent rebaseline, and retain its explicit inclusion in Phase 7. Provenance\nrebaseline remains separately scoped by Phase 5.5. Unsupported\nclaims or refused preimages stop the edit; do not substitute a direct write or\nnative adoption. A codeArbiter contributor may exercise the tested and\nindependently reviewed canonical helper under `core\u002Fpysrc\u002F` with live enforcement\nintact, never a copied script, installed-cache edit or hook\u002Ftrust change.\n\n## Phase 6 — Diff review · gate: BLOCK\n\nRead the complete staged diff (`git diff --cached`). Flag as blocking:\n\n- Unexpected files — not discussed in the session.\n- Credentials, tokens, API keys, or any secret — belt-and-suspenders to Phase 4.\n- Incomplete changes — TODO markers, placeholder values, dead commented-out code, partial stubs.\n- Tests disabled or skipped that were not intentionally disabled.\n- Scope creep — changes outside the agreed feature or fix boundary.\n\n**Board-edit exemption (ADR-0008):** ADR-0008 governs lifecycle transitions riding a commit whose primary purpose is something else — a board edit inside such a commit is **expected and RETAINED** (not scope creep, MUST NOT be unstaged) only when `_taskboardlib.classify_board_diff(old, new)` returns a clean transition: a done-flip `[~]`→`[x]`; a start-flip `[ ]`→`[~]` with its optional minted dotted ID; an attachment-only Spec ID or Plan ID binding; start+attachment; start+complete `[ ]`→`[x]`; one queued or already-started addition; or a missing level-two section plus one queued addition. Any other `open-tasks.md` edit riding an unrelated commit does not classify as one of those transitions and still flags as scope creep — it does not belong to that commit's agreed boundary.\n\nThis does not cover a commit whose own Phase 3 classification **is** the board change — e.g. a `docs` chore whose sole content is a `\u002Fca-standup` archival sweep (open-tasks.md removals plus the matching `done-tasks.md` append). There, the boundary was already agreed at Phase 3, so those edits are in-scope by that classification directly; `classify_board_diff` is not consulted and does not need to recognize archival as a fourth transition.\n\n**Native work co-location (ADR-0008):** use the installed `work.py list --limit 1`\nowner check before applying the board exemption. A `project_id` response selects\nnative work; a dual-owner or failed read is a stop. For each staged\n`.codearbiter\u002Fwork\u002F\u003Cwork_id>.html`, reject unstaged changes to that same path,\nthen use installed `work.py get \u003Cwork_id>` to verify the current native identity,\nstate, and intended relationship to this commit. Review the exact staged diff;\nfor a first native item, also review `.codearbiter\u002Fwork\u002Fproject.json` as the\nportable project identity and reject a staged\u002Fcurrent mismatch on that path.\nThe first work-create writes project.json and the HTML together; omitting the\nidentity would leave the work unreadable in a fresh clone. Resolve the installed\nhelper and Python from the loaded `ca-commit` skill or `commit.md` command\nresource using its installed\n`..\u002F..\u002Fincludes\u002Fhelper-invocation.md`\ncard; invoke with the card's current-shell syntax.\ndo not grant a blanket exemption to arbitrary work HTML or a change to a\ndifferent ID. An in-scope lifecycle change rides the work commit, including a\nnew queued follow-up from harvest. A standup archive belongs to its own Phase 3\nclassification, as with the legacy board archive. Do not run\n`classify_board_diff` on native work or create a Markdown mirror.\n\n**Provenance re-baseline exemption (ADR-0008):** a `.codearbiter\u002F.provenance\u002F\u003Cdoc>.json` file written by the Phase 5.5 auto-heal re-baseline is likewise **expected and RETAINED** — it is not scope creep and MUST NOT be unstaged. A heal-proposed doc or code-map edit (the claim-changed path from Phase 5.5) appears in the diff for normal review; treat it as any other finding. This exemption waives the scope-creep flag only; the secrets check is not waived — the automated re-scan in Phase 5.5 covers the provenance file.\n\nOn any blocking finding, unstage the affected files, surface the finding, and STOP. An out-of-scope change that should not be lost gets an inline `[NEEDS-TRIAGE]` marker before it is set aside.\n\n**Stakes:** name what the finding would have cost if committed — a leaked credential is live the moment it lands and must be rotated; a scope-creep file ships untested behavior the review waved through. State that consequence on a credential or scope finding, not just \"out of scope.\"\n\nGate: the diff is clean — zero blocking findings.\n\n## Phase 7 — Selective stage · gate: BLOCK\n\n**First, run the follow-up harvest — before staging anything.** Run the follow-up harvest (`\u003Cplugin-root>\u002Fincludes\u002Fharvest.md`) over any Phase 6 `[NEEDS-TRIAGE]` set-asides — promote discovered work through the selected owner (legacy `open-tasks.md` or native work HTML) and decisions to `open-questions.md`. Running this before the commit means raised work is staged and rides the work commit in the same payload.\n\n**Atomicity rule:** a raised task riding the work commit is a **contingent default** — if the PR\u002Fbranch is abandoned, the selected owner's additions are abandoned with it (self-correcting, ADR-0008). A follow-up that **must survive** PR abandonment is filed as a **GitHub issue**, not local work.\n\nBefore staging any newly harvested native work, review the exact current HTML\nbytes and, for the first item, `project.json` bytes under the Phase 6 secret,\nidentity, scope, and native work checks. Verify the selected owner and current\n`work.py get \u003Cwork_id>` result, and reject unexpected or mismatched files. A\npath-list check alone does not review these newly created bytes. If this review\nfinds a blocker, stop before the commit; do not exempt the harvest output.\n\nThen selectively stage: if files were unstaged in Phase 6, re-stage only the clean files by explicit path: `git add path\u002Fto\u002Ffile`. For the legacy owner, retain clean board transitions and harvest additions by explicitly staging `open-tasks.md`. For the native owner, stage validated `.codearbiter\u002Fwork\u002F\u003Cwork_id>.html` paths returned or changed by the selected work operation, each by its exact ID. When the first native work-create also creates `.codearbiter\u002Fwork\u002Fproject.json`, stage that exact validated identity path in the same commit; if its staged bytes differ from current bytes, stop. Never stage the whole work directory or a journal. The lifecycle change rides the same work commit. When Phase 5.5 produced a re-baselined provenance record, include the affected `.codearbiter\u002F.provenance\u002F\u003Cdoc>.json` file(s) by explicit path in the same selective stage so the re-baselined record rides the work commit. Re-run `git diff --cached --name-only` and confirm the staged list matches the intended set exactly — no extra files. Unstage any extra and report the discrepancy.\n\nFor harvested native work, compare the newly staged HTML and first-item\n`project.json` with the reviewed current bytes, then inspect their exact\n`git diff --cached` content and rerun Phase 6 secret, identity, scope, and\nnative work checks on those staged bytes. A mismatch or new finding blocks\nthe commit. This check is required even when the staged path list is exact.\n\nGate: the staged set contains exactly the intended files. MUST NOT use `git add -A`, `git add .`, or any wildcard.\n\n## Phase 8 — Message · gate: BLOCK\n\nCompose a Conventional Commits message:\n\n- Subject: `\u003Ctype>(\u003Cscope>): \u003Cimperative summary>`, MUST NOT exceed 72 characters.\n- Blank line, then a body explaining WHY — not a restatement of what changed.\n- For `feat` and `fix`, add a `CHANGELOG:` footer summarizing the user-visible impact.\n- If the commit closes an issue or references a decision, add the footer (`Closes #NN`, `Ref: ADR-NNNN`).\n- No content-free subjects — \"fix bug\", \"update code\", \"changes\" do not pass.\n\nGate: subject ≤ 72 chars, a body is present, and any `feat`\u002F`fix` carries a `CHANGELOG:` footer.\n\n## Phase 9 — Commit · gate: BLOCK\n\nCommit with the approved message via `-m` or heredoc with proper quoting — never an interactive editor. Capture the resulting SHA.\n\nIf a pre-commit hook fails: read its output in full, fix the issue, re-stage by explicit path (Phase 7 rules apply), and create a NEW commit. MUST NOT `--amend` after a hook failure.\n\nAfter a successful commit, recapture the status inventory, index entries and worktree SHA-256\u002Fabsence for every preflight path and every newly reported path. Compare them with the content-addressed baseline: require no remaining staged or tracked changes in the selected reviewed payload, and investigate any unexpected path, byte or index mutation made during this commit. Report unrelated preexisting paths only when their recorded bytes and index state are unchanged; never stage, clear or call changed data preexisting. Native `.codearbiter\u002F.artifacts\u002F` files created by the selected helper are local recovery metadata: report their presence, preserve them in this worktree, and do not treat that exact path alone as source dirt. Do not ignore, stage, move, or delete the store to make the check pass. Deliver the report: SHA, branch, explicit file list, gate results (test \u002F lint \u002F secrets), and the message used.\n\nGate: the selected reviewed payload lands with no unexpected remaining changes to its paths. Unrelated preexisting paths remain intact and visible; new unexplained changes block closure until classified.\n\n## Hard rules\n\n- MUST NOT commit without explicit user authorization for the selected action; a clear scoped natural-language grant counts, while \"it looks good\" alone does not.\n- MUST NOT commit to `main`, `master`, or any protected branch.\n- MUST NOT run `git add -A`, `git add .`, or any wildcard staging.\n- MUST NOT commit while any test is failing, any lint error stands, or any secret is present.\n- MUST NOT turn exhaustive repository-wide or cross-platform CI into a local prerequisite when the shared `verification-boundary` assigns it to exact-head hosted CI.\n- MUST prove the behavior against the spec with inspected current evidence (Phase 5); a self-reported \"it works\" is insufficient.\n- MUST NOT skip, disable, or work around any automated gate.\n- MUST NOT commit a staged database migration without a recorded migration-review pass — the H-14 hook blocks it until `migration-reviewer` passes and `hooks\u002Fmigration-pass.py` records the content-bound marker.\n- MUST NOT `--amend` after a pre-commit hook failure — create a new commit.\n- MUST NOT guess the test, lint, or secrets-scan command — read `tech-stack.md` (or `knowledge.py commands`) or STOP.\n- MUST NOT silently rewrite a doc's claims — a claim-change edit proposed by Phase 5.5 goes through diff review (Phase 6), never through the silent re-baseline path. The re-baseline path is strictly for claims that still hold; the Phase 5.5 re-baseline MUST ride the work commit (staged by explicit path in Phase 7).\n- MUST, **at Phase 7 before staging**, run the follow-up harvest (`\u003Cplugin-root>\u002Fincludes\u002Fharvest.md`) over any Phase 6 `[NEEDS-TRIAGE]` set-aside — promote work through the selected owner and decisions to `open-questions.md` so raised tasks ride the work commit. A follow-up that must survive PR abandonment is filed as a GitHub issue, not local work.\n","# commit-gate\n\nThe only permitted path to a commit. Bypassing it is a hard-rule violation. Routed to when the user invokes `\u002Fcommit` or any equivalent instruction to persist staged changes.\n\nNo command arguments are required; inspect current Git state. Test-only requests use the\nrecorded invocation in `tech-stack.md` without entering this committing procedure. PR\nreadiness belongs to the existing PR workflow; an informational or message-only request\nmust not reach staging, commit, or this procedure's writing close.\n\n## Pre-flight\n\nRead these, or STOP and surface the gap — never guess a command:\n\n- `\u003Cproject-root>\u002F.codearbiter\u002Ftech-stack.md` — test, lint, and secrets-scan invocations. Stop if missing; do not guess. In an HTML-knowledge repository the same declarations come from `\"$PY\" \"\u003Cplugin-root>\u002Fhooks\u002Fknowledge.py\" commands` (see `\u003Cplugin-root>\u002Fincludes\u002Fknowledge.md`); stop if the command you need is not declared. A declared command's `run_state` is what was reported, not proof it passes.\n- `\u003Cplugin-root>\u002Fincludes\u002Fverification-boundary.md` — the required split between focused local proof and exhaustive exact-head hosted CI.\n- A git repository must be present and `git status` available. Before any mutation, capture and\n  retain the HEAD identity, exact `git status --porcelain --untracked-files=all` inventory, index\n  entries, and each inventoried path's worktree SHA-256 or recorded absence. Include every staged,\n  unstaged and untracked file. This content-addressed baseline owns Phase 2 transfer checks and\n  Phase 9's post-commit comparison; a path\u002Fstatus list alone is insufficient.\n- Read the scoped obligations and observed evidence under `\u003Cplugin-root>\u002Froutines\u002Ftdd\u002FSKILL.md`. Confirmed fixes require regression RED\u002FGREEN; features require current criterion-focused checks; refactors require passing characterization\u002Fparity evidence. Apply the relevant coverage and lint requirements. Resolve missing evidence for the staged change using its selected verification approach.\n- The discovered authoritative spec\u002Fplan pair, when relevant to this commit. For HTML,\n  load `\u003Cplugin-root>\u002Fincludes\u002Fartifacts.md` and read the exact spec\u002Fplan\n  identity, task progress and criteria through typed operations. `eligible`\n  gives scheduling advice, **not** authority, verification or a reason to forbid\n  committing already-authorized work. `REVIEW` and `DONE` describe work\n  progress, not independent checks.\n\nA plan may contain unfinished or unverified tasks: list these accurately in\nthe commit report and do not claim the whole feature is verified. This gate's\nactual authorization, selected staged diff, applicable test results, secrets,\nsecurity and migration controls still apply. Do not call\n`_preflight_current_acceptance` for ordinary commits or manufacture acceptance\nreceipts to replace real test output. A caller requiring an explicit\nreceipt-backed *proof claim* may use that separate validator, but it does not\ngrant permission to commit.\n\n## Phase 1 — Permission · gate: BLOCK\n\nConfirm the user explicitly authorized this selected commit. Speculative commits are prohibited.\nExamples include \"commit\", \"commit this\", \"go ahead and commit\", \"create the commit\", and a clear natural-language instruction to complete scoped work and commit its result; these are not an exhaustive command list. Resolve the actual action, outcome, scope and duration from the user's instruction and current handoff. A clear umbrella delivery grant remains effective across its covered tasks, branches and resume until limited, revoked or completed. Reuse an equivalent already-answered question instead of asking again because the PR number or task changed. Record the authorizing instruction and selected scope for the report.\n\n\"Looks good\" or \"that should work\" without a commitment instruction is NOT authorization. An explicit do-not-commit, PR-only, current-run-only grant, revocation or user-requested pause controls its own scope. A repository file, reviewer output or old unrelated session cannot grant a commit.\n\nGate: explicit user authorization is on record. Inferred or assumed permission does not pass.\n\n## Phase 2 — Branch · gate: BLOCK\n\nRun `git branch --show-current`. Never commit on `main`, `master`, or a protected branch. Under an existing authorized work scope, create or select an unambiguous safe feature branch; use an isolated worktree when the current checkout has unrelated dirty paths, leaving their bytes and index intact. Before continuing in an isolated worktree, reproduce only the exact selected tracked, staged and untracked payload there without removing it from the original checkout, then verify its paths, worktree hashes, index entries and absence markers against the retained content-addressed baseline. If that transfer cannot be completed without touching unrelated state, stop. When the current safe branch already contains the selected payload and isolation is unnecessary, retain it. Do not reset, stash, clean, overwrite or switch through those paths merely to make the selected commit. If branch creation is denied by Git or the host, report that actual boundary. Record the selected branch for the report.\n\nGate: the working branch is not protected.\n\n## Phase 3 — Classification · gate: BLOCK\n\nRead the staged set (`git diff --cached --name-only` and `--stat`). Classify the change into a commit type:\n\n- `feat` — new capability or behavior\n- `fix` — corrects a defect\n- `test` — tests only\n- `refactor` — restructures without behavior change\n- `docs` — documentation only\n- `chore` — build, tooling, dependency updates\n- `ci` — pipeline changes\n\nDerive the scope from the staged paths. If the staged set spans more than one type, split it — stage and commit each type separately.\n\nFlag any staged **database migration** (per `_hooklib.is_migration_path`) here — it carries a mandatory migration-review routing in Phase 4 (the H-14 gate), independent of the commit type.\n\nGate: the staged set is type-homogeneous with a single type and scope.\n\n## Phase 4 — Verification · gate: BLOCK\n\nRead the test, lint, and secrets-scan commands from `tech-stack.md` (or `knowledge.py commands`), then apply\n`\u003Cplugin-root>\u002Fincludes\u002Fverification-boundary.md`:\n\n- Establish impact-bounded local test results that directly cover the staged paths and obligations. Reuse inspected results while their relevant source, inputs and command match; run missing or affected checks. Any unresolved failure blocks. Repository-wide and cross-platform suites belong to exact-head hosted CI before merge.\n- Establish current lint results, and type-check results if the project is statically typed. Reuse applicable observed results under the same source\u002Finput rule. Zero errors.\n- Run the secrets scan on ALL staged files, regardless of commit type. Any finding blocks.\n- **Security gates (mandatory routing):** if the staged diff touches crypto\u002FTLS or secret patterns, route it through `crypto-compliance` (`\u003Cplugin-root>\u002Froutines\u002Fcrypto-compliance\u002FSKILL.md`) and\u002For `secret-handling` (`\u003Cplugin-root>\u002Froutines\u002Fsecret-handling\u002FSKILL.md`) — they scan against `security-controls.md` and, on pass, record the exact staged-candidate marker `.codearbiter\u002F.markers\u002Fsecurity-gate-passed` (via `hooks\u002Fsecurity-pass.py`). This is not optional: the PreToolUse commit hook **H-09b\u002FH-10b blocks the commit** until that gate pass is recorded AND matches the complete staged diff.\n- **Migration gate (mandatory routing):** if the staged set contains a database migration (Phase 3 flags it; the detection rule is `_hooklib.is_migration_path` — default migration globs, extendable\u002Fnarrowable via a `migration-paths` block in `security-controls.md`), dispatch the independent `migration-reviewer` agent (`\u003Cplugin-root>\u002Fagents\u002Fmigration-reviewer.md`) on those exact staged files. **On a genuine PASS only**, record the staged-set and worktree-bound marker `.codearbiter\u002F.markers\u002Fmigration-gate-passed` with one standalone command whose current working directory is the reviewed checkout: `python \"\u003Cplugin-root>\u002Fhooks\u002Fmigration-pass.py\"` (substitute the host's known Python 3 launcher when its literal name differs; do not chain launcher discovery with the producer). Do not run it from a launch-time main checkout when the review covered a linked worktree. This sanctioned PASS recording is not an override. The PreToolUse commit hook **H-14 blocks the commit** until the marker covers the complete staged migration path\u002Fcontent set and the same worktree identity; an unstaged\u002Funtracked migration is not absorbed, and any later addition, omission, rename, or edit re-blocks. On a BLOCK, unreadable candidate, self-review, or wrong-worktree result, do not record the pass. `\u002Foverride` remains only the explicit exception that skips review.\n- **CI\u002Fdeploy review (mandatory routing, no marker gate):** if the staged set touches a CI\u002FCD workflow (`_hooklib.is_ci_path` — defaults extendable via a `ci-paths` block in `security-controls.md`) or a deployment\u002FIaC manifest (`_hooklib.is_deploy_path` — `deploy-paths` block), dispatch the `security-reviewer` agent (`\u003Cplugin-root>\u002Fagents\u002Fsecurity-reviewer.md`). This is the enforcement point the advisory `post-write-edit` reminders **H-15\u002FH-16** point to, and it closes the bare-`\u002Fcommit` \u002F small-lane gap for CI\u002Fdeploy (the `\u002Freview`, `\u002Fpr`, `\u002Fcheckpoint`, and sprint lanes already dispatch it). Unlike crypto\u002Fsecret\u002Fmigration there is **no commit-block marker** — a CI workflow runs only once merged and IaC bites only on apply, so a BLOCK-level finding halts the commit via Phase 6 review, but routine CI\u002Fdeploy edits are not gated per-commit. Act on the findings by severity; do not record a marker.\n\nRequired specialized review may reuse an existing review of the same source,\nrequirements, findings and verification inputs. Dispatch only missing or affected\nreview work. Required security and migration markers must still cover the actual\nstaged content; a prior review does not waive their writers or hook checks.\nRecord each result (PASS \u002F BLOCK), its source and whether it was reused or run.\n\nGate: the applicable focused tests, lint\u002Ftype-check, secrets scan, and specialized gates all PASS. Any failure halts the commit until fixed and re-run. This gate does not claim that exhaustive hosted CI has run; `finishing-a-development-branch` proves that separately before merge.\n\n## Phase 5 — Behavioral proof · gate: BLOCK\n\nApply the current-evidence rules in `\u003Cplugin-root>\u002Fincludes\u002Ffresh-verification.md`, with\n**the spec's acceptance criterion** as the target — prove the behavior against the spec, not against a\nself-report.\n\n- Identify the proving command or observable from the selected authoritative\n  pair. For Markdown, use the existing criterion and task-verification text. For\n  HTML, use the exact criterion and task records returned by symbol-scoped\n  engine `read`; never scrape the rendered document. If none exists, derive the\n  smallest command that exercises the claimed behavior.\n- Inspect the applicable output and exit code and confirm the observed behavior matches the spec's acceptance criteria. Reuse the Phase 4 or implementation result when it already proves that criterion on unchanged relevant inputs. Run a separate proving command only when existing evidence is missing, affected or insufficient. A mismatch or unverifiable claim blocks.\n\n**Stakes:** a behavioral-proof mismatch means the change does not do what the spec claims — state what would ship broken if this passed (\"the retry path never fires; a transient error would hang the caller\"), not just \"proof mismatch.\" That gap is exactly what a green-looking suite hides.\n\nGate: inspected current command output and exit code prove the claimed behavior. The phase change alone does not require another run. A self-reported \"it works\" does not pass.\n\n## Phase 5.5 — Provenance auto-heal (conditional)\n\nAn HTML-knowledge repository has no provenance records, so this phase does\nnothing there. Knowledge freshness is advisory: when staged paths are ones that\nknowledge records govern, `knowledge.py stale` lists those records for the next\ncontext refresh. It never blocks the commit and is never auto-rewritten here.\n\nPartition the loaded records by schema. Select only recorded content paths or\nmembership scopes\u002Fpredicates intersecting staged sources. Commits touching no\nrecorded source do no re-scout work. An empty legacy worklist says nothing about v2.\nInclude deleted paths and both sides of renames in `staged_paths`, for example\nwith `git diff --cached --name-only --no-renames`.\n\n**Managed v2 pairs:** acquire one bounded snapshot covering the selected documents'\nrecorded dependencies and target preimages. Call `assess_context_provenance` for\nthose document IDs with its action-boundary snapshot probe, then reuse that\nsnapshot and assessment in\n`_provenancelib.v2_heal_worklist(staged_paths, provenance, snapshot, assessment)`.\nIts `claims` identify the affected document, field, claim and staged source paths;\nthey select inspection work, not permission to write. These paths are staged triggers;\ninspect the selected claims' complete recorded evidence before refreshing their fields,\nincluding any changed unstaged dependency. Preserve uninspected claims and bindings.\nReport `unknown` entries and defer that document's automatic\nupdate; do not label it fresh or block independent commit work.\n\nWhen inspected claims still hold, prepare an `update` of the selected owned fields\nwith unchanged content and current source evidence. When a claim changed, propose\nthe bounded content correction for Phase 6 review. Use the typed `context-preview`\nand `context-apply` procedure in\n`\u003Cplugin-root>\u002Froutines\u002Fcontext-check\u002FSKILL.md`, retaining exact expected pair hashes,\nthe returned preview reference\u002Fdigest and all unselected bytes. Reuse the existing\nmaintenance authorization; do not enter a second approval cycle. Native apply\nrechecks the source and pair identities and writes both files together. Read back\nthe result. Never pass v2 records to `rebaseline` or write them directly. Stage the\nresulting pair by explicit paths and secrets-scan every newly staged file.\n\n**Legacy v1 records:** compute the heal worklist via\n`_provenancelib.heal_worklist(staged_paths, provenance, current_hashes)` — staged\n`drift_trigger:true` entries whose hash diverged or is absent. An empty v1 worklist\nskips only this legacy branch.\n\nNon-empty worklist → call `_provenancelib.compute_drift(provenance, current_hashes)` to retain the document\u002Fsource mapping. For each stale document in that drift report, get its record as `doc_provenance` and call `_provenancelib.changed_scope(doc_provenance, drift)`. Intersect that document's drifted paths with the worklist; skip a document when the intersection is empty. The hash map can omit unstaged paths, so a missing entry outside the worklist must not broaden this commit's re-scout. Confirm that every selected worklist path maps to at least one stale document after this filtering; if a record is malformed or the mapping is incomplete, STOP and report the gap rather than treating the path as fresh.\n\nRun an **incremental re-scout for each affected document**, scoped to its selected staged paths only (not the full repo). A fresh first document does not discharge a stale second document's claims for the same source. Resolve each selected document\u002Fpath dependency independently:\n\n- **Claim still holds → silently re-baseline only that document's provenance record.** Call `_provenancelib.rebaseline(doc_provenance, selected_current_hashes)` where `selected_current_hashes` contains current hashes only for the selected staged paths whose claims in that document were inspected and still hold. Do not re-baseline a path whose claim changed or was not inspected. Stage only `.codearbiter\u002F.provenance\u002F\u003Cdoc>.json` by explicit path so the re-baselined record rides THIS commit (ADR-0008 ride-along pattern — nothing is surfaced to the user). After staging, re-run the secrets scan from `tech-stack.md` over the newly-staged path(s) — any file staged after Phase 4 must still pass the automated secrets scan before the commit proceeds. A missing current hash (deletion or rename) cannot be silently re-baselined; surface it in Phase 6 for review.\n- **Claim changed → route to the existing Phase 6 diff-review.** Propose only the affected doc or code-map edit required to reflect its changed claim. The user reviews that edit in the normal diff, and Phase 7 stages approved paths explicitly; do not silently rewrite or add unrelated documentation.\n\nFor reviewed legacy code-map metadata in codeArbiter's source layout, use the\nshipped fixed-target helper at `\u003Cplugin-root>\u002Fhooks\u002Fresolve-context-conflict.py`.\nThis claim-refresh lane reads all three fixed source manifests:\n`\u003Cproject-root>\u002Fplugins\u002Fca\u002F.claude-plugin\u002Fplugin.json`,\n`\u003Cproject-root>\u002Fplugins\u002Fca-codex\u002F.codex-plugin\u002Fplugin.json`, and `\u003Cproject-root>\u002Fplugins\u002Fca-pi\u002Fpackage.json`,\neven for a date-only refresh. Other repository layouts and arbitrary manifest\nclaims are unsupported.\n\nResolve the interpreter once by presence, then inspect:\n\n```sh\nPY=python3; { command -v python3 >\u002Fdev\u002Fnull 2>&1 && python3 --version >\u002Fdev\u002Fnull 2>&1; } || PY=python\n\"$PY\" \"\u003Cplugin-root>\u002Fhooks\u002Fresolve-context-conflict.py\" --root \"\u003Cproject-root>\" inspect-claims\n```\n\nPass the returned `binding` to the same helper and interpreter:\n\n```sh\n\"$PY\" \"\u003Cplugin-root>\u002Fhooks\u002Fresolve-context-conflict.py\" --root \"\u003Cproject-root>\" refresh-claims --expected '\u003Cbinding>' --claims '\u003Cjson-array>'\n```\n\nSupply one to four reviewed records containing exactly\n`field`, `before`, and `after`. The supported existing fields are `ca_version`,\n`codex_version`, `pi_version`, and `metadata_date`. Use the inspection's exact\ncurrent claim as `before`; a version's `after` must match its fixed source\nmanifest, and the date must match `inspection_date`. Use the selected interpreter\nfor both calls; never retry a failed operation under another interpreter.\n\nThis operation requires resolved, tracked legacy schema-1 document\u002Fprovenance\nand no native or uncertain journal ownership. It binds document, provenance,\nGit\u002Findex, source manifest bytes and date, preserves all unselected bytes, and\ndoes not stage, rebaseline, adopt, enroll or create a native receipt. Inspect the\nworktree diff for `.codearbiter\u002Fcode-map.md`, selectively stage that explicit\npath, and re-run the normal secrets scan over the newly staged Markdown before\nPhase 6. Treat it as a heal-proposed doc\u002Fcode-map edit in Phase 6 review, never as\na silent rebaseline, and retain its explicit inclusion in Phase 7. Provenance\nrebaseline remains separately scoped by Phase 5.5. Unsupported\nclaims or refused preimages stop the edit; do not substitute a direct write or\nnative adoption. A codeArbiter contributor may exercise the tested and\nindependently reviewed canonical helper under `core\u002Fpysrc\u002F` with live enforcement\nintact, never a copied script, installed-cache edit or hook\u002Ftrust change.\n\n## Phase 6 — Diff review · gate: BLOCK\n\nRead the complete staged diff (`git diff --cached`). Flag as blocking:\n\n- Unexpected files — not discussed in the session.\n- Credentials, tokens, API keys, or any secret — belt-and-suspenders to Phase 4.\n- Incomplete changes — TODO markers, placeholder values, dead commented-out code, partial stubs.\n- Tests disabled or skipped that were not intentionally disabled.\n- Scope creep — changes outside the agreed feature or fix boundary.\n\n**Board-edit exemption (ADR-0008):** ADR-0008 governs lifecycle transitions riding a commit whose primary purpose is something else — a board edit inside such a commit is **expected and RETAINED** (not scope creep, MUST NOT be unstaged) only when `_taskboardlib.classify_board_diff(old, new)` returns a clean transition: a done-flip `[~]`→`[x]`; a start-flip `[ ]`→`[~]` with its optional minted dotted ID; an attachment-only Spec ID or Plan ID binding; start+attachment; start+complete `[ ]`→`[x]`; one queued or already-started addition; or a missing level-two section plus one queued addition. Any other `open-tasks.md` edit riding an unrelated commit does not classify as one of those transitions and still flags as scope creep — it does not belong to that commit's agreed boundary.\n\nThis does not cover a commit whose own Phase 3 classification **is** the board change — e.g. a `docs` chore whose sole content is a `\u002Fca-standup` archival sweep (open-tasks.md removals plus the matching `done-tasks.md` append). There, the boundary was already agreed at Phase 3, so those edits are in-scope by that classification directly; `classify_board_diff` is not consulted and does not need to recognize archival as a fourth transition.\n\n**Native work co-location (ADR-0008):** use the installed `work.py list --limit 1`\nowner check before applying the board exemption. A `project_id` response selects\nnative work; a dual-owner or failed read is a stop. For each staged\n`.codearbiter\u002Fwork\u002F\u003Cwork_id>.html`, reject unstaged changes to that same path,\nthen use installed `work.py get \u003Cwork_id>` to verify the current native identity,\nstate, and intended relationship to this commit. Review the exact staged diff;\nfor a first native item, also review `.codearbiter\u002Fwork\u002Fproject.json` as the\nportable project identity and reject a staged\u002Fcurrent mismatch on that path.\nThe first work-create writes project.json and the HTML together; omitting the\nidentity would leave the work unreadable in a fresh clone. Resolve the installed\nhelper and Python from the loaded `ca-commit` skill or `commit.md` command\nresource using its installed\n`..\u002F..\u002Fincludes\u002Fhelper-invocation.md`\ncard; invoke with the card's current-shell syntax.\ndo not grant a blanket exemption to arbitrary work HTML or a change to a\ndifferent ID. An in-scope lifecycle change rides the work commit, including a\nnew queued follow-up from harvest. A standup archive belongs to its own Phase 3\nclassification, as with the legacy board archive. Do not run\n`classify_board_diff` on native work or create a Markdown mirror.\n\n**Provenance re-baseline exemption (ADR-0008):** a `.codearbiter\u002F.provenance\u002F\u003Cdoc>.json` file written by the Phase 5.5 auto-heal re-baseline is likewise **expected and RETAINED** — it is not scope creep and MUST NOT be unstaged. A heal-proposed doc or code-map edit (the claim-changed path from Phase 5.5) appears in the diff for normal review; treat it as any other finding. This exemption waives the scope-creep flag only; the secrets check is not waived — the automated re-scan in Phase 5.5 covers the provenance file.\n\nOn any blocking finding, unstage the affected files, surface the finding, and STOP. An out-of-scope change that should not be lost gets an inline `[NEEDS-TRIAGE]` marker before it is set aside.\n\n**Stakes:** name what the finding would have cost if committed — a leaked credential is live the moment it lands and must be rotated; a scope-creep file ships untested behavior the review waved through. State that consequence on a credential or scope finding, not just \"out of scope.\"\n\nGate: the diff is clean — zero blocking findings.\n\n## Phase 7 — Selective stage · gate: BLOCK\n\n**First, run the follow-up harvest — before staging anything.** Run the follow-up harvest (`\u003Cplugin-root>\u002Fincludes\u002Fharvest.md`) over any Phase 6 `[NEEDS-TRIAGE]` set-asides — promote discovered work through the selected owner (legacy `open-tasks.md` or native work HTML) and decisions to `open-questions.md`. Running this before the commit means raised work is staged and rides the work commit in the same payload.\n\n**Atomicity rule:** a raised task riding the work commit is a **contingent default** — if the PR\u002Fbranch is abandoned, the selected owner's additions are abandoned with it (self-correcting, ADR-0008). A follow-up that **must survive** PR abandonment is filed as a **GitHub issue**, not local work.\n\nBefore staging any newly harvested native work, review the exact current HTML\nbytes and, for the first item, `project.json` bytes under the Phase 6 secret,\nidentity, scope, and native work checks. Verify the selected owner and current\n`work.py get \u003Cwork_id>` result, and reject unexpected or mismatched files. A\npath-list check alone does not review these newly created bytes. If this review\nfinds a blocker, stop before the commit; do not exempt the harvest output.\n\nThen selectively stage: if files were unstaged in Phase 6, re-stage only the clean files by explicit path: `git add path\u002Fto\u002Ffile`. For the legacy owner, retain clean board transitions and harvest additions by explicitly staging `open-tasks.md`. For the native owner, stage validated `.codearbiter\u002Fwork\u002F\u003Cwork_id>.html` paths returned or changed by the selected work operation, each by its exact ID. When the first native work-create also creates `.codearbiter\u002Fwork\u002Fproject.json`, stage that exact validated identity path in the same commit; if its staged bytes differ from current bytes, stop. Never stage the whole work directory or a journal. The lifecycle change rides the same work commit. When Phase 5.5 produced a re-baselined provenance record, include the affected `.codearbiter\u002F.provenance\u002F\u003Cdoc>.json` file(s) by explicit path in the same selective stage so the re-baselined record rides the work commit. Re-run `git diff --cached --name-only` and confirm the staged list matches the intended set exactly — no extra files. Unstage any extra and report the discrepancy.\n\nFor harvested native work, compare the newly staged HTML and first-item\n`project.json` with the reviewed current bytes, then inspect their exact\n`git diff --cached` content and rerun Phase 6 secret, identity, scope, and\nnative work checks on those staged bytes. A mismatch or new finding blocks\nthe commit. This check is required even when the staged path list is exact.\n\nGate: the staged set contains exactly the intended files. MUST NOT use `git add -A`, `git add .`, or any wildcard.\n\n## Phase 8 — Message · gate: BLOCK\n\nCompose a Conventional Commits message:\n\n- Subject: `\u003Ctype>(\u003Cscope>): \u003Cimperative summary>`, MUST NOT exceed 72 characters.\n- Blank line, then a body explaining WHY — not a restatement of what changed.\n- For `feat` and `fix`, add a `CHANGELOG:` footer summarizing the user-visible impact.\n- If the commit closes an issue or references a decision, add the footer (`Closes #NN`, `Ref: ADR-NNNN`).\n- No content-free subjects — \"fix bug\", \"update code\", \"changes\" do not pass.\n\nGate: subject ≤ 72 chars, a body is present, and any `feat`\u002F`fix` carries a `CHANGELOG:` footer.\n\n## Phase 9 — Commit · gate: BLOCK\n\nCommit with the approved message via `-m` or heredoc with proper quoting — never an interactive editor. Capture the resulting SHA.\n\nIf a pre-commit hook fails: read its output in full, fix the issue, re-stage by explicit path (Phase 7 rules apply), and create a NEW commit. MUST NOT `--amend` after a hook failure.\n\nAfter a successful commit, recapture the status inventory, index entries and worktree SHA-256\u002Fabsence for every preflight path and every newly reported path. Compare them with the content-addressed baseline: require no remaining staged or tracked changes in the selected reviewed payload, and investigate any unexpected path, byte or index mutation made during this commit. Report unrelated preexisting paths only when their recorded bytes and index state are unchanged; never stage, clear or call changed data preexisting. Native `.codearbiter\u002F.artifacts\u002F` files created by the selected helper are local recovery metadata: report their presence, preserve them in this worktree, and do not treat that exact path alone as source dirt. Do not ignore, stage, move, or delete the store to make the check pass. Deliver the report: SHA, branch, explicit file list, gate results (test \u002F lint \u002F secrets), and the message used.\n\nGate: the selected reviewed payload lands with no unexpected remaining changes to its paths. Unrelated preexisting paths remain intact and visible; new unexplained changes block closure until classified.\n\n## Hard rules\n\n- MUST NOT commit without explicit user authorization for the selected action; a clear scoped natural-language grant counts, while \"it looks good\" alone does not.\n- MUST NOT commit to `main`, `master`, or any protected branch.\n- MUST NOT run `git add -A`, `git add .`, or any wildcard staging.\n- MUST NOT commit while any test is failing, any lint error stands, or any secret is present.\n- MUST NOT turn exhaustive repository-wide or cross-platform CI into a local prerequisite when the shared `verification-boundary` assigns it to exact-head hosted CI.\n- MUST prove the behavior against the spec with inspected current evidence (Phase 5); a self-reported \"it works\" is insufficient.\n- MUST NOT skip, disable, or work around any automated gate.\n- MUST NOT commit a staged database migration without a recorded migration-review pass — the H-14 hook blocks it until `migration-reviewer` passes and `hooks\u002Fmigration-pass.py` records the content-bound marker.\n- MUST NOT `--amend` after a pre-commit hook failure — create a new commit.\n- MUST NOT guess the test, lint, or secrets-scan command — read `tech-stack.md` (or `knowledge.py commands`) or STOP.\n- MUST NOT silently rewrite a doc's claims — a claim-change edit proposed by Phase 5.5 goes through diff review (Phase 6), never through the silent re-baseline path. The re-baseline path is strictly for claims that still hold; the Phase 5.5 re-baseline MUST ride the work commit (staged by explicit path in Phase 7).\n- MUST, **at Phase 7 before staging**, run the follow-up harvest (`\u003Cplugin-root>\u002Fincludes\u002Fharvest.md`) over any Phase 6 `[NEEDS-TRIAGE]` set-aside — promote work through the selected owner and decisions to `open-questions.md` so raised tasks ride the work commit. A follow-up that must survive PR abandonment is filed as a GitHub issue, not local work.\n",{"name":5,"description":7,"argument-hint":23},"(none)","main","5158e2c2d4e52b179a63272d5101bbe615d9476d","plugins\u002Fca-pi\u002Froutines\u002Fcommit-gate",9,"https:\u002F\u002Fgithub.com\u002FarbiterForge\u002FcodeArbiter","https:\u002F\u002Fcodearbiter.dev\u002F","https:\u002F\u002Fgithub.com\u002FarbiterForge","https:\u002F\u002FArbiterForge.com","2026-11-13 03:00:20",{"source":8,"skillName":5,"commands":34,"prompt":44,"zipAvailable":45},[35,38,41],{"tool":36,"command":37},"npx","npx skills add arbiterForge\u002FcodeArbiter --skill commit-gate",{"tool":39,"command":40},"bunx","bunx skills add arbiterForge\u002FcodeArbiter --skill commit-gate",{"tool":42,"command":43},"pnpm","pnpm dlx skills add arbiterForge\u002FcodeArbiter --skill commit-gate","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FarbiterForge\u002FcodeArbiter\u002Fblob\u002Fmain\u002Fplugins\u002Fca-pi\u002Froutines\u002Fcommit-gate\u002FSKILL.md",true,[],[48,53,60,66,71,76],{"skillNo":49,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":50,"categories":51,"keywords":52,"publishedAt":18},"01M723RSNWM8SSKYF90DWTBQMM","https:\u002F\u002Fgithub.com\u002FarbiterForge\u002FcodeArbiter\u002Fblob\u002Fmain\u002Fplugins\u002Fca\u002Fskills\u002Fcommit-gate\u002FSKILL.md",[],[],{"skillNo":54,"name":55,"nameZh":6,"description":56,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":57,"categories":58,"keywords":59,"publishedAt":18},"01M723Q3MCYNCEYA5N52DZCSN3","ca-doctor","Verify the active host install, package, command ownership, enforcement, wrapper self-test, and active-dispatch coverage gap. Read-only.","https:\u002F\u002Fgithub.com\u002FarbiterForge\u002FcodeArbiter\u002Fblob\u002Fmain\u002Fplugins\u002Fca-pi\u002Fskills\u002Fca-doctor\u002FSKILL.md",[],[],{"skillNo":61,"name":62,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":63,"categories":64,"keywords":65,"publishedAt":18},"01M723PNHKMHAY5E30TTY5Y3HE","ca-commit","https:\u002F\u002Fgithub.com\u002FarbiterForge\u002FcodeArbiter\u002Fblob\u002Fmain\u002Fplugins\u002Fca-pi\u002Fskills\u002Fca-commit\u002FSKILL.md",[],[],{"skillNo":67,"name":62,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":68,"categories":69,"keywords":70,"publishedAt":18},"01M723J01KRWXJRSK4GEN4EHCE","https:\u002F\u002Fgithub.com\u002FarbiterForge\u002FcodeArbiter\u002Fblob\u002Fmain\u002Fplugins\u002Fca-codex\u002Fskills\u002Fca-commit\u002FSKILL.md",[],[],{"skillNo":72,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":73,"categories":74,"keywords":75,"publishedAt":18},"01M723F8KK1J8VYCBWX9YH7TRR","https:\u002F\u002Fgithub.com\u002FarbiterForge\u002FcodeArbiter\u002Fblob\u002Fmain\u002Fplugins\u002Fca-codex\u002Froutines\u002Fcommit-gate\u002FSKILL.md",[],[],{"skillNo":77,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":80,"publishedAt":18},"01M723D58MYZNJH8ZEX8HY11WG","https:\u002F\u002Fgithub.com\u002FarbiterForge\u002FcodeArbiter\u002Fblob\u002Fmain\u002Fcore\u002Fsurface\u002Fskills\u002Fcommit-gate\u002FSKILL.md",[],[]]