immune-brain 3.6.0 → 3.6.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "3.6.0",
+  "version": "3.6.2",
   "description": "Immune-Brain agent skill system",
   "publishConfig": {
     "access": "public",

package/plugins/immune-brain/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "3.6.0",
+  "version": "3.6.2",
   "description": "Immune-Brain Claude Code Host: native Enrollment, QA, Review, and Kernel settlement.",
   "author": {
     "name": "Immune-Brain Team"

package/plugins/immune-brain/.pi-extension/imm-canary-enroll.ts

@@ -381,7 +381,11 @@ async function executeForegroundEnrollment(
 			taskIntent = await readTaskIntent(root, taskId);
 		} catch (error) {
 			const message = errorMessage(error);
-			if (/not Git-tracked|ENOENT|no such file/i.test(message))
+			// `readTaskIntent` reports an absent sidecar semantically now, so the
+			// "missing" classification must recognise that wording as well as the raw
+			// filesystem errors; otherwise a missing file is misreported as a schema
+			// defect and the operator is told to repair fields that do not exist.
+			if (/not Git-tracked|ENOENT|no such file|sidecar is missing/i.test(message))
 				return terminal(action, taskId, "blocked", stage, "A Git-tracked TaskIntent is required for Kernel enrollment", "author and stage the canonical TaskIntent");
 			return terminal(action, taskId, "blocked", stage, `TaskIntent validation failed before rehearsal: ${message}`, "repair the reported TaskIntent schema errors");
 		}

package/plugins/immune-brain/dist/claude/mcp-server.mjs

@@ -42,7 +42,7 @@ function probeHost(env = process.env, platform = process.platform, hostVersion)
 }
 
 // plugins/immune-brain/runtime/plugin_version.ts
-var PLUGIN_VERSION = "3.6.0";
+var PLUGIN_VERSION = "3.6.2";
 
 // plugins/immune-brain/runtime/claude/interaction.ts
 import { createHash, randomUUID } from "node:crypto";
@@ -1001,13 +1001,20 @@ function roleSpec(role) {
     throw new Error(`unknown internal role: ${String(role)}`);
   return spec;
 }
+function rolePromptSearchDirs(moduleDir) {
+  return [
+    join3(moduleDir, "..", "dist", "role-prompts"),
+    join3(moduleDir, "..", "role-prompts")
+  ];
+}
 function loadRolePrompt(role) {
   const spec = roleSpec(role);
-  const path = join3(RUNTIME_DIR, "..", "dist", "role-prompts", spec.file);
-  if (!existsSync(path)) {
-    throw new Error(`internal role prompt is not packaged: ${role}`);
+  for (const dir of rolePromptSearchDirs(RUNTIME_DIR)) {
+    const path = join3(dir, spec.file);
+    if (existsSync(path))
+      return readFileSync(path, "utf8");
   }
-  return readFileSync(path, "utf8");
+  throw new Error(`internal role prompt is not packaged: ${role}`);
 }
 function buildRoleDelegationPacket(input) {
   const spec = roleSpec(input.role);
@@ -1289,6 +1296,7 @@ class AssuranceCoordinator {
     this.rejectedReviewOperations.delete(taskId);
     let authorityCommitted = false;
     let authorityBoundaryStarted = false;
+    let boundaryBaseline = null;
     let reviewPreparationStarted = false;
     let phase = "preparing";
     const operationLive = () => this.sessionActive && this.sessionGeneration === operationGeneration && this.activeOperations.get(taskId) === operationId && !operationController.signal.aborted;
@@ -1340,6 +1348,7 @@ class AssuranceCoordinator {
         if (aborted())
           return this.cancelled("qa", operationId, "host cancellation before artifact freeze");
         progress("freezing_artifacts", "Freezing planning artifacts for deterministic assurance");
+        boundaryBaseline = projection.projection.record_revision;
         const freeze = this.ports.applyOrdinaryOperation(ctx, { taskId, operation: { op: "freeze_artifacts", actor_id: "executor" } });
         authorityBoundaryStarted = true;
         await freeze;
@@ -1349,13 +1358,17 @@ class AssuranceCoordinator {
         if (projection.error || projection.projection.lifecycle !== "active" || projection.projection.artifact_state !== "frozen")
           return this.unknownAfterCommit(taskId, "qa", operationId, projection.error ?? "artifact freeze did not settle");
         authorityBoundaryStarted = false;
+        boundaryBaseline = null;
       }
       if (projection.projection.next_obligation === "complete") {
         progress("completing", "Completing the routine task after deterministic QA");
+        const completionBaseline = projection.projection.record_revision;
         try {
           await this.ports.applyOrdinaryOperation(ctx, { taskId, operation: { op: "complete", actor_id: "kernel-assurance" } });
           return { state: "completed" };
         } catch (error) {
+          if (await this.mutationProvablyRejected(ctx, taskId, completionBaseline))
+            return { state: "failed", operation: "qa", operation_id: operationId, reason: `${phase}: ${boundedAssuranceError(error)}` };
           return this.unknownAfterCommit(taskId, "qa", operationId, boundedAssuranceError(error));
         }
       }
@@ -1527,8 +1540,12 @@ class AssuranceCoordinator {
         const reason = aborted() || error instanceof VerificationAbortedError ? `${phase}: host cancellation` : `${phase}: ${boundedAssuranceError(error)}`;
         return this.reviewPreparationFailed(taskId, operationId, reason);
       }
-      if (authorityCommitted || authorityBoundaryStarted)
+      if (authorityCommitted || authorityBoundaryStarted) {
+        const cancelling = aborted() || error instanceof VerificationAbortedError;
+        if (!authorityCommitted && boundaryBaseline !== null && !cancelling && await this.mutationProvablyRejected(ctx, taskId, boundaryBaseline))
+          return { state: "failed", operation: "qa", operation_id: operationId, reason: `${phase}: ${boundedAssuranceError(error)}` };
         return this.unknownAfterCommit(taskId, "qa", operationId, `${phase}: ${boundedAssuranceError(error)}`);
+      }
       if (aborted() || error instanceof VerificationAbortedError)
         return this.cancelled("qa", operationId, `${phase}: host cancellation`);
       return { state: "failed", operation: "qa", operation_id: operationId, reason: `${phase}: ${boundedAssuranceError(error)}` };
@@ -1665,6 +1682,14 @@ class AssuranceCoordinator {
     this.rejectedReviewOperations.delete(taskId);
     return { state: "review_preparation_failed", operation: "review", operation_id: operationId, reason };
   }
+  async mutationProvablyRejected(ctx, taskId, baselineRevision) {
+    try {
+      const fresh = await this.ports.projectTask(ctx.cwd, taskId);
+      return !fresh.error && fresh.projection.record_revision === baselineRevision;
+    } catch {
+      return false;
+    }
+  }
   unknownAfterCommit(taskId, operation, operationId, reason) {
     this.unknownOperations.set(taskId, { operation, operationId, reason });
     return { state: "settlement_unknown", operation, operation_id: operationId, reason };
@@ -2916,6 +2941,21 @@ function resolveCanonicalRoot(root) {
     throw new Error("project root must be a real directory, not a symlink");
   return realpathSync4(resolved);
 }
+function resolveSidecarPath(canonicalRoot, activePath, archivedPath) {
+  if (sidecarPresent(canonicalRoot, activePath))
+    return activePath;
+  if (sidecarPresent(canonicalRoot, archivedPath))
+    return archivedPath;
+  return activePath;
+}
+function sidecarPresent(canonicalRoot, relativePath) {
+  try {
+    lstatSync4(join6(canonicalRoot, relativePath));
+    return true;
+  } catch {
+    return false;
+  }
+}
 function collectPathIdentities(canonicalRoot, relativePath) {
   const identities = [];
   let current = canonicalRoot;
@@ -2943,12 +2983,14 @@ function readTaskIntent(root, taskId, requestedPath) {
   const canonicalRoot = resolveCanonicalRoot(root);
   const activePath = `${INTENT_SIDECAR_RELATIVE_PREFIX}${taskId}.intent.json`;
   const archivedPath = `${INTENT_SIDECAR_RELATIVE_PREFIX}archive/${taskId}.intent.json`;
-  const sidecarPath = requestedPath ?? activePath;
+  const sidecarPath = requestedPath ?? resolveSidecarPath(canonicalRoot, activePath, archivedPath);
   if (sidecarPath !== activePath && sidecarPath !== archivedPath)
     throw new Error("intent sidecar path is not the active or archived task path");
   const target = join6(canonicalRoot, sidecarPath);
   if (!target.startsWith(canonicalRoot + sep3))
     throw new Error("intent sidecar escapes project root");
+  if (!sidecarPresent(canonicalRoot, sidecarPath))
+    throw new Error(`TaskIntent sidecar is missing at ${sidecarPath}`);
   const pathIdentities = collectPathIdentities(canonicalRoot, sidecarPath);
   const fileIdentity = pathIdentities[pathIdentities.length - 1];
   try {
@@ -6472,6 +6514,10 @@ function diffSnapshotOf(root, record) {
 function diffHashOf(root, record) {
   return diffSnapshotOf(root, record).diff_hash;
 }
+function readTaskIntentForRecord(root, taskId) {
+  const currentPath = readTaskRecordRaw(root, taskId).record?.intent_ref?.path;
+  return readTaskIntent(root, taskId, currentPath);
+}
 function extractVerdictJson(input) {
   if (typeof input === "string") {
     const cleaned = input.split(`
@@ -6674,7 +6720,7 @@ class ClaudeRuntime {
       host: this.host,
       projectTask: (root, taskId) => projectAssurance(root, taskId, diffSnapshotOf),
       readTaskRecord: (root, taskId) => readTaskRecord(root, taskId),
-      readTaskIntent: (root, taskId) => readTaskIntent(root, taskId),
+      readTaskIntent: (root, taskId) => readTaskIntentForRecord(root, taskId),
       frozenRunner: async () => resolveBunRunner(),
       buildAssurance: (root, taskId, role, projection, runner) => buildAssuranceSnapshot(root, taskId, role, projection, runner),
       ensureReviewRevision: async (root, taskId, projection) => {
@@ -6735,7 +6781,7 @@ class ClaudeRuntime {
   async enroll(taskId, meta) {
     const now = new Date().toISOString();
     const preparation = await preparePiCanary(this.cwd, { task_id: taskId, now });
-    const intent = await readTaskIntent(this.cwd, taskId);
+    const intent = await readTaskIntentForRecord(this.cwd, taskId);
     const gate = await this.gate("enroll", { ...meta, taskId }, {
       risk: intent.intent.risk,
       intentRevision: preparation.intent?.revision,
@@ -6810,7 +6856,7 @@ class ClaudeRuntime {
         throw new Error(readiness.blocked ?? "no unique host-derived authorization operation");
       }
     }
-    const priorIntent = await readTaskIntent(this.cwd, taskId);
+    const priorIntent = await readTaskIntentForRecord(this.cwd, taskId);
     const now = new Date().toISOString();
     const actorId = "user";
     const nextIntent = extra.next_intent ? await parseTaskIntentV1(extra.next_intent) : undefined;
@@ -6937,7 +6983,7 @@ class ClaudeRuntime {
   }
   async applyVerdict(ctx, input) {
     const { registry, app } = await this.authority();
-    const priorIntentToken = (await readTaskIntent(ctx.cwd, input.taskId)).token;
+    const priorIntentToken = (await readTaskIntentForRecord(ctx.cwd, input.taskId)).token;
     const now = new Date().toISOString();
     const commitAndApply = async (apply) => {
       this.coordinator.commitInvocation(input.invocation);
@@ -7019,7 +7065,7 @@ class ClaudeRuntime {
   async executeOrdinary(ctx, input) {
     const { app } = await this.authority();
     const operation = input.operation.op === "revise_intent" ? { ...input.operation, next_intent: await parseTaskIntentV1(input.operation.next_intent) } : input.operation;
-    const priorIntent = await readTaskIntent(ctx.cwd, input.taskId);
+    const priorIntent = await readTaskIntentForRecord(ctx.cwd, input.taskId);
     const sidecar = join7(ctx.cwd, priorIntent.intent_ref.path);
     const priorBytes = operation.op === "revise_intent" ? readFileSync7(sidecar) : null;
     try {

package/plugins/immune-brain/dist/imm-loop.md

@@ -15,6 +15,15 @@ Host's `imm_kernel_canary` `status` first and verify the exact active backend
 claim, TaskIntent, and TaskRecord. Invalid or contradictory projections fail
 closed. A candidate TaskIntent is not Enrollment authority.
 
+Before the first Enrollment of a candidate TaskIntent, confirm the Planner
+returned `tracker_associated` for its Initiative. `tracker_projection_failed` or
+`awaiting_user_initiative_confirmation` blocks that Enrollment until the same
+complete carrier batch succeeds; report the stable carrier reason and its exact
+retry action instead of enrolling. A carrier command the Host refused, cancelled,
+or never ran is not a completed batch, and a later `imm-loop` entry does not
+clear it. This pre-Enrollment gate is distinct from the post-settlement tracker
+projection below, which never blocks the Loop.
+
 TaskIntent defines the goal, acceptance, and `scope_hint`; TaskRecord and the
 Kernel projection own lifecycle, artifact state, freshness, and next obligation.
 Conversation memory, GitHub Issues, and `CONTEXT.md` never override them.

package/plugins/immune-brain/runtime/assurance/coordinator.ts

@@ -470,6 +470,10 @@ export class AssuranceCoordinator {
 		this.rejectedReviewOperations.delete(taskId);
 		let authorityCommitted = false;
 		let authorityBoundaryStarted = false;
+		// Record revision observed immediately before an in-flight ordinary
+		// mutation, so a rejected precondition can be proven to have written
+		// nothing instead of being reported as an unknown settlement.
+		let boundaryBaseline: string | null = null;
 		let reviewPreparationStarted = false;
 		let phase = "preparing";
 		const operationLive = () => this.sessionActive
@@ -519,6 +523,7 @@ export class AssuranceCoordinator {
 					return { state: "blocked", reason: `Kernel requires ${projection.projection.next_obligation}` };
 				if (aborted()) return this.cancelled("qa", operationId, "host cancellation before artifact freeze");
 				progress("freezing_artifacts", "Freezing planning artifacts for deterministic assurance");
+				boundaryBaseline = projection.projection.record_revision;
 				const freeze = this.ports.applyOrdinaryOperation(ctx, { taskId, operation: { op: "freeze_artifacts", actor_id: "executor" } });
 				authorityBoundaryStarted = true;
 				await freeze;
@@ -530,13 +535,17 @@ export class AssuranceCoordinator {
 				// The freeze outcome is proven by the re-projection above, so later
 				// read-only preparation failures are never a committed-authority mystery.
 				authorityBoundaryStarted = false;
+				boundaryBaseline = null;
 			}
 			if (projection.projection.next_obligation === "complete") {
 				progress("completing", "Completing the routine task after deterministic QA");
+				const completionBaseline = projection.projection.record_revision;
 				try {
 					await this.ports.applyOrdinaryOperation(ctx, { taskId, operation: { op: "complete", actor_id: "kernel-assurance" } });
 					return { state: "completed" };
 				} catch (error) {
+					if (await this.mutationProvablyRejected(ctx, taskId, completionBaseline))
+						return { state: "failed", operation: "qa", operation_id: operationId, reason: `${phase}: ${boundedAssuranceError(error)}` };
 					return this.unknownAfterCommit(taskId, "qa", operationId, boundedAssuranceError(error));
 				}
 			}
@@ -701,7 +710,18 @@ export class AssuranceCoordinator {
 					: `${phase}: ${boundedAssuranceError(error)}`;
 				return this.reviewPreparationFailed(taskId, operationId, reason);
 			}
-			if (authorityCommitted || authorityBoundaryStarted) return this.unknownAfterCommit(taskId, "qa", operationId, `${phase}: ${boundedAssuranceError(error)}`);
+			if (authorityCommitted || authorityBoundaryStarted) {
+				// An in-flight mutation is genuinely unknown only when the authority
+				// state cannot be proven. A Kernel precondition rejection — a missing
+				// scope-bound Spec, for example — writes nothing, and reporting it as
+				// `settlement_unknown` sends the Loop into a reconciling retry that
+				// can never change the outcome.
+				const cancelling = aborted() || error instanceof VerificationAbortedError;
+				if (!authorityCommitted && boundaryBaseline !== null && !cancelling
+					&& await this.mutationProvablyRejected(ctx, taskId, boundaryBaseline))
+					return { state: "failed", operation: "qa", operation_id: operationId, reason: `${phase}: ${boundedAssuranceError(error)}` };
+				return this.unknownAfterCommit(taskId, "qa", operationId, `${phase}: ${boundedAssuranceError(error)}`);
+			}
 			if (aborted() || error instanceof VerificationAbortedError) return this.cancelled("qa", operationId, `${phase}: host cancellation`);
 			return { state: "failed", operation: "qa", operation_id: operationId, reason: `${phase}: ${boundedAssuranceError(error)}` };
 		} finally {
@@ -835,6 +855,24 @@ export class AssuranceCoordinator {
 		return { state: "review_preparation_failed", operation: "review", operation_id: operationId, reason };
 	}
 
+	/**
+	 * Prove that a failed ordinary mutation wrote nothing.
+	 *
+	 * Re-reads the projection once and compares the record revision with the one
+	 * observed immediately before the mutation. An unchanged revision means the
+	 * Kernel rejected a precondition, which is a deterministic failure the caller
+	 * must act on — not an unknown settlement to reconcile. Any read failure or
+	 * drift stays unknown, so the conservative answer is the default.
+	 */
+	private async mutationProvablyRejected(ctx: HostContext, taskId: string, baselineRevision: string): Promise<boolean> {
+		try {
+			const fresh = await this.ports.projectTask(ctx.cwd, taskId);
+			return !fresh.error && fresh.projection.record_revision === baselineRevision;
+		} catch {
+			return false;
+		}
+	}
+
 	private unknownAfterCommit(taskId: string, operation: "qa" | "review", operationId: string, reason: string): AssuranceAdvanceResult {
 		this.unknownOperations.set(taskId, { operation, operationId, reason });
 		return { state: "settlement_unknown", operation, operation_id: operationId, reason };

package/plugins/immune-brain/runtime/claude/kernel_ports.ts

@@ -26,7 +26,7 @@ import {
 import { parseVerificationDescriptor } from "../verification_descriptor";
 import { projectAssurance, type AssuranceProjectionResult } from "../kernel/assurance_projection";
 import type { TaskRecord } from "../kernel/types";
-import { readTaskRecord } from "../kernel/storage";
+import { readTaskRecord, readTaskRecordRaw } from "../kernel/storage";
 import { canonicalIntentHash, parseTaskIntentV1, readTaskIntent } from "../kernel/intent";
 import { capabilityActionFor, createCanaryApplication } from "../kernel/canary_application";
 import {
@@ -70,6 +70,19 @@ export function diffHashOf(root: string, record: TaskRecord): string {
 	return diffSnapshotOf(root, record).diff_hash;
 }
 
+/**
+ * Read the TaskIntent through the TaskRecord's `intent_ref.path`.
+ *
+ * `freeze_artifacts` relocates the sidecar from `docs/plans/<task-id>.intent.json`
+ * into `docs/plans/archive/`, so every post-freeze read — QA settlement included —
+ * must follow the record instead of the pre-freeze default path. The Pi adapter
+ * resolves the same way in its own runtime stub; both Hosts must stay in step.
+ */
+function readTaskIntentForRecord(root: string, taskId: string) {
+	const currentPath = readTaskRecordRaw(root, taskId).record?.intent_ref?.path;
+	return readTaskIntent(root, taskId, currentPath);
+}
+
 function extractVerdictJson(input: unknown): Record<string, unknown> | null {
 	if (typeof input === "string") {
 		const cleaned = input.split("\n").map((line) => line.trim()).filter((line) => line.startsWith("{") && line.endsWith("}")).join("");
@@ -335,7 +348,7 @@ export class ClaudeRuntime {
 			host: this.host,
 			projectTask: (root, taskId) => projectAssurance(root, taskId, diffSnapshotOf),
 			readTaskRecord: (root, taskId) => readTaskRecord(root, taskId),
-			readTaskIntent: (root, taskId) => readTaskIntent(root, taskId),
+			readTaskIntent: (root, taskId) => readTaskIntentForRecord(root, taskId),
 			frozenRunner: async () => resolveBunRunner(),
 			buildAssurance: (root, taskId, role, projection, runner) => buildAssuranceSnapshot(root, taskId, role, projection, runner),
 			ensureReviewRevision: async (root, taskId, projection) => {
@@ -398,7 +411,7 @@ export class ClaudeRuntime {
 	async enroll(taskId: string, meta: ToolMeta) {
 		const now = new Date().toISOString();
 		const preparation = await preparePiCanary(this.cwd, { task_id: taskId, now });
-		const intent = await readTaskIntent(this.cwd, taskId);
+		const intent = await readTaskIntentForRecord(this.cwd, taskId);
 		const gate = await this.gate("enroll", { ...meta, taskId }, {
 			risk: intent.intent.risk,
 			intentRevision: preparation.intent?.revision,
@@ -476,7 +489,7 @@ export class ClaudeRuntime {
 				throw new Error(readiness.blocked ?? "no unique host-derived authorization operation");
 			}
 		}
-		const priorIntent = await readTaskIntent(this.cwd, taskId);
+		const priorIntent = await readTaskIntentForRecord(this.cwd, taskId);
 		const now = new Date().toISOString();
 		const actorId = "user";
 		const nextIntent = extra.next_intent ? await parseTaskIntentV1(extra.next_intent) : undefined;
@@ -614,7 +627,7 @@ export class ClaudeRuntime {
 		},
 	): Promise<void> {
 		const { registry, app } = await this.authority();
-		const priorIntentToken = (await readTaskIntent(ctx.cwd, input.taskId)).token;
+		const priorIntentToken = (await readTaskIntentForRecord(ctx.cwd, input.taskId)).token;
 		const now = new Date().toISOString();
 		const commitAndApply = async <T>(apply: () => Promise<T>): Promise<T> => {
 			this.coordinator.commitInvocation(input.invocation as never);
@@ -699,7 +712,7 @@ export class ClaudeRuntime {
 		const operation = input.operation.op === "revise_intent"
 			? { ...input.operation, next_intent: await parseTaskIntentV1(input.operation.next_intent) }
 			: input.operation;
-		const priorIntent = await readTaskIntent(ctx.cwd, input.taskId);
+		const priorIntent = await readTaskIntentForRecord(ctx.cwd, input.taskId);
 		const sidecar = join(ctx.cwd, priorIntent.intent_ref.path);
 		const priorBytes = operation.op === "revise_intent" ? readFileSync(sidecar) : null;
 		try {

package/plugins/immune-brain/runtime/kernel/intent.ts

@@ -463,6 +463,35 @@ function resolveCanonicalRoot(root: string): string {
 	return realpathSync(resolved);
 }
 
+// Resolve a path-less read to the sidecar that actually exists.
+//
+// The active path stays authoritative whenever it is present: that is the
+// pre-freeze layout every path-less caller assumes, and a leftover archived
+// sidecar from an earlier task reusing the same id must never shadow it. Only
+// when the active path is gone — the post-`freeze_artifacts` layout — does the
+// archive answer, which is exactly the case that used to fail with a raw ENOENT.
+function resolveSidecarPath(
+	canonicalRoot: string,
+	activePath: string,
+	archivedPath: string,
+): string {
+	if (sidecarPresent(canonicalRoot, activePath)) return activePath;
+	if (sidecarPresent(canonicalRoot, archivedPath)) return archivedPath;
+	return activePath;
+}
+
+// Existence only. A symlink counts as present so `collectPathIdentities` still
+// rejects it as a symlink; reporting it as missing would turn a security
+// rejection into a lookup failure.
+function sidecarPresent(canonicalRoot: string, relativePath: string): boolean {
+	try {
+		lstatSync(join(canonicalRoot, relativePath));
+		return true;
+	} catch {
+		return false;
+	}
+}
+
 function collectPathIdentities(
 	canonicalRoot: string,
 	relativePath: string,
@@ -504,12 +533,19 @@ export function readTaskIntent(
 	const canonicalRoot = resolveCanonicalRoot(root);
 	const activePath = `${INTENT_SIDECAR_RELATIVE_PREFIX}${taskId}.intent.json`;
 	const archivedPath = `${INTENT_SIDECAR_RELATIVE_PREFIX}archive/${taskId}.intent.json`;
-	const sidecarPath = requestedPath ?? activePath;
+	// `freeze_artifacts` relocates the sidecar from the active path to the archive
+	// path, so the caller's TaskRecord `intent_ref.path` is the authority. When no
+	// path is requested, resolve the single sidecar that exists rather than
+	// assuming the pre-freeze layout; a missing or ambiguous sidecar is a stable
+	// contract failure, not a raw `lstat` ENOENT.
+	const sidecarPath = requestedPath ?? resolveSidecarPath(canonicalRoot, activePath, archivedPath);
 	if (sidecarPath !== activePath && sidecarPath !== archivedPath)
 		throw new Error("intent sidecar path is not the active or archived task path");
 	const target = join(canonicalRoot, sidecarPath);
 	if (!target.startsWith(canonicalRoot + sep))
 		throw new Error("intent sidecar escapes project root");
+	if (!sidecarPresent(canonicalRoot, sidecarPath))
+		throw new Error(`TaskIntent sidecar is missing at ${sidecarPath}`);
 
 	const pathIdentities = collectPathIdentities(canonicalRoot, sidecarPath);
 	const fileIdentity = pathIdentities[pathIdentities.length - 1];

package/plugins/immune-brain/runtime/plugin_version.ts

@@ -1,2 +1,2 @@
 // Generated by scripts/plugin_versioning.ts from the root package.json.
-export const PLUGIN_VERSION = "3.6.0" as const;
+export const PLUGIN_VERSION = "3.6.2" as const;

package/plugins/immune-brain/runtime/role_prompt_bridge.ts

@@ -108,17 +108,33 @@ function roleSpec(role: InternalRole): RolePromptSpec {
 	return spec;
 }
 
+/**
+ * Directories that can hold the packaged role prompts, most specific first.
+ *
+ * From source this module sits in `runtime/`, a sibling of `dist/`. The Claude
+ * Code Host instead ships a bundle at `dist/claude/mcp-server.mjs`, where the
+ * same relative walk lands on a `dist/dist/` that never exists while the prompts
+ * sit one level up. Every test runs from source, so the shipped Host could not
+ * load a single internal role prompt and no test noticed.
+ */
+export function rolePromptSearchDirs(moduleDir: string): string[] {
+	return [
+		join(moduleDir, "..", "dist", "role-prompts"),
+		join(moduleDir, "..", "role-prompts"),
+	];
+}
+
 /**
  * Read the packaged prompt so the runtime follows the bytes shipped to a
  * consumer. The canonical source is synced into this dist-local directory.
  */
 export function loadRolePrompt(role: InternalRole): string {
 	const spec = roleSpec(role);
-	const path = join(RUNTIME_DIR, "..", "dist", "role-prompts", spec.file);
-	if (!existsSync(path)) {
-		throw new Error(`internal role prompt is not packaged: ${role}`);
+	for (const dir of rolePromptSearchDirs(RUNTIME_DIR)) {
+		const path = join(dir, spec.file);
+		if (existsSync(path)) return readFileSync(path, "utf8");
 	}
-	return readFileSync(path, "utf8");
+	throw new Error(`internal role prompt is not packaged: ${role}`);
 }
 
 export function buildRoleDelegationPacket(input: {