fix(orchestrator): define the tier-1/tier-2 boundary so resolved intent routes instead of asking

[SUaDtL]

Summary

ORCHESTRATOR.md §6 never defined the tier-1/tier-2 boundary (ADR-0022) operationally, so a cautious host model (observed on codex) answered a fully-resolved intent with tier 2's "did you mean $feature "F-137 …"?" — displaying the exact command and complete argument while asking permission to run it. That is the retype ceremony ADR-0022 abolished, wearing a question mark.

This edits core/surface/ORCHESTRATOR.md §6 to:

1. Redefine tier 2 ("Probable") by incompleteness — an argument you'd have to invent, or a second plausible command — rather than by anything merely inferred.
2. Add a boundary paragraph stating the tier-1/tier-2 line is drawn by what is already resolved, not by temperament: an exact command with a complete argument and no competing candidate is unambiguous by definition and routes as tier 1.

Regenerated via tools/build-surface.py into all three host renders (plugins/ca, plugins/ca-codex, plugins/ca-pi), each with correct per-host command spellings (/ca:fix, $ca-fix, /ca-fix).

Does not contradict ADR-0022 — it sharpens "unambiguous" operationally without touching the risk axis, which the next paragraph ("Clarity and risk are separate axes") still owns.

Before / after (core/surface/ORCHESTRATOR.md §6)

Before:

2. Probable — ask once, naming the command ("did you mean {{CMD:fix}}?"). One approval, then
   route. The user approves rather than retypes.
3. Genuinely unclear — emit the redirect ({{PLUGIN_ROOT}}/includes/redirect.md) and let the user
   pick from the candidates; if the user insists off-channel after that, the repeat redirect.

Clarity and risk are separate axes. ...

After:

2. Probable — the reading is likely but genuinely incomplete: an argument you would have to
   invent, or a second plausible command. Ask once, naming the best candidate ("did you mean
   {{CMD:fix}}?"). One approval, then route — the user approves rather than retypes.
3. Genuinely unclear — emit the redirect ({{PLUGIN_ROOT}}/includes/redirect.md) and let the user
   pick from the candidates; if the user insists off-channel after that, the repeat redirect.

The tier-1/tier-2 line is drawn by what is already resolved, not by temperament. If you can name
the exact command and its complete argument — nothing left to invent, no competing candidate — the
intent is unambiguous: that is tier 1, route it. Asking "did you mean" while displaying the
fully-formed command is the retype ceremony ADR-0022 abolished, returned as a question; the
demonstration that you resolved the route is the reason to take it, never the thing to ask permission
for. Tier 2 exists for a genuinely incomplete reading, and for the destructive set below — nothing
else.

Clarity and risk are separate axes. ...

Verification

• python tools/build-surface.py then --check: OK (claude, codex, pi in sync)
• python tools/sync-core.py --check: OK (56 core files x 3 plugins, byte-identical)
• python .github/scripts/test_build_surface.py: 40/40 OK (pytest unavailable in this environment; run directly as unittest, which the module supports)
• plugins/ca/hooks/tests (NO_COLOR unset), via python -m unittest discover: 1308 tests, 5 failures / 5 errors — proven pre-existing and identical (same 10 test names) on a stashed clean origin/main baseline in this same worktree. All ten are in test_git_hooks.py/test_repo_resolution.py, about the git-level enforcer drop-in registration and Windows symlink creation, and are caused by running from a linked worktree, not by this diff.
• python .github/scripts/payload_version_gate.py --plugin plugins/ca --base origin/main: shipped payload changed and version advanced 2.11.1 -> 2.11.4
• python .github/scripts/payload_version_gate.py --plugin plugins/ca-codex --base origin/main: shipped payload changed and version advanced 0.4.0 -> 0.4.3
• python tools/build-host-packages.py --check and --release-guard-base origin/main (ca-pi's own gate, per .codearbiter/release-targets.md): Pi payload, version, changelog, and root metadata advanced together 0.2.0 -> 0.2.3
• git diff --check origin/main..HEAD: clean, no CR/whitespace errors

Deviations

• pytest is not installed in this environment; both test suites were run via their unittest-compatible direct-invocation path instead, as the task instructions allowed ("or run directly").
• ca-pi required a plugins/ca-pi/CHANGELOG.md entry (added in a second commit) to satisfy its own release guard, which enforces changelog + root-manifest synchronization on any version advance — this wasn't spelled out in the task brief but is required by the declared pre-tag gate for that plugin.

Closes #595

https://claude.ai/code/session_01QjJeSbcwPHwMmd6CEZeagB

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 3816957d-e133-428f-b4a5-6c038712bceb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}