fix(orchestrator): define the tier-1/tier-2 boundary so resolved intent routes instead of asking

CHANGELOG.md

@@ -12,6 +12,18 @@ predate the plugin rewrite and are grouped by date.
 
 ## [Unreleased]
 
+## [2.11.4] — 2026-08-04
+
+### Fixed
+
+- The orchestrator no longer asks "did you mean" when it has already resolved
+  the exact command and its complete argument. `ORCHESTRATOR.md` §6 now draws
+  the tier-1/tier-2 boundary (ADR-0022) by what is already resolved rather than
+  by temperament: an exact command with a complete argument and no competing
+  candidate is unambiguous by definition and routes directly. Tier 2 is
+  reserved for a genuinely incomplete reading — an argument you'd have to
+  invent, or a second plausible command — and the destructive set.
+
 ## [2.11.1] — 2026-08-03
 
 ### Fixed

README.md

@@ -10,7 +10,7 @@ project context. You decide. codeArbiter enforces.
 <img alt="Claude Code plugin" src="https://img.shields.io/badge/Claude_Code-plugin-d97757">
 <img alt="Codex plugin" src="https://img.shields.io/badge/OpenAI_Codex-plugin-10a37f">
 <img alt="Pi Feature Forge preview" src="https://img.shields.io/badge/ca--pi-Feature_Forge_preview-d97757">
-<img alt="version 2.11.1" src="https://img.shields.io/badge/version-2.11.1-2b7489">
+<img alt="version 2.11.4" src="https://img.shields.io/badge/version-2.11.4-2b7489">
 <img alt="commands" src="https://img.shields.io/badge/commands-40-555">
 <img alt="skills" src="https://img.shields.io/badge/skills-23-555">
 <img alt="agents" src="https://img.shields.io/badge/agents-28-555">
@@ -119,7 +119,7 @@ Approve the normal plugin trust prompt, open the target repository, and continue
 
 ### Codex CLI
 
-The public GitHub-slug flow is **available now**. The repository currently ships `ca-codex 0.4.0`;
+The public GitHub-slug flow is **available now**. The repository currently ships `ca-codex 0.4.3`;
 the dated end-to-end public-install record discovered `ca-codex 0.2.4` from release `v2.8.13`.
 Current packaging and shared-core parity are continuously verified, while that dated live-install
 record stays labeled rather than being silently promoted to evidence for a newer adapter:

core/surface/ORCHESTRATOR.md

@@ -158,11 +158,20 @@ user type. Route on understood intent, in three tiers (ADR-0022):
 
 1. **Unambiguous and non-destructive** — route directly into the command. Name the route in one line
    as you take it. Every gate runs exactly as if the user had typed it.
-2. **Probable** — ask once, naming the command ("did you mean `{{CMD:fix}}`?"). One approval, then
-   route. The user approves rather than retypes.
+2. **Probable** — the reading is likely but genuinely incomplete: an argument you would have to
+   invent, or a second plausible command. Ask once, naming the best candidate ("did you mean
+   `{{CMD:fix}}`?"). One approval, then route — the user approves rather than retypes.
 3. **Genuinely unclear** — emit the redirect (`{{PLUGIN_ROOT}}/includes/redirect.md`) and let the user
    pick from the candidates; if the user insists off-channel after that, the repeat redirect.
 
+**The tier-1/tier-2 line is drawn by what is already resolved, not by temperament.** If you can name
+the exact command and its complete argument — nothing left to invent, no competing candidate — the
+intent *is* unambiguous: that is tier 1, route it. Asking "did you mean" while displaying the
+fully-formed command is the retype ceremony ADR-0022 abolished, returned as a question; the
+demonstration that you resolved the route is the reason to take it, never the thing to ask permission
+for. Tier 2 exists for a genuinely incomplete reading, and for the destructive set below — nothing
+else.
+
 **Clarity and risk are separate axes.** Tier 1 requires BOTH unambiguous intent AND a non-destructive
 command. Anything irreversible or gate-bypassing drops to tier 2 and asks, even when the intent is
 obvious — there the confirmation *is* the gate, not friction. That set: `{{CMD:override}}`, merge to

package.json

@@ -1,6 +1,6 @@
 {
   "name": "ca-pi",
-  "version": "0.2.0",
+  "version": "0.2.3",
   "private": true,
   "license": "AGPL-3.0-only",
   "engines": {

plugins/ca-codex/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ca-codex",
   "description": "Governance kernel for OpenAI Codex CLI: the full codeArbiter surface — 37 ca-prefixed governance skills (spec-driven /feature pipeline, nine-gate commit gate, ADRs, audits) plus enforcement hooks (persona injection, blocking pre-exec and pre-write gates, append-only audit trail) — sharing one .codearbiter/ store with the Claude Code sibling plugin. Standalone: opt a repo in with ca-init; enforcement stays dormant until .codearbiter/CONTEXT.md carries 'arbiter: enabled'. Requires Python 3 and Codex >= 0.143.0. CI continuously verifies, through a real Codex host at 0.143.0 and 0.145.0, that the plugin installs, reads back enabled, and ships every hook script it declares; an advisory lane tracks npm latest for upstream drift. Hook FIRING - live persona injection and live blocks inside a turn - is verified by hand per release against docs/codex-parity-testing.md, because a turn needs a model and a provider credential cannot gate fork pull requests.",
-  "version": "0.4.0",
+  "version": "0.4.3",
   "author": {
     "name": "arbiterForge"
   },

plugins/ca-codex/ORCHESTRATOR.md

@@ -137,11 +137,20 @@ user type. Route on understood intent, in three tiers (ADR-0022):
 
 1. **Unambiguous and non-destructive** — route directly into the command. Name the route in one line
    as you take it. Every gate runs exactly as if the user had typed it.
-2. **Probable** — ask once, naming the command ("did you mean `$ca-fix`?"). One approval, then
-   route. The user approves rather than retypes.
+2. **Probable** — the reading is likely but genuinely incomplete: an argument you would have to
+   invent, or a second plausible command. Ask once, naming the best candidate ("did you mean
+   `$ca-fix`?"). One approval, then route — the user approves rather than retypes.
 3. **Genuinely unclear** — emit the redirect (`${CLAUDE_PLUGIN_ROOT}/includes/redirect.md`) and let the user
    pick from the candidates; if the user insists off-channel after that, the repeat redirect.
 
+**The tier-1/tier-2 line is drawn by what is already resolved, not by temperament.** If you can name
+the exact command and its complete argument — nothing left to invent, no competing candidate — the
+intent *is* unambiguous: that is tier 1, route it. Asking "did you mean" while displaying the
+fully-formed command is the retype ceremony ADR-0022 abolished, returned as a question; the
+demonstration that you resolved the route is the reason to take it, never the thing to ask permission
+for. Tier 2 exists for a genuinely incomplete reading, and for the destructive set below — nothing
+else.
+
 **Clarity and risk are separate axes.** Tier 1 requires BOTH unambiguous intent AND a non-destructive
 command. Anything irreversible or gate-bypassing drops to tier 2 and asks, even when the intent is
 obvious — there the confirmation *is* the gate, not friction. That set: `$ca-override`, merge to

plugins/ca-pi/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to `ca-pi` are documented in this file.
 
 ## [Unreleased]
 
+## [0.2.3] - 2026-08-04
+
+### Fixed
+
+- ORCHESTRATOR.md §6 now defines the tier-1/tier-2 boundary operationally: a fully-resolved command with a complete argument routes directly (ADR-0022 tier 1) instead of asking "did you mean" while displaying the already-resolved command (#595).
+
 ## [0.2.0] - 2026-08-01
 
 ### Added

plugins/ca-pi/ORCHESTRATOR.md

@@ -137,11 +137,20 @@ user type. Route on understood intent, in three tiers (ADR-0022):
 
 1. **Unambiguous and non-destructive** — route directly into the command. Name the route in one line
    as you take it. Every gate runs exactly as if the user had typed it.
-2. **Probable** — ask once, naming the command ("did you mean `/ca-fix`?"). One approval, then
-   route. The user approves rather than retypes.
+2. **Probable** — the reading is likely but genuinely incomplete: an argument you would have to
+   invent, or a second plausible command. Ask once, naming the best candidate ("did you mean
+   `/ca-fix`?"). One approval, then route — the user approves rather than retypes.
 3. **Genuinely unclear** — emit the redirect (`<plugin-root>/includes/redirect.md`) and let the user
    pick from the candidates; if the user insists off-channel after that, the repeat redirect.
 
+**The tier-1/tier-2 line is drawn by what is already resolved, not by temperament.** If you can name
+the exact command and its complete argument — nothing left to invent, no competing candidate — the
+intent *is* unambiguous: that is tier 1, route it. Asking "did you mean" while displaying the
+fully-formed command is the retype ceremony ADR-0022 abolished, returned as a question; the
+demonstration that you resolved the route is the reason to take it, never the thing to ask permission
+for. Tier 2 exists for a genuinely incomplete reading, and for the destructive set below — nothing
+else.
+
 **Clarity and risk are separate axes.** Tier 1 requires BOTH unambiguous intent AND a non-destructive
 command. Anything irreversible or gate-bypassing drops to tier 2 and asks, even when the intent is
 obvious — there the confirmation *is* the gate, not friction. That set: `/ca-override`, merge to

plugins/ca-pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ca-pi",
-  "version": "0.2.0",
+  "version": "0.2.3",
   "private": true,
   "license": "AGPL-3.0-only",
   "type": "module",

plugins/ca/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "ca",
   "displayName": "codeArbiter",
   "description": "Orchestration layer for Claude Code. Routes every intent through gated skills and reviewer agents, drives spec-driven TDD, mechanically enforces the commit and audit-trail gates, decides via SMARTS, and keeps an append-only audit trail. Requires Python 3 on PATH. Dormant until you opt a repo in; run /ca:init to activate.",
-  "version": "2.11.1",
+  "version": "2.11.4",
   "author": { "name": "arbiterForge" },
   "license": "AGPL-3.0-only",
   "homepage": "https://github.com/arbiterForge/codeArbiter",

plugins/ca/ORCHESTRATOR.md

@@ -134,11 +134,20 @@ user type. Route on understood intent, in three tiers (ADR-0022):
 
 1. **Unambiguous and non-destructive** — route directly into the command. Name the route in one line
    as you take it. Every gate runs exactly as if the user had typed it.
-2. **Probable** — ask once, naming the command ("did you mean `/ca:fix`?"). One approval, then
-   route. The user approves rather than retypes.
+2. **Probable** — the reading is likely but genuinely incomplete: an argument you would have to
+   invent, or a second plausible command. Ask once, naming the best candidate ("did you mean
+   `/ca:fix`?"). One approval, then route — the user approves rather than retypes.
 3. **Genuinely unclear** — emit the redirect (`${CLAUDE_PLUGIN_ROOT}/includes/redirect.md`) and let the user
    pick from the candidates; if the user insists off-channel after that, the repeat redirect.
 
+**The tier-1/tier-2 line is drawn by what is already resolved, not by temperament.** If you can name
+the exact command and its complete argument — nothing left to invent, no competing candidate — the
+intent *is* unambiguous: that is tier 1, route it. Asking "did you mean" while displaying the
+fully-formed command is the retype ceremony ADR-0022 abolished, returned as a question; the
+demonstration that you resolved the route is the reason to take it, never the thing to ask permission
+for. Tier 2 exists for a genuinely incomplete reading, and for the destructive set below — nothing
+else.
+
 **Clarity and risk are separate axes.** Tier 1 requires BOTH unambiguous intent AND a non-destructive
 command. Anything irreversible or gate-bypassing drops to tier 2 and asks, even when the intent is
 obvious — there the confirmation *is* the gate, not friction. That set: `/ca:override`, merge to