immune-brain 3.2.2 → 3.4.0

package/plugins/immune-brain/dist/docs/reference/subagent-dispatch-protocol.md

@@ -90,7 +90,7 @@ Pi `Agent` has no `readonly` parameter; the empty tool policy, child type, and p
 4. Kernel Assurance chat uses native Tool rendering only. It does not publish completion messages or wake a later parent turn; the direct Tool result is the continuation boundary. `awaiting_user` remains valid until the host-built authorization operation is confirmed and the immutable snapshot is revalidated.
 5. Child 不得再次派发 child，nested delegation 一律禁止。Parent 保留综合与最终判断责任。
 6. Kernel authority Review 对每个 immutable snapshot 恰好一个 primary reviewer，turn 预算按 workload 缩放（Quick 12 / Standard 16 / Heavy 24），并使用该 snapshot 对应的 Quick/Standard/Heavy 执行档位；不存在从 initial dispatch 起算的单一端到端总预算。Reviewer 必须先验证 immutable v5 manifest 的 `base_head`、`review_commit`、单一 parent、`review_tree` 与 `manifest_digest`，再用只读 Git 命令从 synthetic revision 获取源码；manifest 只有 metadata，不复制 source bytes，也不枚举 neighborhood files。审查只围绕 acceptance assertions 与 `changed_paths`，未变更路径只有在 acceptance、changed caller 或同一 state machine 直接需要时按需读取并注明理由；Reviewer 不探索无关 repository paths。对 settlement-class change，Reviewer 必须先枚举 immutable revision 内每条 terminal、cancellation、timeout 与 race path，再对全部路径给出判断；finding summary 必须以受影响路径开头。每个 acceptance 的执行结果已由 deterministic QA 在 review 前验证并内嵌于 manifest 的 `outcomes` 字段（acceptance_id -> {status, summary}）；Reviewer 不得重跑 descriptor，也不得把本地没有测试运行当作 finding——Review 只审 revision provenance、代码正确性、回归、安全与缺失测试。除该 reviewer 外，同一触发点最多两个相互独立的 advisory/discovery children；它们只能并行读，不能写 workflow state、关闭 QA 或产生 authority。
-7. Foreground assurance never sleeps, polls, or schedules a completion callback. One Tool call owns QA; one Parent turn obtains and submits the reviewer verdict; one explicit authorization operation owns the critical-risk user decision.
+7. Foreground assurance never sleeps, polls, or schedules a completion callback. One Tool call owns QA; one Parent turn obtains and submits the reviewer verdict. User authorization is reserved for unresolved decisions, explicit stop, and breaking Intent revisions; no risk tier adds a generic final confirmation.
 8. `submit_review` validates the verdict contract, task identity, immutable snapshot digest, and fresh record/Intent/workspace/diff revisions before applying Review authority. Malformed verdicts are retryable without rebuilding evidence. Stale verdicts leave the TaskRecord unchanged and release the stale reservation. Local execution trusts the Parent to relay the reviewer verdict and does not require Agent lifecycle receipts.
 9. The assurance Tool checks the immutable snapshot before each phase and returns a terminal structured state directly: `cancelled`, `rework`, `review_ready`, `awaiting_user`, `blocked`, or `settlement_unknown`. The commit boundary is non-cancellable. No silent task, status timer, completion notification, or result retrieval path is permitted.
 

package/plugins/immune-brain/dist/imm-brainstorm.md

@@ -103,7 +103,7 @@ Runtime helpers: `imm_core.buildBrainstormEnsembleRequest`, `imm_core.buildBrain
 
 A Brainstorm ensemble is optional advisory-only framing input, not a vote and not a child-owned decision. The default roles are clarify scope, divergent options, minimal solution, and risk review.
 
-All Brainstorm ensemble children are advisory-only with `tool_policy: no tools`; they do not edit code, write Specs, write Plans, mutate workflow state, or close QA. The parent `imm-brainstorm` owns final framing synthesis, Brainstorm manifest IDs, and decision-delta confirmation. Final Spec and Plan authority stays with `imm-planner`. Routine Managed enrollment uses the Planner's final `ctx.ui.custom` confirmation bound to the TaskIntent content hash as the single authority gate; Enrollment validates descriptor structure without executing acceptance descriptors, deterministic QA executes them after implementation, and the routine task proceeds without a second human stop.
+All Brainstorm ensemble children are advisory-only with `tool_policy: no tools`; they do not edit code, write Specs, write Plans, mutate workflow state, or close QA. The parent `imm-brainstorm` owns final framing synthesis, Brainstorm manifest IDs, and decision-delta confirmation. Final Spec and Plan authority stays with `imm-planner`. Routine Managed enrollment uses the current Host's native confirmation bound to the TaskIntent revision, content hash, and preparation digest as the single authority gate; Enrollment validates descriptor structure without executing acceptance descriptors, deterministic QA executes them after implementation, and the routine task proceeds without a second human stop. A later authority-gate failure stays fail-closed in the current Host and reports exactly one same-Host recovery action; Brainstorm must never recommend another Host, worktree, or unmanaged implementation as a fallback.
 
 Pi's adapter may consume `brainstorm_ensemble` dispatch JSON to prepare advisory Pi subagent envelopes, but envelope construction is not child execution and does not transfer framing authority. Pi launches one foreground Agent at a time, consumes its direct result, and re-evaluates the remaining dispatch budget before launching another candidate. Runtime does not call any agent, poll or recover background work, mutate state, or own final Spec/Plan authority. Pi subagent children remain no-tools advisory candidates; the parent `imm-brainstorm` collects outputs before synthesis.
 

package/plugins/immune-brain/dist/imm-loop.md

@@ -36,7 +36,7 @@ before any workflow mutation.
 
 ## Core Responsibilities
 
-- **Main-context completion loop**: Drive the enrolled Kernel task in the current Pi conversation until completion or a safe stop.
+- **Main-context completion loop**: Drive the enrolled Kernel task in the current Host conversation until completion or a safe stop.
 - **Context-preserving execution**: Call `imm_loop_action` with `op: route`, then follow the returned `executor` context in the current Parent conversation. Implement only the active Step or pending same-boundary `follow_up`, then record structured execution evidence through the Loop runtime action. A bounded test failure uses the returned internal `test-fixer` dispatch with its explicit delegated test-file list; PR feedback or CI repair uses the returned internal `pr-fix` dispatch inside the current Plan boundary.
 - **Independent authority isolation**: Use the host `Agent` subagent primitive for `awaiting_qa_decision` and for the exact runtime-reported review gate. Standard Plan Steps close from accepted passing evidence before an internal QA boundary exists; Strict Steps and all follow-ups retain isolated QA. The parent records accepted child decisions through the Loop runtime action.
 - **Observable progress**: Update only at major phase changes: Step start, execution evidence recorded, QA/review result, or terminal stop. Always emit a terminal summary.
@@ -52,7 +52,7 @@ Repeat this sequence; do not silently stop while a valid action remains:
 1. Call `imm_loop_action` with `op: route` (or `dispatch_role` at a QA/review boundary) and follow the projected `next` authority.
 2. Emit one progress line: `[target][phase] result | next: action`.
 3. Execute exactly one allowed action:
-   - Kernel ownership: call `imm_kernel_canary` for that owned task. Freeze the completed artifacts, then call `advance_assurance`; when it returns `review_ready`, invoke the foreground reviewer and pass its structured verdict to `submit_review`. When the projection calls for `request_authorization`, `approve_breaking_intent_revision`, or `repair_authority_state`, invoke the exact Tool operation directly without asking the user for chat pre-confirmation. The native host interaction is the single authority decision.
+   - Kernel ownership: call `imm_kernel_canary` for that owned task. Freeze the completed artifacts, then call `advance_assurance`; when it returns `review_ready`, invoke the foreground reviewer and pass its structured verdict to `submit_review`. When the projection calls for `request_authorization` or `approve_breaking_intent_revision`, invoke the exact Tool operation directly without asking the user for chat pre-confirmation; the native host interaction is the single authority decision. Invoke `repair_authority_state` directly for a proven stale claim; Kernel revalidation removes only the redundant claim without user interaction.
    - Active Step / `rework_needed`: follow the returned `executor` context in the current conversation, implement only the active Step or pending same-boundary `follow_up`, verify, record structured execution evidence through the Loop runtime action, and continue. A bounded test-only repair may request internal `test-fixer` with `focus_delta.specific_changes`; PR review or CI repair may request internal `pr-fix` with the current `plan_id`, changed-file boundary, and verification. Both return child evidence to the Parent and cannot widen scope.
    - `awaiting_qa_decision`: call `imm_loop_action` with `op: dispatch_role`, role `qa`, the current projection, Plan verification, recorded evidence, and current target identity. Invoke the returned foreground Agent envelope exactly. A `rework` or `replan` must carry validated `notes`.
    - `review_required`: map the exact `pending_review_gate` (`imm-code-review` or `imm-ui-review`) to the internal `code-review` or `ui-review` role and call `imm_loop_action` with `op: dispatch_role`, passing `pending_review_gate`, `review_changed_files`, and `review_changed_files_signature`. Invoke the returned foreground Agent envelope exactly. Record a validated pass, or open a same-boundary follow-up through the Loop runtime action.
@@ -67,6 +67,7 @@ Use Pi native `Agent` subagents. Do not spawn Pi child processes or invoke a sep
 - The parent may implement but must not issue its own QA or review pass.
 - QA and reviewer children must not edit files, write Plans, mutate Kernel state, or close decisions directly.
 - Missing `Agent` support, failed or malformed child output, stale child target, runtime write failure, invalid projection, missing credentials, unclear verification, repeated unchanged failure, or user cancellation stops fail-closed with an explicit reason and no decision write.
+- A Managed native authority failure reports its stable reason and exactly one same-Host recovery action. Never recommend another Host, worktree, Direct Path, unmanaged implementation, or automatic retry as a fallback.
 - `replan_needed` stops at `imm-planner`; do not widen scope or rewrite the active Plan. A replacement must use a new sequential Plan path after the current Plan reaches `completed`, or after a literal user explicitly marks it `cancelled` or `superseded`.
 - Plans never suspend, resume, queue, or execute in parallel. Do not insert a repair Plan ahead of the current Plan.
 - Same-boundary review `follow_up` repeats execution, independent QA, and the originating review gate.
@@ -139,18 +140,22 @@ Default user-facing shape: checkpoint progress lines, then `Conclusion -> Eviden
 ## Kernel Canary Routing
 
 When the Kernel projection reports an active/draining backend claim, keep
-`imm-loop` as the user-facing entry and call the `imm_kernel_canary` Tool for
-that owned task. Enrollment uses the `imm_canary_enrollment` Tool and Review
-authorization remains a native TUI gate. When the projection calls for
-`request_authorization`, `approve_breaking_intent_revision`, or
-`repair_authority_state`, invoke the exact Tool operation directly without
-asking the user for chat pre-confirmation; the native host interaction is the
-single authority decision. Do not invoke the removed `imm-canary-work` Skill as
+`imm-loop` as the user-facing entry and call the current Host's Kernel integration
+for that owned task. Enrollment and Review authorization use the current Host's
+native gates. When the projection calls for `request_authorization` or
+`approve_breaking_intent_revision`, invoke the exact Tool operation directly
+without asking the user for chat pre-confirmation; the native Host interaction is
+the single authority decision. Invoke
+`repair_authority_state` directly for a proven stale claim; Kernel revalidation
+removes only the redundant claim without user interaction. Do not invoke the
+removed `imm-canary-work` Skill as
 a separate entry point. Invalid or contradictory projections fail closed. After
 implementation and focused verification, freeze the artifacts and call
 `advance_assurance`. If it returns `review_ready`, invoke the foreground
 reviewer and pass its structured verdict to `submit_review`;
-`request_authorization` remains the critical-risk user authorization boundary.
+`request_authorization` is reserved for an unresolved user decision or an
+explicit stop. Critical work completes after fresh QA and Review without a
+second user confirmation.
 Every QA/Review operation stays foreground and returns its next projected
 obligation directly to the Parent. The host performs any opted-in GitHub Issue
 projection only after the corresponding authority mutation: only a fresh

package/plugins/immune-brain/dist/imm-planner.md

@@ -22,9 +22,12 @@ planning artifacts. A later literal-user request to start Enrollment is a
 non-authoritative execution trigger: invoke the native Enrollment gate directly,
 without asking for chat pre-confirmation. For a clear mutation request that
 already includes execution, invoke that gate as soon as the candidate is
-validated and Git-tracked. Literal-user confirmation in the native gate remains
-the authority boundary. Fast-Track may compress the same phases but cannot
-bypass that boundary, QA, Review, authorization, or completion.
+validated and Git-tracked. Literal-user confirmation in the current Host's
+native gate remains the authority boundary. A gate failure preserves candidate
+artifacts and reports its reason plus exactly one same-Host recovery action; it
+must never recommend another Host, worktree, Direct Path, unmanaged
+implementation, or automatic retry. Fast-Track may compress the same phases but
+cannot bypass that boundary, QA, Review, authorization, or completion.
 
 ## Clarification supplement
 
@@ -73,7 +76,7 @@ Then route deterministically:
 - an active or otherwise nonterminal v3 Plan remains on its existing v3 route;
 - no routing policy preserves the legacy v3 Planner behavior;
 - a valid `kernel_task_intent` retirement policy produces one TaskIntent draft
-  through Pi `imm-planner`;
+  through the current Host's explicit `imm-planner`;
 - an invalid, unreadable, untracked, or tracked-deleted policy rejects new
   planning authority with `routing_policy_invalid`;
 - no Planner path enrolls a task or falls back to v3 after retirement.
@@ -90,17 +93,18 @@ The routing projection selects the planning route; explicit
 of that Plan artifact. A valid Plan never proves Managed authority. Under an
 active `kernel_task_intent` policy, authority still requires a Git-tracked
 TaskIntent whose `imm-kernel intent validate <path> --json` projection is
-`valid: true` and `enrollment_ready: true`, followed by Pi TUI enrollment.
-
-Pi host identity is implicit and never a planning input. The production boundary
-that turns a Git-tracked TaskIntent draft into managed execution authority is the
-native host TUI: the Planner's final `ctx.ui.custom` gate (via the
-`imm_canary_enrollment` foreground Tool) provides one literal-user confirmation
-bound to the TaskIntent content hash. Invoke the Tool directly when the route is
-ready; do not ask for a chat pre-confirmation. Enrollment validates the intent,
-Git ownership, scope, workspace claim, and final authority preconditions without
-executing acceptance descriptors. A routine task proceeds from that single
-confirmation through enrollment, execution and QA without a second human stop.
+`valid: true` and `enrollment_ready: true`, followed by current-Host native
+Enrollment.
+
+Host identity is implicit and never a planning input. The production boundary
+that turns a Git-tracked TaskIntent draft into managed execution authority is
+the current Host's native Enrollment gate. Invoke that Host integration
+directly when the route is ready; do not ask for chat pre-confirmation. The
+single literal-user decision is bound to the TaskIntent revision, content hash,
+and preparation digest. Enrollment validates the intent, Git ownership, scope,
+workspace claim, and final authority preconditions without executing acceptance
+descriptors. A routine task proceeds from that single confirmation through
+enrollment, execution and QA without a second human stop.
 
 Before authoring a TaskIntent, trace each expected behavior from its public or
 runtime entry point through existing imports and callers to the highest focused
@@ -387,10 +391,11 @@ Iteration plan under `docs/plans/` and spec under `docs/specs/`. Includes: `Summ
 - When a project explicitly expects Chinese document prose, `imm-plan <plan-path> --json` includes an `output_language` warning if target Plan or referenced Spec prose appears mostly English.
 - Spec references align with steps: each step’s `Verification` is copy-paste-checkable against repo commands or files.
 - For brainstorm-origin Plans with a manifest, `imm-plan <plan-path> --json` reports `origin_coverage` totals with no `unmapped_items` and no reason-required trace rows without reasons.
-- Managed execution handoff is Git-tracked TaskIntent author/validate plus Pi TUI enrollment. Do not sync a v3 State Ledger or invoke a missing dispatcher.
+- Managed execution handoff is Git-tracked TaskIntent author/validate plus current-Host native Enrollment. Do not sync a v3 State Ledger or invoke a missing dispatcher.
 
 ## Next Action
 
 - Gate: Reference closure and the clarification supplement are complete; every upstream `BR-*` item is represented; no unresolved user-owned decision remains; any Planner-introduced decision delta is confirmed; the Plan passes `imm-plan --json` validation; and no step has a hypothetical-only verification path.
-- If gates pass: for Kernel-managed work, invoke the `imm_canary_enrollment` Tool directly without chat pre-confirmation. Its native `ctx.ui.custom` gate provides the single literal-user confirmation bound to the TaskIntent content hash, validates Enrollment preconditions without executing acceptance descriptors, and enrolls the task to continue through `imm-loop`.
+- If gates pass: for Kernel-managed work, invoke the current Host's native Enrollment Tool directly without chat pre-confirmation. Its single literal-user gate binds the TaskIntent revision, content hash, and preparation digest, validates Enrollment preconditions without executing acceptance descriptors, and enrolls the task to continue through `imm-loop`.
+- If the native gate fails: preserve candidate artifacts and report the stable reason plus exactly one same-Host recovery action. Do not suggest another Host, worktree, Direct Path, unmanaged implementation, or automatic retry.
 - If gates are not met: state which validation failures, unresolved verification paths, or material decision deltas remain; do not name a next skill.

package/plugins/immune-brain/hooks/hooks.json

@@ -31,16 +31,6 @@
         ]
       }
     ],
-    "ElicitationResult": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/dist/claude/mcp-server.mjs\" --hook"
-          }
-        ]
-      }
-    ],
     "SessionEnd": [
       {
         "hooks": [

package/plugins/immune-brain/runtime/assurance/coordinator.ts

@@ -133,7 +133,6 @@ export interface ForegroundToolUpdate {
 
 export type AssuranceAdvanceResult =
 	| { state: "review_ready"; operation: "review"; operation_id: string; snapshot_digest: string; review_bundle_digest: string; agent_params: unknown }
-	| { state: "awaiting_user"; operation: "record-user-approval"; operation_id: string }
 	| { state: "rework"; operation: "qa"; operation_id: string; summary: string }
 	| { state: "cancelled"; operation: "qa" | "review"; operation_id: string; reason: string }
 	| { state: "failed"; operation: "qa" | "review"; operation_id: string; reason: string }
@@ -150,7 +149,6 @@ export type AssuranceAdvanceResult =
 
 export type AssuranceSubmitReviewResult =
 	| { state: "rework"; operation: "review"; operation_id: string; summary: string }
-	| { state: "awaiting_user"; operation: "record-user-approval"; operation_id: string }
 	| { state: "review_preparation_failed"; operation: "review"; operation_id: string; reason: string }
 	| { state: "completed" }
 	| { state: "settlement_unknown"; operation: "qa" | "review"; operation_id: string; reason: string }
@@ -528,8 +526,6 @@ export class AssuranceCoordinator {
 					return this.unknownAfterCommit(taskId, "qa", operationId, boundedAssuranceError(error));
 				}
 			}
-			if (projection.projection.next_obligation === "authorize_user")
-				return { state: "awaiting_user", operation: "record-user-approval", operation_id: operationId };
 			if (projection.projection.next_obligation !== "run_qa" && projection.projection.next_obligation !== "run_review")
 				return { state: "blocked", reason: `Kernel requires ${projection.projection.next_obligation}` };
 			const qaAlreadySettled = projection.projection.next_obligation === "run_review";
@@ -623,8 +619,6 @@ export class AssuranceCoordinator {
 					return this.unknownAfterCommit(taskId, "qa", operationId, boundedAssuranceError(error));
 				}
 			}
-			if (fresh.projection.next_obligation === "authorize_user")
-				return { state: "awaiting_user", operation: "record-user-approval", operation_id: operationId };
 			if (fresh.projection.next_obligation !== "run_review") {
 				if (authorityCommitted && aborted()) return this.unknownAfterCommit(taskId, "qa", operationId, "QA settlement projection did not require Review after cancellation");
 				return { state: "blocked", reason: `Kernel requires ${fresh.projection.next_obligation} after QA` };
@@ -777,8 +771,6 @@ export class AssuranceCoordinator {
 				return this.unknownAfterCommit(taskId, "review", reservation.operationId, boundedAssuranceError(error));
 			}
 		}
-		if (settled.projection.next_obligation === "authorize_user")
-			return { state: "awaiting_user", operation: "record-user-approval", operation_id: reservation.operationId };
 		return { state: "blocked", reason: `Kernel requires ${settled.projection.next_obligation} after Review` };
 	}
 

package/plugins/immune-brain/runtime/claude/capability.ts

@@ -1,4 +1,4 @@
-export const MIN_CLAUDE_CODE_VERSION = "2.1.199";
+export const MIN_CLAUDE_CODE_VERSION = "2.1.236";
 export const HOST_ID = "claude-code" as const;
 export const CORE_CONTRACT = "assurance_kernel/host_adapter/claude-code/v1";
 export const SUPPORTED_PLATFORMS = ["darwin", "linux"] as const;
@@ -6,12 +6,12 @@ export const SUPPORTED_PLATFORMS = ["darwin", "linux"] as const;
 export type PermissionMode = "manual" | "acceptEdits" | "auto" | "bypassPermissions" | "dontAsk";
 
 export type HostProbe =
-	| { ok: true; version: string; permissionMode: PermissionMode; platform: string }
+	| { ok: true; version: string; platform: string }
 	| { ok: false; reason: string };
 
 function parseSemver(value: string): [number, number, number] | null {
 	// Prerelease and build suffixes are rejected: an unstable build such as
-	// 2.1.199-alpha never satisfies the stable minimum.
+	// Prerelease builds never satisfy the stable minimum.
 	const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(value.trim());
 	if (!match) return null;
 	return [Number(match[1]), Number(match[2]), Number(match[3])];
@@ -57,11 +57,5 @@ export function probeHost(
 	if (platform !== "darwin" && platform !== "linux") {
 		return { ok: false, reason: `unsupported platform ${platform}; native Windows is out of scope` };
 	}
-	const rawPermissionMode = env.CLAUDE_CODE_PERMISSION_MODE;
-	if (rawPermissionMode !== undefined && rawPermissionMode !== "") {
-		const permissionMode = parsePermissionMode(rawPermissionMode);
-		if (!permissionMode) return { ok: false, reason: `unsupported permission mode ${rawPermissionMode}` };
-		return { ok: true, version, permissionMode, platform };
-	}
-	return { ok: true, version, permissionMode: "manual", platform };
+	return { ok: true, version, platform };
 }

package/plugins/immune-brain/runtime/claude/interaction.ts

@@ -1,58 +1,91 @@
 import { createHash, randomUUID } from "node:crypto";
-import { parsePermissionMode, type PermissionMode } from "./capability";
 
 export const PRIVILEGED_OPERATIONS = [
 	"enroll",
 	"request_authorization",
 	"approve_breaking_intent_revision",
 	"stop",
-	"repair_authority_state",
 ] as const;
 
 export type PrivilegedOperation = (typeof PRIVILEGED_OPERATIONS)[number];
-export type NativeDecision = "accept" | "deny" | "cancel";
+export type NativeDecision = "accept" | "decline" | "cancel";
+export type NativeFailureCode =
+	| "interaction_not_opened"
+	| "user_denied"
+	| "user_cancelled"
+	| "correlation_missing"
+	| "unsupported_host"
+	| "workspace_changed";
+
+const RECOVERY_ACTIONS: Record<NativeFailureCode, string> = {
+	interaction_not_opened: "retry through a fresh native gate in the current Host",
+	user_denied: "wait for a fresh literal-user request",
+	user_cancelled: "wait for a fresh literal-user request",
+	correlation_missing: "retry through a fresh native gate in the current Host",
+	unsupported_host: "upgrade to a supported Claude Code version and retry in the current Host",
+	workspace_changed: "review the current workspace and retry through a fresh native gate",
+};
+
+export class NativeAuthorityError extends Error {
+	constructor(
+		readonly reasonCode: NativeFailureCode,
+		detail: string,
+		readonly recoveryAction = RECOVERY_ACTIONS[reasonCode],
+	) {
+		super(`${reasonCode}: ${detail}; recovery: ${recoveryAction}`);
+		this.name = "NativeAuthorityError";
+	}
+}
 
 export function isPrivilegedOperation(operation: string): operation is PrivilegedOperation {
 	return (PRIVILEGED_OPERATIONS as readonly string[]).includes(operation);
 }
 
 export function privilegedAnnotations(): Record<string, unknown> {
-	return {
-		destructiveHint: true,
-		"anthropic/requiresUserInteraction": true,
-	};
+	return { destructiveHint: true };
 }
 
 export interface NativeGateInput {
 	operation: string;
-	permissionMode: PermissionMode | string;
-	requiresUserInteraction: boolean;
 	interactive: boolean;
 	decision?: NativeDecision;
 }
 
 export type NativeGateResult =
 	| { ok: true }
-	| { ok: false; reason: string };
+	| { ok: false; error: NativeAuthorityError };
 
 export function evaluateNativeGate(input: NativeGateInput): NativeGateResult {
 	if (!isPrivilegedOperation(input.operation)) return { ok: true };
-	if (!input.interactive) return { ok: false, reason: "non-interactive execution cannot mint authority" };
-	const mode = parsePermissionMode(input.permissionMode);
-	if (!mode) return { ok: false, reason: `unsupported permission mode ${String(input.permissionMode)}` };
-	if (mode === "dontAsk") return { ok: false, reason: "dontAsk cannot mint authority" };
-	if (!input.requiresUserInteraction) {
-		return { ok: false, reason: "privileged operation requires anthropic/requiresUserInteraction" };
-	}
-	if (input.decision === "deny") return { ok: false, reason: "native interaction denied" };
-	if (input.decision === "cancel") return { ok: false, reason: "native interaction cancelled" };
-	if (input.decision !== "accept") return { ok: false, reason: "native interaction missing" };
+	if (!input.interactive) return { ok: false, error: new NativeAuthorityError("unsupported_host", "interactive MCP elicitation is unavailable") };
+	if (input.decision === "decline") return { ok: false, error: new NativeAuthorityError("user_denied", "native interaction declined") };
+	if (input.decision === "cancel") return { ok: false, error: new NativeAuthorityError("user_cancelled", "native interaction cancelled") };
+	if (input.decision !== "accept") return { ok: false, error: new NativeAuthorityError("interaction_not_opened", "native interaction returned no decision") };
 	return { ok: true };
 }
 
+export interface NativeConfirmationInput {
+	operation: PrivilegedOperation;
+	taskId: string;
+	toolCallId: string;
+	risk?: string;
+	intentRevision?: number;
+	intentContentHash?: string;
+	bindingDigest?: string;
+	signal?: AbortSignal;
+}
+
+export interface NativeConfirmationResult {
+	decision: NativeDecision;
+	requestId: string;
+}
+
+export type NativeConfirmationPort = (input: NativeConfirmationInput) => Promise<NativeConfirmationResult>;
+
 export function confirmationRef(input: {
-	sessionId: string;
+	connectionId: string;
 	toolCallId: string;
+	requestId: string;
 	operation: string;
 	taskId: string;
 	intentRevision?: number;
@@ -60,7 +93,7 @@ export function confirmationRef(input: {
 	bindingDigest?: string;
 }): string {
 	return `claude-confirm-${createHash("sha256")
-		.update(`${input.sessionId}\0${input.toolCallId}\0${input.operation}\0${input.taskId}\0${input.intentRevision ?? ""}\0${input.intentContentHash ?? ""}\0${input.bindingDigest ?? ""}`)
+		.update(`${input.connectionId}\0${input.toolCallId}\0${input.requestId}\0${input.operation}\0${input.taskId}\0${input.intentRevision ?? ""}\0${input.intentContentHash ?? ""}\0${input.bindingDigest ?? ""}`)
 		.digest("hex")
 		.slice(0, 16)}`;
 }