immune-brain 3.2.2 → 3.4.0

package/README.md

@@ -14,7 +14,7 @@ Immune-Brain adds a structured engineering workflow on top of Pi:
 - **Plans become trackable tasks** (`TaskIntent` + `TaskRecord`) so progress survives across sessions, not just chat history.
 - **Quality is enforced by code, not promises** — automated QA and isolated review must pass before a task is marked done.
 
-Pi and Claude Code are the supported hosts. Undeclared adapters remain unsupported. Minimum Claude Code is `2.1.199`. Real Host evidence lives in [docs/verification/claude-code-host-conformance.md](docs/verification/claude-code-host-conformance.md). Either host can use the model provider you configure — Immune-Brain works on top of Kernel authority, not a vendor chat.
+Pi and Claude Code are the supported hosts. Undeclared adapters remain unsupported. Minimum Claude Code is `2.1.236`, the lowest version verified with interactive server-initiated MCP elicitation. Current real-Host evidence is recorded in [Claude native elicitation conformance](docs/verification/claude-native-elicitation-authority-conformance.md); historical reports remain under [docs/verification/archive/](docs/verification/archive/). Either host can use the model provider you configure — Immune-Brain works on top of Kernel authority, not a vendor chat.
 
 ---
 
@@ -191,7 +191,7 @@ docs/specs/                           # Living specs (updated in place)
 
 **QA failed — what now?** QA returns `rework` or `replan_required`. `imm-loop` routes back to the executor or to `imm-planner` for scope changes. No manual reset needed.
 
-**Can I use it outside Pi?** Yes. Local interactive Claude Code is supported from version `2.1.199`; use the Claude plugin for the same Kernel-backed workflow.
+**Can I use it outside Pi?** Yes. Local interactive Claude Code is supported from version `2.1.236`; its plugin uses a digest-bound native MCP elicitation gate for the same Kernel-backed workflow.
 
 ---
 

package/README.zh-CN.md

@@ -14,7 +14,7 @@ Immune-Brain 在 Pi 之上提供结构化的工程工作流：
 - **计划变为可追踪的任务**（`TaskIntent` + `TaskRecord`），进度落盘持久化，不依赖对话历史。
 - **质量由代码强制保障** — 自动化 QA 与隔离式 Review 必须通过，任务才会完成。
 
-Pi 与 Claude Code 是支持的宿主。未声明的适配器仍不受支持。Claude Code 最低版本为 `2.1.199`。真实 Host 证据见 `docs/verification/claude-code-host-conformance.md`。
+Pi 与 Claude Code 是支持的宿主。未声明的适配器仍不受支持。Claude Code 最低版本为 `2.1.236`，这是已通过交互式 server-initiated MCP elicitation 验证的最低版本。当前真实 Host 证据见 `docs/verification/claude-native-elicitation-authority-conformance.md`；历史报告归档于 `docs/verification/archive/`。
 
 ---
 
@@ -64,7 +64,7 @@ mise run check-dist-sync    # 校验生成文档同步
 
 Pi 会自动路由：需求模糊走澄清，目标明确走规划。
 
-**2. 确认计划** — Planner 会在 `docs/plans/` 生成 `TaskIntent`（范围、风险等级、验收条件）。检查无误后在 TUI 弹窗中确认 Enrollment（所有风险等级都需要确认，确认前零写入）。
+**2. 确认计划** — Planner 会在 `docs/plans/` 生成 `TaskIntent`（范围、风险等级、验收条件）。检查无误后由当前 Host 的原生 gate 确认 Enrollment（所有风险等级都需要确认，确认前零 authority 写入）。
 
 **3. 开始执行** — `imm-loop` 按计划执行、跑 QA、触发 Review。按提示暂存任务拥有的文件：
 
@@ -191,7 +191,7 @@ docs/specs/                           # Living specs（原地更新）
 
 **QA 失败怎么办？** QA 返回 `rework` 或 `replan_required`，`imm-loop` 会自动路由回 Executor 或 `imm-planner` 调整范围，无需手动重置。
 
-**可以在 Pi 之外使用吗？** 可以在本地交互式 Claude Code 中使用同一套 Kernel；未声明的适配器不受支持。
+**可以在 Pi 之外使用吗？** 可以从 `2.1.236` 起在本地交互式 Claude Code 中使用同一套 Kernel；Claude plugin 通过绑定 digest 的原生 MCP elicitation gate 获取 authority，未声明的适配器不受支持。
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "3.2.2",
+  "version": "3.4.0",
   "description": "Immune-Brain agent skill system",
   "publishConfig": {
     "access": "public",
@@ -29,8 +29,9 @@
   },
   "scripts": {
     "changeset": "changeset",
-    "changeset:version": "changeset version && bun scripts/plugin_versioning.ts stamp && bun scripts/plugin_versioning.ts validate",
-    "changeset:publish": "bun scripts/plugin_versioning.ts validate && changeset publish",
+    "changeset:version": "changeset version && bun scripts/build-claude-plugin.ts && bun scripts/plugin_versioning.ts validate",
+    "verify:release": "bun scripts/plugin_versioning.ts validate && bun scripts/build-claude-plugin.ts --check && bun scripts/sync-dist-docs.ts --check && bun test && npm pack --dry-run --ignore-scripts",
+    "changeset:publish": "bun run verify:release && changeset publish",
     "release": "bun run changeset:publish"
   },
   "devDependencies": {
@@ -76,6 +77,7 @@
     "plugins/immune-brain/runtime/verification_descriptor.ts",
     "plugins/immune-brain/runtime/role_prompt_bridge.ts",
     "plugins/immune-brain/runtime/loop_contract.ts",
+    "plugins/immune-brain/runtime/plugin_version.ts",
     "plugins/immune-brain/runtime/assurance",
     "plugins/immune-brain/runtime/claude",
     "plugins/immune-brain/runtime/prompts",

package/plugins/immune-brain/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "3.2.2",
+  "version": "3.4.0",
   "description": "Immune-Brain Claude Code Host: native Enrollment, QA, Review, and Kernel settlement.",
   "author": {
     "name": "Immune-Brain Team"

package/plugins/immune-brain/.pi-extension/imm-canary-work.ts

@@ -20,6 +20,7 @@ import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
+import { PLUGIN_VERSION } from "../runtime/plugin_version";
 import {
 	parseVerificationDescriptor,
 	canonicalDescriptorBytes,
@@ -171,7 +172,6 @@ const TASK_INTENT_SCHEMA = Type.Object({
 
 export type { AssuranceRole } from "./pi-canary-assurance";
 export type AuthorizeOperation =
-	| "record-user-approval"
 	| "approve-breaking-intent-revision"
 	| "resolve-user-decision"
 	| "stop";
@@ -391,7 +391,7 @@ export default function (
 			"After implementation and focused verification, freeze the artifacts, call advance_assurance, and consume its direct terminal result; do not poll or create a detached job.",
 			"When advance_assurance returns review_ready, invoke the foreground Agent from agent_params once, then pass its structured verdict to submit_review.",
 			"For a complete breaking revision, call approve_breaking_intent_revision with the complete next_intent directly; do not ask for chat pre-confirmation because the host opens the single native confirmation before applying it.",
-			"For a proven stale authority claim, call repair_authority_state directly; do not ask for chat pre-confirmation because the host opens the single native confirmation.",
+			"For a proven stale authority claim, call repair_authority_state directly; the Kernel revalidates and removes only the redundant claim without user interaction.",
 			"After awaiting_user, call request_authorization directly so the host opens the single native confirmation; do not ask for chat pre-confirmation or ask the user to copy or report a command.",
 		],
 		parameters: Type.Object({
@@ -474,43 +474,6 @@ export default function (
 					presentTaskRailResult(ctx, taskId, blocked);
 					return failCanaryTool(taskId, action.op, "authority_conflict", "authority_conflict", blocked.result, blocked.next_action);
 				}
-				presentTaskRail(ctx, {
-					task_id: taskId,
-					state: "Approval required",
-					result: "Authority repair needs your approval",
-					next: "Decide whether to repair the stale claim",
-				});
-				const repairSelection = await requestAuthorityDialog(pi, ctx, {
-					attention_id: randomUUID(),
-					task_id: taskId,
-					reason: "authority_repair",
-					label: "Kernel authority repair required",
-				}, {
-					title: "Repair Kernel authority state?",
-					summary: [
-						`Owner: ${taskId}`,
-						`Terminal lifecycle: ${authority.owner_lifecycle}`,
-						`Claim lifecycle: ${authority.claim_lifecycle_status}`,
-					].join("\n"),
-					details: [
-						`Projection revision: ${authority.revision}`,
-						"Action: remove only the stale global claim; preserve TaskRecord and tombstone.",
-					].join("\n"),
-					signal: ctx.signal ?? signal,
-					actions: [
-						{ value: "repair", label: "Repair stale claim", description: "Remove only the stale global claim" },
-						{ value: "cancel", label: "Cancel", description: "Preserve all authority state unchanged" },
-					],
-				});
-				if (repairSelection !== "repair") {
-					const cancelled = {
-						state: "cancelled",
-						operation: action.op,
-						result: "Authority repair cancelled with zero writes",
-						next_action: "request authorization again if repair is still intended",
-					};
-					return toolResult(JSON.stringify(cancelled, null, 2), cancelled);
-				}
 				try {
 					const repaired = await repairKernelAuthority(ctx.cwd, taskId, authority.revision);
 					const result = {
@@ -574,9 +537,11 @@ export default function (
 				const blockers = state.blocking_finding_ids.length
 					+ state.unresolved_user_decision_ids.length
 					+ state.replan_required_ids.length;
+				const status = { plugin_version: PLUGIN_VERSION, ...state };
 				const details = {
 					state: "status",
 					operation: "status",
+					plugin_version: PLUGIN_VERSION,
 					lifecycle: state.lifecycle,
 					artifact_state: state.artifact_state,
 					task_state: state,
@@ -584,7 +549,7 @@ export default function (
 					next_action: state.next_obligation,
 				};
 				presentTaskRailResult(ctx, taskId, details);
-				return toolResult(JSON.stringify(state, null, 2), details);
+				return toolResult(JSON.stringify(status, null, 2), details);
 			}
 			const claim = projection.claim;
 			if (!claim || claim.task_id !== taskId) {
@@ -823,6 +788,17 @@ export default function (
 			`Decision: ${operation}`,
 			`State: ${projection.projection.lifecycle}:${projection.projection.artifact_state} | Claim: ${projection.claim.lifecycle_status}`,
 		].join("\n");
+		const intentDelta = nextIntent
+			? [
+					`Risk: ${priorIntent.intent.risk} -> ${nextIntent.risk}`,
+					`Goal: ${priorIntent.intent.goal} -> ${nextIntent.goal}`,
+					`Scope added: ${nextIntent.scope_hint.filter((path) => !priorIntent.intent.scope_hint.includes(path)).join(", ") || "none"}`,
+					`Scope removed: ${priorIntent.intent.scope_hint.filter((path) => !nextIntent.scope_hint.includes(path)).join(", ") || "none"}`,
+					`Acceptance added: ${nextIntent.acceptance.filter((item) => !priorIntent.intent.acceptance.some((prior) => prior.id === item.id)).map((item) => item.id).join(", ") || "none"}`,
+					`Acceptance removed: ${priorIntent.intent.acceptance.filter((item) => !nextIntent.acceptance.some((next) => next.id === item.id)).map((item) => item.id).join(", ") || "none"}`,
+					`Acceptance changed: ${nextIntent.acceptance.filter((item) => { const prior = priorIntent.intent.acceptance.find((candidate) => candidate.id === item.id); return prior && (prior.assertion !== item.assertion || prior.verification !== item.verification); }).map((item) => item.id).join(", ") || "none"}`,
+				]
+			: [];
 		const dialogDetails = [
 			`Operation: ${operation}`,
 			...(userDecisionOperation
@@ -834,9 +810,8 @@ export default function (
 			...(nextIntent
 				? [
 						`Next Intent: rev ${nextIntent.revision} (${nextIntentHash})`,
-						`Next Goal: ${nextIntent.goal}`,
-						`Next Scope: ${nextIntent.scope_hint.join(", ")}`,
-						`Next Acceptance Items: ${nextIntent.acceptance.length}`,
+						...intentDelta,
+						`Acceptance Items: ${priorIntent.intent.acceptance.length} -> ${nextIntent.acceptance.length}`,
 						`Next staged diff: ${stagedNextDiffHash}`,
 					]
 				: []),
@@ -922,23 +897,6 @@ export default function (
 					content_hash: nextIntentHash!,
 				};
 			}
-			// record-user-approval: literal-user approval for critical-task-completion. The approval payload is bound to the fresh
-			// projection (task revision, intent content hash, diff hash) and
-			// applied through the same exact-action capability path; the
-			// The reducer requires kind user, user authority, and active:frozen state.
-			const isUserApproval = operation === "record-user-approval";
-			const approval = isUserApproval
-				? {
-						id: `approval-user-${randomUUID().slice(0, 8)}`,
-						kind: "user" as const,
-						authority_role: "user" as const,
-						task_revision: projection.projection.intent_revision,
-						intent_content_hash: projection.projection.intent_content_hash,
-						diff_hash: projection.projection.diff_hash,
-						actor_id: "literal-user",
-						summary: "literal user approval",
-					}
-				: undefined;
 			const exactOperation = operation === "stop"
 				? { op: "stop" as const, reason: "literal user stopped task parked for replan" }
 				: operation === "approve-breaking-intent-revision"
@@ -947,7 +905,7 @@ export default function (
 							next_intent: nextIntent!,
 							next_intent_ref: nextIntentRef!,
 						}
-					: userDecisionOperation ?? userOperationFor(operation, approval);
+					: userDecisionOperation!;
 				// The exact host-built operation is shared by capability digest and
 				// application payload; command arguments cannot inject authority fields.
 				try {
@@ -971,7 +929,6 @@ export default function (
 						intent_content_hash: nextIntentHash ?? projection.projection.intent_content_hash,
 						diff_hash: operationDiffHash,
 						actor_id: "literal-user",
-						...(exactOperation.op === "record_user_approval" ? { approval: exactOperation.approval } : {}),
 						...(exactOperation.op === "approve_breaking_intent_revision"
 							? { next_intent: exactOperation.next_intent, next_intent_ref: exactOperation.next_intent_ref }
 							: {}),
@@ -1039,7 +996,6 @@ export default function (
 
 export type DerivedAuthorizationOperation =
 	| "resolve-user-decision"
-	| "record-user-approval"
 	| "stop";
 
 // Kernel projection is the sole source of authorization readiness.
@@ -1049,7 +1005,6 @@ export function deriveAuthorizationOperation(input: {
 }): { operation: DerivedAuthorizationOperation } | { blocked: string } {
 	if (input.hasOpenReplanRequired) return { operation: "stop" };
 	if (input.readiness.state === "resolve_user_decision") return { operation: "resolve-user-decision" };
-	if (input.readiness.state === "record_user_approval") return { operation: "record-user-approval" };
 	if (input.readiness.blocked) return { blocked: input.readiness.blocked };
 	return { blocked: "no unique host-derived authorization operation" };
 }
@@ -1126,15 +1081,6 @@ export function buildUserDecisionOperation(record: {
 	};
 }
 
-export function userOperationFor(operation: AuthorizeOperation, approval?: unknown) {
-	if (operation !== "record-user-approval")
-		throw new Error(`unsupported authorize operation: ${operation}`);
-	// The approval payload is constructed by the authorize handler from
-	// the fresh projection; it is never derived from untrusted input.
-	if (approval === undefined) throw new Error("record-user-approval requires an approval payload");
-	return { op: "record_user_approval" as const, approval };
-}
-
 /**
  * One record-aware freshness identity. v4 derives the scoped revision digest
  * from the immutable Enrollment base so committed and staged task work share a

package/plugins/immune-brain/.pi-extension/pi-canary-interaction.ts

@@ -8,8 +8,7 @@ export type UserAttentionReason =
 	| "enrollment"
 	| "descriptor_waiver"
 	| "breaking_intent_revision"
-	| "review_authorization"
-	| "authority_repair";
+	| "review_authorization";
 
 export interface UserAttentionEventV1 {
 	active: boolean;

package/plugins/immune-brain/.pi-extension/runtime-stub.ts

@@ -179,7 +179,7 @@ export interface TaskRecordRead {
 // --- Assurance projection (host-neutral Kernel facts, not exported from the
 // public Kernel index) ---
 export interface AssuranceAuthorizationReadiness {
-	state: "resolve_user_decision" | "record_user_approval" | "none";
+	state: "resolve_user_decision" | "none";
 	blocked: string | null;
 }
 export interface AssuranceProjection {
@@ -191,7 +191,7 @@ export interface AssuranceProjection {
 	lifecycle: "active" | "done" | "stopped" | "";
 	artifact_state: "active" | "frozen" | "";
 	risk: "routine" | "material" | "critical" | "";
-	next_obligation: "resolve_findings" | "resolve_user_decision" | "revise_intent" | "submit_assurance" | "run_qa" | "run_review" | "authorize_user" | "complete" | "none";
+	next_obligation: "resolve_findings" | "resolve_user_decision" | "revise_intent" | "submit_assurance" | "run_qa" | "run_review" | "complete" | "none";
 	fresh_acceptance_ids: string[];
 	missing_acceptance_ids: string[];
 	stale_attestation_ids: string[];

package/plugins/immune-brain/dist/BASELINE.md

@@ -59,7 +59,7 @@ Require exact host confirmation only for privileged effects:
   override; and
 - external writes whose target or impact cannot be safely reversed locally.
 
-Routine Managed enrollment uses one host confirmation bound to the TaskIntent content hash at the Planner's final `ctx.ui.custom` gate. Enrollment validates intent, Git ownership, scope, workspace claim, and final authority preconditions without executing acceptance descriptors; deterministic QA executes them after implementation. The routine task proceeds from that single confirmation through enrollment, execution, and QA without a second human stop. Do not request confirmation for local in-scope edits, local verification, ordinary Direct rework, scoped diff review, or completion reporting. Managed evidence, QA, Review, and completion authority remain governed by their Managed contracts; R2 does not weaken them.
+Routine Managed enrollment uses one current-Host native confirmation bound to the TaskIntent content hash after Planner validation. Explicit Plan-only requests stop with candidate artifacts and do not invoke Enrollment; execution-bearing requests open the native gate directly without chat pre-confirmation. Enrollment validates intent, Git ownership, scope, workspace claim, and final authority preconditions without executing acceptance descriptors; deterministic QA executes them after implementation. The routine task proceeds from that single confirmation through enrollment, execution, and QA without a second human stop. Do not request confirmation for local in-scope edits, local verification, ordinary Direct rework, scoped diff review, or completion reporting. Managed evidence, QA, Review, and completion authority remain governed by their Managed contracts; R2 does not weaken them. Managed native-authority failures fail closed with one stable reason and exactly one same-Host recovery action; never offer a Pi, Direct Path, cross-Host/worktree, unmanaged, or automatic-retry fallback.
 
 ## Parallel Read-Only Dispatch