fix(artifacts): cover migration recovery and add Pi approval candidate

[SUaDtL]

Migration recovery needs direct coverage for stale previews, replay and edits after a checkpoint. Pi preflight also compared its scoped npm package with ca-pi, reporting an identity mismatch before reaching the actual authority limitation. This group adds those recovery regressions, recognizes @arbiterforge/ca-pi, and adds a private native Pi approval dialog candidate for isolated qualification.

The dialog is loaded explicitly in one Pi 1.0.2 process with no other extensions, tools, startup prompt or inherited context. It checks genuine host trust and session identity, then passes the native dialog return unchanged through the packaged TypeScript/Python bridge. The pending artifact digest, session, generation and one-shot receipt remain bound. Ordinary prompt input and unqualified paired approval remain refused; the helper is not registered in ordinary sessions.

The original migration pilot remains unchanged. Canonical Python and adapter copies stay synchronized. The branch now includes reviewed main af741255ab199f8465f4ea9ee8c5c178836fcc7e, with the existing group patch versions ca 2.25.2, ca-codex 0.16.2 and ca-pi 0.17.2 preserved. Dependency inputs and release policy are unchanged.

Validation:

• Original seven migration pilot tests, 22 adjacent context tests and the six-test conformance runner passed. The Pi identity regression failed before the fix and passed with refusal and invalid-name controls retained.
• Three native-input binding regressions failed before implementation. The merged adapter suite passes 68 tests; four input-seam mutations were caught. An actual Pi 1.0.2 TUI loaded the packaged producer and exercised its inspect path through BridgeClient, Python and the native engine. No input was supplied and no authority receipt was created.
• Local Windows Pi coverage passes with 889 tests and one existing platform skip: 86.04% lines and 80.73% branches. Current-head repository CI passes its required coverage unions and native artifact/cold-package matrix at 2311c871ec9f8978fbd0d8ddf24eb5db746b1284 in CI run 37870013460.
• The latest main sync passed 74 promotion tests, 102 CI contract tests, five package integration checks, 29 dialog/package tests against retained Pi 1.0.2, and a fresh CI-consumer proving check. Type checking, syntax, generated parity and all three committed payload/version guards pass. Incoming installer files and the full 450-file site tree match the retained independent review and 56-test/typecheck evidence.
• Independent coverage, security, auth/crypto and integration/dependency reviews have no findings. CI previously caught five private producer files missing from the non-policy inventory. The exact-name enrollment fixes the four reproduced failures; all 22 descriptor tests and three refusal/comparison checks passed with every assertion unchanged.

The owner authorized merging finished source after current-head checks pass. Installed-host qualification remains separate: one genuine owner-entered Pi native approval and durable readback are pending. Wrong-token, replay, artifact-binding, denial, cancellation and restart controls have bounded source/native-engine regression proof; those tests are not installed TUI observations or human authority. Ordinary workflow activation remains a separate owner decision. The current Codex Windows profile lacks the supported containment needed for the remaining context/scout qualification; no machine configuration change is proposed. No actual project migration or fixture input was performed.

ADR ancestry was verified against fetched base af741255ab199f8465f4ea9ee8c5c178836fcc7e and head 2311c871ec9f8978fbd0d8ddf24eb5db746b1284; the installed verifier permits squash. Current-head CI is terminal green (76 successful checks and 5 skipped checks), including the required merge-readiness aggregate. The coordinator completed the authorized squash merge as fc35117016f47de4bbfc15195057cf57c30a8a4a at 2026-10-09T02:07:39Z. Exact-merge CI, docs and both CodeQL runs passed. CI passed all six native builds, package assembly and all 18 cold-package cells. The existing automatic release run 37875957946 passed and published ca 2.25.2, ca-codex 0.16.2 and ca-pi 0.17.2; their public release tags resolve to fc35117016f47de4bbfc15195057cf57c30a8a4a, and npm metadata for ca-pi 0.17.2 was read back. The deployed docs reference page also names this merge commit. Installed/human qualification remains open as stated above.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}