immune-brain 3.2.2 → 3.3.0

package/README.md

@@ -14,7 +14,7 @@ Immune-Brain adds a structured engineering workflow on top of Pi:
 - **Plans become trackable tasks** (`TaskIntent` + `TaskRecord`) so progress survives across sessions, not just chat history.
 - **Quality is enforced by code, not promises** — automated QA and isolated review must pass before a task is marked done.
 
-Pi and Claude Code are the supported hosts. Undeclared adapters remain unsupported. Minimum Claude Code is `2.1.199`. Real Host evidence lives in [docs/verification/claude-code-host-conformance.md](docs/verification/claude-code-host-conformance.md). Either host can use the model provider you configure — Immune-Brain works on top of Kernel authority, not a vendor chat.
+Pi and Claude Code are the supported hosts. Undeclared adapters remain unsupported. Minimum Claude Code is `2.1.199`. Historical real-Host evidence is archived under [docs/verification/archive/](docs/verification/archive/); deterministic package and authority checks gate current releases. Either host can use the model provider you configure — Immune-Brain works on top of Kernel authority, not a vendor chat.
 
 ---
 

package/README.zh-CN.md

@@ -14,7 +14,7 @@ Immune-Brain 在 Pi 之上提供结构化的工程工作流：
 - **计划变为可追踪的任务**（`TaskIntent` + `TaskRecord`），进度落盘持久化，不依赖对话历史。
 - **质量由代码强制保障** — 自动化 QA 与隔离式 Review 必须通过，任务才会完成。
 
-Pi 与 Claude Code 是支持的宿主。未声明的适配器仍不受支持。Claude Code 最低版本为 `2.1.199`。真实 Host 证据见 `docs/verification/claude-code-host-conformance.md`。
+Pi 与 Claude Code 是支持的宿主。未声明的适配器仍不受支持。Claude Code 最低版本为 `2.1.199`。历史真实 Host 证据归档于 `docs/verification/archive/`；当前发布由确定性的 package 与 authority 检查把关。
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "3.2.2",
+  "version": "3.3.0",
   "description": "Immune-Brain agent skill system",
   "publishConfig": {
     "access": "public",
@@ -29,8 +29,9 @@
   },
   "scripts": {
     "changeset": "changeset",
-    "changeset:version": "changeset version && bun scripts/plugin_versioning.ts stamp && bun scripts/plugin_versioning.ts validate",
-    "changeset:publish": "bun scripts/plugin_versioning.ts validate && changeset publish",
+    "changeset:version": "changeset version && bun scripts/build-claude-plugin.ts && bun scripts/plugin_versioning.ts validate",
+    "verify:release": "bun scripts/plugin_versioning.ts validate && bun scripts/build-claude-plugin.ts --check && bun scripts/sync-dist-docs.ts --check && bun test && npm pack --dry-run --ignore-scripts",
+    "changeset:publish": "bun run verify:release && changeset publish",
     "release": "bun run changeset:publish"
   },
   "devDependencies": {
@@ -76,6 +77,7 @@
     "plugins/immune-brain/runtime/verification_descriptor.ts",
     "plugins/immune-brain/runtime/role_prompt_bridge.ts",
     "plugins/immune-brain/runtime/loop_contract.ts",
+    "plugins/immune-brain/runtime/plugin_version.ts",
     "plugins/immune-brain/runtime/assurance",
     "plugins/immune-brain/runtime/claude",
     "plugins/immune-brain/runtime/prompts",

package/plugins/immune-brain/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "3.2.2",
+  "version": "3.3.0",
   "description": "Immune-Brain Claude Code Host: native Enrollment, QA, Review, and Kernel settlement.",
   "author": {
     "name": "Immune-Brain Team"

package/plugins/immune-brain/.pi-extension/imm-canary-work.ts

@@ -20,6 +20,7 @@ import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
+import { PLUGIN_VERSION } from "../runtime/plugin_version";
 import {
 	parseVerificationDescriptor,
 	canonicalDescriptorBytes,
@@ -171,7 +172,6 @@ const TASK_INTENT_SCHEMA = Type.Object({
 
 export type { AssuranceRole } from "./pi-canary-assurance";
 export type AuthorizeOperation =
-	| "record-user-approval"
 	| "approve-breaking-intent-revision"
 	| "resolve-user-decision"
 	| "stop";
@@ -391,7 +391,7 @@ export default function (
 			"After implementation and focused verification, freeze the artifacts, call advance_assurance, and consume its direct terminal result; do not poll or create a detached job.",
 			"When advance_assurance returns review_ready, invoke the foreground Agent from agent_params once, then pass its structured verdict to submit_review.",
 			"For a complete breaking revision, call approve_breaking_intent_revision with the complete next_intent directly; do not ask for chat pre-confirmation because the host opens the single native confirmation before applying it.",
-			"For a proven stale authority claim, call repair_authority_state directly; do not ask for chat pre-confirmation because the host opens the single native confirmation.",
+			"For a proven stale authority claim, call repair_authority_state directly; the Kernel revalidates and removes only the redundant claim without user interaction.",
 			"After awaiting_user, call request_authorization directly so the host opens the single native confirmation; do not ask for chat pre-confirmation or ask the user to copy or report a command.",
 		],
 		parameters: Type.Object({
@@ -474,43 +474,6 @@ export default function (
 					presentTaskRailResult(ctx, taskId, blocked);
 					return failCanaryTool(taskId, action.op, "authority_conflict", "authority_conflict", blocked.result, blocked.next_action);
 				}
-				presentTaskRail(ctx, {
-					task_id: taskId,
-					state: "Approval required",
-					result: "Authority repair needs your approval",
-					next: "Decide whether to repair the stale claim",
-				});
-				const repairSelection = await requestAuthorityDialog(pi, ctx, {
-					attention_id: randomUUID(),
-					task_id: taskId,
-					reason: "authority_repair",
-					label: "Kernel authority repair required",
-				}, {
-					title: "Repair Kernel authority state?",
-					summary: [
-						`Owner: ${taskId}`,
-						`Terminal lifecycle: ${authority.owner_lifecycle}`,
-						`Claim lifecycle: ${authority.claim_lifecycle_status}`,
-					].join("\n"),
-					details: [
-						`Projection revision: ${authority.revision}`,
-						"Action: remove only the stale global claim; preserve TaskRecord and tombstone.",
-					].join("\n"),
-					signal: ctx.signal ?? signal,
-					actions: [
-						{ value: "repair", label: "Repair stale claim", description: "Remove only the stale global claim" },
-						{ value: "cancel", label: "Cancel", description: "Preserve all authority state unchanged" },
-					],
-				});
-				if (repairSelection !== "repair") {
-					const cancelled = {
-						state: "cancelled",
-						operation: action.op,
-						result: "Authority repair cancelled with zero writes",
-						next_action: "request authorization again if repair is still intended",
-					};
-					return toolResult(JSON.stringify(cancelled, null, 2), cancelled);
-				}
 				try {
 					const repaired = await repairKernelAuthority(ctx.cwd, taskId, authority.revision);
 					const result = {
@@ -574,9 +537,11 @@ export default function (
 				const blockers = state.blocking_finding_ids.length
 					+ state.unresolved_user_decision_ids.length
 					+ state.replan_required_ids.length;
+				const status = { plugin_version: PLUGIN_VERSION, ...state };
 				const details = {
 					state: "status",
 					operation: "status",
+					plugin_version: PLUGIN_VERSION,
 					lifecycle: state.lifecycle,
 					artifact_state: state.artifact_state,
 					task_state: state,
@@ -584,7 +549,7 @@ export default function (
 					next_action: state.next_obligation,
 				};
 				presentTaskRailResult(ctx, taskId, details);
-				return toolResult(JSON.stringify(state, null, 2), details);
+				return toolResult(JSON.stringify(status, null, 2), details);
 			}
 			const claim = projection.claim;
 			if (!claim || claim.task_id !== taskId) {
@@ -823,6 +788,17 @@ export default function (
 			`Decision: ${operation}`,
 			`State: ${projection.projection.lifecycle}:${projection.projection.artifact_state} | Claim: ${projection.claim.lifecycle_status}`,
 		].join("\n");
+		const intentDelta = nextIntent
+			? [
+					`Risk: ${priorIntent.intent.risk} -> ${nextIntent.risk}`,
+					`Goal: ${priorIntent.intent.goal} -> ${nextIntent.goal}`,
+					`Scope added: ${nextIntent.scope_hint.filter((path) => !priorIntent.intent.scope_hint.includes(path)).join(", ") || "none"}`,
+					`Scope removed: ${priorIntent.intent.scope_hint.filter((path) => !nextIntent.scope_hint.includes(path)).join(", ") || "none"}`,
+					`Acceptance added: ${nextIntent.acceptance.filter((item) => !priorIntent.intent.acceptance.some((prior) => prior.id === item.id)).map((item) => item.id).join(", ") || "none"}`,
+					`Acceptance removed: ${priorIntent.intent.acceptance.filter((item) => !nextIntent.acceptance.some((next) => next.id === item.id)).map((item) => item.id).join(", ") || "none"}`,
+					`Acceptance changed: ${nextIntent.acceptance.filter((item) => { const prior = priorIntent.intent.acceptance.find((candidate) => candidate.id === item.id); return prior && (prior.assertion !== item.assertion || prior.verification !== item.verification); }).map((item) => item.id).join(", ") || "none"}`,
+				]
+			: [];
 		const dialogDetails = [
 			`Operation: ${operation}`,
 			...(userDecisionOperation
@@ -834,9 +810,8 @@ export default function (
 			...(nextIntent
 				? [
 						`Next Intent: rev ${nextIntent.revision} (${nextIntentHash})`,
-						`Next Goal: ${nextIntent.goal}`,
-						`Next Scope: ${nextIntent.scope_hint.join(", ")}`,
-						`Next Acceptance Items: ${nextIntent.acceptance.length}`,
+						...intentDelta,
+						`Acceptance Items: ${priorIntent.intent.acceptance.length} -> ${nextIntent.acceptance.length}`,
 						`Next staged diff: ${stagedNextDiffHash}`,
 					]
 				: []),
@@ -922,23 +897,6 @@ export default function (
 					content_hash: nextIntentHash!,
 				};
 			}
-			// record-user-approval: literal-user approval for critical-task-completion. The approval payload is bound to the fresh
-			// projection (task revision, intent content hash, diff hash) and
-			// applied through the same exact-action capability path; the
-			// The reducer requires kind user, user authority, and active:frozen state.
-			const isUserApproval = operation === "record-user-approval";
-			const approval = isUserApproval
-				? {
-						id: `approval-user-${randomUUID().slice(0, 8)}`,
-						kind: "user" as const,
-						authority_role: "user" as const,
-						task_revision: projection.projection.intent_revision,
-						intent_content_hash: projection.projection.intent_content_hash,
-						diff_hash: projection.projection.diff_hash,
-						actor_id: "literal-user",
-						summary: "literal user approval",
-					}
-				: undefined;
 			const exactOperation = operation === "stop"
 				? { op: "stop" as const, reason: "literal user stopped task parked for replan" }
 				: operation === "approve-breaking-intent-revision"
@@ -947,7 +905,7 @@ export default function (
 							next_intent: nextIntent!,
 							next_intent_ref: nextIntentRef!,
 						}
-					: userDecisionOperation ?? userOperationFor(operation, approval);
+					: userDecisionOperation!;
 				// The exact host-built operation is shared by capability digest and
 				// application payload; command arguments cannot inject authority fields.
 				try {
@@ -971,7 +929,6 @@ export default function (
 						intent_content_hash: nextIntentHash ?? projection.projection.intent_content_hash,
 						diff_hash: operationDiffHash,
 						actor_id: "literal-user",
-						...(exactOperation.op === "record_user_approval" ? { approval: exactOperation.approval } : {}),
 						...(exactOperation.op === "approve_breaking_intent_revision"
 							? { next_intent: exactOperation.next_intent, next_intent_ref: exactOperation.next_intent_ref }
 							: {}),
@@ -1039,7 +996,6 @@ export default function (
 
 export type DerivedAuthorizationOperation =
 	| "resolve-user-decision"
-	| "record-user-approval"
 	| "stop";
 
 // Kernel projection is the sole source of authorization readiness.
@@ -1049,7 +1005,6 @@ export function deriveAuthorizationOperation(input: {
 }): { operation: DerivedAuthorizationOperation } | { blocked: string } {
 	if (input.hasOpenReplanRequired) return { operation: "stop" };
 	if (input.readiness.state === "resolve_user_decision") return { operation: "resolve-user-decision" };
-	if (input.readiness.state === "record_user_approval") return { operation: "record-user-approval" };
 	if (input.readiness.blocked) return { blocked: input.readiness.blocked };
 	return { blocked: "no unique host-derived authorization operation" };
 }
@@ -1126,15 +1081,6 @@ export function buildUserDecisionOperation(record: {
 	};
 }
 
-export function userOperationFor(operation: AuthorizeOperation, approval?: unknown) {
-	if (operation !== "record-user-approval")
-		throw new Error(`unsupported authorize operation: ${operation}`);
-	// The approval payload is constructed by the authorize handler from
-	// the fresh projection; it is never derived from untrusted input.
-	if (approval === undefined) throw new Error("record-user-approval requires an approval payload");
-	return { op: "record_user_approval" as const, approval };
-}
-
 /**
  * One record-aware freshness identity. v4 derives the scoped revision digest
  * from the immutable Enrollment base so committed and staged task work share a

package/plugins/immune-brain/.pi-extension/pi-canary-interaction.ts

@@ -8,8 +8,7 @@ export type UserAttentionReason =
 	| "enrollment"
 	| "descriptor_waiver"
 	| "breaking_intent_revision"
-	| "review_authorization"
-	| "authority_repair";
+	| "review_authorization";
 
 export interface UserAttentionEventV1 {
 	active: boolean;

package/plugins/immune-brain/.pi-extension/runtime-stub.ts

@@ -179,7 +179,7 @@ export interface TaskRecordRead {
 // --- Assurance projection (host-neutral Kernel facts, not exported from the
 // public Kernel index) ---
 export interface AssuranceAuthorizationReadiness {
-	state: "resolve_user_decision" | "record_user_approval" | "none";
+	state: "resolve_user_decision" | "none";
 	blocked: string | null;
 }
 export interface AssuranceProjection {
@@ -191,7 +191,7 @@ export interface AssuranceProjection {
 	lifecycle: "active" | "done" | "stopped" | "";
 	artifact_state: "active" | "frozen" | "";
 	risk: "routine" | "material" | "critical" | "";
-	next_obligation: "resolve_findings" | "resolve_user_decision" | "revise_intent" | "submit_assurance" | "run_qa" | "run_review" | "authorize_user" | "complete" | "none";
+	next_obligation: "resolve_findings" | "resolve_user_decision" | "revise_intent" | "submit_assurance" | "run_qa" | "run_review" | "complete" | "none";
 	fresh_acceptance_ids: string[];
 	missing_acceptance_ids: string[];
 	stale_attestation_ids: string[];

package/plugins/immune-brain/dist/claude/mcp-server.mjs

@@ -52,14 +52,16 @@ function probeHost(env = process.env, platform = process.platform, hostVersion)
   return { ok: true, version, permissionMode: "manual", platform };
 }
 
+// plugins/immune-brain/runtime/plugin_version.ts
+var PLUGIN_VERSION = "3.3.0";
+
 // plugins/immune-brain/runtime/claude/interaction.ts
 import { createHash, randomUUID } from "node:crypto";
 var PRIVILEGED_OPERATIONS = [
   "enroll",
   "request_authorization",
   "approve_breaking_intent_revision",
-  "stop",
-  "repair_authority_state"
+  "stop"
 ];
 function isPrivilegedOperation(operation) {
   return PRIVILEGED_OPERATIONS.includes(operation);
@@ -1484,8 +1486,6 @@ class AssuranceCoordinator {
           return this.unknownAfterCommit(taskId, "qa", operationId, boundedAssuranceError(error));
         }
       }
-      if (projection.projection.next_obligation === "authorize_user")
-        return { state: "awaiting_user", operation: "record-user-approval", operation_id: operationId };
       if (projection.projection.next_obligation !== "run_qa" && projection.projection.next_obligation !== "run_review")
         return { state: "blocked", reason: `Kernel requires ${projection.projection.next_obligation}` };
       const qaAlreadySettled = projection.projection.next_obligation === "run_review";
@@ -1583,8 +1583,6 @@ class AssuranceCoordinator {
           return this.unknownAfterCommit(taskId, "qa", operationId, boundedAssuranceError(error));
         }
       }
-      if (fresh.projection.next_obligation === "authorize_user")
-        return { state: "awaiting_user", operation: "record-user-approval", operation_id: operationId };
       if (fresh.projection.next_obligation !== "run_review") {
         if (authorityCommitted && aborted())
           return this.unknownAfterCommit(taskId, "qa", operationId, "QA settlement projection did not require Review after cancellation");
@@ -1747,8 +1745,6 @@ class AssuranceCoordinator {
         return this.unknownAfterCommit(taskId, "review", reservation.operationId, boundedAssuranceError(error));
       }
     }
-    if (settled.projection.next_obligation === "authorize_user")
-      return { state: "awaiting_user", operation: "record-user-approval", operation_id: reservation.operationId };
     return { state: "blocked", reason: `Kernel requires ${settled.projection.next_obligation} after Review` };
   }
   abandonReview(taskId, reason) {
@@ -3633,7 +3629,6 @@ var ACTION_V2_TYPES = [
   "record_finding",
   "resolve_finding",
   "record_approval",
-  "record_user_approval",
   "revise_intent",
   "approve_breaking_intent_revision",
   "request_rework",
@@ -3696,8 +3691,7 @@ function parseTaskAction(raw) {
       };
       break;
     }
-    case "record_approval":
-    case "record_user_approval": {
+    case "record_approval": {
       rejectUnknown2(value, [...ACTION_BASE_FIELDS, "approval"], "action", violations);
       const approval = parseApprovalV2(value.approval, 0, violations, true);
       if (approval.review_revision && approval.kind !== "review")
@@ -4904,7 +4898,7 @@ function commitTerminalLocked(root, taskId, transaction, tombstone) {
 var REQUIRED_ATTESTATIONS = {
   routine: ["qa"],
   material: ["qa", "review"],
-  critical: ["qa", "review", "user"]
+  critical: ["qa", "review"]
 };
 function archiveActivePlanningPath(path) {
   const matched = path.match(/^docs\/(plans|specs)\/([^/]+)$/);
@@ -5009,8 +5003,6 @@ function projectTask(intent, record, currentDiffHash, currentIntentContentHash,
       nextObligation = "run_qa";
     } else if (decision.missing_approval_kinds.includes("review")) {
       nextObligation = "run_review";
-    } else if (decision.missing_approval_kinds.includes("user")) {
-      nextObligation = "authorize_user";
     } else if (decision.complete) {
       nextObligation = "complete";
     }
@@ -5036,8 +5028,6 @@ function deriveAssuranceAuthorization(input) {
       state: "none",
       blocked: `resolve-user-decision requires exactly one open user decision; found ${input.open_user_decision_count}`
     };
-  if (input.next_obligation === "authorize_user")
-    return { state: "record_user_approval", blocked: null };
   return { state: "none", blocked: null };
 }
 function emptyProjection() {
@@ -5288,7 +5278,7 @@ function intentRefMatches(intent, ref) {
   return ref.path === `docs/plans/${intent.task_id}.intent.json` && ref.content_hash === canonicalIntentHash(intent);
 }
 function hasPrivilegedKind(action) {
-  return action.type === "record_approval" || action.type === "record_user_approval" || action.type === "approve_breaking_intent_revision" || action.type === "request_rework" || action.type === "stop" || action.type === "resolve_user_decision";
+  return action.type === "record_approval" || action.type === "approve_breaking_intent_revision" || action.type === "request_rework" || action.type === "stop" || action.type === "resolve_user_decision";
 }
 function findingsDigestV2(findings) {
   const normalized = findings.map((finding) => ({
@@ -5440,36 +5430,6 @@ function reduceTask(recordRaw, actionRaw, authorityAudit = null, changedPaths) {
       appendHistory(record, action, from, approval.id, authorityAudit);
       break;
     }
-    case "record_user_approval": {
-      if (record.lifecycle !== "active" || record.artifact_state !== "frozen")
-        throw new KernelInvariantError([
-          `cannot record user approval while state is ${stateOf(record)}`
-        ]);
-      const approval = action.approval;
-      if (approval.kind !== "user")
-        throw new KernelInvariantError([
-          "record_user_approval requires kind user"
-        ]);
-      if (!authorityAudit || authorityAudit.authority_kind !== "user")
-        throw new KernelInvariantError([
-          "record_user_approval requires user authority"
-        ]);
-      if (approval.task_revision !== record.intent_snapshot.revision)
-        throw new KernelInvariantError(["approval task_revision must equal the current intent revision"]);
-      if (approval.intent_content_hash !== record.intent_ref.content_hash)
-        throw new KernelInvariantError(["approval intent_content_hash must equal the current intent hash"]);
-      if (approval.diff_hash !== diffHash)
-        throw new KernelInvariantError(["approval diff_hash must equal the action diff hash"]);
-      if (record.attestations.some((item) => item.id === approval.id))
-        throw new KernelInvariantError([
-          `attestations contains duplicate id ${approval.id}`
-        ]);
-      if (approval.review_revision)
-        throw new KernelInvariantError(["review_revision is only valid on review approvals"]);
-      record.attestations.push({ ...approval, acceptance_results: [] });
-      appendHistory(record, action, from, approval.id, authorityAudit);
-      break;
-    }
     case "revise_intent":
     case "approve_breaking_intent_revision": {
       if (record.lifecycle !== "active")
@@ -5706,7 +5666,7 @@ function applyTaskAction(input) {
           "intent token does not match the committed record intent"
         ]);
     }
-    const privileged = action.type === "record_approval" || action.type === "record_user_approval" || action.type === "approve_breaking_intent_revision" || action.type === "request_rework" || action.type === "stop" || action.type === "resolve_user_decision";
+    const privileged = action.type === "record_approval" || action.type === "approve_breaking_intent_revision" || action.type === "request_rework" || action.type === "stop" || action.type === "resolve_user_decision";
     const expectedAuthority = privileged ? {
       task_id,
       action,
@@ -5828,8 +5788,6 @@ function capabilityActionFor(input) {
   switch (input.op) {
     case "record_approval":
       return { ...base, approval: input.approval };
-    case "record_user_approval":
-      return { ...base, approval: input.approval };
     case "request_rework":
       return { ...base, findings: input.findings };
     case "stop":
@@ -6014,10 +5972,6 @@ function createCanaryApplication(registry) {
         capability = operation.capability;
         action = { ...base, type: "record_approval", approval: operation.approval };
         break;
-      case "record_user_approval":
-        capability = operation.capability;
-        action = { ...base, type: "record_user_approval", approval: operation.approval };
-        break;
       case "revise_intent":
         action = {
           ...base,
@@ -6914,22 +6868,17 @@ class ClaudeRuntime {
     return submitClaudeReview(this.host, this.coordinator, { cwd: this.cwd }, taskId, verdictInput);
   }
   async authorize(taskId, operation, meta, extra = {}) {
-    if (!isPrivilegedOperation(operation) && operation !== "request_authorization")
-      throw new Error(`unsupported privileged operation ${operation}`);
-    this.rejectBeforePreparation(operation, { ...meta, taskId });
     if (operation === "repair_authority_state") {
       const authority = reconcileKernelAuthority(this.cwd, taskId);
       if (authority.state !== "repairable_stale_claim" || authority.owner_task_id !== taskId) {
         throw new Error(authority.diagnostic ?? "authority repair requires a repairable stale claim");
       }
-      const gate2 = this.gate(operation, { ...meta, taskId }, { bindingDigest: `repair:${authority.revision}` });
-      const current = reconcileKernelAuthority(this.cwd, taskId);
-      if (current.state !== authority.state || current.owner_task_id !== authority.owner_task_id || current.revision !== authority.revision) {
-        throw new Error("authority changed after native confirmation; repair aborted before capability issuance");
-      }
-      return repairKernelAuthority(this.cwd, taskId, current.revision);
+      return repairKernelAuthority(this.cwd, taskId, authority.revision);
     }
-    let op = operation === "request_authorization" ? "record_user_approval" : operation;
+    if (!isPrivilegedOperation(operation) && operation !== "request_authorization")
+      throw new Error(`unsupported privileged operation ${operation}`);
+    this.rejectBeforePreparation(operation, { ...meta, taskId });
+    let op = operation;
     let decisionOp;
     const projection = await this.status(taskId);
     if (projection.error || !projection.claim)
@@ -6943,7 +6892,7 @@ class ClaudeRuntime {
           throw new Error(`resolve-user-decision requires exactly one open user decision; found ${open.length}`);
         op = "resolve_user_decision";
         decisionOp = { finding_id: open[0].id, resolution: `resume after literal-user decision: ${open[0].summary}` };
-      } else if (readiness.state !== "record_user_approval") {
+      } else {
         throw new Error(readiness.blocked ?? "no unique host-derived authorization operation");
       }
     }
@@ -7010,16 +6959,6 @@ class ClaudeRuntime {
     }
     const { registry, app } = this.authority();
     const confirmation = gate.confirmation_ref;
-    const approval = op === "record_user_approval" ? {
-      id: `approval-user-${randomUUID5().slice(0, 8)}`,
-      kind: "user",
-      authority_role: "user",
-      task_revision: projection.projection.intent_revision,
-      intent_content_hash: projection.projection.intent_content_hash,
-      diff_hash: projection.projection.diff_hash,
-      actor_id: actorId,
-      summary: "literal user approval"
-    } : undefined;
     try {
       const capabilityProjection = await this.status(taskId);
       assertProjectionBinding(projection, capabilityProjection, Boolean(nextIntent));
@@ -7038,7 +6977,6 @@ class ClaudeRuntime {
         actor_id: actorId,
         now,
         confirmation_ref: confirmation,
-        ...approval ? { approval } : {},
         ...op === "approve_breaking_intent_revision" ? { next_intent: nextIntent, next_intent_ref: nextIntentRef } : {},
         ...op === "resolve_user_decision" && decisionOp ? decisionOp : {},
         ...op === "stop" ? { reason: extra.reason ?? "user stop" } : {}
@@ -7050,7 +6988,6 @@ class ClaudeRuntime {
           op,
           capability,
           actor_id: actorId,
-          ...approval ? { approval } : {},
           ...op === "approve_breaking_intent_revision" ? { next_intent: nextIntent, next_intent_ref: nextIntentRef } : {},
           ...op === "resolve_user_decision" && decisionOp ? decisionOp : {},
           ...op === "stop" ? { reason: extra.reason ?? "user stop" } : {}
@@ -7194,7 +7131,7 @@ var TOOLS = [
   { name: "request_authorization", description: "Apply exact literal-user authorization.", privileged: true },
   { name: "approve_breaking_intent_revision", description: "Approve a breaking TaskIntent revision.", privileged: true },
   { name: "stop", description: "Stop the active task with literal-user authority.", privileged: true },
-  { name: "repair_authority_state", description: "Repair a recoverable stale backend claim.", privileged: true }
+  { name: "repair_authority_state", description: "Repair a proven recoverable stale backend claim.", privileged: false }
 ];
 function listMcpTools() {
   return TOOLS.map((tool) => ({
@@ -7242,10 +7179,10 @@ function createMcpRuntime(options = {}) {
       if ("native_decision" in args)
         throw new Error("native_decision cannot be supplied in tool arguments");
       if (name === "status")
-        return runtime.status(taskId);
+        return { plugin_version: PLUGIN_VERSION, ...await runtime.status(taskId) };
       if (!negotiatedVersion)
         throw new Error("Claude Code version is unavailable");
-      if (!negotiatedInteractive)
+      if (!negotiatedInteractive && name !== "repair_authority_state")
         throw new Error("non-interactive host session cannot execute authority tools");
       const probe = probeHost(options.env ?? process.env, process.platform, negotiatedVersion);
       if (!probe.ok)
@@ -7306,7 +7243,12 @@ async function handleJsonRpc(message, mcp = createMcpRuntime()) {
       id: message.id ?? null,
       result: {
         protocolVersion: "2024-11-05",
-        serverInfo: { name: HOST_ID, version: MIN_CLAUDE_CODE_VERSION, contract: CORE_CONTRACT },
+        serverInfo: {
+          name: HOST_ID,
+          version: PLUGIN_VERSION,
+          contract: CORE_CONTRACT,
+          minimumHostVersion: MIN_CLAUDE_CODE_VERSION
+        },
         capabilities: { tools: {} }
       }
     };
@@ -7506,9 +7448,9 @@ if (entry.endsWith("mcp_server.ts") || entry.endsWith("mcp-server.mjs")) {
     serveStdio();
 }
 export {
-  serveStdio,
-  listMcpTools,
-  handleJsonRpc,
+  TOOLS,
   createMcpRuntime,
-  TOOLS
+  handleJsonRpc,
+  listMcpTools,
+  serveStdio
 };

package/plugins/immune-brain/dist/docs/reference/subagent-dispatch-protocol.md

@@ -90,7 +90,7 @@ Pi `Agent` has no `readonly` parameter; the empty tool policy, child type, and p
 4. Kernel Assurance chat uses native Tool rendering only. It does not publish completion messages or wake a later parent turn; the direct Tool result is the continuation boundary. `awaiting_user` remains valid until the host-built authorization operation is confirmed and the immutable snapshot is revalidated.
 5. Child 不得再次派发 child，nested delegation 一律禁止。Parent 保留综合与最终判断责任。
 6. Kernel authority Review 对每个 immutable snapshot 恰好一个 primary reviewer，turn 预算按 workload 缩放（Quick 12 / Standard 16 / Heavy 24），并使用该 snapshot 对应的 Quick/Standard/Heavy 执行档位；不存在从 initial dispatch 起算的单一端到端总预算。Reviewer 必须先验证 immutable v5 manifest 的 `base_head`、`review_commit`、单一 parent、`review_tree` 与 `manifest_digest`，再用只读 Git 命令从 synthetic revision 获取源码；manifest 只有 metadata，不复制 source bytes，也不枚举 neighborhood files。审查只围绕 acceptance assertions 与 `changed_paths`，未变更路径只有在 acceptance、changed caller 或同一 state machine 直接需要时按需读取并注明理由；Reviewer 不探索无关 repository paths。对 settlement-class change，Reviewer 必须先枚举 immutable revision 内每条 terminal、cancellation、timeout 与 race path，再对全部路径给出判断；finding summary 必须以受影响路径开头。每个 acceptance 的执行结果已由 deterministic QA 在 review 前验证并内嵌于 manifest 的 `outcomes` 字段（acceptance_id -> {status, summary}）；Reviewer 不得重跑 descriptor，也不得把本地没有测试运行当作 finding——Review 只审 revision provenance、代码正确性、回归、安全与缺失测试。除该 reviewer 外，同一触发点最多两个相互独立的 advisory/discovery children；它们只能并行读，不能写 workflow state、关闭 QA 或产生 authority。
-7. Foreground assurance never sleeps, polls, or schedules a completion callback. One Tool call owns QA; one Parent turn obtains and submits the reviewer verdict; one explicit authorization operation owns the critical-risk user decision.
+7. Foreground assurance never sleeps, polls, or schedules a completion callback. One Tool call owns QA; one Parent turn obtains and submits the reviewer verdict. User authorization is reserved for unresolved decisions, explicit stop, and breaking Intent revisions; no risk tier adds a generic final confirmation.
 8. `submit_review` validates the verdict contract, task identity, immutable snapshot digest, and fresh record/Intent/workspace/diff revisions before applying Review authority. Malformed verdicts are retryable without rebuilding evidence. Stale verdicts leave the TaskRecord unchanged and release the stale reservation. Local execution trusts the Parent to relay the reviewer verdict and does not require Agent lifecycle receipts.
 9. The assurance Tool checks the immutable snapshot before each phase and returns a terminal structured state directly: `cancelled`, `rework`, `review_ready`, `awaiting_user`, `blocked`, or `settlement_unknown`. The commit boundary is non-cancellable. No silent task, status timer, completion notification, or result retrieval path is permitted.
 

package/plugins/immune-brain/dist/imm-loop.md

@@ -52,7 +52,7 @@ Repeat this sequence; do not silently stop while a valid action remains:
 1. Call `imm_loop_action` with `op: route` (or `dispatch_role` at a QA/review boundary) and follow the projected `next` authority.
 2. Emit one progress line: `[target][phase] result | next: action`.
 3. Execute exactly one allowed action:
-   - Kernel ownership: call `imm_kernel_canary` for that owned task. Freeze the completed artifacts, then call `advance_assurance`; when it returns `review_ready`, invoke the foreground reviewer and pass its structured verdict to `submit_review`. When the projection calls for `request_authorization`, `approve_breaking_intent_revision`, or `repair_authority_state`, invoke the exact Tool operation directly without asking the user for chat pre-confirmation. The native host interaction is the single authority decision.
+   - Kernel ownership: call `imm_kernel_canary` for that owned task. Freeze the completed artifacts, then call `advance_assurance`; when it returns `review_ready`, invoke the foreground reviewer and pass its structured verdict to `submit_review`. When the projection calls for `request_authorization` or `approve_breaking_intent_revision`, invoke the exact Tool operation directly without asking the user for chat pre-confirmation; the native host interaction is the single authority decision. Invoke `repair_authority_state` directly for a proven stale claim; Kernel revalidation removes only the redundant claim without user interaction.
    - Active Step / `rework_needed`: follow the returned `executor` context in the current conversation, implement only the active Step or pending same-boundary `follow_up`, verify, record structured execution evidence through the Loop runtime action, and continue. A bounded test-only repair may request internal `test-fixer` with `focus_delta.specific_changes`; PR review or CI repair may request internal `pr-fix` with the current `plan_id`, changed-file boundary, and verification. Both return child evidence to the Parent and cannot widen scope.
    - `awaiting_qa_decision`: call `imm_loop_action` with `op: dispatch_role`, role `qa`, the current projection, Plan verification, recorded evidence, and current target identity. Invoke the returned foreground Agent envelope exactly. A `rework` or `replan` must carry validated `notes`.
    - `review_required`: map the exact `pending_review_gate` (`imm-code-review` or `imm-ui-review`) to the internal `code-review` or `ui-review` role and call `imm_loop_action` with `op: dispatch_role`, passing `pending_review_gate`, `review_changed_files`, and `review_changed_files_signature`. Invoke the returned foreground Agent envelope exactly. Record a validated pass, or open a same-boundary follow-up through the Loop runtime action.
@@ -142,15 +142,19 @@ When the Kernel projection reports an active/draining backend claim, keep
 `imm-loop` as the user-facing entry and call the `imm_kernel_canary` Tool for
 that owned task. Enrollment uses the `imm_canary_enrollment` Tool and Review
 authorization remains a native TUI gate. When the projection calls for
-`request_authorization`, `approve_breaking_intent_revision`, or
-`repair_authority_state`, invoke the exact Tool operation directly without
-asking the user for chat pre-confirmation; the native host interaction is the
-single authority decision. Do not invoke the removed `imm-canary-work` Skill as
+`request_authorization` or `approve_breaking_intent_revision`, invoke the exact
+Tool operation directly without asking the user for chat pre-confirmation; the
+native host interaction is the single authority decision. Invoke
+`repair_authority_state` directly for a proven stale claim; Kernel revalidation
+removes only the redundant claim without user interaction. Do not invoke the
+removed `imm-canary-work` Skill as
 a separate entry point. Invalid or contradictory projections fail closed. After
 implementation and focused verification, freeze the artifacts and call
 `advance_assurance`. If it returns `review_ready`, invoke the foreground
 reviewer and pass its structured verdict to `submit_review`;
-`request_authorization` remains the critical-risk user authorization boundary.
+`request_authorization` is reserved for an unresolved user decision or an
+explicit stop. Critical work completes after fresh QA and Review without a
+second user confirmation.
 Every QA/Review operation stays foreground and returns its next projected
 obligation directly to the Parent. The host performs any opted-in GitHub Issue
 projection only after the corresponding authority mutation: only a fresh

package/plugins/immune-brain/runtime/assurance/coordinator.ts

@@ -133,7 +133,6 @@ export interface ForegroundToolUpdate {
 
 export type AssuranceAdvanceResult =
 	| { state: "review_ready"; operation: "review"; operation_id: string; snapshot_digest: string; review_bundle_digest: string; agent_params: unknown }
-	| { state: "awaiting_user"; operation: "record-user-approval"; operation_id: string }
 	| { state: "rework"; operation: "qa"; operation_id: string; summary: string }
 	| { state: "cancelled"; operation: "qa" | "review"; operation_id: string; reason: string }
 	| { state: "failed"; operation: "qa" | "review"; operation_id: string; reason: string }
@@ -150,7 +149,6 @@ export type AssuranceAdvanceResult =
 
 export type AssuranceSubmitReviewResult =
 	| { state: "rework"; operation: "review"; operation_id: string; summary: string }
-	| { state: "awaiting_user"; operation: "record-user-approval"; operation_id: string }
 	| { state: "review_preparation_failed"; operation: "review"; operation_id: string; reason: string }
 	| { state: "completed" }
 	| { state: "settlement_unknown"; operation: "qa" | "review"; operation_id: string; reason: string }
@@ -528,8 +526,6 @@ export class AssuranceCoordinator {
 					return this.unknownAfterCommit(taskId, "qa", operationId, boundedAssuranceError(error));
 				}
 			}
-			if (projection.projection.next_obligation === "authorize_user")
-				return { state: "awaiting_user", operation: "record-user-approval", operation_id: operationId };
 			if (projection.projection.next_obligation !== "run_qa" && projection.projection.next_obligation !== "run_review")
 				return { state: "blocked", reason: `Kernel requires ${projection.projection.next_obligation}` };
 			const qaAlreadySettled = projection.projection.next_obligation === "run_review";
@@ -623,8 +619,6 @@ export class AssuranceCoordinator {
 					return this.unknownAfterCommit(taskId, "qa", operationId, boundedAssuranceError(error));
 				}
 			}
-			if (fresh.projection.next_obligation === "authorize_user")
-				return { state: "awaiting_user", operation: "record-user-approval", operation_id: operationId };
 			if (fresh.projection.next_obligation !== "run_review") {
 				if (authorityCommitted && aborted()) return this.unknownAfterCommit(taskId, "qa", operationId, "QA settlement projection did not require Review after cancellation");
 				return { state: "blocked", reason: `Kernel requires ${fresh.projection.next_obligation} after QA` };
@@ -777,8 +771,6 @@ export class AssuranceCoordinator {
 				return this.unknownAfterCommit(taskId, "review", reservation.operationId, boundedAssuranceError(error));
 			}
 		}
-		if (settled.projection.next_obligation === "authorize_user")
-			return { state: "awaiting_user", operation: "record-user-approval", operation_id: reservation.operationId };
 		return { state: "blocked", reason: `Kernel requires ${settled.projection.next_obligation} after Review` };
 	}
 

package/plugins/immune-brain/runtime/claude/interaction.ts

@@ -6,7 +6,6 @@ export const PRIVILEGED_OPERATIONS = [
 	"request_authorization",
 	"approve_breaking_intent_revision",
 	"stop",
-	"repair_authority_state",
 ] as const;
 
 export type PrivilegedOperation = (typeof PRIVILEGED_OPERATIONS)[number];

package/plugins/immune-brain/runtime/claude/kernel_ports.ts

@@ -493,21 +493,16 @@ export class ClaudeRuntime {
 	}
 
 	async authorize(taskId: string, operation: string, meta: ToolMeta, extra: Record<string, unknown> = {}) {
-		if (!isPrivilegedOperation(operation) && operation !== "request_authorization") throw new Error(`unsupported privileged operation ${operation}`);
-		this.rejectBeforePreparation(operation, { ...meta, taskId });
 		if (operation === "repair_authority_state") {
 			const authority = reconcileKernelAuthority(this.cwd, taskId);
 			if (authority.state !== "repairable_stale_claim" || authority.owner_task_id !== taskId) {
 				throw new Error(authority.diagnostic ?? "authority repair requires a repairable stale claim");
 			}
-			const gate = this.gate(operation, { ...meta, taskId }, { bindingDigest: `repair:${authority.revision}` });
-			const current = reconcileKernelAuthority(this.cwd, taskId);
-			if (current.state !== authority.state || current.owner_task_id !== authority.owner_task_id || current.revision !== authority.revision) {
-				throw new Error("authority changed after native confirmation; repair aborted before capability issuance");
-			}
-			return repairKernelAuthority(this.cwd, taskId, current.revision);
+			return repairKernelAuthority(this.cwd, taskId, authority.revision);
 		}
-		let op = operation === "request_authorization" ? "record_user_approval" : operation;
+		if (!isPrivilegedOperation(operation) && operation !== "request_authorization") throw new Error(`unsupported privileged operation ${operation}`);
+		this.rejectBeforePreparation(operation, { ...meta, taskId });
+		let op = operation;
 		let decisionOp: { finding_id: string; resolution: string } | undefined;
 		const projection = await this.status(taskId);
 		if (projection.error || !projection.claim) throw new Error(projection.error ?? "no active backend claim");
@@ -524,7 +519,7 @@ export class ClaudeRuntime {
 				if (open.length !== 1) throw new Error(`resolve-user-decision requires exactly one open user decision; found ${open.length}`);
 				op = "resolve_user_decision";
 				decisionOp = { finding_id: open[0].id, resolution: `resume after literal-user decision: ${open[0].summary}` };
-			} else if (readiness.state !== "record_user_approval") {
+			} else {
 				throw new Error(readiness.blocked ?? "no unique host-derived authorization operation");
 			}
 		}
@@ -591,18 +586,6 @@ export class ClaudeRuntime {
 		}
 		const { registry, app } = this.authority();
 		const confirmation = gate.confirmation_ref;
-		const approval = op === "record_user_approval"
-			? {
-				id: `approval-user-${randomUUID().slice(0, 8)}`,
-				kind: "user" as const,
-				authority_role: "user" as const,
-				task_revision: projection.projection.intent_revision,
-				intent_content_hash: projection.projection.intent_content_hash,
-				diff_hash: projection.projection.diff_hash,
-				actor_id: actorId,
-				summary: "literal user approval",
-			}
-			: undefined;
 		try {
 			const capabilityProjection = await this.status(taskId);
 			assertProjectionBinding(projection, capabilityProjection, Boolean(nextIntent));
@@ -621,7 +604,6 @@ export class ClaudeRuntime {
 				actor_id: actorId,
 				now,
 				confirmation_ref: confirmation,
-				...(approval ? { approval } : {}),
 				...(op === "approve_breaking_intent_revision" ? { next_intent: nextIntent, next_intent_ref: nextIntentRef } : {}),
 				...(op === "resolve_user_decision" && decisionOp ? decisionOp : {}),
 				...(op === "stop" ? { reason: extra.reason ?? "user stop" } : {}),
@@ -633,7 +615,6 @@ export class ClaudeRuntime {
 					op,
 					capability,
 					actor_id: actorId,
-					...(approval ? { approval } : {}),
 					...(op === "approve_breaking_intent_revision" ? { next_intent: nextIntent, next_intent_ref: nextIntentRef } : {}),
 					...(op === "resolve_user_decision" && decisionOp ? decisionOp : {}),
 					...(op === "stop" ? { reason: extra.reason ?? "user stop" } : {}),

package/plugins/immune-brain/runtime/claude/mcp_server.ts

@@ -2,6 +2,7 @@ import { createInterface } from "node:readline";
 import { stdin, stdout } from "node:process";
 import type { Readable, Writable } from "node:stream";
 import { CORE_CONTRACT, HOST_ID, MIN_CLAUDE_CODE_VERSION, probeHost } from "./capability";
+import { PLUGIN_VERSION } from "../plugin_version";
 import { isPrivilegedOperation, privilegedAnnotations, type NativeDecision } from "./interaction";
 import { ClaudeReviewHost, FileHookEventLog, parseHookStdin } from "./review_host";
 import { ClaudeRuntime, type ToolMeta } from "./kernel_ports";
@@ -15,7 +16,7 @@ export const TOOLS = [
 	{ name: "request_authorization", description: "Apply exact literal-user authorization.", privileged: true },
 	{ name: "approve_breaking_intent_revision", description: "Approve a breaking TaskIntent revision.", privileged: true },
 	{ name: "stop", description: "Stop the active task with literal-user authority.", privileged: true },
-	{ name: "repair_authority_state", description: "Repair a recoverable stale backend claim.", privileged: true },
+	{ name: "repair_authority_state", description: "Repair a proven recoverable stale backend claim.", privileged: false },
 ] as const;
 
 export function listMcpTools() {
@@ -75,16 +76,14 @@ export function createMcpRuntime(options: McpRuntimeOptions = {}) {
 			if ("native_decision" in args) throw new Error("native_decision cannot be supplied in tool arguments");
 			// Read-only status must stay usable without trusted Host evidence, so it
 			// is dispatched before the capability probe rejects unversioned hosts.
-			if (name === "status") return runtime.status(taskId);
+			if (name === "status") return { plugin_version: PLUGIN_VERSION, ...(await runtime.status(taskId)) };
 			// The environment version fallback is disabled on this connection:
 			// only a version bound from the trusted initialize handshake may
 			// reach authority-mutating tools.
 			if (!negotiatedVersion) throw new Error("Claude Code version is unavailable");
-			// Every authority-mutating tool requires the handshake to have
-			// declared elicitation support: only read-only status works on
-			// non-interactive sessions, so QA/review/completion cannot mutate
-			// Kernel state without native interaction capability.
-			if (!negotiatedInteractive) throw new Error("non-interactive host session cannot execute authority tools");
+			// Automatic stale-claim repair is deterministic and needs no native
+			// interaction; other mutations retain the Host capability requirement.
+			if (!negotiatedInteractive && name !== "repair_authority_state") throw new Error("non-interactive host session cannot execute authority tools");
 			const probe = probeHost(options.env ?? process.env, process.platform, negotiatedVersion);
 			if (!probe.ok) throw new Error(probe.reason);
 			const toolMeta: ToolMeta = {
@@ -168,7 +167,12 @@ export async function handleJsonRpc(message: JsonRpc, mcp = createMcpRuntime()):
 			id: message.id ?? null,
 			result: {
 				protocolVersion: "2024-11-05",
-				serverInfo: { name: HOST_ID, version: MIN_CLAUDE_CODE_VERSION, contract: CORE_CONTRACT },
+				serverInfo: {
+					name: HOST_ID,
+					version: PLUGIN_VERSION,
+					contract: CORE_CONTRACT,
+					minimumHostVersion: MIN_CLAUDE_CODE_VERSION,
+				},
 				capabilities: { tools: {} },
 			},
 		};

package/plugins/immune-brain/runtime/kernel/application.ts

@@ -158,7 +158,6 @@ export function applyTaskAction(
 
 		const privileged =
 			action.type === "record_approval" ||
-			action.type === "record_user_approval" ||
 			action.type === "approve_breaking_intent_revision" ||
 			action.type === "request_rework" ||
 			action.type === "stop" ||

package/plugins/immune-brain/runtime/kernel/assurance_projection.ts

@@ -25,13 +25,9 @@ export interface AssuranceAuthorizationReadiness {
 	/**
 	 * Kernel-decidable authorization readiness:
 	 * - "resolve_user_decision": exactly one open unresolved-user-decision finding;
-	 * - "record_user_approval": Kernel projects authorize_user after fresh QA
-	 *   and Review attestations for a critical task;
 	 * - "none": nothing uniquely decidable from Kernel facts.
-	 * A pending Pi native Review verdict is a session fact and is NOT visible
-	 * here; the host composes it before this readiness.
 	 */
-	state: "resolve_user_decision" | "record_user_approval" | "none";
+	state: "resolve_user_decision" | "none";
 	/** Non-null only when Kernel facts prove the authorization is blocked. */
 	blocked: string | null;
 }
@@ -79,8 +75,6 @@ export function deriveAssuranceAuthorization(input: {
 			state: "none",
 			blocked: `resolve-user-decision requires exactly one open user decision; found ${input.open_user_decision_count}`,
 		};
-	if (input.next_obligation === "authorize_user")
-		return { state: "record_user_approval", blocked: null };
 	return { state: "none", blocked: null };
 }
 

package/plugins/immune-brain/runtime/kernel/canary_application.ts

@@ -51,7 +51,6 @@ export type CanaryOperation =
 	| { op: "resolve_finding"; finding_id: string; actor_id: string }
 	| { op: "request_rework"; capability: object; findings: TaskFinding[]; actor_id: string }
 	| { op: "record_approval"; capability: object; approval: TaskApprovalV2; actor_id: string }
-	| { op: "record_user_approval"; capability: object; approval: TaskApprovalV2; actor_id: string }
 	| { op: "revise_intent"; next_intent: TaskIntentV1; actor_id: string }
 	| { op: "approve_breaking_intent_revision"; capability: object; next_intent: TaskIntentV1; actor_id: string }
 	| { op: "complete"; actor_id: string }
@@ -141,8 +140,6 @@ export function capabilityActionFor(input: {
 	switch (input.op) {
 		case "record_approval":
 			return { ...base, approval: input.approval } as TaskAction;
-		case "record_user_approval":
-			return { ...base, approval: input.approval } as TaskAction;
 		case "request_rework":
 			return { ...base, findings: input.findings } as TaskAction;
 		case "stop":
@@ -373,10 +370,6 @@ export function createCanaryApplication(
 				capability = operation.capability;
 				action = { ...base, type: "record_approval", approval: operation.approval };
 				break;
-			case "record_user_approval":
-				capability = operation.capability;
-				action = { ...base, type: "record_user_approval", approval: operation.approval };
-				break;
 			case "revise_intent":
 				action = {
 					...base,

package/plugins/immune-brain/runtime/kernel/completion.ts

@@ -12,7 +12,7 @@ import { assertKernelInvariantsV3, KernelInvariantError } from "./validation";
 const REQUIRED_ATTESTATIONS: Record<TaskIntentV1["risk"], ApprovalKind[]> = {
 	routine: ["qa"],
 	material: ["qa", "review"],
-	critical: ["qa", "review", "user"],
+	critical: ["qa", "review"],
 };
 
 function archiveActivePlanningPath(path: string): string | null {
@@ -199,8 +199,6 @@ export function projectTask(
 			nextObligation = "run_qa";
 		} else if (decision.missing_approval_kinds.includes("review")) {
 			nextObligation = "run_review";
-		} else if (decision.missing_approval_kinds.includes("user")) {
-			nextObligation = "authorize_user";
 		} else if (decision.complete) {
 			nextObligation = "complete";
 		}

package/plugins/immune-brain/runtime/kernel/reducer.ts

@@ -176,7 +176,6 @@ function intentRefMatches(intent: TaskIntentV1, ref: TaskIntentRefV3): boolean {
 function hasPrivilegedKind(action: TaskAction): boolean {
 	return (
 		action.type === "record_approval" ||
-		action.type === "record_user_approval" ||
 		action.type === "approve_breaking_intent_revision" ||
 		action.type === "request_rework" ||
 		action.type === "stop" ||
@@ -374,36 +373,6 @@ export function reduceTask(
 			appendHistory(record, action, from, approval.id, authorityAudit);
 			break;
 		}
-		case "record_user_approval": {
-			if (record.lifecycle !== "active" || record.artifact_state !== "frozen")
-				throw new KernelInvariantError([
-					`cannot record user approval while state is ${stateOf(record)}`,
-				]);
-			const approval = action.approval;
-			if (approval.kind !== "user")
-				throw new KernelInvariantError([
-					"record_user_approval requires kind user",
-				]);
-			if (!authorityAudit || authorityAudit.authority_kind !== "user")
-				throw new KernelInvariantError([
-					"record_user_approval requires user authority",
-				]);
-			if (approval.task_revision !== record.intent_snapshot.revision)
-				throw new KernelInvariantError(["approval task_revision must equal the current intent revision"]);
-			if (approval.intent_content_hash !== record.intent_ref.content_hash)
-				throw new KernelInvariantError(["approval intent_content_hash must equal the current intent hash"]);
-			if (approval.diff_hash !== diffHash)
-				throw new KernelInvariantError(["approval diff_hash must equal the action diff hash"]);
-			if (record.attestations.some((item) => item.id === approval.id))
-				throw new KernelInvariantError([
-					`attestations contains duplicate id ${approval.id}`,
-				]);
-			if (approval.review_revision)
-				throw new KernelInvariantError(["review_revision is only valid on review approvals"]);
-			record.attestations.push({ ...approval, acceptance_results: [] });
-			appendHistory(record, action, from, approval.id, authorityAudit);
-			break;
-		}
 		case "revise_intent":
 		case "approve_breaking_intent_revision": {
 			if (record.lifecycle !== "active")

package/plugins/immune-brain/runtime/kernel/types.ts

@@ -57,7 +57,6 @@ export type AssuranceObligation =
 	| "submit_assurance"
 	| "run_qa"
 	| "run_review"
-	| "authorize_user"
 	| "complete"
 	| "none";
 
@@ -276,7 +275,6 @@ export type TaskAction =
 	| (TaskActionBase & { type: "record_finding"; finding: TaskFinding })
 	| (TaskActionBase & { type: "resolve_finding"; finding_id: string })
 	| (TaskActionBase & { type: "record_approval"; approval: TaskApprovalV2 })
-	| (TaskActionBase & { type: "record_user_approval"; approval: TaskApprovalV2 })
 	| (TaskActionBase & {
 			type: "revise_intent";
 			next_intent: TaskIntentV1;

package/plugins/immune-brain/runtime/kernel/validation.ts

@@ -730,7 +730,6 @@ const ACTION_V2_TYPES = [
 	"record_finding",
 	"resolve_finding",
 	"record_approval",
-	"record_user_approval",
 	"revise_intent",
 	"approve_breaking_intent_revision",
 	"request_rework",
@@ -831,8 +830,7 @@ export function parseTaskAction(raw: unknown): TaskAction {
 			};
 			break;
 		}
-		case "record_approval":
-		case "record_user_approval": {
+		case "record_approval": {
 			rejectUnknown(
 				value,
 				[...ACTION_BASE_FIELDS, "approval"],

package/plugins/immune-brain/runtime/plugin_version.ts

@@ -0,0 +1,2 @@
+// Generated by scripts/plugin_versioning.ts from the root package.json.
+export const PLUGIN_VERSION = "3.3.0" as const;