@@ -3,7 +3,7 @@ status: accepted
 date: 2026-07-16
 title: Require every live git enforcer and persist trusted executable identity
 decided-by: SUaDtL@users.noreply.github.com
-supersedes: 0014
+supersedes: 0014-githook-shim-dropin-fail-closed
 governs: core/pysrc/_githooks.py, core/pysrc/session-start.py, plugins/*/hooks/_githooks.py, plugins/*/hooks/session-start.py
 ---
 
 
@@ -3,7 +3,7 @@ status: accepted
 date: 2026-07-22
 title: Permit bounded selected-provider credential projection for isolated Pi children
 decided-by: SUaDtL@users.noreply.github.com
-supersedes: 0014
+supersedes: 0014-pi-host-authentication-and-fail-closed-tool-boundary
 governs: .codearbiter/security-controls.md, .codearbiter/specs/pi-support.md, .codearbiter/plans/pi-support.md, plugins/ca-pi/**
 ---
 
 
@@ -0,0 +1,68 @@
+---
+status: accepted
+date: 2026-07-25
+title: Hook input fails open on malformed shape as well as malformed syntax
+decided-by: SUaDtL@users.noreply.github.com
+supersedes: none
+governs: core/pysrc/_hooklib.py, core/pysrc/pre-bash.py, core/pysrc/pre-write.py, core/pysrc/pre-edit.py, core/pysrc/pre-read.py, core/pysrc/post-write-edit.py
+---
+
+# ADR-0020 — Hook input fails open on malformed shape as well as malformed syntax
+
+## Status
+Accepted — explicitly decided by SUaDtL@users.noreply.github.com on 2026-07-25.
+
+## Context
+`_hooklib.read_input()` already carries a documented, deliberate exception to the fail-loud
+principle: a malformed stdin payload must NOT brick the session by blocking every subsequent tool
+call, so a parse error warns and returns `{}`.
+
+That exception covers malformed **syntax** only. A payload that is valid JSON but not an object —
+`[]`, `3`, `"str"`, `true`, `null` — parses cleanly and is returned as a non-dict. Downstream,
+`tool_input(data)` evaluates `(data or {}).get(...)`, so *falsy* non-dicts (`[]`, `null`) are
+accidentally safe via the `or {}`, while *truthy* ones (`3`, `"str"`, `true`) raise AttributeError
+out of the guard.
+
+The decisive fact is that **the hook envelope is host-produced, not model-produced.** It arrives on
+stdin from Claude Code, Codex, or Pi. A model can place hostile content *inside* `tool_input`
+fields, but cannot make the top-level object a list. A non-dict envelope therefore means host
+misbehaviour or version drift — a compatibility event, not an attack.
+
+## Decision
+Treat a malformed **shape** exactly as the existing exception treats malformed **syntax**: normalize
+any non-dict payload to `{}` at the single `read_input()` chokepoint, and widen the docstring to say
+so. Unreadable input is unreadable, whether the failure is syntactic or structural.
+
+The distinction between the two carries no security content here. Both mean *the guard cannot read
+this call*, which is the exact situation the documented exception already ruled on.
+
+## Alternatives considered
+- **Fail closed on a non-dict envelope** — rejected. It buys no protection against a threat that
+  cannot reach this surface (the envelope is not model-controlled), while creating precisely the
+  failure the existing exception exists to prevent: a host payload change would brick every tool
+  call until codeArbiter shipped a fix.
+- **Split the rule by position — router fails closed, guard fails open** — considered and not taken
+  as doctrine. It is more precise, but it makes every future hook author decide which side their
+  code is on, and the asymmetry is better recorded as a note than as a rule (see below).
+
+## Consequences
+One rule, stated once, at one chokepoint: unreadable input yields `{}` and a warning. Every host —
+including future ones — inherits it without a per-host decision.
+
+**A deliberate asymmetry is recorded rather than removed.** The ca-codex *adapter*
+(`plugins/ca-codex/hooks/pre-tool-adapter.py`) fails CLOSED on a non-object payload, and that stays.
+The adapter is a **router**: it decides which guard to dispatch to, so a payload it cannot route is
+one it cannot prove safe. A guard that cannot parse its own input is a different case. That
+difference is intentional, not drift, and this ADR is the place it is written down. The adapter's
+refusal is additionally dormancy-aware — in a repository that never opted into codeArbiter it passes
+through untouched — so failing closed there cannot break unrelated projects.
+
+## Risks
+Normalizing a non-dict envelope to `{}` means a guard proceeds with no `tool_input` rather than
+refusing, so a host that silently changed its envelope shape would degrade to unenforced calls with
+only a warning to show for it. That is the accepted cost of the existing exception, now applied
+consistently.
+
+This decision is proven wrong if a host is found where the envelope shape is model-influenceable, or
+if the warning proves too quiet to surface a real host drift — in which case the remedy is to make
+the degradation louder, not to fail closed and brick the session.
@@ -0,0 +1,57 @@
+---
+status: accepted
+date: 2026-07-25
+title: Per-call Python bridge spawn is the cross-host cost model
+decided-by: SUaDtL@users.noreply.github.com
+supersedes: none
+governs: plugins/ca-pi/tools/src/bridge.ts, plugins/ca-pi/hooks/pi-bridge.py
+---
+
+# ADR-0021 — Per-call Python bridge spawn is the cross-host cost model
+
+## Status
+Accepted — explicitly decided by SUaDtL@users.noreply.github.com on 2026-07-25.
+
+## Context
+Every gated Pi tool call spawns a fresh Python bridge process. Tribunal finding performance-001
+raised whether that should become a persistent bridge worker, and downgraded itself from high on a
+decisive observation: **Claude Code pays the same per-call hook-spawn cost.** The question is
+therefore not whether spawning is free — it is whether Pi should diverge from the cost model every
+other host already accepts.
+
+`.github/scripts/pi_benchmark.py` measures the cost (`medianMs`, `p95Ms`) and is wired into CI path
+filters, so the number is observable rather than anecdotal.
+
+## Decision
+Accept the per-call spawn as the cross-host standard cost model. Do not build a persistent bridge
+worker.
+
+The per-call process is **stateless by construction**: it holds no lifetime, carries nothing between
+gate decisions, and dies with the decision it made. That property is the point, not a side effect.
+
+## Alternatives considered
+- **Persistent bridge worker (daemon)** — rejected. It places a long-lived process holding
+  enforcement authority in front of every gated tool call, requiring its own authentication, health
+  checking, restart, and staleness handling. A wedged worker degrades every subsequent gated call
+  rather than one.
+- **Reduce spawn cost instead** — not needed now, and explicitly the preferred remedy if latency
+  ever becomes a real problem (see reopen condition).
+
+## Consequences
+One code path, no daemon lifecycle, and no state that can be poisoned between calls. Pi's cost
+profile matches Claude Code's, so "is this slow?" is answered the same way on every host.
+
+The cost is linear in gated tool calls and is paid on every one. That is accepted.
+
+## Risks
+The rejection rests on a judgement about where this codebase actually breaks. The 2026-07-25 sweep
+produced three independent defects from long-lived or ambient state — a statusline pinned into a
+worktree that was then pruned, a broker listener that could outlive its child, and a token bound to a
+broker rather than to a process. A daemon in the enforcement path would add exactly that class of
+surface.
+
+This decision is proven wrong if the measured `p95Ms` becomes a real impediment to normal work. The
+remedy in that case is to make the bridge **cheaper to start** — trimming imports, deferring work
+off the hot path — not to keep one alive. Adopting a persistent worker would require superseding this
+ADR and confronting the daemon-lifetime surface deliberately, rather than arriving at it by
+increments.
@@ -0,0 +1,83 @@
+---
+status: accepted
+date: 2026-07-25
+title: Auto-route unambiguous, non-destructive intent into its command
+decided-by: SUaDtL@users.noreply.github.com
+supersedes: none
+governs: core/surface/includes/redirect.md, core/surface/includes/routing-table.md, plugins/ca/ORCHESTRATOR.md, plugins/ca-codex/ORCHESTRATOR.md, plugins/ca-pi/ORCHESTRATOR.md
+---
+
+# ADR-0022 — Auto-route unambiguous, non-destructive intent into its command
+
+## Status
+Accepted — explicitly decided by SUaDtL@users.noreply.github.com on 2026-07-25. Amends ORCHESTRATOR
+§6; the §6 invariant itself is preserved, not relaxed (see Decision).
+
+## Context
+§6 read: *"All intent flows through a slash command … The user picks; nothing routes without their
+command."* In practice the orchestrator would infer the intent, name the exact command, and then ask
+the user to type it back — a redirect of the form *"for that action, run `/ca:fix <exactly what you
+just asked for>`"*.
+
+That is ceremony, not governance. Naming the command demonstrates the routing was already
+understood; requiring it to be retyped adds friction without adding a decision.
+
+The friction also produced harm rather than safety. Issue #308 records a post-merge cleanup where no
+command owned the operation and the redirect loop produced **two incorrect routes — first to
+`/ca:chore`, then to `/ca:override`.** An override for routine repository hygiene is exactly what
+overrides exist to be rare for: a rule intended to ensure deliberate routing instead manufactured an
+unjustified bypass.
+
+## Decision
+Route on understood intent, in three tiers:
+
+1. **Unambiguous and non-destructive** — route directly into the command. Every gate runs exactly as
+   if the user had typed it.
+2. **Probable** — ask once, naming the command (*"did you mean `/ca:fix`?"*). One approval, then
+   route. The user approves rather than retypes.
+3. **Genuinely unclear** — present the candidate commands and let the user pick.
+
+**The invariant §6 actually protects is preserved by construction.** §6 exists so that nothing
+happens outside a gated command path — not so that the user does typing. Auto-routing *into* the
+command satisfies it completely. What remains prohibited, and is the line this ADR draws, is the
+orchestrator performing the work itself instead of routing: it routes the command, it does not
+improvise the operation.
+
+**Clarity and risk are separate axes.** Tier 1 requires BOTH unambiguous intent AND a
+non-destructive command. Anything irreversible or gate-bypassing — `/ca:override`, merge to the
+default branch, branch or worktree deletion, release and tag publication, `/ca:dev` entry — drops to
+tier 2 and asks, even when the intent is obvious. There the confirmation is the gate, not friction.
+
+## Alternatives considered
+- **Keep §6 as written** — rejected. The dead end it produced was caused by no command owning the
+  operation, and the redirect loop converted that gap into a wrong override rather than preventing
+  one.
+- **Auto-route anything unambiguous, destructive included** — rejected. The commands' own gates do
+  stop and ask in most cases, but "clear intent" and "safe to perform without confirmation" are
+  different properties, and conflating them puts the irreversible cases on the wrong side.
+- **Declare the destructive set per-command in the routing table** — considered and deferred. It is
+  more auditable and prevents a new command being auto-routed by omission; recorded here as the
+  preferred refinement if the hardcoded set proves hard to keep current.
+
+## Consequences
+The redirect stops asking for a command it has already named. A user saying "go fix that" or "let's
+run a checkpoint" reaches the routed skill with its gates intact.
+
+Issue #308's other half ships alongside: a sanctioned owner for the merged-branch transition, which
+proves the branch is an ancestor of the *fetched* default, classifies dirty artifacts as unique,
+redundant, or superseded, and never discards unique or ambiguous data without per-item confirmation.
+Closing that gap removes the cause the redirect loop was reacting to.
+
+## Risks
+"Unambiguous" is a judgement the orchestrator makes about its own routing, so a mis-classification
+routes a command the user did not intend. Two things bound it: tier 1 excludes everything
+irreversible, and the routed command's own gates still run — a wrongly routed `/ca:fix` stops at
+`tdd` Phase 1 exactly as a typed one would.
+
+The destructive set is enumerated in the orchestrator rather than declared per command, so a newly
+added destructive command could be auto-routed by omission. That is the known weakness, and the
+routing-table variant above is the fix if it bites.
+
+This decision is proven wrong if auto-routing produces a command the user did not want with
+consequences a gate did not catch, or if the destructive enumeration is found stale after a new
+command ships.