immune-brain 3.2.1 → 3.3.0

package/plugins/immune-brain/dist/imm-loop.md

@@ -1,6 +1,6 @@
 ---
 name: imm-loop
-description: Use when running validated Plans to completion.
+description: Use to run an enrolled TaskIntent to completion through Kernel-governed execution, QA, and Review.
 ---
 
 # Immune-Brain: Loop
@@ -52,7 +52,7 @@ Repeat this sequence; do not silently stop while a valid action remains:
 1. Call `imm_loop_action` with `op: route` (or `dispatch_role` at a QA/review boundary) and follow the projected `next` authority.
 2. Emit one progress line: `[target][phase] result | next: action`.
 3. Execute exactly one allowed action:
-   - Kernel ownership: call `imm_kernel_canary` for that owned task. Freeze the completed artifacts, then call `advance_assurance`; when it returns `review_ready`, invoke the foreground reviewer and pass its structured verdict to `submit_review`. When the projection calls for `request_authorization`, `approve_breaking_intent_revision`, or `repair_authority_state`, invoke the exact Tool operation directly without asking the user for chat pre-confirmation. The native host interaction is the single authority decision.
+   - Kernel ownership: call `imm_kernel_canary` for that owned task. Freeze the completed artifacts, then call `advance_assurance`; when it returns `review_ready`, invoke the foreground reviewer and pass its structured verdict to `submit_review`. When the projection calls for `request_authorization` or `approve_breaking_intent_revision`, invoke the exact Tool operation directly without asking the user for chat pre-confirmation; the native host interaction is the single authority decision. Invoke `repair_authority_state` directly for a proven stale claim; Kernel revalidation removes only the redundant claim without user interaction.
    - Active Step / `rework_needed`: follow the returned `executor` context in the current conversation, implement only the active Step or pending same-boundary `follow_up`, verify, record structured execution evidence through the Loop runtime action, and continue. A bounded test-only repair may request internal `test-fixer` with `focus_delta.specific_changes`; PR review or CI repair may request internal `pr-fix` with the current `plan_id`, changed-file boundary, and verification. Both return child evidence to the Parent and cannot widen scope.
    - `awaiting_qa_decision`: call `imm_loop_action` with `op: dispatch_role`, role `qa`, the current projection, Plan verification, recorded evidence, and current target identity. Invoke the returned foreground Agent envelope exactly. A `rework` or `replan` must carry validated `notes`.
    - `review_required`: map the exact `pending_review_gate` (`imm-code-review` or `imm-ui-review`) to the internal `code-review` or `ui-review` role and call `imm_loop_action` with `op: dispatch_role`, passing `pending_review_gate`, `review_changed_files`, and `review_changed_files_signature`. Invoke the returned foreground Agent envelope exactly. Record a validated pass, or open a same-boundary follow-up through the Loop runtime action.
@@ -141,17 +141,26 @@ Default user-facing shape: checkpoint progress lines, then `Conclusion -> Eviden
 When the Kernel projection reports an active/draining backend claim, keep
 `imm-loop` as the user-facing entry and call the `imm_kernel_canary` Tool for
 that owned task. Enrollment uses the `imm_canary_enrollment` Tool and Review
-authorization remains a native TUI gate using the internal user-kind approval
-action `record-user-approval`. When the projection calls for
-`request_authorization`, `approve_breaking_intent_revision`, or
-`repair_authority_state`, invoke the exact Tool operation directly without
-asking the user for chat pre-confirmation; the native host interaction is the
-single authority decision. This action is not a public Skill or CLI route. Do
-not invoke the removed `imm-canary-work` Skill as a separate entry point.
-Invalid or contradictory projections fail closed. After implementation and focused verification, freeze the artifacts and call
-`imm_kernel_canary` `advance_assurance`. If it returns `review_ready`, invoke
-the foreground reviewer and pass its structured verdict to `submit_review`;
-`request_authorization` remains the user authorization boundary. Foreground
-results replace background continuation and result polling. A terminal task leaves only an immutable task tombstone: it is
-never reactivated and never blocks unrelated v3 routing. The Kernel projection
-is advisory; every Kernel mutation re-enters Kernel store-lock validation.
+authorization remains a native TUI gate. When the projection calls for
+`request_authorization` or `approve_breaking_intent_revision`, invoke the exact
+Tool operation directly without asking the user for chat pre-confirmation; the
+native host interaction is the single authority decision. Invoke
+`repair_authority_state` directly for a proven stale claim; Kernel revalidation
+removes only the redundant claim without user interaction. Do not invoke the
+removed `imm-canary-work` Skill as
+a separate entry point. Invalid or contradictory projections fail closed. After
+implementation and focused verification, freeze the artifacts and call
+`advance_assurance`. If it returns `review_ready`, invoke the foreground
+reviewer and pass its structured verdict to `submit_review`;
+`request_authorization` is reserved for an unresolved user decision or an
+explicit stop. Critical work completes after fresh QA and Review without a
+second user confirmation.
+Every QA/Review operation stays foreground and returns its next projected
+obligation directly to the Parent. The host performs any opted-in GitHub Issue
+projection only after the corresponding authority mutation: only a fresh
+claimless `done`/`stopped` projection with its exact terminal tombstone projects
+terminal closure (`completed`/`not planned`); Enrollment performs no GitHub
+projection. Treat the attached tracker result as non-authoritative observation.
+Report its failure separately, but never use it as evidence, a stop condition,
+or a reason to repeat a Kernel mutation. A terminal tombstone alone never
+blocks unrelated v3 routing.

package/plugins/immune-brain/dist/imm-planner.md

@@ -1,6 +1,6 @@
 ---
 name: imm-planner
-description: Use when planning work.
+description: Use to create or revise a spec and TaskIntent from requirements; owns scope and decomposition, not implementation or Enrollment.
 ---
 
 # Immune-Brain: Planner

package/plugins/immune-brain/runtime/assurance/coordinator.ts

@@ -133,7 +133,6 @@ export interface ForegroundToolUpdate {
 
 export type AssuranceAdvanceResult =
 	| { state: "review_ready"; operation: "review"; operation_id: string; snapshot_digest: string; review_bundle_digest: string; agent_params: unknown }
-	| { state: "awaiting_user"; operation: "record-user-approval"; operation_id: string }
 	| { state: "rework"; operation: "qa"; operation_id: string; summary: string }
 	| { state: "cancelled"; operation: "qa" | "review"; operation_id: string; reason: string }
 	| { state: "failed"; operation: "qa" | "review"; operation_id: string; reason: string }
@@ -150,7 +149,6 @@ export type AssuranceAdvanceResult =
 
 export type AssuranceSubmitReviewResult =
 	| { state: "rework"; operation: "review"; operation_id: string; summary: string }
-	| { state: "awaiting_user"; operation: "record-user-approval"; operation_id: string }
 	| { state: "review_preparation_failed"; operation: "review"; operation_id: string; reason: string }
 	| { state: "completed" }
 	| { state: "settlement_unknown"; operation: "qa" | "review"; operation_id: string; reason: string }
@@ -528,8 +526,6 @@ export class AssuranceCoordinator {
 					return this.unknownAfterCommit(taskId, "qa", operationId, boundedAssuranceError(error));
 				}
 			}
-			if (projection.projection.next_obligation === "authorize_user")
-				return { state: "awaiting_user", operation: "record-user-approval", operation_id: operationId };
 			if (projection.projection.next_obligation !== "run_qa" && projection.projection.next_obligation !== "run_review")
 				return { state: "blocked", reason: `Kernel requires ${projection.projection.next_obligation}` };
 			const qaAlreadySettled = projection.projection.next_obligation === "run_review";
@@ -623,8 +619,6 @@ export class AssuranceCoordinator {
 					return this.unknownAfterCommit(taskId, "qa", operationId, boundedAssuranceError(error));
 				}
 			}
-			if (fresh.projection.next_obligation === "authorize_user")
-				return { state: "awaiting_user", operation: "record-user-approval", operation_id: operationId };
 			if (fresh.projection.next_obligation !== "run_review") {
 				if (authorityCommitted && aborted()) return this.unknownAfterCommit(taskId, "qa", operationId, "QA settlement projection did not require Review after cancellation");
 				return { state: "blocked", reason: `Kernel requires ${fresh.projection.next_obligation} after QA` };
@@ -777,8 +771,6 @@ export class AssuranceCoordinator {
 				return this.unknownAfterCommit(taskId, "review", reservation.operationId, boundedAssuranceError(error));
 			}
 		}
-		if (settled.projection.next_obligation === "authorize_user")
-			return { state: "awaiting_user", operation: "record-user-approval", operation_id: reservation.operationId };
 		return { state: "blocked", reason: `Kernel requires ${settled.projection.next_obligation} after Review` };
 	}
 

package/plugins/immune-brain/runtime/claude/interaction.ts

@@ -6,7 +6,6 @@ export const PRIVILEGED_OPERATIONS = [
 	"request_authorization",
 	"approve_breaking_intent_revision",
 	"stop",
-	"repair_authority_state",
 ] as const;
 
 export type PrivilegedOperation = (typeof PRIVILEGED_OPERATIONS)[number];

package/plugins/immune-brain/runtime/claude/kernel_ports.ts

@@ -493,21 +493,16 @@ export class ClaudeRuntime {
 	}
 
 	async authorize(taskId: string, operation: string, meta: ToolMeta, extra: Record<string, unknown> = {}) {
-		if (!isPrivilegedOperation(operation) && operation !== "request_authorization") throw new Error(`unsupported privileged operation ${operation}`);
-		this.rejectBeforePreparation(operation, { ...meta, taskId });
 		if (operation === "repair_authority_state") {
 			const authority = reconcileKernelAuthority(this.cwd, taskId);
 			if (authority.state !== "repairable_stale_claim" || authority.owner_task_id !== taskId) {
 				throw new Error(authority.diagnostic ?? "authority repair requires a repairable stale claim");
 			}
-			const gate = this.gate(operation, { ...meta, taskId }, { bindingDigest: `repair:${authority.revision}` });
-			const current = reconcileKernelAuthority(this.cwd, taskId);
-			if (current.state !== authority.state || current.owner_task_id !== authority.owner_task_id || current.revision !== authority.revision) {
-				throw new Error("authority changed after native confirmation; repair aborted before capability issuance");
-			}
-			return repairKernelAuthority(this.cwd, taskId, current.revision);
+			return repairKernelAuthority(this.cwd, taskId, authority.revision);
 		}
-		let op = operation === "request_authorization" ? "record_user_approval" : operation;
+		if (!isPrivilegedOperation(operation) && operation !== "request_authorization") throw new Error(`unsupported privileged operation ${operation}`);
+		this.rejectBeforePreparation(operation, { ...meta, taskId });
+		let op = operation;
 		let decisionOp: { finding_id: string; resolution: string } | undefined;
 		const projection = await this.status(taskId);
 		if (projection.error || !projection.claim) throw new Error(projection.error ?? "no active backend claim");
@@ -524,7 +519,7 @@ export class ClaudeRuntime {
 				if (open.length !== 1) throw new Error(`resolve-user-decision requires exactly one open user decision; found ${open.length}`);
 				op = "resolve_user_decision";
 				decisionOp = { finding_id: open[0].id, resolution: `resume after literal-user decision: ${open[0].summary}` };
-			} else if (readiness.state !== "record_user_approval") {
+			} else {
 				throw new Error(readiness.blocked ?? "no unique host-derived authorization operation");
 			}
 		}
@@ -591,18 +586,6 @@ export class ClaudeRuntime {
 		}
 		const { registry, app } = this.authority();
 		const confirmation = gate.confirmation_ref;
-		const approval = op === "record_user_approval"
-			? {
-				id: `approval-user-${randomUUID().slice(0, 8)}`,
-				kind: "user" as const,
-				authority_role: "user" as const,
-				task_revision: projection.projection.intent_revision,
-				intent_content_hash: projection.projection.intent_content_hash,
-				diff_hash: projection.projection.diff_hash,
-				actor_id: actorId,
-				summary: "literal user approval",
-			}
-			: undefined;
 		try {
 			const capabilityProjection = await this.status(taskId);
 			assertProjectionBinding(projection, capabilityProjection, Boolean(nextIntent));
@@ -621,7 +604,6 @@ export class ClaudeRuntime {
 				actor_id: actorId,
 				now,
 				confirmation_ref: confirmation,
-				...(approval ? { approval } : {}),
 				...(op === "approve_breaking_intent_revision" ? { next_intent: nextIntent, next_intent_ref: nextIntentRef } : {}),
 				...(op === "resolve_user_decision" && decisionOp ? decisionOp : {}),
 				...(op === "stop" ? { reason: extra.reason ?? "user stop" } : {}),
@@ -633,7 +615,6 @@ export class ClaudeRuntime {
 					op,
 					capability,
 					actor_id: actorId,
-					...(approval ? { approval } : {}),
 					...(op === "approve_breaking_intent_revision" ? { next_intent: nextIntent, next_intent_ref: nextIntentRef } : {}),
 					...(op === "resolve_user_decision" && decisionOp ? decisionOp : {}),
 					...(op === "stop" ? { reason: extra.reason ?? "user stop" } : {}),

package/plugins/immune-brain/runtime/claude/mcp_server.ts

@@ -2,6 +2,7 @@ import { createInterface } from "node:readline";
 import { stdin, stdout } from "node:process";
 import type { Readable, Writable } from "node:stream";
 import { CORE_CONTRACT, HOST_ID, MIN_CLAUDE_CODE_VERSION, probeHost } from "./capability";
+import { PLUGIN_VERSION } from "../plugin_version";
 import { isPrivilegedOperation, privilegedAnnotations, type NativeDecision } from "./interaction";
 import { ClaudeReviewHost, FileHookEventLog, parseHookStdin } from "./review_host";
 import { ClaudeRuntime, type ToolMeta } from "./kernel_ports";
@@ -15,7 +16,7 @@ export const TOOLS = [
 	{ name: "request_authorization", description: "Apply exact literal-user authorization.", privileged: true },
 	{ name: "approve_breaking_intent_revision", description: "Approve a breaking TaskIntent revision.", privileged: true },
 	{ name: "stop", description: "Stop the active task with literal-user authority.", privileged: true },
-	{ name: "repair_authority_state", description: "Repair a recoverable stale backend claim.", privileged: true },
+	{ name: "repair_authority_state", description: "Repair a proven recoverable stale backend claim.", privileged: false },
 ] as const;
 
 export function listMcpTools() {
@@ -75,16 +76,14 @@ export function createMcpRuntime(options: McpRuntimeOptions = {}) {
 			if ("native_decision" in args) throw new Error("native_decision cannot be supplied in tool arguments");
 			// Read-only status must stay usable without trusted Host evidence, so it
 			// is dispatched before the capability probe rejects unversioned hosts.
-			if (name === "status") return runtime.status(taskId);
+			if (name === "status") return { plugin_version: PLUGIN_VERSION, ...(await runtime.status(taskId)) };
 			// The environment version fallback is disabled on this connection:
 			// only a version bound from the trusted initialize handshake may
 			// reach authority-mutating tools.
 			if (!negotiatedVersion) throw new Error("Claude Code version is unavailable");
-			// Every authority-mutating tool requires the handshake to have
-			// declared elicitation support: only read-only status works on
-			// non-interactive sessions, so QA/review/completion cannot mutate
-			// Kernel state without native interaction capability.
-			if (!negotiatedInteractive) throw new Error("non-interactive host session cannot execute authority tools");
+			// Automatic stale-claim repair is deterministic and needs no native
+			// interaction; other mutations retain the Host capability requirement.
+			if (!negotiatedInteractive && name !== "repair_authority_state") throw new Error("non-interactive host session cannot execute authority tools");
 			const probe = probeHost(options.env ?? process.env, process.platform, negotiatedVersion);
 			if (!probe.ok) throw new Error(probe.reason);
 			const toolMeta: ToolMeta = {
@@ -168,7 +167,12 @@ export async function handleJsonRpc(message: JsonRpc, mcp = createMcpRuntime()):
 			id: message.id ?? null,
 			result: {
 				protocolVersion: "2024-11-05",
-				serverInfo: { name: HOST_ID, version: MIN_CLAUDE_CODE_VERSION, contract: CORE_CONTRACT },
+				serverInfo: {
+					name: HOST_ID,
+					version: PLUGIN_VERSION,
+					contract: CORE_CONTRACT,
+					minimumHostVersion: MIN_CLAUDE_CODE_VERSION,
+				},
 				capabilities: { tools: {} },
 			},
 		};

package/plugins/immune-brain/runtime/kernel/application.ts

@@ -158,7 +158,6 @@ export function applyTaskAction(
 
 		const privileged =
 			action.type === "record_approval" ||
-			action.type === "record_user_approval" ||
 			action.type === "approve_breaking_intent_revision" ||
 			action.type === "request_rework" ||
 			action.type === "stop" ||

package/plugins/immune-brain/runtime/kernel/assurance_projection.ts

@@ -25,13 +25,9 @@ export interface AssuranceAuthorizationReadiness {
 	/**
 	 * Kernel-decidable authorization readiness:
 	 * - "resolve_user_decision": exactly one open unresolved-user-decision finding;
-	 * - "record_user_approval": Kernel projects authorize_user after fresh QA
-	 *   and Review attestations for a critical task;
 	 * - "none": nothing uniquely decidable from Kernel facts.
-	 * A pending Pi native Review verdict is a session fact and is NOT visible
-	 * here; the host composes it before this readiness.
 	 */
-	state: "resolve_user_decision" | "record_user_approval" | "none";
+	state: "resolve_user_decision" | "none";
 	/** Non-null only when Kernel facts prove the authorization is blocked. */
 	blocked: string | null;
 }
@@ -79,8 +75,6 @@ export function deriveAssuranceAuthorization(input: {
 			state: "none",
 			blocked: `resolve-user-decision requires exactly one open user decision; found ${input.open_user_decision_count}`,
 		};
-	if (input.next_obligation === "authorize_user")
-		return { state: "record_user_approval", blocked: null };
 	return { state: "none", blocked: null };
 }
 

package/plugins/immune-brain/runtime/kernel/canary_application.ts

@@ -51,7 +51,6 @@ export type CanaryOperation =
 	| { op: "resolve_finding"; finding_id: string; actor_id: string }
 	| { op: "request_rework"; capability: object; findings: TaskFinding[]; actor_id: string }
 	| { op: "record_approval"; capability: object; approval: TaskApprovalV2; actor_id: string }
-	| { op: "record_user_approval"; capability: object; approval: TaskApprovalV2; actor_id: string }
 	| { op: "revise_intent"; next_intent: TaskIntentV1; actor_id: string }
 	| { op: "approve_breaking_intent_revision"; capability: object; next_intent: TaskIntentV1; actor_id: string }
 	| { op: "complete"; actor_id: string }
@@ -141,8 +140,6 @@ export function capabilityActionFor(input: {
 	switch (input.op) {
 		case "record_approval":
 			return { ...base, approval: input.approval } as TaskAction;
-		case "record_user_approval":
-			return { ...base, approval: input.approval } as TaskAction;
 		case "request_rework":
 			return { ...base, findings: input.findings } as TaskAction;
 		case "stop":
@@ -373,10 +370,6 @@ export function createCanaryApplication(
 				capability = operation.capability;
 				action = { ...base, type: "record_approval", approval: operation.approval };
 				break;
-			case "record_user_approval":
-				capability = operation.capability;
-				action = { ...base, type: "record_user_approval", approval: operation.approval };
-				break;
 			case "revise_intent":
 				action = {
 					...base,

package/plugins/immune-brain/runtime/kernel/completion.ts

@@ -12,7 +12,7 @@ import { assertKernelInvariantsV3, KernelInvariantError } from "./validation";
 const REQUIRED_ATTESTATIONS: Record<TaskIntentV1["risk"], ApprovalKind[]> = {
 	routine: ["qa"],
 	material: ["qa", "review"],
-	critical: ["qa", "review", "user"],
+	critical: ["qa", "review"],
 };
 
 function archiveActivePlanningPath(path: string): string | null {
@@ -199,8 +199,6 @@ export function projectTask(
 			nextObligation = "run_qa";
 		} else if (decision.missing_approval_kinds.includes("review")) {
 			nextObligation = "run_review";
-		} else if (decision.missing_approval_kinds.includes("user")) {
-			nextObligation = "authorize_user";
 		} else if (decision.complete) {
 			nextObligation = "complete";
 		}

package/plugins/immune-brain/runtime/kernel/reducer.ts

@@ -176,7 +176,6 @@ function intentRefMatches(intent: TaskIntentV1, ref: TaskIntentRefV3): boolean {
 function hasPrivilegedKind(action: TaskAction): boolean {
 	return (
 		action.type === "record_approval" ||
-		action.type === "record_user_approval" ||
 		action.type === "approve_breaking_intent_revision" ||
 		action.type === "request_rework" ||
 		action.type === "stop" ||
@@ -374,36 +373,6 @@ export function reduceTask(
 			appendHistory(record, action, from, approval.id, authorityAudit);
 			break;
 		}
-		case "record_user_approval": {
-			if (record.lifecycle !== "active" || record.artifact_state !== "frozen")
-				throw new KernelInvariantError([
-					`cannot record user approval while state is ${stateOf(record)}`,
-				]);
-			const approval = action.approval;
-			if (approval.kind !== "user")
-				throw new KernelInvariantError([
-					"record_user_approval requires kind user",
-				]);
-			if (!authorityAudit || authorityAudit.authority_kind !== "user")
-				throw new KernelInvariantError([
-					"record_user_approval requires user authority",
-				]);
-			if (approval.task_revision !== record.intent_snapshot.revision)
-				throw new KernelInvariantError(["approval task_revision must equal the current intent revision"]);
-			if (approval.intent_content_hash !== record.intent_ref.content_hash)
-				throw new KernelInvariantError(["approval intent_content_hash must equal the current intent hash"]);
-			if (approval.diff_hash !== diffHash)
-				throw new KernelInvariantError(["approval diff_hash must equal the action diff hash"]);
-			if (record.attestations.some((item) => item.id === approval.id))
-				throw new KernelInvariantError([
-					`attestations contains duplicate id ${approval.id}`,
-				]);
-			if (approval.review_revision)
-				throw new KernelInvariantError(["review_revision is only valid on review approvals"]);
-			record.attestations.push({ ...approval, acceptance_results: [] });
-			appendHistory(record, action, from, approval.id, authorityAudit);
-			break;
-		}
 		case "revise_intent":
 		case "approve_breaking_intent_revision": {
 			if (record.lifecycle !== "active")

package/plugins/immune-brain/runtime/kernel/types.ts

@@ -57,7 +57,6 @@ export type AssuranceObligation =
 	| "submit_assurance"
 	| "run_qa"
 	| "run_review"
-	| "authorize_user"
 	| "complete"
 	| "none";
 
@@ -276,7 +275,6 @@ export type TaskAction =
 	| (TaskActionBase & { type: "record_finding"; finding: TaskFinding })
 	| (TaskActionBase & { type: "resolve_finding"; finding_id: string })
 	| (TaskActionBase & { type: "record_approval"; approval: TaskApprovalV2 })
-	| (TaskActionBase & { type: "record_user_approval"; approval: TaskApprovalV2 })
 	| (TaskActionBase & {
 			type: "revise_intent";
 			next_intent: TaskIntentV1;

package/plugins/immune-brain/runtime/kernel/validation.ts

@@ -730,7 +730,6 @@ const ACTION_V2_TYPES = [
 	"record_finding",
 	"resolve_finding",
 	"record_approval",
-	"record_user_approval",
 	"revise_intent",
 	"approve_breaking_intent_revision",
 	"request_rework",
@@ -831,8 +830,7 @@ export function parseTaskAction(raw: unknown): TaskAction {
 			};
 			break;
 		}
-		case "record_approval":
-		case "record_user_approval": {
+		case "record_approval": {
 			rejectUnknown(
 				value,
 				[...ACTION_BASE_FIELDS, "approval"],

package/plugins/immune-brain/runtime/plugin_version.ts

@@ -0,0 +1,2 @@
+// Generated by scripts/plugin_versioning.ts from the root package.json.
+export const PLUGIN_VERSION = "3.3.0" as const;

package/plugins/immune-brain/skills/imm-loop/SKILL.md

@@ -1,51 +1,9 @@
 ---
 name: imm-loop
-description: Use to run a validated Plan to completion in the current conversation through checkpoints and isolated QA/review authorities.
+description: Use to run an enrolled TaskIntent to completion through Kernel-governed execution, QA, and Review.
 ---
 
 # Immune-Brain: Loop
 
-Load [`../../dist/imm-loop.md`](../../dist/imm-loop.md), then run the checkpoint loop in the current Pi conversation. Keep active Step implementation in this conversation; use Pi native `Agent` subagents only when the runtime reports `awaiting_qa_decision` or a required review gate. Standard Plan Steps close from passing evidence without per-Step QA; Strict Plan Steps retain isolated QA. Return visible checkpoint progress and a final stop summary.
-At every runtime role boundary, call the read-only `imm_loop_action` Tool. Use
-`route` for active Steps, bounded repair, architecture exploration, advisory
-review, Compounder, Kernel ownership, or scope expansion. Use `dispatch_role`
-for `qa`, `code-review`, and `ui-review`, then invoke the returned foreground
-Agent envelope exactly. Brainstorm and Planner use the same Tool for bounded
-`arch-explorer` and explicit-lens `advisory-reviewer` dispatches. Loop may
-dispatch `compounder` only when a closed Step supplies structured evidence for
-a reusable Learning; routine work without that evidence returns `next: none`
-and creates no Learning. Do not discover or load a Pi Skill for these roles. The Managed Path public entries remain `imm-brainstorm`, `imm-planner`, and `imm-loop`; standalone `imm-pr-fix`, `imm-doc-prune`, and `imm-agent-doc-maintain` are host-native and are never dispatched as the Loop role.
-Subagent Dispatch Protocol](../../dist/docs/reference/subagent-dispatch-protocol.md#authorization-authority).
-All internal Agent dispatch envelopes use `run_in_background: false` and
-return a direct result to the Parent before any workflow mutation.
-
-At `terminal_plan_complete`, stop with no next skill, authority, or action. At `awaiting_user_successor_decision`, stop with `recommended_authority: user`. This boundary follows the explicit internal Compounder handoff and runtime terminal settlement; it must not dispatch Planner, Compounder, transition, or a new Pi session/subagent. Only a literal user may approve a successor through the native authority gate; the internal runtime token is `--approve-successor`, never a public Skill or user-facing entry.
-
-Scope expansion always returns to `imm-planner`; Executor and repair roles must stop with the concrete missing scope and verification reason instead of widening execution.
-
-The loop always enters through `imm_loop_action`: the projected action's `next`
-authority is `executor`, `test-fixer`, `pr-fix`, `arch-explorer`,
-`advisory-reviewer`, `compounder`, `imm_kernel_canary`, `imm-planner`, or
-`none`.
-
-When the Kernel projection reports an active/draining backend claim, keep
-`imm-loop` as the user-facing entry and call the `imm_kernel_canary` Tool for
-that owned task. Enrollment uses the `imm_canary_enrollment` Tool and Review
-authorization remains a native TUI gate. When the projection calls for
-`request_authorization`, `approve_breaking_intent_revision`, or
-`repair_authority_state`, invoke the exact Tool operation directly without
-asking the user for chat pre-confirmation; the native host interaction is the
-single authority decision. Do not invoke the removed `imm-canary-work` Skill as
-a separate entry point. Invalid or contradictory projections fail closed. After
-implementation and focused verification, freeze the artifacts and call
-`advance_assurance`. If it returns `review_ready`, invoke the foreground
-reviewer and pass its structured verdict to `submit_review`; `request_authorization` remains the
-critical-risk user authorization boundary. Every QA/Review operation stays
-foreground and returns its next projected obligation directly to the Parent. The host performs any opted-in GitHub Issue projection only after the
-corresponding authority mutation: only a fresh claimless `done`/`stopped`
-projection with its exact terminal tombstone projects terminal closure
-(`completed`/`not planned`); Enrollment performs no GitHub projection. Treat the
-attached tracker result as non-authoritative observation. Report its failure
-separately, but never use it as evidence, a stop condition, or a reason to
-repeat a Kernel mutation. A terminal tombstone alone never blocks unrelated v3
-routing.
+Load [`../../dist/imm-loop.md`](../../dist/imm-loop.md), then follow that
+canonical contract in the current host conversation.