immune-brain 3.2.2 → 3.4.0

package/plugins/immune-brain/runtime/claude/review_host.ts

@@ -45,23 +45,17 @@ export type ClaudeHookEvent =
 		taskId?: string;
 		operationId?: string;
 	}
-	| { type: "SessionEnd"; sessionId: string }
-	| { type: "ElicitationResult"; sessionId: string; toolCallId: string; decision: "accept" | "deny" | "cancel" }
-	| { type: "ElicitationConsumed"; sessionId: string; toolCallId: string };
+	| { type: "SessionEnd"; sessionId: string };
 
 export interface HookEventLog {
 	append(event: ClaudeHookEvent): boolean;
 	list(sessionId?: string): ClaudeHookEvent[];
 	sessions(): string[];
 	clear(sessionId?: string): void;
-	/** Persists consumed identity durably; true only after the record is verified. */
-	consumeElicitation(sessionId: string, toolCallId: string): boolean;
-	consumedKeys(): string[];
 }
 
 export class MemoryHookEventLog implements HookEventLog {
 	private readonly events: ClaudeHookEvent[] = [];
-	private readonly consumed: string[] = [];
 	append(event: ClaudeHookEvent): boolean { this.events.push(event); return true; }
 	list(sessionId?: string): ClaudeHookEvent[] {
 		return sessionId ? this.events.filter((event) => event.sessionId === sessionId) : [...this.events];
@@ -78,17 +72,9 @@ export class MemoryHookEventLog implements HookEventLog {
 			if (this.events[i].sessionId === sessionId) this.events.splice(i, 1);
 		}
 	}
-	consumeElicitation(sessionId: string, toolCallId: string): boolean {
-		this.consumed.push(`${sessionId}\0${toolCallId}`);
-		this.events.push({ type: "ElicitationConsumed", sessionId, toolCallId });
-		return true;
-	}
-	consumedKeys(): string[] { return [...this.consumed]; }
 }
 
 const CACHE_DIR = "immune-brain-claude";
-const CONSUMED_FILE = "consumed.jsonl";
-const CONSUMED_DIR = "consumed";
 
 function sessionHash(sessionId: string): string {
 	return createHash("sha256").update(sessionId).digest("hex");
@@ -120,25 +106,6 @@ function ensurePrivateDir(dir: string): boolean {
 	}
 }
 
-function claimAtomicKey(dir: string, keyName: string): boolean {
-	const claimsDir = join(dir, CONSUMED_DIR);
-	if (!ensurePrivateDir(claimsDir)) return false;
-	const claimPath = join(claimsDir, `${keyName}.claim`);
-	const flags = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW | constants.O_NONBLOCK;
-	let fd: number;
-	try {
-		fd = openSync(claimPath, flags, 0o600);
-	} catch (error) {
-		return false;
-	}
-	try {
-		const stat = fstatSync(fd);
-		if (!stat.isFile() || !ownedByUs(stat) || (stat.mode & 0o777) !== 0o600) return false;
-		return true;
-	} finally {
-		closeSync(fd);
-	}
-}
 function appendPrivate(path: string, dir: string, line: string): boolean {
 	if (!ensurePrivateDir(dir)) return false;
 	const flags = constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND | constants.O_NOFOLLOW | constants.O_NONBLOCK;
@@ -185,7 +152,7 @@ export class FileHookEventLog implements HookEventLog {
 		if (!ensurePrivateDir(dir)) return [];
 		try {
 			return readdirSync(dir)
-				.filter((name) => name.endsWith(".jsonl") && name !== CONSUMED_FILE)
+				.filter((name) => name.endsWith(".jsonl"))
 				.flatMap((name) => this.readFile(join(dir, name)));
 		} catch {
 			return [];
@@ -218,34 +185,6 @@ export class FileHookEventLog implements HookEventLog {
 			rmSync(path, { force: true });
 		} catch { /* cleanup cannot create authority */ }
 	}
-	consumeElicitation(sessionId: string, toolCallId: string): boolean {
-		// The durable consumed identity is claimed atomically (O_EXCL per-key)
-		// and committed to consumed.jsonl BEFORE any session evidence is touched:
-		// concurrent consumers cannot double-claim the same identity.
-		const dir = cacheDir(this.root);
-		const claimKey = createHash("sha256").update(`${sessionId}\0${toolCallId}`).digest("hex");
-		const keyClaimed = claimAtomicKey(dir, claimKey);
-		if (!keyClaimed) return false;
-		if (!appendPrivate(join(dir, CONSUMED_FILE), dir, `${JSON.stringify({ sessionId, toolCallId })}\n`)) {
-			// Roll back the claim file if the durable record append failed
-			try { rmSync(join(dir, CONSUMED_DIR, `${claimKey}.claim`), { force: true }); } catch { /* ignore */ }
-			return false;
-		}
-		if (!this.consumedKeys().includes(`${sessionId}\0${toolCallId}`)) return false;
-		return this.append({ type: "ElicitationConsumed", sessionId, toolCallId });
-	}
-	consumedKeys(): string[] {
-		if (!ensurePrivateDir(cacheDir(this.root))) return [];
-		const text = readPrivate(join(cacheDir(this.root), CONSUMED_FILE));
-		if (!text) return [];
-		try {
-			return text.split("\n").filter(Boolean)
-				.map((line) => JSON.parse(line) as { sessionId: string; toolCallId: string })
-				.map((item) => `${item.sessionId}\0${item.toolCallId}`);
-		} catch {
-			return [];
-		}
-	}
 }
 
 interface PendingReview {
@@ -287,11 +226,8 @@ export class ClaudeReviewHost implements AssuranceHostPort {
 	readonly host = "claude-code" as const;
 	private readonly pending = new Map<string, PendingReview>();
 	private readonly appliedBySession = new Map<string, number>();
-	private readonly consumedElicitations = new Set<string>();
 	constructor(private readonly log: HookEventLog = new MemoryHookEventLog()) {}
 
-	private readonly confirmations = new Map<string, "accept" | "deny" | "cancel">();
-
 	prepareReview(request: ReviewRequest): HostReviewReservation {
 		const initialCursors = new Map<string, number>();
 		const sessionCursors = new Map<string, number>();
@@ -322,7 +258,6 @@ export class ClaudeReviewHost implements AssuranceHostPort {
 	}
 
 	private drain(): void {
-		for (const key of this.log.consumedKeys()) this.consumedElicitations.add(key);
 		for (const sessionId of this.log.sessions()) {
 			const events = this.log.list(sessionId);
 			let start = this.appliedBySession.get(sessionId) ?? 0;
@@ -330,34 +265,10 @@ export class ClaudeReviewHost implements AssuranceHostPort {
 			let ended = false;
 			for (let i = start; i < events.length; i++) {
 				const event = events[i];
-				if (event.type === "ElicitationResult") {
-					const key = `${event.sessionId}\0${event.toolCallId}`;
-					if (this.consumedElicitations.has(key)) continue;
-					if (this.confirmations.has(key)) {
-						if (this.log.consumeElicitation(event.sessionId, event.toolCallId)) {
-							this.confirmations.delete(key);
-							this.consumedElicitations.add(key);
-						}
-						continue;
-					}
-					this.confirmations.set(key, event.decision);
-					continue;
-				}
-				if (event.type === "ElicitationConsumed") {
-					const key = `${event.sessionId}\0${event.toolCallId}`;
-					this.consumedElicitations.add(key);
-					this.confirmations.delete(key);
-					continue;
-				}
 				if (event.type === "SessionEnd") {
 					this.log.clear(event.sessionId);
 					ended = true;
 					this.appliedBySession.delete(event.sessionId);
-					// A confirmation cached before the session ended must never
-					// authorize a later privileged call.
-					for (const key of this.confirmations.keys()) {
-						if (key.startsWith(`${event.sessionId}\0`)) this.confirmations.delete(key);
-					}
 					for (const [id, state] of this.pending) {
 						if (state.startEvent?.sessionId === event.sessionId || state.postEvent?.sessionId === event.sessionId || state.stopEvent?.sessionId === event.sessionId) {
 							this.pending.delete(id);
@@ -394,38 +305,6 @@ export class ClaudeReviewHost implements AssuranceHostPort {
 		}
 	}
 
-	peekConfirmation(sessionId: string, toolCallId: string): boolean {
-		this.drain();
-		return this.confirmations.has(`${sessionId}\0${toolCallId}`);
-	}
-
-	takeConfirmation(sessionId: string, toolCallId: string): "accept" | "deny" | "cancel" | undefined {
-		this.drain();
-		const key = `${sessionId}\0${toolCallId}`;
-		const decision = this.confirmations.get(key);
-		if (!decision) return undefined;
-		if (!this.log.consumeElicitation(sessionId, toolCallId)) {
-			this.confirmations.delete(key);
-			return undefined;
-		}
-		this.confirmations.delete(key);
-		this.consumedElicitations.add(key);
-		this.drain();
-		return decision;
-	}
-
-	sessionOfElicitation(toolCallId: string): string | undefined {
-		this.drain();
-		const sessions: string[] = [];
-		for (const key of this.confirmations.keys()) {
-			const sep = key.lastIndexOf("\0");
-			if (sep >= 0 && key.slice(sep + 1) === toolCallId) sessions.push(key.slice(0, sep));
-		}
-		// Ambiguous correlation across sessions fails closed.
-		if (sessions.length !== 1) return undefined;
-		return sessions[0];
-	}
-
 	private applyReviewEvent(event: ClaudeHookEvent, state: PendingReview): void {
 		if (state.error) return;
 		if (event.type === "SubagentStart") {
@@ -543,10 +422,6 @@ export function parseHookStdin(raw: string): ClaudeHookEvent | null {
 	try { payload = JSON.parse(raw) as Record<string, unknown>; }
 	catch { return null; }
 	const hookType = String(payload.hook_event_name ?? payload.type ?? "");
-	// ElicitationResult is native authority evidence: it must carry the Host's
-	// own session_id verbatim. Alias or environment fallbacks are never
-	// accepted for this event; anything else is malformed and fails closed.
-	if (hookType === "ElicitationResult" && (typeof payload.session_id !== "string" || !payload.session_id)) return null;
 	const sessionId = String(payload.session_id ?? payload.sessionId ?? process.env.CLAUDE_SESSION_ID ?? "");
 	if (!sessionId) return null;
 	const agent = String(payload.agent_type ?? payload.agent ?? payload.subagent_type ?? "");
@@ -630,16 +505,5 @@ export function parseHookStdin(raw: string): ClaudeHookEvent | null {
 		};
 	}
 	if (hookType === "SessionEnd") return { type: "SessionEnd", sessionId };
-	if (hookType === "ElicitationResult") {
-		const rawToolCallId = payload.tool_use_id ?? payload.toolCallId;
-		if (typeof rawToolCallId !== "string" || !rawToolCallId) return null;
-		const toolCallId = rawToolCallId;
-		const raw = payload.decision ?? payload.result ?? payload.action;
-		// Only the exact MCP elicitation decision strings are native evidence;
-		// booleans and aliases like "yes" are malformed and fail closed.
-		const decision = raw === "accept" ? "accept" : raw === "deny" ? "deny" : raw === "cancel" ? "cancel" : null;
-		if (!toolCallId || !decision) return null;
-		return { type: "ElicitationResult", sessionId, toolCallId, decision };
-	}
 	return null;
 }

package/plugins/immune-brain/runtime/kernel/application.ts

@@ -158,7 +158,6 @@ export function applyTaskAction(
 
 		const privileged =
 			action.type === "record_approval" ||
-			action.type === "record_user_approval" ||
 			action.type === "approve_breaking_intent_revision" ||
 			action.type === "request_rework" ||
 			action.type === "stop" ||

package/plugins/immune-brain/runtime/kernel/assurance_projection.ts

@@ -25,13 +25,9 @@ export interface AssuranceAuthorizationReadiness {
 	/**
 	 * Kernel-decidable authorization readiness:
 	 * - "resolve_user_decision": exactly one open unresolved-user-decision finding;
-	 * - "record_user_approval": Kernel projects authorize_user after fresh QA
-	 *   and Review attestations for a critical task;
 	 * - "none": nothing uniquely decidable from Kernel facts.
-	 * A pending Pi native Review verdict is a session fact and is NOT visible
-	 * here; the host composes it before this readiness.
 	 */
-	state: "resolve_user_decision" | "record_user_approval" | "none";
+	state: "resolve_user_decision" | "none";
 	/** Non-null only when Kernel facts prove the authorization is blocked. */
 	blocked: string | null;
 }
@@ -79,8 +75,6 @@ export function deriveAssuranceAuthorization(input: {
 			state: "none",
 			blocked: `resolve-user-decision requires exactly one open user decision; found ${input.open_user_decision_count}`,
 		};
-	if (input.next_obligation === "authorize_user")
-		return { state: "record_user_approval", blocked: null };
 	return { state: "none", blocked: null };
 }
 

package/plugins/immune-brain/runtime/kernel/canary_application.ts

@@ -51,7 +51,6 @@ export type CanaryOperation =
 	| { op: "resolve_finding"; finding_id: string; actor_id: string }
 	| { op: "request_rework"; capability: object; findings: TaskFinding[]; actor_id: string }
 	| { op: "record_approval"; capability: object; approval: TaskApprovalV2; actor_id: string }
-	| { op: "record_user_approval"; capability: object; approval: TaskApprovalV2; actor_id: string }
 	| { op: "revise_intent"; next_intent: TaskIntentV1; actor_id: string }
 	| { op: "approve_breaking_intent_revision"; capability: object; next_intent: TaskIntentV1; actor_id: string }
 	| { op: "complete"; actor_id: string }
@@ -141,8 +140,6 @@ export function capabilityActionFor(input: {
 	switch (input.op) {
 		case "record_approval":
 			return { ...base, approval: input.approval } as TaskAction;
-		case "record_user_approval":
-			return { ...base, approval: input.approval } as TaskAction;
 		case "request_rework":
 			return { ...base, findings: input.findings } as TaskAction;
 		case "stop":
@@ -373,10 +370,6 @@ export function createCanaryApplication(
 				capability = operation.capability;
 				action = { ...base, type: "record_approval", approval: operation.approval };
 				break;
-			case "record_user_approval":
-				capability = operation.capability;
-				action = { ...base, type: "record_user_approval", approval: operation.approval };
-				break;
 			case "revise_intent":
 				action = {
 					...base,

package/plugins/immune-brain/runtime/kernel/completion.ts

@@ -12,7 +12,7 @@ import { assertKernelInvariantsV3, KernelInvariantError } from "./validation";
 const REQUIRED_ATTESTATIONS: Record<TaskIntentV1["risk"], ApprovalKind[]> = {
 	routine: ["qa"],
 	material: ["qa", "review"],
-	critical: ["qa", "review", "user"],
+	critical: ["qa", "review"],
 };
 
 function archiveActivePlanningPath(path: string): string | null {
@@ -199,8 +199,6 @@ export function projectTask(
 			nextObligation = "run_qa";
 		} else if (decision.missing_approval_kinds.includes("review")) {
 			nextObligation = "run_review";
-		} else if (decision.missing_approval_kinds.includes("user")) {
-			nextObligation = "authorize_user";
 		} else if (decision.complete) {
 			nextObligation = "complete";
 		}

package/plugins/immune-brain/runtime/kernel/reducer.ts

@@ -176,7 +176,6 @@ function intentRefMatches(intent: TaskIntentV1, ref: TaskIntentRefV3): boolean {
 function hasPrivilegedKind(action: TaskAction): boolean {
 	return (
 		action.type === "record_approval" ||
-		action.type === "record_user_approval" ||
 		action.type === "approve_breaking_intent_revision" ||
 		action.type === "request_rework" ||
 		action.type === "stop" ||
@@ -374,36 +373,6 @@ export function reduceTask(
 			appendHistory(record, action, from, approval.id, authorityAudit);
 			break;
 		}
-		case "record_user_approval": {
-			if (record.lifecycle !== "active" || record.artifact_state !== "frozen")
-				throw new KernelInvariantError([
-					`cannot record user approval while state is ${stateOf(record)}`,
-				]);
-			const approval = action.approval;
-			if (approval.kind !== "user")
-				throw new KernelInvariantError([
-					"record_user_approval requires kind user",
-				]);
-			if (!authorityAudit || authorityAudit.authority_kind !== "user")
-				throw new KernelInvariantError([
-					"record_user_approval requires user authority",
-				]);
-			if (approval.task_revision !== record.intent_snapshot.revision)
-				throw new KernelInvariantError(["approval task_revision must equal the current intent revision"]);
-			if (approval.intent_content_hash !== record.intent_ref.content_hash)
-				throw new KernelInvariantError(["approval intent_content_hash must equal the current intent hash"]);
-			if (approval.diff_hash !== diffHash)
-				throw new KernelInvariantError(["approval diff_hash must equal the action diff hash"]);
-			if (record.attestations.some((item) => item.id === approval.id))
-				throw new KernelInvariantError([
-					`attestations contains duplicate id ${approval.id}`,
-				]);
-			if (approval.review_revision)
-				throw new KernelInvariantError(["review_revision is only valid on review approvals"]);
-			record.attestations.push({ ...approval, acceptance_results: [] });
-			appendHistory(record, action, from, approval.id, authorityAudit);
-			break;
-		}
 		case "revise_intent":
 		case "approve_breaking_intent_revision": {
 			if (record.lifecycle !== "active")

package/plugins/immune-brain/runtime/kernel/types.ts

@@ -57,7 +57,6 @@ export type AssuranceObligation =
 	| "submit_assurance"
 	| "run_qa"
 	| "run_review"
-	| "authorize_user"
 	| "complete"
 	| "none";
 
@@ -276,7 +275,6 @@ export type TaskAction =
 	| (TaskActionBase & { type: "record_finding"; finding: TaskFinding })
 	| (TaskActionBase & { type: "resolve_finding"; finding_id: string })
 	| (TaskActionBase & { type: "record_approval"; approval: TaskApprovalV2 })
-	| (TaskActionBase & { type: "record_user_approval"; approval: TaskApprovalV2 })
 	| (TaskActionBase & {
 			type: "revise_intent";
 			next_intent: TaskIntentV1;

package/plugins/immune-brain/runtime/kernel/validation.ts

@@ -730,7 +730,6 @@ const ACTION_V2_TYPES = [
 	"record_finding",
 	"resolve_finding",
 	"record_approval",
-	"record_user_approval",
 	"revise_intent",
 	"approve_breaking_intent_revision",
 	"request_rework",
@@ -831,8 +830,7 @@ export function parseTaskAction(raw: unknown): TaskAction {
 			};
 			break;
 		}
-		case "record_approval":
-		case "record_user_approval": {
+		case "record_approval": {
 			rejectUnknown(
 				value,
 				[...ACTION_BASE_FIELDS, "approval"],

package/plugins/immune-brain/runtime/plugin_version.ts

@@ -0,0 +1,2 @@
+// Generated by scripts/plugin_versioning.ts from the root package.json.
+export const PLUGIN_VERSION = "3.4.0" as const;

package/plugins/immune-brain/skills/BASELINE.md

@@ -59,7 +59,7 @@ Require exact host confirmation only for privileged effects:
   override; and
 - external writes whose target or impact cannot be safely reversed locally.
 
-Routine Managed enrollment uses one host confirmation bound to the TaskIntent content hash at the Planner's final `ctx.ui.custom` gate. Enrollment validates intent, Git ownership, scope, workspace claim, and final authority preconditions without executing acceptance descriptors; deterministic QA executes them after implementation. The routine task proceeds from that single confirmation through enrollment, execution, and QA without a second human stop. Do not request confirmation for local in-scope edits, local verification, ordinary Direct rework, scoped diff review, or completion reporting. Managed evidence, QA, Review, and completion authority remain governed by their Managed contracts; R2 does not weaken them.
+Routine Managed enrollment uses one current-Host native confirmation bound to the TaskIntent content hash after Planner validation. Explicit Plan-only requests stop with candidate artifacts and do not invoke Enrollment; execution-bearing requests open the native gate directly without chat pre-confirmation. Enrollment validates intent, Git ownership, scope, workspace claim, and final authority preconditions without executing acceptance descriptors; deterministic QA executes them after implementation. The routine task proceeds from that single confirmation through enrollment, execution, and QA without a second human stop. Do not request confirmation for local in-scope edits, local verification, ordinary Direct rework, scoped diff review, or completion reporting. Managed evidence, QA, Review, and completion authority remain governed by their Managed contracts; R2 does not weaken them. Managed native-authority failures fail closed with one stable reason and exactly one same-Host recovery action; never offer a Pi, Direct Path, cross-Host/worktree, unmanaged, or automatic-retry fallback.
 
 ## Parallel Read-Only Dispatch
 

package/plugins/immune-brain/skills/imm-brainstorm/SKILL.md

@@ -64,3 +64,7 @@ collect completed child outputs, and feed them to
 background work, mutate state, or own final Spec/Plan authority.
 Agreement becomes framing evidence, Disagreement becomes decision criteria or
 `BR-Q-*`, and strong-model blockers become risks or verification requirements.
+
+When framing discusses later execution, describe Enrollment only as the current
+Host's native gate. Never recommend another Host, worktree, or unmanaged
+implementation as a fallback for a failed Managed authority interaction.

package/plugins/immune-brain/skills/imm-loop/SKILL.md

@@ -7,3 +7,7 @@ description: Use to run an enrolled TaskIntent to completion through Kernel-gove
 
 Load [`../../dist/imm-loop.md`](../../dist/imm-loop.md), then follow that
 canonical contract in the current host conversation.
+
+All Managed authority gates use the current Host's native interaction. A failed
+gate stays fail-closed and reports one same-Host recovery action; never suggest
+another Host, worktree, or unmanaged implementation as a fallback.

package/plugins/immune-brain/skills/imm-planner/SKILL.md

@@ -7,3 +7,9 @@ description: Use to create or revise a spec and TaskIntent from requirements; ow
 
 Load [`../../dist/imm-planner.md`](../../dist/imm-planner.md), then follow that
 canonical contract. `mode: page_design` selects its page-design branch.
+
+Plan-only requests stop after candidate Spec/TaskIntent validation. Requests that
+include execution invoke the current Host's native Enrollment gate directly,
+without chat pre-confirmation. Native-gate failure stays fail-closed in that Host:
+report its reason and one retry action only; never suggest another Host, worktree,
+or unmanaged implementation as a fallback.