immune-brain 3.2.1 → 3.3.0

package/README.md

@@ -14,7 +14,7 @@ Immune-Brain adds a structured engineering workflow on top of Pi:
 - **Plans become trackable tasks** (`TaskIntent` + `TaskRecord`) so progress survives across sessions, not just chat history.
 - **Quality is enforced by code, not promises** — automated QA and isolated review must pass before a task is marked done.
 
-Pi and Claude Code are the supported hosts. Undeclared adapters remain unsupported. Minimum Claude Code is `2.1.199`. Real Host evidence lives in [docs/verification/claude-code-host-conformance.md](docs/verification/claude-code-host-conformance.md). Either host can use the model provider you configure — Immune-Brain works on top of Kernel authority, not a vendor chat.
+Pi and Claude Code are the supported hosts. Undeclared adapters remain unsupported. Minimum Claude Code is `2.1.199`. Historical real-Host evidence is archived under [docs/verification/archive/](docs/verification/archive/); deterministic package and authority checks gate current releases. Either host can use the model provider you configure — Immune-Brain works on top of Kernel authority, not a vendor chat.
 
 ---
 

package/README.zh-CN.md

@@ -14,7 +14,7 @@ Immune-Brain 在 Pi 之上提供结构化的工程工作流：
 - **计划变为可追踪的任务**（`TaskIntent` + `TaskRecord`），进度落盘持久化，不依赖对话历史。
 - **质量由代码强制保障** — 自动化 QA 与隔离式 Review 必须通过，任务才会完成。
 
-Pi 与 Claude Code 是支持的宿主。未声明的适配器仍不受支持。Claude Code 最低版本为 `2.1.199`。真实 Host 证据见 `docs/verification/claude-code-host-conformance.md`。
+Pi 与 Claude Code 是支持的宿主。未声明的适配器仍不受支持。Claude Code 最低版本为 `2.1.199`。历史真实 Host 证据归档于 `docs/verification/archive/`；当前发布由确定性的 package 与 authority 检查把关。
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "3.2.1",
+  "version": "3.3.0",
   "description": "Immune-Brain agent skill system",
   "publishConfig": {
     "access": "public",
@@ -29,8 +29,9 @@
   },
   "scripts": {
     "changeset": "changeset",
-    "changeset:version": "changeset version && bun scripts/plugin_versioning.ts stamp && bun scripts/plugin_versioning.ts validate",
-    "changeset:publish": "bun scripts/plugin_versioning.ts validate && changeset publish",
+    "changeset:version": "changeset version && bun scripts/build-claude-plugin.ts && bun scripts/plugin_versioning.ts validate",
+    "verify:release": "bun scripts/plugin_versioning.ts validate && bun scripts/build-claude-plugin.ts --check && bun scripts/sync-dist-docs.ts --check && bun test && npm pack --dry-run --ignore-scripts",
+    "changeset:publish": "bun run verify:release && changeset publish",
     "release": "bun run changeset:publish"
   },
   "devDependencies": {
@@ -76,6 +77,7 @@
     "plugins/immune-brain/runtime/verification_descriptor.ts",
     "plugins/immune-brain/runtime/role_prompt_bridge.ts",
     "plugins/immune-brain/runtime/loop_contract.ts",
+    "plugins/immune-brain/runtime/plugin_version.ts",
     "plugins/immune-brain/runtime/assurance",
     "plugins/immune-brain/runtime/claude",
     "plugins/immune-brain/runtime/prompts",

package/plugins/immune-brain/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "3.2.1",
+  "version": "3.3.0",
   "description": "Immune-Brain Claude Code Host: native Enrollment, QA, Review, and Kernel settlement.",
   "author": {
     "name": "Immune-Brain Team"

package/plugins/immune-brain/.pi-extension/imm-canary-work.ts

@@ -20,6 +20,7 @@ import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
+import { PLUGIN_VERSION } from "../runtime/plugin_version";
 import {
 	parseVerificationDescriptor,
 	canonicalDescriptorBytes,
@@ -171,7 +172,6 @@ const TASK_INTENT_SCHEMA = Type.Object({
 
 export type { AssuranceRole } from "./pi-canary-assurance";
 export type AuthorizeOperation =
-	| "record-user-approval"
 	| "approve-breaking-intent-revision"
 	| "resolve-user-decision"
 	| "stop";
@@ -391,7 +391,7 @@ export default function (
 			"After implementation and focused verification, freeze the artifacts, call advance_assurance, and consume its direct terminal result; do not poll or create a detached job.",
 			"When advance_assurance returns review_ready, invoke the foreground Agent from agent_params once, then pass its structured verdict to submit_review.",
 			"For a complete breaking revision, call approve_breaking_intent_revision with the complete next_intent directly; do not ask for chat pre-confirmation because the host opens the single native confirmation before applying it.",
-			"For a proven stale authority claim, call repair_authority_state directly; do not ask for chat pre-confirmation because the host opens the single native confirmation.",
+			"For a proven stale authority claim, call repair_authority_state directly; the Kernel revalidates and removes only the redundant claim without user interaction.",
 			"After awaiting_user, call request_authorization directly so the host opens the single native confirmation; do not ask for chat pre-confirmation or ask the user to copy or report a command.",
 		],
 		parameters: Type.Object({
@@ -474,43 +474,6 @@ export default function (
 					presentTaskRailResult(ctx, taskId, blocked);
 					return failCanaryTool(taskId, action.op, "authority_conflict", "authority_conflict", blocked.result, blocked.next_action);
 				}
-				presentTaskRail(ctx, {
-					task_id: taskId,
-					state: "Approval required",
-					result: "Authority repair needs your approval",
-					next: "Decide whether to repair the stale claim",
-				});
-				const repairSelection = await requestAuthorityDialog(pi, ctx, {
-					attention_id: randomUUID(),
-					task_id: taskId,
-					reason: "authority_repair",
-					label: "Kernel authority repair required",
-				}, {
-					title: "Repair Kernel authority state?",
-					summary: [
-						`Owner: ${taskId}`,
-						`Terminal lifecycle: ${authority.owner_lifecycle}`,
-						`Claim lifecycle: ${authority.claim_lifecycle_status}`,
-					].join("\n"),
-					details: [
-						`Projection revision: ${authority.revision}`,
-						"Action: remove only the stale global claim; preserve TaskRecord and tombstone.",
-					].join("\n"),
-					signal: ctx.signal ?? signal,
-					actions: [
-						{ value: "repair", label: "Repair stale claim", description: "Remove only the stale global claim" },
-						{ value: "cancel", label: "Cancel", description: "Preserve all authority state unchanged" },
-					],
-				});
-				if (repairSelection !== "repair") {
-					const cancelled = {
-						state: "cancelled",
-						operation: action.op,
-						result: "Authority repair cancelled with zero writes",
-						next_action: "request authorization again if repair is still intended",
-					};
-					return toolResult(JSON.stringify(cancelled, null, 2), cancelled);
-				}
 				try {
 					const repaired = await repairKernelAuthority(ctx.cwd, taskId, authority.revision);
 					const result = {
@@ -574,9 +537,11 @@ export default function (
 				const blockers = state.blocking_finding_ids.length
 					+ state.unresolved_user_decision_ids.length
 					+ state.replan_required_ids.length;
+				const status = { plugin_version: PLUGIN_VERSION, ...state };
 				const details = {
 					state: "status",
 					operation: "status",
+					plugin_version: PLUGIN_VERSION,
 					lifecycle: state.lifecycle,
 					artifact_state: state.artifact_state,
 					task_state: state,
@@ -584,7 +549,7 @@ export default function (
 					next_action: state.next_obligation,
 				};
 				presentTaskRailResult(ctx, taskId, details);
-				return toolResult(JSON.stringify(state, null, 2), details);
+				return toolResult(JSON.stringify(status, null, 2), details);
 			}
 			const claim = projection.claim;
 			if (!claim || claim.task_id !== taskId) {
@@ -823,6 +788,17 @@ export default function (
 			`Decision: ${operation}`,
 			`State: ${projection.projection.lifecycle}:${projection.projection.artifact_state} | Claim: ${projection.claim.lifecycle_status}`,
 		].join("\n");
+		const intentDelta = nextIntent
+			? [
+					`Risk: ${priorIntent.intent.risk} -> ${nextIntent.risk}`,
+					`Goal: ${priorIntent.intent.goal} -> ${nextIntent.goal}`,
+					`Scope added: ${nextIntent.scope_hint.filter((path) => !priorIntent.intent.scope_hint.includes(path)).join(", ") || "none"}`,
+					`Scope removed: ${priorIntent.intent.scope_hint.filter((path) => !nextIntent.scope_hint.includes(path)).join(", ") || "none"}`,
+					`Acceptance added: ${nextIntent.acceptance.filter((item) => !priorIntent.intent.acceptance.some((prior) => prior.id === item.id)).map((item) => item.id).join(", ") || "none"}`,
+					`Acceptance removed: ${priorIntent.intent.acceptance.filter((item) => !nextIntent.acceptance.some((next) => next.id === item.id)).map((item) => item.id).join(", ") || "none"}`,
+					`Acceptance changed: ${nextIntent.acceptance.filter((item) => { const prior = priorIntent.intent.acceptance.find((candidate) => candidate.id === item.id); return prior && (prior.assertion !== item.assertion || prior.verification !== item.verification); }).map((item) => item.id).join(", ") || "none"}`,
+				]
+			: [];
 		const dialogDetails = [
 			`Operation: ${operation}`,
 			...(userDecisionOperation
@@ -834,9 +810,8 @@ export default function (
 			...(nextIntent
 				? [
 						`Next Intent: rev ${nextIntent.revision} (${nextIntentHash})`,
-						`Next Goal: ${nextIntent.goal}`,
-						`Next Scope: ${nextIntent.scope_hint.join(", ")}`,
-						`Next Acceptance Items: ${nextIntent.acceptance.length}`,
+						...intentDelta,
+						`Acceptance Items: ${priorIntent.intent.acceptance.length} -> ${nextIntent.acceptance.length}`,
 						`Next staged diff: ${stagedNextDiffHash}`,
 					]
 				: []),
@@ -922,23 +897,6 @@ export default function (
 					content_hash: nextIntentHash!,
 				};
 			}
-			// record-user-approval: literal-user approval for critical-task-completion. The approval payload is bound to the fresh
-			// projection (task revision, intent content hash, diff hash) and
-			// applied through the same exact-action capability path; the
-			// The reducer requires kind user, user authority, and active:frozen state.
-			const isUserApproval = operation === "record-user-approval";
-			const approval = isUserApproval
-				? {
-						id: `approval-user-${randomUUID().slice(0, 8)}`,
-						kind: "user" as const,
-						authority_role: "user" as const,
-						task_revision: projection.projection.intent_revision,
-						intent_content_hash: projection.projection.intent_content_hash,
-						diff_hash: projection.projection.diff_hash,
-						actor_id: "literal-user",
-						summary: "literal user approval",
-					}
-				: undefined;
 			const exactOperation = operation === "stop"
 				? { op: "stop" as const, reason: "literal user stopped task parked for replan" }
 				: operation === "approve-breaking-intent-revision"
@@ -947,7 +905,7 @@ export default function (
 							next_intent: nextIntent!,
 							next_intent_ref: nextIntentRef!,
 						}
-					: userDecisionOperation ?? userOperationFor(operation, approval);
+					: userDecisionOperation!;
 				// The exact host-built operation is shared by capability digest and
 				// application payload; command arguments cannot inject authority fields.
 				try {
@@ -971,7 +929,6 @@ export default function (
 						intent_content_hash: nextIntentHash ?? projection.projection.intent_content_hash,
 						diff_hash: operationDiffHash,
 						actor_id: "literal-user",
-						...(exactOperation.op === "record_user_approval" ? { approval: exactOperation.approval } : {}),
 						...(exactOperation.op === "approve_breaking_intent_revision"
 							? { next_intent: exactOperation.next_intent, next_intent_ref: exactOperation.next_intent_ref }
 							: {}),
@@ -1039,7 +996,6 @@ export default function (
 
 export type DerivedAuthorizationOperation =
 	| "resolve-user-decision"
-	| "record-user-approval"
 	| "stop";
 
 // Kernel projection is the sole source of authorization readiness.
@@ -1049,7 +1005,6 @@ export function deriveAuthorizationOperation(input: {
 }): { operation: DerivedAuthorizationOperation } | { blocked: string } {
 	if (input.hasOpenReplanRequired) return { operation: "stop" };
 	if (input.readiness.state === "resolve_user_decision") return { operation: "resolve-user-decision" };
-	if (input.readiness.state === "record_user_approval") return { operation: "record-user-approval" };
 	if (input.readiness.blocked) return { blocked: input.readiness.blocked };
 	return { blocked: "no unique host-derived authorization operation" };
 }
@@ -1126,15 +1081,6 @@ export function buildUserDecisionOperation(record: {
 	};
 }
 
-export function userOperationFor(operation: AuthorizeOperation, approval?: unknown) {
-	if (operation !== "record-user-approval")
-		throw new Error(`unsupported authorize operation: ${operation}`);
-	// The approval payload is constructed by the authorize handler from
-	// the fresh projection; it is never derived from untrusted input.
-	if (approval === undefined) throw new Error("record-user-approval requires an approval payload");
-	return { op: "record_user_approval" as const, approval };
-}
-
 /**
  * One record-aware freshness identity. v4 derives the scoped revision digest
  * from the immutable Enrollment base so committed and staged task work share a

package/plugins/immune-brain/.pi-extension/pi-canary-interaction.ts

@@ -8,8 +8,7 @@ export type UserAttentionReason =
 	| "enrollment"
 	| "descriptor_waiver"
 	| "breaking_intent_revision"
-	| "review_authorization"
-	| "authority_repair";
+	| "review_authorization";
 
 export interface UserAttentionEventV1 {
 	active: boolean;

package/plugins/immune-brain/.pi-extension/runtime-stub.ts

@@ -179,7 +179,7 @@ export interface TaskRecordRead {
 // --- Assurance projection (host-neutral Kernel facts, not exported from the
 // public Kernel index) ---
 export interface AssuranceAuthorizationReadiness {
-	state: "resolve_user_decision" | "record_user_approval" | "none";
+	state: "resolve_user_decision" | "none";
 	blocked: string | null;
 }
 export interface AssuranceProjection {
@@ -191,7 +191,7 @@ export interface AssuranceProjection {
 	lifecycle: "active" | "done" | "stopped" | "";
 	artifact_state: "active" | "frozen" | "";
 	risk: "routine" | "material" | "critical" | "";
-	next_obligation: "resolve_findings" | "resolve_user_decision" | "revise_intent" | "submit_assurance" | "run_qa" | "run_review" | "authorize_user" | "complete" | "none";
+	next_obligation: "resolve_findings" | "resolve_user_decision" | "revise_intent" | "submit_assurance" | "run_qa" | "run_review" | "complete" | "none";
 	fresh_acceptance_ids: string[];
 	missing_acceptance_ids: string[];
 	stale_attestation_ids: string[];

package/plugins/immune-brain/dist/claude/mcp-server.mjs

@@ -52,14 +52,16 @@ function probeHost(env = process.env, platform = process.platform, hostVersion)
   return { ok: true, version, permissionMode: "manual", platform };
 }
 
+// plugins/immune-brain/runtime/plugin_version.ts
+var PLUGIN_VERSION = "3.3.0";
+
 // plugins/immune-brain/runtime/claude/interaction.ts
 import { createHash, randomUUID } from "node:crypto";
 var PRIVILEGED_OPERATIONS = [
   "enroll",
   "request_authorization",
   "approve_breaking_intent_revision",
-  "stop",
-  "repair_authority_state"
+  "stop"
 ];
 function isPrivilegedOperation(operation) {
   return PRIVILEGED_OPERATIONS.includes(operation);
@@ -1484,8 +1486,6 @@ class AssuranceCoordinator {
           return this.unknownAfterCommit(taskId, "qa", operationId, boundedAssuranceError(error));
         }
       }
-      if (projection.projection.next_obligation === "authorize_user")
-        return { state: "awaiting_user", operation: "record-user-approval", operation_id: operationId };
       if (projection.projection.next_obligation !== "run_qa" && projection.projection.next_obligation !== "run_review")
         return { state: "blocked", reason: `Kernel requires ${projection.projection.next_obligation}` };
       const qaAlreadySettled = projection.projection.next_obligation === "run_review";
@@ -1583,8 +1583,6 @@ class AssuranceCoordinator {
           return this.unknownAfterCommit(taskId, "qa", operationId, boundedAssuranceError(error));
         }
       }
-      if (fresh.projection.next_obligation === "authorize_user")
-        return { state: "awaiting_user", operation: "record-user-approval", operation_id: operationId };
       if (fresh.projection.next_obligation !== "run_review") {
         if (authorityCommitted && aborted())
           return this.unknownAfterCommit(taskId, "qa", operationId, "QA settlement projection did not require Review after cancellation");
@@ -1747,8 +1745,6 @@ class AssuranceCoordinator {
         return this.unknownAfterCommit(taskId, "review", reservation.operationId, boundedAssuranceError(error));
       }
     }
-    if (settled.projection.next_obligation === "authorize_user")
-      return { state: "awaiting_user", operation: "record-user-approval", operation_id: reservation.operationId };
     return { state: "blocked", reason: `Kernel requires ${settled.projection.next_obligation} after Review` };
   }
   abandonReview(taskId, reason) {
@@ -3633,7 +3629,6 @@ var ACTION_V2_TYPES = [
   "record_finding",
   "resolve_finding",
   "record_approval",
-  "record_user_approval",
   "revise_intent",
   "approve_breaking_intent_revision",
   "request_rework",
@@ -3696,8 +3691,7 @@ function parseTaskAction(raw) {
       };
       break;
     }
-    case "record_approval":
-    case "record_user_approval": {
+    case "record_approval": {
       rejectUnknown2(value, [...ACTION_BASE_FIELDS, "approval"], "action", violations);
       const approval = parseApprovalV2(value.approval, 0, violations, true);
       if (approval.review_revision && approval.kind !== "review")
@@ -4904,7 +4898,7 @@ function commitTerminalLocked(root, taskId, transaction, tombstone) {
 var REQUIRED_ATTESTATIONS = {
   routine: ["qa"],
   material: ["qa", "review"],
-  critical: ["qa", "review", "user"]
+  critical: ["qa", "review"]
 };
 function archiveActivePlanningPath(path) {
   const matched = path.match(/^docs\/(plans|specs)\/([^/]+)$/);
@@ -5009,8 +5003,6 @@ function projectTask(intent, record, currentDiffHash, currentIntentContentHash,
       nextObligation = "run_qa";
     } else if (decision.missing_approval_kinds.includes("review")) {
       nextObligation = "run_review";
-    } else if (decision.missing_approval_kinds.includes("user")) {
-      nextObligation = "authorize_user";
     } else if (decision.complete) {
       nextObligation = "complete";
     }
@@ -5036,8 +5028,6 @@ function deriveAssuranceAuthorization(input) {
       state: "none",
       blocked: `resolve-user-decision requires exactly one open user decision; found ${input.open_user_decision_count}`
     };
-  if (input.next_obligation === "authorize_user")
-    return { state: "record_user_approval", blocked: null };
   return { state: "none", blocked: null };
 }
 function emptyProjection() {
@@ -5288,7 +5278,7 @@ function intentRefMatches(intent, ref) {
   return ref.path === `docs/plans/${intent.task_id}.intent.json` && ref.content_hash === canonicalIntentHash(intent);
 }
 function hasPrivilegedKind(action) {
-  return action.type === "record_approval" || action.type === "record_user_approval" || action.type === "approve_breaking_intent_revision" || action.type === "request_rework" || action.type === "stop" || action.type === "resolve_user_decision";
+  return action.type === "record_approval" || action.type === "approve_breaking_intent_revision" || action.type === "request_rework" || action.type === "stop" || action.type === "resolve_user_decision";
 }
 function findingsDigestV2(findings) {
   const normalized = findings.map((finding) => ({
@@ -5440,36 +5430,6 @@ function reduceTask(recordRaw, actionRaw, authorityAudit = null, changedPaths) {
       appendHistory(record, action, from, approval.id, authorityAudit);
       break;
     }
-    case "record_user_approval": {
-      if (record.lifecycle !== "active" || record.artifact_state !== "frozen")
-        throw new KernelInvariantError([
-          `cannot record user approval while state is ${stateOf(record)}`
-        ]);
-      const approval = action.approval;
-      if (approval.kind !== "user")
-        throw new KernelInvariantError([
-          "record_user_approval requires kind user"
-        ]);
-      if (!authorityAudit || authorityAudit.authority_kind !== "user")
-        throw new KernelInvariantError([
-          "record_user_approval requires user authority"
-        ]);
-      if (approval.task_revision !== record.intent_snapshot.revision)
-        throw new KernelInvariantError(["approval task_revision must equal the current intent revision"]);
-      if (approval.intent_content_hash !== record.intent_ref.content_hash)
-        throw new KernelInvariantError(["approval intent_content_hash must equal the current intent hash"]);
-      if (approval.diff_hash !== diffHash)
-        throw new KernelInvariantError(["approval diff_hash must equal the action diff hash"]);
-      if (record.attestations.some((item) => item.id === approval.id))
-        throw new KernelInvariantError([
-          `attestations contains duplicate id ${approval.id}`
-        ]);
-      if (approval.review_revision)
-        throw new KernelInvariantError(["review_revision is only valid on review approvals"]);
-      record.attestations.push({ ...approval, acceptance_results: [] });
-      appendHistory(record, action, from, approval.id, authorityAudit);
-      break;
-    }
     case "revise_intent":
     case "approve_breaking_intent_revision": {
       if (record.lifecycle !== "active")
@@ -5706,7 +5666,7 @@ function applyTaskAction(input) {
           "intent token does not match the committed record intent"
         ]);
     }
-    const privileged = action.type === "record_approval" || action.type === "record_user_approval" || action.type === "approve_breaking_intent_revision" || action.type === "request_rework" || action.type === "stop" || action.type === "resolve_user_decision";
+    const privileged = action.type === "record_approval" || action.type === "approve_breaking_intent_revision" || action.type === "request_rework" || action.type === "stop" || action.type === "resolve_user_decision";
     const expectedAuthority = privileged ? {
       task_id,
       action,
@@ -5828,8 +5788,6 @@ function capabilityActionFor(input) {
   switch (input.op) {
     case "record_approval":
       return { ...base, approval: input.approval };
-    case "record_user_approval":
-      return { ...base, approval: input.approval };
     case "request_rework":
       return { ...base, findings: input.findings };
     case "stop":
@@ -6014,10 +5972,6 @@ function createCanaryApplication(registry) {
         capability = operation.capability;
         action = { ...base, type: "record_approval", approval: operation.approval };
         break;
-      case "record_user_approval":
-        capability = operation.capability;
-        action = { ...base, type: "record_user_approval", approval: operation.approval };
-        break;
       case "revise_intent":
         action = {
           ...base,
@@ -6914,22 +6868,17 @@ class ClaudeRuntime {
     return submitClaudeReview(this.host, this.coordinator, { cwd: this.cwd }, taskId, verdictInput);
   }
   async authorize(taskId, operation, meta, extra = {}) {
-    if (!isPrivilegedOperation(operation) && operation !== "request_authorization")
-      throw new Error(`unsupported privileged operation ${operation}`);
-    this.rejectBeforePreparation(operation, { ...meta, taskId });
     if (operation === "repair_authority_state") {
       const authority = reconcileKernelAuthority(this.cwd, taskId);
       if (authority.state !== "repairable_stale_claim" || authority.owner_task_id !== taskId) {
         throw new Error(authority.diagnostic ?? "authority repair requires a repairable stale claim");
       }
-      const gate2 = this.gate(operation, { ...meta, taskId }, { bindingDigest: `repair:${authority.revision}` });
-      const current = reconcileKernelAuthority(this.cwd, taskId);
-      if (current.state !== authority.state || current.owner_task_id !== authority.owner_task_id || current.revision !== authority.revision) {
-        throw new Error("authority changed after native confirmation; repair aborted before capability issuance");
-      }
-      return repairKernelAuthority(this.cwd, taskId, current.revision);
+      return repairKernelAuthority(this.cwd, taskId, authority.revision);
     }
-    let op = operation === "request_authorization" ? "record_user_approval" : operation;
+    if (!isPrivilegedOperation(operation) && operation !== "request_authorization")
+      throw new Error(`unsupported privileged operation ${operation}`);
+    this.rejectBeforePreparation(operation, { ...meta, taskId });
+    let op = operation;
     let decisionOp;
     const projection = await this.status(taskId);
     if (projection.error || !projection.claim)
@@ -6943,7 +6892,7 @@ class ClaudeRuntime {
           throw new Error(`resolve-user-decision requires exactly one open user decision; found ${open.length}`);
         op = "resolve_user_decision";
         decisionOp = { finding_id: open[0].id, resolution: `resume after literal-user decision: ${open[0].summary}` };
-      } else if (readiness.state !== "record_user_approval") {
+      } else {
         throw new Error(readiness.blocked ?? "no unique host-derived authorization operation");
       }
     }
@@ -7010,16 +6959,6 @@ class ClaudeRuntime {
     }
     const { registry, app } = this.authority();
     const confirmation = gate.confirmation_ref;
-    const approval = op === "record_user_approval" ? {
-      id: `approval-user-${randomUUID5().slice(0, 8)}`,
-      kind: "user",
-      authority_role: "user",
-      task_revision: projection.projection.intent_revision,
-      intent_content_hash: projection.projection.intent_content_hash,
-      diff_hash: projection.projection.diff_hash,
-      actor_id: actorId,
-      summary: "literal user approval"
-    } : undefined;
     try {
       const capabilityProjection = await this.status(taskId);
       assertProjectionBinding(projection, capabilityProjection, Boolean(nextIntent));
@@ -7038,7 +6977,6 @@ class ClaudeRuntime {
         actor_id: actorId,
         now,
         confirmation_ref: confirmation,
-        ...approval ? { approval } : {},
         ...op === "approve_breaking_intent_revision" ? { next_intent: nextIntent, next_intent_ref: nextIntentRef } : {},
         ...op === "resolve_user_decision" && decisionOp ? decisionOp : {},
         ...op === "stop" ? { reason: extra.reason ?? "user stop" } : {}
@@ -7050,7 +6988,6 @@ class ClaudeRuntime {
           op,
           capability,
           actor_id: actorId,
-          ...approval ? { approval } : {},
           ...op === "approve_breaking_intent_revision" ? { next_intent: nextIntent, next_intent_ref: nextIntentRef } : {},
           ...op === "resolve_user_decision" && decisionOp ? decisionOp : {},
           ...op === "stop" ? { reason: extra.reason ?? "user stop" } : {}
@@ -7194,7 +7131,7 @@ var TOOLS = [
   { name: "request_authorization", description: "Apply exact literal-user authorization.", privileged: true },
   { name: "approve_breaking_intent_revision", description: "Approve a breaking TaskIntent revision.", privileged: true },
   { name: "stop", description: "Stop the active task with literal-user authority.", privileged: true },
-  { name: "repair_authority_state", description: "Repair a recoverable stale backend claim.", privileged: true }
+  { name: "repair_authority_state", description: "Repair a proven recoverable stale backend claim.", privileged: false }
 ];
 function listMcpTools() {
   return TOOLS.map((tool) => ({
@@ -7242,10 +7179,10 @@ function createMcpRuntime(options = {}) {
       if ("native_decision" in args)
         throw new Error("native_decision cannot be supplied in tool arguments");
       if (name === "status")
-        return runtime.status(taskId);
+        return { plugin_version: PLUGIN_VERSION, ...await runtime.status(taskId) };
       if (!negotiatedVersion)
         throw new Error("Claude Code version is unavailable");
-      if (!negotiatedInteractive)
+      if (!negotiatedInteractive && name !== "repair_authority_state")
         throw new Error("non-interactive host session cannot execute authority tools");
       const probe = probeHost(options.env ?? process.env, process.platform, negotiatedVersion);
       if (!probe.ok)
@@ -7306,7 +7243,12 @@ async function handleJsonRpc(message, mcp = createMcpRuntime()) {
       id: message.id ?? null,
       result: {
         protocolVersion: "2024-11-05",
-        serverInfo: { name: HOST_ID, version: MIN_CLAUDE_CODE_VERSION, contract: CORE_CONTRACT },
+        serverInfo: {
+          name: HOST_ID,
+          version: PLUGIN_VERSION,
+          contract: CORE_CONTRACT,
+          minimumHostVersion: MIN_CLAUDE_CODE_VERSION
+        },
         capabilities: { tools: {} }
       }
     };
@@ -7506,9 +7448,9 @@ if (entry.endsWith("mcp_server.ts") || entry.endsWith("mcp-server.mjs")) {
     serveStdio();
 }
 export {
-  serveStdio,
-  listMcpTools,
-  handleJsonRpc,
+  TOOLS,
   createMcpRuntime,
-  TOOLS
+  handleJsonRpc,
+  listMcpTools,
+  serveStdio
 };

package/plugins/immune-brain/dist/docs/reference/subagent-dispatch-protocol.md

@@ -90,7 +90,7 @@ Pi `Agent` has no `readonly` parameter; the empty tool policy, child type, and p
 4. Kernel Assurance chat uses native Tool rendering only. It does not publish completion messages or wake a later parent turn; the direct Tool result is the continuation boundary. `awaiting_user` remains valid until the host-built authorization operation is confirmed and the immutable snapshot is revalidated.
 5. Child 不得再次派发 child，nested delegation 一律禁止。Parent 保留综合与最终判断责任。
 6. Kernel authority Review 对每个 immutable snapshot 恰好一个 primary reviewer，turn 预算按 workload 缩放（Quick 12 / Standard 16 / Heavy 24），并使用该 snapshot 对应的 Quick/Standard/Heavy 执行档位；不存在从 initial dispatch 起算的单一端到端总预算。Reviewer 必须先验证 immutable v5 manifest 的 `base_head`、`review_commit`、单一 parent、`review_tree` 与 `manifest_digest`，再用只读 Git 命令从 synthetic revision 获取源码；manifest 只有 metadata，不复制 source bytes，也不枚举 neighborhood files。审查只围绕 acceptance assertions 与 `changed_paths`，未变更路径只有在 acceptance、changed caller 或同一 state machine 直接需要时按需读取并注明理由；Reviewer 不探索无关 repository paths。对 settlement-class change，Reviewer 必须先枚举 immutable revision 内每条 terminal、cancellation、timeout 与 race path，再对全部路径给出判断；finding summary 必须以受影响路径开头。每个 acceptance 的执行结果已由 deterministic QA 在 review 前验证并内嵌于 manifest 的 `outcomes` 字段（acceptance_id -> {status, summary}）；Reviewer 不得重跑 descriptor，也不得把本地没有测试运行当作 finding——Review 只审 revision provenance、代码正确性、回归、安全与缺失测试。除该 reviewer 外，同一触发点最多两个相互独立的 advisory/discovery children；它们只能并行读，不能写 workflow state、关闭 QA 或产生 authority。
-7. Foreground assurance never sleeps, polls, or schedules a completion callback. One Tool call owns QA; one Parent turn obtains and submits the reviewer verdict; one explicit authorization operation owns the critical-risk user decision.
+7. Foreground assurance never sleeps, polls, or schedules a completion callback. One Tool call owns QA; one Parent turn obtains and submits the reviewer verdict. User authorization is reserved for unresolved decisions, explicit stop, and breaking Intent revisions; no risk tier adds a generic final confirmation.
 8. `submit_review` validates the verdict contract, task identity, immutable snapshot digest, and fresh record/Intent/workspace/diff revisions before applying Review authority. Malformed verdicts are retryable without rebuilding evidence. Stale verdicts leave the TaskRecord unchanged and release the stale reservation. Local execution trusts the Parent to relay the reviewer verdict and does not require Agent lifecycle receipts.
 9. The assurance Tool checks the immutable snapshot before each phase and returns a terminal structured state directly: `cancelled`, `rework`, `review_ready`, `awaiting_user`, `blocked`, or `settlement_unknown`. The commit boundary is non-cancellable. No silent task, status timer, completion notification, or result retrieval path is permitted.
 

package/plugins/immune-brain/dist/imm-agent-doc-maintain.md

@@ -55,9 +55,12 @@ commit.
    routing owner or scope cannot be read reliably, fail closed for mutation.
 
 3. **Inventory instruction relationships.** Determine nesting, explicit
-   precedence statements, inbound references, and existing authority pointers.
-   Preserve each file's native organization. Do not normalize files to a shared
-   template and do not infer unsupported cross-host inheritance semantics.
+   precedence statements, inbound references, existing authority pointers, and
+   semantic duplication within and across candidates. Preserve each file's
+   native organization. Do not normalize files to a shared template and do not
+   infer unsupported cross-host inheritance semantics. Resolve duplicate
+   ownership only from explicit precedence, authority, and inbound-reference
+   evidence; unresolved ownership remains `UNVERIFIED` or `BLOCKED`.
 
 4. **Build repository facts.** Resolve current truth in this order:
    executable/public registries, package exports, CLI/runtime entrypoints;
@@ -77,14 +80,25 @@ commit.
 6. **Classify exact actions.** Classify entries as `REMOVE`, `REWRITE`,
    `POINTER`, `KEEP`, `BLOCKED`, `BLOCKED_ACTIVE_SCOPE`, `UNVERIFIED`, or
    `MISSING_OWNER`. Every mutation entry identifies exact file/section bytes,
-   preserved meaning, evidence, candidate hash, and resulting text. `POINTER`
-   may target only an existing current authority and must include a concrete
-   trigger condition. Missing reference ownership is `MISSING_OWNER`; this Skill
-   does not create a reference document. Unknown or one-off-looking rules remain
-   `UNVERIFIED` and are not deleted by default. Unresolved precedence or
-   semantic conflicts that cannot be decided from explicit repository scope or
-   declared precedence are `BLOCKED`. Filename convention, nesting, or guessed
-   host behavior alone may not resolve a conflict.
+   preserved meaning, evidence, candidate hash, and resulting text. A retained
+   meaning has one instruction owner; duplicate copies are not all `KEEP` by
+   default. Rules already enforced deterministically by a formatter, linter,
+   schema, permission policy, Git hook, or runtime are `REMOVE` unless the agent
+   still needs a non-discoverable recovery action, in which case use the shortest
+   `REWRITE` or `POINTER`. Keep globally relevant retained rules inline. For a
+   branch-specific rule, prefer `POINTER` to an existing current authority with
+   a concrete trigger condition; when no owner exists, use `MISSING_OWNER`
+   rather than creating one. This Skill does not create a reference document.
+   Do not introduce host-specific conditional markup,
+   including `<important if>`, without an explicit current host contract and
+   repository evidence that the target file uses those semantics. Discoverable
+   code snippets, examples, and command tables are repository caches and are
+   removed or replaced with a stable pointer unless they encode a necessary
+   non-discoverable exception or recovery action. Unknown or one-off-looking
+   rules remain `UNVERIFIED` and are not deleted by default. Unresolved
+   precedence or semantic conflicts that cannot be decided from explicit
+   repository scope or declared precedence are `BLOCKED`. Filename convention,
+   nesting, or guessed host behavior alone may not resolve a conflict.
 
 7. **Produce one exact manifest.** `audit` mode stops after the manifest.
    Mutation mode also stops until the literal user approves exact manifest
@@ -103,8 +117,9 @@ commit.
    brevity.
 
 9. **Verify and report.** Re-scan modified instruction relationships, local
-   pointer targets, unresolved conflicts, source/package public-surface parity,
-   existing focused documentation contracts, and `git diff --check`. This Skill
+   pointer targets, duplicate retained meanings, unresolved conflicts,
+   source/package public-surface parity, existing focused documentation
+   contracts, and `git diff --check`. This Skill
    does not execute arbitrary documented commands, real-model success-rate
    benchmarks, or Token measurements unless the user literally requests a
    benchmark. This Skill does not commit. Report only `Removed`, `Rewritten`,