immune-brain 3.3.0 → 3.5.0

package/plugins/immune-brain/dist/imm-brainstorm.md

@@ -103,7 +103,7 @@ Runtime helpers: `imm_core.buildBrainstormEnsembleRequest`, `imm_core.buildBrain
 
 A Brainstorm ensemble is optional advisory-only framing input, not a vote and not a child-owned decision. The default roles are clarify scope, divergent options, minimal solution, and risk review.
 
-All Brainstorm ensemble children are advisory-only with `tool_policy: no tools`; they do not edit code, write Specs, write Plans, mutate workflow state, or close QA. The parent `imm-brainstorm` owns final framing synthesis, Brainstorm manifest IDs, and decision-delta confirmation. Final Spec and Plan authority stays with `imm-planner`. Routine Managed enrollment uses the Planner's final `ctx.ui.custom` confirmation bound to the TaskIntent content hash as the single authority gate; Enrollment validates descriptor structure without executing acceptance descriptors, deterministic QA executes them after implementation, and the routine task proceeds without a second human stop.
+All Brainstorm ensemble children are advisory-only with `tool_policy: no tools`; they do not edit code, write Specs, write Plans, mutate workflow state, or close QA. The parent `imm-brainstorm` owns final framing synthesis, Brainstorm manifest IDs, and decision-delta confirmation. Final Spec and Plan authority stays with `imm-planner`. Routine Managed enrollment uses the current Host's native confirmation bound to the TaskIntent revision, content hash, and preparation digest as the single authority gate; Enrollment validates descriptor structure without executing acceptance descriptors, deterministic QA executes them after implementation, and the routine task proceeds without a second human stop. A later authority-gate failure stays fail-closed in the current Host and reports exactly one same-Host recovery action; Brainstorm must never recommend another Host, worktree, or unmanaged implementation as a fallback.
 
 Pi's adapter may consume `brainstorm_ensemble` dispatch JSON to prepare advisory Pi subagent envelopes, but envelope construction is not child execution and does not transfer framing authority. Pi launches one foreground Agent at a time, consumes its direct result, and re-evaluates the remaining dispatch budget before launching another candidate. Runtime does not call any agent, poll or recover background work, mutate state, or own final Spec/Plan authority. Pi subagent children remain no-tools advisory candidates; the parent `imm-brainstorm` collects outputs before synthesis.
 

package/plugins/immune-brain/dist/imm-loop.md

@@ -36,7 +36,7 @@ before any workflow mutation.
 
 ## Core Responsibilities
 
-- **Main-context completion loop**: Drive the enrolled Kernel task in the current Pi conversation until completion or a safe stop.
+- **Main-context completion loop**: Drive the enrolled Kernel task in the current Host conversation until completion or a safe stop.
 - **Context-preserving execution**: Call `imm_loop_action` with `op: route`, then follow the returned `executor` context in the current Parent conversation. Implement only the active Step or pending same-boundary `follow_up`, then record structured execution evidence through the Loop runtime action. A bounded test failure uses the returned internal `test-fixer` dispatch with its explicit delegated test-file list; PR feedback or CI repair uses the returned internal `pr-fix` dispatch inside the current Plan boundary.
 - **Independent authority isolation**: Use the host `Agent` subagent primitive for `awaiting_qa_decision` and for the exact runtime-reported review gate. Standard Plan Steps close from accepted passing evidence before an internal QA boundary exists; Strict Steps and all follow-ups retain isolated QA. The parent records accepted child decisions through the Loop runtime action.
 - **Observable progress**: Update only at major phase changes: Step start, execution evidence recorded, QA/review result, or terminal stop. Always emit a terminal summary.
@@ -67,6 +67,7 @@ Use Pi native `Agent` subagents. Do not spawn Pi child processes or invoke a sep
 - The parent may implement but must not issue its own QA or review pass.
 - QA and reviewer children must not edit files, write Plans, mutate Kernel state, or close decisions directly.
 - Missing `Agent` support, failed or malformed child output, stale child target, runtime write failure, invalid projection, missing credentials, unclear verification, repeated unchanged failure, or user cancellation stops fail-closed with an explicit reason and no decision write.
+- A Managed native authority failure reports its stable reason and exactly one same-Host recovery action. Never recommend another Host, worktree, Direct Path, unmanaged implementation, or automatic retry as a fallback.
 - `replan_needed` stops at `imm-planner`; do not widen scope or rewrite the active Plan. A replacement must use a new sequential Plan path after the current Plan reaches `completed`, or after a literal user explicitly marks it `cancelled` or `superseded`.
 - Plans never suspend, resume, queue, or execute in parallel. Do not insert a repair Plan ahead of the current Plan.
 - Same-boundary review `follow_up` repeats execution, independent QA, and the originating review gate.
@@ -139,12 +140,12 @@ Default user-facing shape: checkpoint progress lines, then `Conclusion -> Eviden
 ## Kernel Canary Routing
 
 When the Kernel projection reports an active/draining backend claim, keep
-`imm-loop` as the user-facing entry and call the `imm_kernel_canary` Tool for
-that owned task. Enrollment uses the `imm_canary_enrollment` Tool and Review
-authorization remains a native TUI gate. When the projection calls for
-`request_authorization` or `approve_breaking_intent_revision`, invoke the exact
-Tool operation directly without asking the user for chat pre-confirmation; the
-native host interaction is the single authority decision. Invoke
+`imm-loop` as the user-facing entry and call the current Host's Kernel integration
+for that owned task. Enrollment and Review authorization use the current Host's
+native gates. When the projection calls for `request_authorization` or
+`approve_breaking_intent_revision`, invoke the exact Tool operation directly
+without asking the user for chat pre-confirmation; the native Host interaction is
+the single authority decision. Invoke
 `repair_authority_state` directly for a proven stale claim; Kernel revalidation
 removes only the redundant claim without user interaction. Do not invoke the
 removed `imm-canary-work` Skill as

package/plugins/immune-brain/dist/imm-planner.md

@@ -22,9 +22,12 @@ planning artifacts. A later literal-user request to start Enrollment is a
 non-authoritative execution trigger: invoke the native Enrollment gate directly,
 without asking for chat pre-confirmation. For a clear mutation request that
 already includes execution, invoke that gate as soon as the candidate is
-validated and Git-tracked. Literal-user confirmation in the native gate remains
-the authority boundary. Fast-Track may compress the same phases but cannot
-bypass that boundary, QA, Review, authorization, or completion.
+validated and Git-tracked. Literal-user confirmation in the current Host's
+native gate remains the authority boundary. A gate failure preserves candidate
+artifacts and reports its reason plus exactly one same-Host recovery action; it
+must never recommend another Host, worktree, Direct Path, unmanaged
+implementation, or automatic retry. Fast-Track may compress the same phases but
+cannot bypass that boundary, QA, Review, authorization, or completion.
 
 ## Clarification supplement
 
@@ -73,7 +76,7 @@ Then route deterministically:
 - an active or otherwise nonterminal v3 Plan remains on its existing v3 route;
 - no routing policy preserves the legacy v3 Planner behavior;
 - a valid `kernel_task_intent` retirement policy produces one TaskIntent draft
-  through Pi `imm-planner`;
+  through the current Host's explicit `imm-planner`;
 - an invalid, unreadable, untracked, or tracked-deleted policy rejects new
   planning authority with `routing_policy_invalid`;
 - no Planner path enrolls a task or falls back to v3 after retirement.
@@ -90,17 +93,18 @@ The routing projection selects the planning route; explicit
 of that Plan artifact. A valid Plan never proves Managed authority. Under an
 active `kernel_task_intent` policy, authority still requires a Git-tracked
 TaskIntent whose `imm-kernel intent validate <path> --json` projection is
-`valid: true` and `enrollment_ready: true`, followed by Pi TUI enrollment.
-
-Pi host identity is implicit and never a planning input. The production boundary
-that turns a Git-tracked TaskIntent draft into managed execution authority is the
-native host TUI: the Planner's final `ctx.ui.custom` gate (via the
-`imm_canary_enrollment` foreground Tool) provides one literal-user confirmation
-bound to the TaskIntent content hash. Invoke the Tool directly when the route is
-ready; do not ask for a chat pre-confirmation. Enrollment validates the intent,
-Git ownership, scope, workspace claim, and final authority preconditions without
-executing acceptance descriptors. A routine task proceeds from that single
-confirmation through enrollment, execution and QA without a second human stop.
+`valid: true` and `enrollment_ready: true`, followed by current-Host native
+Enrollment.
+
+Host identity is implicit and never a planning input. The production boundary
+that turns a Git-tracked TaskIntent draft into managed execution authority is
+the current Host's native Enrollment gate. Invoke that Host integration
+directly when the route is ready; do not ask for chat pre-confirmation. The
+single literal-user decision is bound to the TaskIntent revision, content hash,
+and preparation digest. Enrollment validates the intent, Git ownership, scope,
+workspace claim, and final authority preconditions without executing acceptance
+descriptors. A routine task proceeds from that single confirmation through
+enrollment, execution and QA without a second human stop.
 
 Before authoring a TaskIntent, trace each expected behavior from its public or
 runtime entry point through existing imports and callers to the highest focused
@@ -387,10 +391,11 @@ Iteration plan under `docs/plans/` and spec under `docs/specs/`. Includes: `Summ
 - When a project explicitly expects Chinese document prose, `imm-plan <plan-path> --json` includes an `output_language` warning if target Plan or referenced Spec prose appears mostly English.
 - Spec references align with steps: each step’s `Verification` is copy-paste-checkable against repo commands or files.
 - For brainstorm-origin Plans with a manifest, `imm-plan <plan-path> --json` reports `origin_coverage` totals with no `unmapped_items` and no reason-required trace rows without reasons.
-- Managed execution handoff is Git-tracked TaskIntent author/validate plus Pi TUI enrollment. Do not sync a v3 State Ledger or invoke a missing dispatcher.
+- Managed execution handoff is Git-tracked TaskIntent author/validate plus current-Host native Enrollment. Do not sync a v3 State Ledger or invoke a missing dispatcher.
 
 ## Next Action
 
 - Gate: Reference closure and the clarification supplement are complete; every upstream `BR-*` item is represented; no unresolved user-owned decision remains; any Planner-introduced decision delta is confirmed; the Plan passes `imm-plan --json` validation; and no step has a hypothetical-only verification path.
-- If gates pass: for Kernel-managed work, invoke the `imm_canary_enrollment` Tool directly without chat pre-confirmation. Its native `ctx.ui.custom` gate provides the single literal-user confirmation bound to the TaskIntent content hash, validates Enrollment preconditions without executing acceptance descriptors, and enrolls the task to continue through `imm-loop`.
+- If gates pass: for Kernel-managed work, invoke the current Host's native Enrollment Tool directly without chat pre-confirmation. Its single literal-user gate binds the TaskIntent revision, content hash, and preparation digest, validates Enrollment preconditions without executing acceptance descriptors, and enrolls the task to continue through `imm-loop`.
+- If the native gate fails: preserve candidate artifacts and report the stable reason plus exactly one same-Host recovery action. Do not suggest another Host, worktree, Direct Path, unmanaged implementation, or automatic retry.
 - If gates are not met: state which validation failures, unresolved verification paths, or material decision deltas remain; do not name a next skill.

package/plugins/immune-brain/hooks/hooks.json

@@ -31,16 +31,6 @@
         ]
       }
     ],
-    "ElicitationResult": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/dist/claude/mcp-server.mjs\" --hook"
-          }
-        ]
-      }
-    ],
     "SessionEnd": [
       {
         "hooks": [

package/plugins/immune-brain/runtime/assurance/coordinator.ts

@@ -559,7 +559,13 @@ export class AssuranceCoordinator {
 				ensureOperationLive();
 				qaVerdict = await this.ports.runQa(assurance.snapshot, assurance.descriptors, runner, {
 					signal: operationController.signal,
-					onProgress: (item) => progress("verifying", `QA ${item.index}/${item.total} ${item.acceptance_id} ${item.phase}`, { current: item.index, total: item.total, acceptance_id: item.acceptance_id }),
+					onProgress: (item) => progress("verifying", `QA ${item.index}/${item.total} ${item.acceptance_id} ${item.phase}`, {
+						current: item.index,
+						total: item.total,
+						acceptance_id: item.acceptance_id,
+						acceptance_phase: item.phase,
+						elapsed_ms: item.elapsed_ms,
+					}),
 				});
 				ensureOperationLive();
 				const invocation = this.openInvocation(taskId);

package/plugins/immune-brain/runtime/claude/capability.ts

@@ -1,4 +1,4 @@
-export const MIN_CLAUDE_CODE_VERSION = "2.1.199";
+export const MIN_CLAUDE_CODE_VERSION = "2.1.236";
 export const HOST_ID = "claude-code" as const;
 export const CORE_CONTRACT = "assurance_kernel/host_adapter/claude-code/v1";
 export const SUPPORTED_PLATFORMS = ["darwin", "linux"] as const;
@@ -6,12 +6,12 @@ export const SUPPORTED_PLATFORMS = ["darwin", "linux"] as const;
 export type PermissionMode = "manual" | "acceptEdits" | "auto" | "bypassPermissions" | "dontAsk";
 
 export type HostProbe =
-	| { ok: true; version: string; permissionMode: PermissionMode; platform: string }
+	| { ok: true; version: string; platform: string }
 	| { ok: false; reason: string };
 
 function parseSemver(value: string): [number, number, number] | null {
 	// Prerelease and build suffixes are rejected: an unstable build such as
-	// 2.1.199-alpha never satisfies the stable minimum.
+	// Prerelease builds never satisfy the stable minimum.
 	const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(value.trim());
 	if (!match) return null;
 	return [Number(match[1]), Number(match[2]), Number(match[3])];
@@ -57,11 +57,5 @@ export function probeHost(
 	if (platform !== "darwin" && platform !== "linux") {
 		return { ok: false, reason: `unsupported platform ${platform}; native Windows is out of scope` };
 	}
-	const rawPermissionMode = env.CLAUDE_CODE_PERMISSION_MODE;
-	if (rawPermissionMode !== undefined && rawPermissionMode !== "") {
-		const permissionMode = parsePermissionMode(rawPermissionMode);
-		if (!permissionMode) return { ok: false, reason: `unsupported permission mode ${rawPermissionMode}` };
-		return { ok: true, version, permissionMode, platform };
-	}
-	return { ok: true, version, permissionMode: "manual", platform };
+	return { ok: true, version, platform };
 }

package/plugins/immune-brain/runtime/claude/interaction.ts

@@ -1,5 +1,4 @@
 import { createHash, randomUUID } from "node:crypto";
-import { parsePermissionMode, type PermissionMode } from "./capability";
 
 export const PRIVILEGED_OPERATIONS = [
 	"enroll",
@@ -9,49 +8,84 @@ export const PRIVILEGED_OPERATIONS = [
 ] as const;
 
 export type PrivilegedOperation = (typeof PRIVILEGED_OPERATIONS)[number];
-export type NativeDecision = "accept" | "deny" | "cancel";
+export type NativeDecision = "accept" | "decline" | "cancel";
+export type NativeFailureCode =
+	| "interaction_not_opened"
+	| "user_denied"
+	| "user_cancelled"
+	| "correlation_missing"
+	| "unsupported_host"
+	| "workspace_changed";
+
+const RECOVERY_ACTIONS: Record<NativeFailureCode, string> = {
+	interaction_not_opened: "retry through a fresh native gate in the current Host",
+	user_denied: "wait for a fresh literal-user request",
+	user_cancelled: "wait for a fresh literal-user request",
+	correlation_missing: "retry through a fresh native gate in the current Host",
+	unsupported_host: "upgrade to a supported Claude Code version and retry in the current Host",
+	workspace_changed: "review the current workspace and retry through a fresh native gate",
+};
+
+export class NativeAuthorityError extends Error {
+	constructor(
+		readonly reasonCode: NativeFailureCode,
+		detail: string,
+		readonly recoveryAction = RECOVERY_ACTIONS[reasonCode],
+	) {
+		super(`${reasonCode}: ${detail}; recovery: ${recoveryAction}`);
+		this.name = "NativeAuthorityError";
+	}
+}
 
 export function isPrivilegedOperation(operation: string): operation is PrivilegedOperation {
 	return (PRIVILEGED_OPERATIONS as readonly string[]).includes(operation);
 }
 
 export function privilegedAnnotations(): Record<string, unknown> {
-	return {
-		destructiveHint: true,
-		"anthropic/requiresUserInteraction": true,
-	};
+	return { destructiveHint: true };
 }
 
 export interface NativeGateInput {
 	operation: string;
-	permissionMode: PermissionMode | string;
-	requiresUserInteraction: boolean;
 	interactive: boolean;
 	decision?: NativeDecision;
 }
 
 export type NativeGateResult =
 	| { ok: true }
-	| { ok: false; reason: string };
+	| { ok: false; error: NativeAuthorityError };
 
 export function evaluateNativeGate(input: NativeGateInput): NativeGateResult {
 	if (!isPrivilegedOperation(input.operation)) return { ok: true };
-	if (!input.interactive) return { ok: false, reason: "non-interactive execution cannot mint authority" };
-	const mode = parsePermissionMode(input.permissionMode);
-	if (!mode) return { ok: false, reason: `unsupported permission mode ${String(input.permissionMode)}` };
-	if (mode === "dontAsk") return { ok: false, reason: "dontAsk cannot mint authority" };
-	if (!input.requiresUserInteraction) {
-		return { ok: false, reason: "privileged operation requires anthropic/requiresUserInteraction" };
-	}
-	if (input.decision === "deny") return { ok: false, reason: "native interaction denied" };
-	if (input.decision === "cancel") return { ok: false, reason: "native interaction cancelled" };
-	if (input.decision !== "accept") return { ok: false, reason: "native interaction missing" };
+	if (!input.interactive) return { ok: false, error: new NativeAuthorityError("unsupported_host", "interactive MCP elicitation is unavailable") };
+	if (input.decision === "decline") return { ok: false, error: new NativeAuthorityError("user_denied", "native interaction declined") };
+	if (input.decision === "cancel") return { ok: false, error: new NativeAuthorityError("user_cancelled", "native interaction cancelled") };
+	if (input.decision !== "accept") return { ok: false, error: new NativeAuthorityError("interaction_not_opened", "native interaction returned no decision") };
 	return { ok: true };
 }
 
+export interface NativeConfirmationInput {
+	operation: PrivilegedOperation;
+	taskId: string;
+	toolCallId: string;
+	risk?: string;
+	intentRevision?: number;
+	intentContentHash?: string;
+	bindingDigest?: string;
+	signal?: AbortSignal;
+}
+
+export interface NativeConfirmationResult {
+	decision: NativeDecision;
+	requestId: string;
+}
+
+export type NativeConfirmationPort = (input: NativeConfirmationInput) => Promise<NativeConfirmationResult>;
+
 export function confirmationRef(input: {
-	sessionId: string;
+	connectionId: string;
 	toolCallId: string;
+	requestId: string;
 	operation: string;
 	taskId: string;
 	intentRevision?: number;
@@ -59,7 +93,7 @@ export function confirmationRef(input: {
 	bindingDigest?: string;
 }): string {
 	return `claude-confirm-${createHash("sha256")
-		.update(`${input.sessionId}\0${input.toolCallId}\0${input.operation}\0${input.taskId}\0${input.intentRevision ?? ""}\0${input.intentContentHash ?? ""}\0${input.bindingDigest ?? ""}`)
+		.update(`${input.connectionId}\0${input.toolCallId}\0${input.requestId}\0${input.operation}\0${input.taskId}\0${input.intentRevision ?? ""}\0${input.intentContentHash ?? ""}\0${input.bindingDigest ?? ""}`)
 		.digest("hex")
 		.slice(0, 16)}`;
 }

package/plugins/immune-brain/runtime/claude/kernel_ports.ts

@@ -47,7 +47,14 @@ import { reconcileKernelAuthority, repairKernelAuthority } from "../kernel/stora
 import { preparePiCanary, revalidatePiCanary } from "../kernel/pi_canary_prepare";
 import { qaFindingId } from "../assurance/qa_findings";
 import { taskDiffIdentity, taskRevisionIdentity } from "../workspace_scope";
-import { confirmationRef, enrollmentNonce, evaluateNativeGate, isPrivilegedOperation, type NativeDecision } from "./interaction";
+import {
+	confirmationRef,
+	enrollmentNonce,
+	evaluateNativeGate,
+	isPrivilegedOperation,
+	NativeAuthorityError,
+	type NativeConfirmationPort,
+} from "./interaction";
 import { ClaudeReviewHost, FileHookEventLog, type ClaudeHookEvent } from "./review_host";
 import { probeHost, type PermissionMode } from "./capability";
 
@@ -311,6 +318,10 @@ async function mintCapability(
 	return registry.issue(binding);
 }
 
+function throwIfCancelled(signal?: AbortSignal): void {
+	if (signal?.aborted) throw new NativeAuthorityError("user_cancelled", "Tool call was cancelled");
+}
+
 export interface ClaudeRuntimeOptions {
 	cwd: string;
 	env?: Record<string, string | undefined>;
@@ -318,7 +329,7 @@ export interface ClaudeRuntimeOptions {
 	ports?: AssuranceCoordinatorPorts;
 	interactive?: boolean;
 	permissionMode?: PermissionMode;
-	decisions?: Map<string, NativeDecision>;
+	requestConfirmation?: NativeConfirmationPort;
 }
 
 export class ClaudeRuntime {
@@ -327,8 +338,7 @@ export class ClaudeRuntime {
 	private readonly cwd: string;
 	private readonly env: Record<string, string | undefined>;
 	private readonly interactive: boolean;
-	private readonly permissionMode: PermissionMode;
-	private readonly decisions: Map<string, NativeDecision>;
+	private requestConfirmation?: NativeConfirmationPort;
 	private hostVersion: string | undefined;
 	private mutationRegistry: MutationAuthorityRegistry | null = null;
 	private enrollmentRegistry = createEnrollmentAuthorityRegistry();
@@ -338,8 +348,7 @@ export class ClaudeRuntime {
 		this.cwd = options.cwd;
 		this.env = options.env ?? process.env;
 		this.interactive = options.interactive ?? true;
-		this.permissionMode = options.permissionMode ?? "manual";
-		this.decisions = options.decisions ?? new Map();
+		this.requestConfirmation = options.requestConfirmation;
 		this.host = options.host ?? new ClaudeReviewHost(new FileHookEventLog());
 		if (options.ports) {
 			this.coordinator = new AssuranceCoordinator({ ...options.ports, host: this.host });
@@ -357,6 +366,10 @@ export class ClaudeRuntime {
 		this.hostVersion = version || undefined;
 	}
 
+	bindNativeConfirmation(port: NativeConfirmationPort): void {
+		this.requestConfirmation = port;
+	}
+
 	async shutdown(): Promise<void> {
 		await this.coordinator.onSessionShutdown();
 	}
@@ -393,45 +406,28 @@ export class ClaudeRuntime {
 		return { registry: this.mutationRegistry, app: this.app };
 	}
 
-	private rejectBeforePreparation(operation: string, meta: ToolMeta): void {
-		// Zero-mutation fast path only: a configured deny/cancel rejects before
-		// any workspace preparation. The live accept elicitation is requested
-		// and consumed only after preparation computes the binding digests, so
-		// native confirmation is always bound to hashes computed before it.
-		const configured = this.decisions.get(operation) ?? meta.decision;
-		if (configured === "deny" || configured === "cancel") this.gate(operation, meta);
-	}
-
-	private gate(operation: string, meta: ToolMeta, binding: {
+	private async gate(operation: string, meta: ToolMeta, binding: {
+		risk?: string;
 		intentRevision?: number;
 		intentContentHash?: string;
 		bindingDigest?: string;
-	} = {}): { confirmation_ref: string } {
+	} = {}): Promise<{ confirmation_ref: string }> {
+		throwIfCancelled(meta.signal);
 		const probe = probeHost(this.env, process.platform, this.hostVersion);
-		if (!probe.ok) throw new Error(probe.reason);
-		const requiresUserInteraction = Boolean(meta.requiresUserInteraction);
-		const permissionMode = meta.permissionMode ?? this.permissionMode;
-		const configuredDecision = this.decisions.get(operation) ?? meta.decision;
-		const decision = configuredDecision ?? (
-			isPrivilegedOperation(operation)
-				&& Boolean(meta.interactive ?? this.interactive)
-				&& requiresUserInteraction
-				&& permissionMode !== "dontAsk"
-				? this.host.takeConfirmation(meta.sessionId, meta.toolCallId)
-				: undefined
-		);
-		const gate = evaluateNativeGate({
-			operation,
-			permissionMode,
-			requiresUserInteraction,
-			interactive: meta.interactive ?? this.interactive,
-			decision,
-		});
-		if (!gate.ok) throw new Error(gate.reason);
+		if (!probe.ok) throw new NativeAuthorityError("unsupported_host", probe.reason);
+		const interactive = meta.interactive ?? this.interactive;
+		if (!interactive) throw new NativeAuthorityError("unsupported_host", "interactive MCP elicitation is unavailable");
+		if (!isPrivilegedOperation(operation)) throw new Error(`unsupported native operation ${operation}`);
+		if (!this.requestConfirmation) throw new NativeAuthorityError("interaction_not_opened", "native confirmation port is unavailable");
+		const result = await this.requestConfirmation({ operation, taskId: meta.taskId, toolCallId: meta.toolCallId, signal: meta.signal, ...binding });
+		throwIfCancelled(meta.signal);
+		const gate = evaluateNativeGate({ operation, interactive, decision: result.decision });
+		if (!gate.ok) throw gate.error;
 		return {
 			confirmation_ref: confirmationRef({
-				sessionId: meta.sessionId,
+				connectionId: meta.sessionId,
 				toolCallId: meta.toolCallId,
+				requestId: result.requestId,
 				operation,
 				taskId: meta.taskId,
 				...binding,
@@ -444,17 +440,19 @@ export class ClaudeRuntime {
 	}
 
 	async enroll(taskId: string, meta: ToolMeta) {
-		this.rejectBeforePreparation("enroll", { ...meta, taskId });
 		const now = new Date().toISOString();
 		const preparation = await preparePiCanary(this.cwd, { task_id: taskId, now });
-		const gate = this.gate("enroll", { ...meta, taskId }, {
+		const intent = await readTaskIntent(this.cwd, taskId);
+		const gate = await this.gate("enroll", { ...meta, taskId }, {
+			risk: intent.intent.risk,
 			intentRevision: preparation.intent?.revision,
 			intentContentHash: preparation.intent?.content_hash,
 			bindingDigest: preparation.digest,
 		});
 		const { unchanged } = await revalidatePiCanary(this.cwd, { task_id: taskId, now }, preparation);
-		if (!unchanged) throw new Error("Workspace changed after confirmation; enrollment aborted before authority");
+		if (!unchanged) throw new NativeAuthorityError("workspace_changed", "workspace changed after native confirmation");
 		if (!preparation.intent) throw new Error("enrollment requires a readable TaskIntent");
+		throwIfCancelled(meta.signal);
 		const nonce = enrollmentNonce();
 		const binding: EnrollmentCapabilityBinding = {
 			task_id: taskId,
@@ -501,7 +499,6 @@ export class ClaudeRuntime {
 			return repairKernelAuthority(this.cwd, taskId, authority.revision);
 		}
 		if (!isPrivilegedOperation(operation) && operation !== "request_authorization") throw new Error(`unsupported privileged operation ${operation}`);
-		this.rejectBeforePreparation(operation, { ...meta, taskId });
 		let op = operation;
 		let decisionOp: { finding_id: string; resolution: string } | undefined;
 		const projection = await this.status(taskId);
@@ -562,15 +559,22 @@ export class ClaudeRuntime {
 				writeFileSync(sidecar, `${JSON.stringify(nextIntent, null, 2)}\n`);
 				execFileSync("git", ["add", "--", priorIntent.intent_ref.path], { cwd: this.cwd, stdio: ["ignore", "pipe", "pipe"] });
 				const preparedRecord = await readTaskRecord(this.cwd, taskId);
-				if (!preparedRecord.record) throw new Error("TaskRecord changed before the breaking revision digest");
+				if (!preparedRecord.record) {
+					throw new NativeAuthorityError("workspace_changed", "TaskRecord changed before the breaking revision digest");
+				}
 				preparedDiffHash = diffHashOf(this.cwd, preparedRecord.record);
 			}
 			const preparedProjection = await this.status(taskId);
-			assertProjectionBinding(projection, preparedProjection, Boolean(nextIntent));
-			if (preparedProjection.projection.diff_hash !== preparedDiffHash) {
-				throw new Error("Workspace changed while preparing the authority digest");
+			try {
+				assertProjectionBinding(projection, preparedProjection, Boolean(nextIntent));
+				if (preparedProjection.projection.diff_hash !== preparedDiffHash) {
+					throw new Error("workspace changed while preparing the authority digest");
+				}
+			} catch (error) {
+				throw new NativeAuthorityError("workspace_changed", error instanceof Error ? error.message : String(error));
 			}
-			gate = this.gate(operation, { ...meta, taskId }, {
+			gate = await this.gate(operation, { ...meta, taskId }, {
+				risk: projection.projection.risk,
 				intentRevision: nextIntent?.revision ?? projection.projection.intent_revision,
 				intentContentHash: nextIntentHash ?? projection.projection.intent_content_hash,
 				bindingDigest: `${preparedDiffHash}:${nextIntentHash ?? ""}`,
@@ -588,11 +592,16 @@ export class ClaudeRuntime {
 		const confirmation = gate.confirmation_ref;
 		try {
 			const capabilityProjection = await this.status(taskId);
-			assertProjectionBinding(projection, capabilityProjection, Boolean(nextIntent));
+			try {
+				assertProjectionBinding(projection, capabilityProjection, Boolean(nextIntent));
+			} catch (error) {
+				throw new NativeAuthorityError("workspace_changed", error instanceof Error ? error.message : String(error));
+			}
 			const operationDiffHash = capabilityProjection.projection.diff_hash;
 			if (nextIntent && operationDiffHash !== preparedDiffHash) {
-				throw new Error("Workspace changed after native confirmation; authority aborted before capability issuance");
+				throw new NativeAuthorityError("workspace_changed", "workspace changed after native confirmation");
 			}
+			throwIfCancelled(meta.signal);
 			const capability = await mintCapability(registry, {
 				authority_kind: "user",
 				task_id: taskId,
@@ -608,6 +617,7 @@ export class ClaudeRuntime {
 				...(op === "resolve_user_decision" && decisionOp ? decisionOp : {}),
 				...(op === "stop" ? { reason: extra.reason ?? "user stop" } : {}),
 			});
+			throwIfCancelled(meta.signal);
 			const result = app.execute({
 				root: this.cwd,
 				task_id: taskId,
@@ -765,6 +775,5 @@ export interface ToolMeta {
 	requiresUserInteraction?: boolean;
 	permissionMode?: PermissionMode;
 	interactive?: boolean;
-	decision?: NativeDecision;
 	signal?: AbortSignal;
 }