immune-brain 3.6.2 → 3.6.4

package/plugins/immune-brain/runtime/claude/kernel_ports.ts

@@ -20,12 +20,12 @@ import {
 import {
 	captureReviewBundle,
 	captureReviewManifest,
-	ensureReviewRevision,
 	writeNativeReviewEvidence,
+	type ReviewRevision,
 } from "../assurance/review_evidence";
 import { parseVerificationDescriptor } from "../verification_descriptor";
-import { projectAssurance, type AssuranceProjectionResult } from "../kernel/assurance_projection";
-import type { TaskRecord } from "../kernel/types";
+import { projectAssurance, type AssuranceProjection, type AssuranceProjectionResult } from "../kernel/assurance_projection";
+import { isTaskRecordV4, type TaskApprovalV2, type TaskRecord } from "../kernel/types";
 import { readTaskRecord, readTaskRecordRaw } from "../kernel/storage";
 import { canonicalIntentHash, parseTaskIntentV1, readTaskIntent } from "../kernel/intent";
 import { capabilityActionFor, createCanaryApplication } from "../kernel/canary_application";
@@ -51,6 +51,7 @@ import {
 	isPrivilegedOperation,
 	NativeAuthorityError,
 	type NativeConfirmationPort,
+	type PrivilegedOperation,
 } from "./interaction";
 import { ClaudeReviewHost, FileHookEventLog, type ClaudeHookEvent } from "./review_host";
 import { probeHost, type PermissionMode } from "./capability";
@@ -129,10 +130,15 @@ export async function submitClaudeReview(
 	return coordinator.submitReview(taskId, ctx, verdictInput);
 }
 
+/** `extra` arrives as `Record<string, unknown>`; only a real string is a reason. */
+function stopReason(value: unknown): string {
+	return typeof value === "string" && value.length > 0 ? value : "user stop";
+}
+
 function assertProjectionBinding(before: AssuranceProjectionResult, after: AssuranceProjectionResult, allowDiffChange = false): void {
-	const fields = (allowDiffChange
+	const fields: ReadonlyArray<keyof AssuranceProjection> = allowDiffChange
 		? ["record_revision", "workspace_revision", "intent_revision", "intent_content_hash"]
-		: ["record_revision", "workspace_revision", "intent_revision", "intent_content_hash", "diff_hash"]) as const;
+		: ["record_revision", "workspace_revision", "intent_revision", "intent_content_hash", "diff_hash"];
 	if (before.error || !before.claim || after.error || !after.claim || before.claim.task_id !== after.claim.task_id
 		|| fields.some((field) => before.projection[field] !== after.projection[field])) {
 		throw new Error("Task changed after native confirmation; authority aborted before capability issuance");
@@ -146,6 +152,58 @@ function qaOutcomes(record: { attestations: Array<{ kind: string; acceptance_res
 	);
 }
 
+/**
+ * Publish the task-scoped synthetic revision for a v4 record and return the
+ * exact identity the Review snapshot binds.
+ *
+ * `submitReview` re-derives this identity and compares all four fields —
+ * `manifest_digest` included — against the reservation. Returning the bare
+ * commit identity therefore compared a real digest against `undefined` and
+ * failed every v4 submission with "Review revision changed before submission",
+ * so the manifest is recomputed here rather than only the commit. The outcomes
+ * come from the same `qaOutcomes` the Review snapshot is built from, which
+ * makes the two digests equal by construction instead of by coincidence.
+ *
+ * v3 records keep the legacy full-source bundle and return null.
+ */
+export async function ensureClaudeReviewRevision(
+	root: string,
+	taskId: string,
+	projection: AssuranceProjectionResult,
+): Promise<ReviewRevision | null> {
+	const current = await readTaskRecord(root, taskId);
+	const record = current.record;
+	if (!record) throw new Error(`task ${taskId} has no TaskRecord`);
+	if (current.revision !== projection.projection.record_revision)
+		throw new Error("TaskRecord changed before Review revision preparation");
+	if (record.contract !== "assurance_kernel/task_record/v4") return null;
+	if (!record.git_base_head)
+		throw new Error("Review revision requires a TaskRecord v4 git_base_head");
+	const manifest = captureReviewManifest(root, {
+		taskId,
+		baseHead: record.git_base_head,
+		scopeHint: record.intent_snapshot.scope_hint,
+		expectedDiffHash: projection.projection.diff_hash,
+		intentRevision: projection.projection.intent_revision,
+		intentContentHash: projection.projection.intent_content_hash,
+		recordRevision: projection.projection.record_revision,
+		workspaceRevision: projection.projection.workspace_revision,
+		lifecycle: projection.projection.lifecycle,
+		artifactState: projection.projection.artifact_state,
+		risk: record.intent_snapshot.risk,
+		outcomes: qaOutcomes(record),
+	});
+	return {
+		contract: "assurance_kernel/review_revision/v1",
+		base_head: manifest.base_head,
+		review_tree: manifest.review_tree,
+		review_commit: manifest.review_commit,
+		review_ref: manifest.review_ref,
+		diff_hash: manifest.diff_hash,
+		manifest_digest: manifest.manifest_digest,
+	};
+}
+
 async function buildAssuranceSnapshot(
 	root: string,
 	taskId: string,
@@ -153,23 +211,25 @@ async function buildAssuranceSnapshot(
 	projection: AssuranceProjectionResult,
 	runner: FrozenRunner,
 ) {
-	const record = await readTaskRecord(root, taskId);
-	if (!record.record || record.revision !== projection.projection.record_revision) throw new Error("TaskRecord changed before assurance snapshot capture");
-	const intent = record.record.intent_snapshot;
+	const read = await readTaskRecord(root, taskId);
+	const record = read.record;
+	if (!record || read.revision !== projection.projection.record_revision) throw new Error("TaskRecord changed before assurance snapshot capture");
+	const intent = record.intent_snapshot;
 	const descriptors = new Map<string, VerificationDescriptor>();
 	for (const item of intent.acceptance) {
 		const descriptor = parseVerificationDescriptor(item.verification);
 		assertRunnerCompatible(descriptor, runner);
 		descriptors.set(item.id, descriptor);
 	}
-	const v4 = record.record.contract === "assurance_kernel/task_record/v4";
-	const reviewBundle = role === "review" && !v4
-		? captureReviewBundle(root, intent.scope_hint, projection.projection.diff_hash, qaOutcomes(record.record))
+	// `git_base_head` exists only on TaskRecord v4, so this must narrow the union
+	// rather than test the contract string into a plain boolean.
+	const reviewBundle = role === "review" && !isTaskRecordV4(record)
+		? captureReviewBundle(root, intent.scope_hint, projection.projection.diff_hash, qaOutcomes(record))
 		: null;
-	const reviewManifest = role === "review" && v4
+	const reviewManifest = role === "review" && isTaskRecordV4(record)
 		? captureReviewManifest(root, {
 			taskId,
-			baseHead: record.record.git_base_head,
+			baseHead: record.git_base_head,
 			scopeHint: intent.scope_hint,
 			expectedDiffHash: projection.projection.diff_hash,
 			intentRevision: projection.projection.intent_revision,
@@ -179,7 +239,7 @@ async function buildAssuranceSnapshot(
 			lifecycle: projection.projection.lifecycle,
 			artifactState: projection.projection.artifact_state,
 			risk: intent.risk,
-			outcomes: qaOutcomes(record.record),
+			outcomes: qaOutcomes(record),
 		})
 		: null;
 	const dirtyFiles = reviewManifest ? Object.keys(reviewManifest.changed_paths) : reviewBundle ? Object.keys(reviewBundle.dirty_files) : [];
@@ -295,7 +355,13 @@ export interface ClaudeRuntimeOptions {
 	cwd: string;
 	env?: Record<string, string | undefined>;
 	host?: ClaudeReviewHost;
-	ports?: AssuranceCoordinatorPorts;
+	/**
+	 * Overrides layered on top of the real production ports, never a
+	 * replacement for them. A whole synthetic ports object could previously be
+	 * substituted here, so a suite could pass while the object production
+	 * actually wires was never constructed once.
+	 */
+	ports?: Partial<AssuranceCoordinatorPorts>;
 	interactive?: boolean;
 	permissionMode?: PermissionMode;
 	requestConfirmation?: NativeConfirmationPort;
@@ -319,11 +385,11 @@ export class ClaudeRuntime {
 		this.interactive = options.interactive ?? true;
 		this.requestConfirmation = options.requestConfirmation;
 		this.host = options.host ?? new ClaudeReviewHost(new FileHookEventLog());
-		if (options.ports) {
-			this.coordinator = new AssuranceCoordinator({ ...options.ports, host: this.host });
-			return;
-		}
-		this.coordinator = new AssuranceCoordinator(this.createKernelPorts());
+		this.coordinator = new AssuranceCoordinator({
+			...this.createKernelPorts(),
+			...options.ports,
+			host: this.host,
+		});
 	}
 
 	observe(event: ClaudeHookEvent): void {
@@ -343,25 +409,25 @@ export class ClaudeRuntime {
 		await this.coordinator.onSessionShutdown();
 	}
 
+	/**
+	 * The exact ports object the coordinator runs on. Public so a conformance
+	 * suite can drive what production wires instead of a hand-built double: the
+	 * host adapter defects that reached published plugins all lived in this
+	 * object and none of them were reachable from a test while it was private.
+	 */
+	kernelPorts(): AssuranceCoordinatorPorts {
+		return this.createKernelPorts();
+	}
+
 	private createKernelPorts(): AssuranceCoordinatorPorts {
 		return {
 			host: this.host,
 			projectTask: (root, taskId) => projectAssurance(root, taskId, diffSnapshotOf),
-			readTaskRecord: (root, taskId) => readTaskRecord(root, taskId),
-			readTaskIntent: (root, taskId) => readTaskIntentForRecord(root, taskId),
+			readTaskRecord: async (root, taskId) => readTaskRecord(root, taskId),
+			readTaskIntent: async (root, taskId) => readTaskIntentForRecord(root, taskId),
 			frozenRunner: async () => resolveBunRunner(),
 			buildAssurance: (root, taskId, role, projection, runner) => buildAssuranceSnapshot(root, taskId, role, projection, runner),
-			ensureReviewRevision: async (root, taskId, projection) => {
-				const current = await readTaskRecord(root, taskId);
-				if (!current.record) throw new Error(`task ${taskId} has no TaskRecord`);
-				if (current.record.contract !== "assurance_kernel/task_record/v4") return null;
-				return ensureReviewRevision(root, {
-					taskId,
-					baseHead: current.record.git_base_head,
-					scopeHint: current.record.intent_snapshot.scope_hint,
-					expectedDiffHash: projection.projection.diff_hash,
-				});
-			},
+			ensureReviewRevision: (root, taskId, projection) => ensureClaudeReviewRevision(root, taskId, projection),
 			runQa: (snapshot, descriptors, runner, options) => runDeterministicQa(snapshot, descriptors, runner, options),
 			writeReviewEvidence: (input) => writeNativeReviewEvidence(input.evidence),
 			applyVerdict: (ctx, input) => this.applyVerdict(ctx, input),
@@ -468,7 +534,7 @@ export class ClaudeRuntime {
 			return repairKernelAuthority(this.cwd, taskId, authority.revision);
 		}
 		if (!isPrivilegedOperation(operation) && operation !== "request_authorization") throw new Error(`unsupported privileged operation ${operation}`);
-		let op = operation;
+		let op: PrivilegedOperation | "request_authorization" | "resolve_user_decision" = operation;
 		let decisionOp: { finding_id: string; resolution: string } | undefined;
 		const projection = await this.status(taskId);
 		if (projection.error || !projection.claim) throw new Error(projection.error ?? "no active backend claim");
@@ -584,7 +650,7 @@ export class ClaudeRuntime {
 				confirmation_ref: confirmation,
 				...(op === "approve_breaking_intent_revision" ? { next_intent: nextIntent, next_intent_ref: nextIntentRef } : {}),
 				...(op === "resolve_user_decision" && decisionOp ? decisionOp : {}),
-				...(op === "stop" ? { reason: extra.reason ?? "user stop" } : {}),
+				...(op === "stop" ? { reason: stopReason(extra.reason) } : {}),
 			});
 			throwIfCancelled(meta.signal);
 			const result = app.execute({
@@ -596,7 +662,7 @@ export class ClaudeRuntime {
 					actor_id: actorId,
 					...(op === "approve_breaking_intent_revision" ? { next_intent: nextIntent, next_intent_ref: nextIntentRef } : {}),
 					...(op === "resolve_user_decision" && decisionOp ? decisionOp : {}),
-					...(op === "stop" ? { reason: extra.reason ?? "user stop" } : {}),
+					...(op === "stop" ? { reason: stopReason(extra.reason) } : {}),
 				} as never,
 				prior_intent_token: priorIntent.token,
 				diffProvider: diffSnapshotOf,
@@ -672,7 +738,7 @@ export class ClaudeRuntime {
 			stagePlanningArtifactTransition(ctx.cwd, result.record);
 			return;
 		}
-		const approval = {
+		const approval: TaskApprovalV2 = {
 			id: `approval-${input.snapshot.role}-${randomUUID().slice(0, 8)}`,
 			kind: input.snapshot.role === "qa" ? "qa" : "review",
 			authority_role: input.snapshot.role === "qa" ? "qa" : "reviewer",

package/plugins/immune-brain/runtime/claude/review_host.ts

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { constants, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readSync, rmSync, writeSync, closeSync } from "node:fs";
+import { constants, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readSync, realpathSync, rmSync, writeSync, closeSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { tmpdir } from "node:os";
 import type {
@@ -122,12 +122,13 @@ function appendPrivate(path: string, dir: string, line: string): boolean {
 	}
 }
 
-function readPrivate(path: string): string | undefined {
+function readPrivate(path: string, maxBytes = Number.POSITIVE_INFINITY): string | undefined {
 	let fd: number;
 	try { fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK); } catch { return; }
 	try {
 		const stat = fstatSync(fd);
 		if (!stat.isFile() || !ownedByUs(stat) || (stat.mode & 0o777) !== 0o600) return;
+		if (stat.size > maxBytes) return;
 		const buf = Buffer.alloc(stat.size);
 		readSync(fd, buf, 0, stat.size, 0);
 		return buf.toString("utf8");
@@ -136,6 +137,78 @@ function readPrivate(path: string): string | undefined {
 	}
 }
 
+/**
+ * Upper bound on a reviewer transcript we are willing to load. A reviewer that
+ * produced more than this did not produce a verdict; refusing to allocate for it
+ * is safer than trusting whatever the tail happens to contain.
+ */
+const MAX_TRANSCRIPT_BYTES = 32 * 1024 * 1024;
+
+export type AsyncAgentLaunch = { agentId: string; outputFile: string };
+
+/**
+ * Recognise the launch receipt this Claude Code build returns for `Agent`.
+ *
+ * Every `Agent` call here runs asynchronously — `run_in_background: false` in
+ * the dispatch envelope is not honoured, and there is no synchronous mode. The
+ * tool result is therefore
+ * `{"isAsync":true,"status":"async_launched","agentId":…,"outputFile":…}`:
+ * proof that a subagent started, never its answer. Treating it as the verdict
+ * would settle Review on a receipt for starting the reviewer, so the launch
+ * envelope is read only as a pointer to where the real bytes live.
+ */
+export function parseAsyncAgentLaunch(result: string): AsyncAgentLaunch | null {
+	let payload: unknown;
+	try { payload = JSON.parse(result); } catch { return null; }
+	if (!payload || typeof payload !== "object") return null;
+	const obj = payload as Record<string, unknown>;
+	if (obj.isAsync !== true && obj.status !== "async_launched") return null;
+	const agentId = typeof obj.agentId === "string" ? obj.agentId : "";
+	const outputFile = typeof obj.outputFile === "string" ? obj.outputFile : "";
+	if (!agentId || !outputFile) return null;
+	return { agentId, outputFile };
+}
+
+/**
+ * Extract the reviewer's terminal message from its own transcript.
+ *
+ * Each record carries the `agentId` that wrote it, so the caller's independently
+ * observed id is matched per record rather than trusted for the file as a whole;
+ * a transcript that interleaves another agent cannot contribute its text.
+ */
+export function readAgentTranscriptResult(transcript: string, agentId: string): string | null {
+	let last: string | null = null;
+	for (const line of transcript.split("\n")) {
+		if (!line.trim()) continue;
+		let row: Record<string, unknown>;
+		try { row = JSON.parse(line) as Record<string, unknown>; } catch { continue; }
+		if (row.type !== "assistant" || row.agentId !== agentId) continue;
+		const message = row.message;
+		if (!message || typeof message !== "object") continue;
+		const content = (message as Record<string, unknown>).content;
+		if (!Array.isArray(content)) continue;
+		let text = "";
+		for (const block of content) {
+			if (!block || typeof block !== "object") continue;
+			const part = block as Record<string, unknown>;
+			if (part.type === "text" && typeof part.text === "string") text += part.text;
+		}
+		if (text.trim()) last = text;
+	}
+	return last;
+}
+
+/**
+ * Read the transcript the launch envelope names. The path is a symlink into the
+ * session store, so it is resolved once and then opened `O_NOFOLLOW` with the
+ * same ownership and mode checks the hook log gets.
+ */
+function readAgentTranscript(path: string): string | undefined {
+	let resolved: string;
+	try { resolved = realpathSync(path); } catch { return; }
+	return readPrivate(resolved, MAX_TRANSCRIPT_BYTES);
+}
+
 export function hookEventPath(sessionId: string, root = tmpdir()): string {
 	return join(cacheDir(root), `${sessionHash(sessionId)}.jsonl`);
 }
@@ -198,16 +271,6 @@ interface PendingReview {
 	error?: string;
 }
 
-function matchesReservation(event: ClaudeHookEvent, pending: PendingReview): boolean {
-	if ("operationId" in event && event.operationId && event.operationId !== pending.request.operationId) return false;
-	if ("taskId" in event && event.taskId && event.taskId !== pending.request.taskId) return false;
-	if (pending.sessionId && event.sessionId !== pending.sessionId) return false;
-	const eventAgentId = "agentId" in event ? event.agentId : "";
-	if (event.type === "SubagentStop" && (!eventAgentId || !pending.agentId || eventAgentId !== pending.agentId)) return false;
-	if (pending.agentId && eventAgentId && eventAgentId !== pending.agentId) return false;
-	return true;
-}
-
 function bindsStart(event: Extract<ClaudeHookEvent, { type: "SubagentStart" }>, pending: PendingReview): boolean {
 	if (event.taskId && event.taskId !== pending.request.taskId) return false;
 	if (event.prompt !== undefined) {
@@ -229,6 +292,11 @@ export class ClaudeReviewHost implements AssuranceHostPort {
 	constructor(private readonly log: HookEventLog = new MemoryHookEventLog()) {}
 
 	prepareReview(request: ReviewRequest): HostReviewReservation {
+		// Retire whatever the log already holds before the cursors are taken. A
+		// resumed session inherits its predecessor's file, and an unprocessed
+		// `SessionEnd` sitting in it used to survive until the first inspection —
+		// long after this reservation's own events had been appended behind it.
+		this.drain();
 		const initialCursors = new Map<string, number>();
 		const sessionCursors = new Map<string, number>();
 		for (const sessionId of this.log.sessions()) {
@@ -266,17 +334,31 @@ export class ClaudeReviewHost implements AssuranceHostPort {
 			for (let i = start; i < events.length; i++) {
 				const event = events[i];
 				if (event.type === "SessionEnd") {
-					this.log.clear(event.sessionId);
-					ended = true;
-					this.appliedBySession.delete(event.sessionId);
+					// Any reservation that already bound evidence from the finished
+					// session loses it outright; that evidence can never be revived.
 					for (const [id, state] of this.pending) {
 						if (state.startEvent?.sessionId === event.sessionId || state.postEvent?.sessionId === event.sessionId || state.stopEvent?.sessionId === event.sessionId) {
 							this.pending.delete(id);
 						}
 					}
-					// The session ended: stop processing this captured batch so a
-					// later event cannot repopulate confirmations after cleanup.
-					break;
+					// A resumed session reuses its id, so the same log can hold events
+					// appended after an earlier end. Advancing every surviving cursor
+					// past this point keeps the pre-end events unusable — the property
+					// the old whole-log clear was protecting — while still letting the
+					// events that follow reach their reservation. Clearing and stopping
+					// here instead silently discarded a live Review receipt.
+					for (const state of this.pending.values()) {
+						const current = state.initialCursors.get(sessionId) ?? 0;
+						if (i + 1 > current) state.initialCursors.set(sessionId, i + 1);
+					}
+					if (i === events.length - 1) {
+						// Nothing followed the end, so the log is safe to reclaim.
+						this.log.clear(event.sessionId);
+						ended = true;
+						this.appliedBySession.delete(event.sessionId);
+						break;
+					}
+					continue;
 				}
 				for (const state of this.pending.values()) {
 					if (state.consumed || state.error || i < (state.initialCursors.get(sessionId) ?? 0)) continue;
@@ -387,13 +469,29 @@ export class ClaudeReviewHost implements AssuranceHostPort {
 		) {
 			return { ok: false, reason: "foreground Agent terminal event correlation mismatch", release: true };
 		}
-		return {
-			ok: true,
-			receipt: {
-				actorId: `claude:${state.startEvent.agentId ?? reservation.id}`,
-				result: state.postEvent.result,
-			},
-		};
+		const actorId = `claude:${state.startEvent.agentId ?? reservation.id}`;
+		const launch = parseAsyncAgentLaunch(state.postEvent.result);
+		if (!launch) {
+			return { ok: true, receipt: { actorId, result: state.postEvent.result } };
+		}
+		// Invariant guard. Correlation already binds the PostToolUse through the
+		// same `agentId` this envelope carries, so a foreign id normally never
+		// reaches here; assert it anyway rather than read a transcript the three
+		// observed events did not agree on.
+		if (launch.agentId !== state.postEvent.agentId) {
+			return { ok: false, reason: "async Agent launch envelope names a different agent", release: true };
+		}
+		const transcript = readAgentTranscript(launch.outputFile);
+		if (transcript === undefined) {
+			// Fail closed rather than falling back to bytes the Parent supplied:
+			// an optional weaker path is a path the Parent can choose to force.
+			return { ok: false, reason: "async Agent transcript is not readable", release: false };
+		}
+		const verdict = readAgentTranscriptResult(transcript, launch.agentId);
+		if (!verdict?.trim()) {
+			return { ok: false, reason: "async Agent transcript carries no reviewer result", release: false };
+		}
+		return { ok: true, receipt: { actorId, result: verdict } };
 	}
 
 	consumeReview(reservation: HostReviewReservation): ConsumeReviewResult {
@@ -437,6 +535,14 @@ export function parseHookStdin(raw: string): ClaudeHookEvent | null {
 		const toolInputObj = payload.tool_input as Record<string, unknown>;
 		if (typeof toolInputObj.prompt === "string") prompt = toolInputObj.prompt;
 	}
+	// The async launch envelope echoes the dispatched prompt. It is the only
+	// place the reservation marker appears when a payload omits `tool_input`,
+	// and it is written by the Host, not by the Parent, like every other field
+	// read here.
+	if (!prompt && typeof payload.tool_response === "object" && payload.tool_response !== null) {
+		const toolResponseObj = payload.tool_response as Record<string, unknown>;
+		if (typeof toolResponseObj.prompt === "string") prompt = toolResponseObj.prompt;
+	}
 	let extractedOpId = operationId;
 	let extractedTaskId = taskId;
 	// Extract nested operation_id/task_id from tool_input or tool_response (e.g. { tool_input: { operation_id, task_id } })

package/plugins/immune-brain/runtime/github_issue_tracker.ts

@@ -275,8 +275,8 @@ export function createGhTransport(binary = "gh"): GhTransport {
 	return {
 		run(args, options = {}) {
 			return new Promise((complete) => {
-				let stdout = Buffer.alloc(0);
-				let stderr = Buffer.alloc(0);
+				let stdout: Buffer = Buffer.alloc(0);
+				let stderr: Buffer = Buffer.alloc(0);
 				let timedOut = false;
 				let outputExceeded = false;
 				let timer: ReturnType<typeof setTimeout> | undefined;
@@ -304,7 +304,7 @@ export function createGhTransport(binary = "gh"): GhTransport {
 					finish(1, error instanceof Error ? error.message : String(error));
 					return;
 				}
-				const append = (current: Buffer, chunk: Buffer): Buffer => {
+				const append = (current: Buffer, chunk: Uint8Array): Buffer => {
 					const available = Math.max(0, MAX_GH_OUTPUT - stdout.length - stderr.length);
 					if (chunk.length > available) {
 						outputExceeded = true;
@@ -312,17 +312,22 @@ export function createGhTransport(binary = "gh"): GhTransport {
 					}
 					return available > 0 ? Buffer.concat([current, chunk.subarray(0, available)]) : current;
 				};
-				child.stdout.on("data", (chunk: Buffer) => { stdout = append(stdout, chunk); });
-				child.stderr.on("data", (chunk: Buffer) => { stderr = append(stderr, chunk); });
+				const { stdout: childOut, stderr: childErr, stdin: childIn } = child;
+				if (!childOut || !childErr || !childIn) {
+					finish(1, "gh was spawned without the stdio pipes this reader requires");
+					return;
+				}
+				childOut.on("data", (chunk: Uint8Array) => { stdout = append(stdout, chunk); });
+				childErr.on("data", (chunk: Uint8Array) => { stderr = append(stderr, chunk); });
 				child.once("error", (error) => { finish(1, error.message); });
-				child.stdin.once("error", (error) => { finish(1, error.message); });
+				childIn.once("error", (error) => { finish(1, error.message); });
 				timer = setTimeout(() => {
 					timedOut = true;
 					child.kill("SIGKILL");
 				}, GH_TIMEOUT_MS);
 				child.once("close", (code) => { finish(code ?? 1); });
 				try {
-					child.stdin.end(options.stdin ?? "");
+					childIn.end(options.stdin ?? "");
 				} catch (error) {
 					finish(1, error instanceof Error ? error.message : String(error));
 				}
@@ -371,7 +376,7 @@ function parseSubIssueNumbers(raw: string): number[] {
 	if (!Array.isArray(pages)) throw new Error("gh returned malformed Sub-issue list");
 	return pages.map((item, index) => {
 		const number = (item as { number?: unknown })?.number;
-		if (!Number.isSafeInteger(number)) throw new Error(`gh returned a malformed Sub-issue entry at ${index}`);
+		if (typeof number !== "number" || !Number.isSafeInteger(number)) throw new Error(`gh returned a malformed Sub-issue entry at ${index}`);
 		return number;
 	});
 }

package/plugins/immune-brain/runtime/kernel/application.ts

@@ -260,6 +260,11 @@ export function applyTaskAction(
 		}
 
 		if (input.terminal) {
+			// A tombstone may only record a terminal lifecycle. Nothing upstream
+			// proved that, so an active record could have been tombstoned as
+			// `terminal_lifecycle: "active"` in violation of its own contract.
+			if (nextRecord.lifecycle === "active")
+				throw new Error("terminal settlement requires a done or stopped TaskRecord lifecycle");
 			const tombstone: TaskTombstone = {
 				contract: TASK_TOMBSTONE_CONTRACT,
 				task_id,

package/plugins/immune-brain/runtime/kernel/enrollment.ts

@@ -244,6 +244,10 @@ export function enrollCanaryTask(
 			// consume immediately before the marker write
 			registry.consume(input.capability, input.capability_binding);
 
+			// Set by beforeLock above, which throws when the repository has no
+			// committed HEAD. Re-assert it here: the compiler cannot carry a
+			// closure's narrowing across to this one.
+			if (!gitBaseHead) throw new Error("enrollment requires a committed Git HEAD");
 			const record = buildTaskRecordV4(input, checks.intent, gitBaseHead);
 			const nextWorkspace: WorkspaceStateLike = {
 				...checks.workspace.state,

package/plugins/immune-brain/runtime/kernel/index.ts

@@ -19,6 +19,8 @@ export {
 	appendJournalEntry,
 	KernelStoreSecurityError,
 	setAfterTaskTransactionWriteForTest,
+	type JournalEntry,
+	type JournalReasonCode,
 } from "./storage";
 export {
 	reduceTask,

package/plugins/immune-brain/runtime/kernel/observation.ts

@@ -229,10 +229,12 @@ export function buildAuthorityObservationSeedV2(
 function committedReceiptV2(
 	receipt: AuthorityCommitReceipt,
 ): receipt is AuthorityCommitReceipt & {
+	contract: "assurance_kernel/authority_commit_receipt/v2";
 	status: "committed" | "recovered_committed";
 	observation_seed: AuthorityObservationSeedV2;
 } {
 	return (
+		receipt.contract === "assurance_kernel/authority_commit_receipt/v2" &&
 		(receipt.status === "committed" ||
 			receipt.status === "recovered_committed") &&
 		receipt.observation_seed !== undefined

package/plugins/immune-brain/runtime/kernel/storage.ts

@@ -78,7 +78,22 @@ export type JournalReasonCode =
 	| "source_read_failed"
 	| "shadow_divergence"
 	| "migration_ambiguous"
-	| "readiness_query_nonqualifying";
+	| "readiness_query_nonqualifying"
+	// Emitted by runtime/commands/kernel.ts. Absent from this union until the
+	// journal types were first exported and type checked.
+	| "routing_policy_invalid"
+	| "routing_unavailable"
+	| "kernel_owner_active"
+	| "v3_owner_nonterminal"
+	| "input_oversize"
+	| "input_invalid"
+	| "intent_invalid"
+	| "task_path_mismatch"
+	| "destination_invalid"
+	| "destination_parent_invalid"
+	| "destination_parent_missing"
+	| "destination_exists"
+	| "destination_write_failed";
 
 export interface JournalEntry {
 	contract: "assurance_kernel/journal/v1";
@@ -1337,7 +1352,7 @@ export function commitEnrollmentLocked(
 	taskId: string,
 	transaction: WorkspaceTransactionV2,
 	claim: Record<string, unknown>,
-): { record: TaskRecordV2; workspace: WorkspaceState } {
+): { record: TaskRecord; workspace: WorkspaceState } {
 	const marker: EnrollmentMarker = {
 		contract: "assurance_kernel/enrollment_transaction/v1",
 		task_id: taskId,

package/plugins/immune-brain/runtime/kernel/storage_layout_migration.ts

@@ -700,7 +700,7 @@ export function migrateLegacyLayout(root: string): MigrationOutcome {
 			affected_paths: initial.dirty_affected_paths,
 			reason: initial.reason,
 		};
-	if (["migration_blocked_active", "invalid"].includes(initial.layout))
+	if (initial.layout === "migration_blocked_active" || initial.layout === "invalid")
 		return {
 			contract: "immune_brain/storage_layout_migration_result/v1",
 			outcome: initial.layout,

package/plugins/immune-brain/runtime/kernel/storage_paths.ts

@@ -242,10 +242,6 @@ function inspectOldLayout(root: string): OldLayoutFacts {
 				facts.blocked_active = true;
 				continue;
 			}
-			if (kind === "marker") {
-				facts.pending_marker ??= path;
-				continue;
-			}
 			if (kind === "claim") {
 				facts.blocked_active = true;
 				continue;

package/plugins/immune-brain/runtime/kernel/types.ts

@@ -235,6 +235,15 @@ export interface TaskRecordV4 extends Omit<TaskRecordV3, "contract"> {
 /** The record shape every Kernel owner passes around during the v3 drain window. */
 export type TaskRecord = TaskRecordV3 | TaskRecordV4;
 
+/**
+ * Narrow the stored record union before reading a v4-only field such as
+ * `git_base_head`. Comparing `record.contract` into a plain boolean does not
+ * narrow, which let adapters read v4 fields off a v3-shaped value unchecked.
+ */
+export function isTaskRecordV4(record: TaskRecord): record is TaskRecordV4 {
+	return record.contract === TASK_RECORD_CONTRACT_V4;
+}
+
 export interface TaskProjectionV3 extends CompletionDecision {
 	contract: "assurance_kernel/projection/v3";
 	task_id: string;

package/plugins/immune-brain/runtime/managed_task_routing_policy.ts

@@ -26,7 +26,7 @@
 
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import {
+import { type Stats,
 	closeSync,
 	constants as fsConstants,
 	fstatSync,
@@ -145,7 +145,7 @@ export function setRoutingPolicyReaderTestHook(
 	routingPolicyReaderTestHook = hook;
 }
 
-function statIdentity(stat: ReturnType<typeof statSync>): {
+function statIdentity(stat: Stats): {
 	dev: number;
 	ino: number;
 	size: number;