immune-brain 3.6.3 → 3.6.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "3.6.3",
+  "version": "3.6.4",
   "description": "Immune-Brain agent skill system",
   "publishConfig": {
     "access": "public",
@@ -30,13 +30,16 @@
   "scripts": {
     "changeset": "changeset",
     "changeset:version": "changeset version && bun scripts/build-claude-plugin.ts && bun scripts/plugin_versioning.ts validate",
-    "verify:release": "bun scripts/plugin_versioning.ts validate && bun scripts/build-claude-plugin.ts --check && bun scripts/sync-dist-docs.ts --check && bun test && npm pack --dry-run --ignore-scripts",
+    "verify:release": "bun scripts/plugin_versioning.ts validate && bun scripts/build-claude-plugin.ts --check && bun scripts/sync-dist-docs.ts --check && bun run typecheck && bun test && npm pack --dry-run --ignore-scripts",
     "changeset:publish": "bun run verify:release && changeset publish",
-    "release": "bun run changeset:publish"
+    "release": "bun run changeset:publish",
+    "typecheck": "tsc -p tsconfig.json"
   },
   "devDependencies": {
     "@changesets/changelog-github": "^0.5.2",
     "@changesets/cli": "^2.29.8",
+    "@types/bun": "^1.4.1",
+    "typescript": "5.7",
     "zod": "^4.1.8"
   },
   "peerDependencies": {

package/plugins/immune-brain/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "3.6.3",
+  "version": "3.6.4",
   "description": "Immune-Brain Claude Code Host: native Enrollment, QA, Review, and Kernel settlement.",
   "author": {
     "name": "Immune-Brain Team"

package/plugins/immune-brain/.pi-extension/imm-canary-work.ts

@@ -56,6 +56,7 @@ import {
 	clearTerminalTaskRailOnInput,
 	loopResultDetails,
 	notifyOnce,
+	type UiContext,
 	presentTaskOverviewOverlay,
 	presentTaskRail,
 	presentTaskRailResult,
@@ -68,7 +69,7 @@ import {
 	type UserAttentionEventV1,
 	type UserAttentionReason,
 } from "./pi-canary-interaction";
-import { isToolFailureState, throwToolFailure } from "./pi-canary-tool-failure";
+import { isToolFailureState, throwToolFailure, type ToolFailureV1 } from "./pi-canary-tool-failure";
 import { taskDiffIdentity, taskRevisionIdentity, captureGitTaskSnapshot } from "../runtime/workspace_scope";
 import {
 	AssuranceProgression,
@@ -87,6 +88,7 @@ import {
 	type AssuranceProgressionPorts,
 	type AssuranceSubmitReviewResult,
 	type AssuranceVerdict,
+	type HostContext,
 	type QaVerificationProgress,
 	type SnapshotDescriptor,
 } from "./pi-canary-assurance-progression";
@@ -262,11 +264,18 @@ type LoopToolAction =
 		context: Record<string, unknown>;
 	};
 
-export default function (
-	pi: ExtensionAPI,
+/**
+ * The exact ports object the Pi Assurance progression runs on.
+ *
+ * This lived as an inline literal inside the anonymous default export, so no
+ * test could ever obtain what production wires; every host adapter defect that
+ * reached a published plugin lived in this object. Exporting the factory lets
+ * the dual-host conformance suite drive the real thing.
+ */
+export function createPiAssuranceProgressionPorts(
 	dependencies: CanaryWorkExtensionDependencies = {},
-) {
-	const progression = new AssuranceProgression({
+): AssuranceProgressionPorts {
+	return {
 		projectTask: (root, taskId) => projectAssuranceState(root, taskId),
 		readTaskRecord: (root, taskId) => readTaskRecord(root, taskId),
 		readTaskIntent: (root, taskId) => readTaskIntent(root, taskId),
@@ -294,7 +303,14 @@ export default function (
 		qaOnAuthorityCommit: dependencies.qaOnAuthorityCommit,
 		qaAfterAuthorityCommit: dependencies.qaAfterAuthorityCommit,
 		qaJobTimeoutMs: dependencies.qaJobTimeoutMs,
-	} satisfies AssuranceProgressionPorts);
+	} satisfies AssuranceProgressionPorts;
+}
+
+export default function (
+	pi: ExtensionAPI,
+	dependencies: CanaryWorkExtensionDependencies = {},
+) {
+	const progression = new AssuranceProgression(createPiAssuranceProgressionPorts(dependencies));
 
 	let railContext: ExtensionContext | undefined;
 	const refreshTaskRail = async (ctx: ExtensionContext) => {
@@ -1196,7 +1212,7 @@ async function projectAssuranceState(root: string, taskId: string): Promise<Assu
  * Publish and prove the task-scoped synthetic revision for a v4 record. v3
  * records keep the legacy full-source bundle and return null here.
  */
-async function ensureTaskReviewRevision(
+export async function ensureTaskReviewRevision(
 	root: string,
 	taskId: string,
 	projection: AssuranceProjectionResult,
@@ -1221,7 +1237,11 @@ async function ensureTaskReviewRevision(
 		lifecycle: projection.projection.lifecycle,
 		artifactState: projection.projection.artifact_state,
 		risk: record.intent_snapshot.risk,
-		outcomes: reviewPreflightOutcomes(record.intent_snapshot.acceptance),
+		// The same outcomes the Review snapshot is built from. A preflight stand-in
+		// only matched the settled QA attestation because deterministic QA happens to
+		// write that exact summary, so the submit-time digest comparison held by
+		// coincidence rather than by construction.
+		outcomes: qaOutcomes(record),
 	});
 	return {
 		contract: "assurance_kernel/review_revision/v1",
@@ -1266,8 +1286,22 @@ async function reconcileReviewRevisionRefs(root: string): Promise<{ removed: str
 	return reconcileReviewRefs(root, live);
 }
 
+/**
+ * The coordinator port supplies a `HostContext`, which carries no UI. Pi hands
+ * its full `ExtensionContext` through at runtime, so the notice still reaches
+ * the user; a host that does not is left un-notified rather than throwing from
+ * inside an authority commit, where a notification has no authority anyway.
+ */
+function notifyHost(ctx: HostContext, key: string, message: string, level: "warning" | "error"): void {
+	const ui = (ctx as Partial<UiContext>).ui;
+	if (ui) notifyOnce({ ui }, key, message, level);
+}
+
 async function applyAssuranceVerdict(
-	ctx: ExtensionContext,
+	// The coordinator port hands these a `HostContext`, not the Pi
+	// `ExtensionContext`. Both functions only ever read `cwd`; declaring the
+	// wider host type made the port assignment unsound.
+	ctx: HostContext,
 	snapshot: SnapshotDescriptor,
 	verdict: AssuranceVerdict,
 	invocation: InvocationToken,
@@ -1352,7 +1386,7 @@ async function applyAssuranceVerdict(
 		const parked = (result.record as { findings?: Array<{ kind: string; status: string }> }).findings?.some(
 			(finding) => finding.kind === "replan_required" && finding.status === "open",
 		);
-		if (parked) notifyOnce(
+		if (parked) notifyHost(
 			ctx,
 			`rework-parked:${snapshot.task_id}`,
 			`rework applied: review parked for replan with ${findings.length} finding(s)`,
@@ -1431,10 +1465,17 @@ async function buildAssuranceSnapshot(
 		assertRunnerCompatible(descriptor, runner);
 		descriptors.set(item.id, descriptor);
 	}
-	const reviewRevision = record.record.contract === "assurance_kernel/task_record/v4"
+	// `git_base_head` is optional on the read shape because v3 records carry
+	// none, so the contract test alone does not prove it is present.
+	const baseHead = record.record.contract === "assurance_kernel/task_record/v4"
+		? record.record.git_base_head
+		: undefined;
+	if (record.record.contract === "assurance_kernel/task_record/v4" && !baseHead)
+		throw new Error("TaskRecord v4 is missing its Enrollment git_base_head");
+	const reviewRevision = baseHead
 		? {
 			contract: "assurance_kernel/review_revision_identity/v1" as const,
-			base_head: record.record.git_base_head,
+			base_head: baseHead,
 			review_commit: "",
 			review_tree: "",
 			manifest_digest: "",
@@ -1507,15 +1548,6 @@ async function buildAssuranceSnapshot(
 	};
 }
 
-function reviewPreflightOutcomes(
-	acceptance: Array<{ id: string }>,
-): Record<string, { status: "passed"; summary: string }> {
-	const summary = `host-attested QA: all ${acceptance.length} fixed verification descriptor(s) passed`;
-	return Object.fromEntries(
-		acceptance.map((item) => [item.id, { status: "passed" as const, summary }]),
-	);
-}
-
 function qaOutcomes(
 	record: NonNullable<TaskRecordRead["record"]>,
 ): Record<string, { status: "passed" | "failed" | "blocked"; summary: string }> {
@@ -1617,7 +1649,7 @@ function authorityPair(): Promise<{ registry: MutationAuthorityRegistry; app: Ca
 }
 
 async function executeOrdinaryOperation(
-	ctx: ExtensionContext,
+	ctx: HostContext,
 	input: { taskId: string; operation: { op: string; actor_id: string; next_intent?: unknown } },
 ): Promise<unknown> {
 	const { app } = await authorityPair();
@@ -1638,7 +1670,10 @@ async function executeOrdinaryOperation(
 			now: new Date().toISOString(),
 		});
 		if (operation.op === "freeze_artifacts" || operation.op === "stop")
-			stagePlanningArtifactTransition(ctx.cwd, result.record);
+			stagePlanningArtifactTransition(
+				ctx.cwd,
+				(result as { record: Parameters<typeof stagePlanningArtifactTransition>[1] }).record,
+			);
 		return result;
 	} catch (error) {
 		if (priorBytes) {
@@ -1741,18 +1776,24 @@ function toolResult(text: string, details?: Record<string, unknown>) {
  * Pi or Hyper adapter upgrade cycles pass a live nested-object Tool-call
  * probe at least 30 days apart.
  */
-function prepareActionArgs(args: unknown): unknown {
-	if (args === null || typeof args !== "object" || Array.isArray(args)) return args;
+/**
+ * Pre-schema normalizer: some hosts deliver `action` as a JSON string. The Pi
+ * runtime validates the returned value against the Tool schema immediately
+ * after this shim, so the parameter type is the schema's, not a claim this
+ * function makes about unvalidated input.
+ */
+function prepareActionArgs<Params>(args: unknown): Params {
+	if (args === null || typeof args !== "object" || Array.isArray(args)) return args as Params;
 	const input = args as Record<string, unknown>;
-	if (typeof input.action !== "string") return input;
+	if (typeof input.action !== "string") return input as Params;
 	try {
 		const parsed: unknown = JSON.parse(input.action);
 		if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed))
-			return { ...input, action: parsed };
+			return { ...input, action: parsed } as Params;
 	} catch {
 		// Unchanged input keeps the normal host schema error authoritative.
 	}
-	return input;
+	return input as Params;
 }
 
 function stagePlanningArtifactTransition(root: string, record: {
@@ -1785,7 +1826,9 @@ function stagePlanningArtifactTransition(root: string, record: {
 function failCanaryTool(
 	taskId: string,
 	operation: string,
-	state: "blocked" | "failed" | "authority_conflict" | "settlement_unknown",
+	// `review_preparation_failed` is a declared ToolFailureV1 state and a
+	// documented Loop recovery path; omitting it here made it unreportable.
+	state: ToolFailureV1["state"],
 	code: string,
 	message: string,
 	nextAction: string,

package/plugins/immune-brain/.pi-extension/pi-canary-interaction.ts

@@ -1,4 +1,4 @@
-import { DynamicBorder, type ExtensionAPI, type ExtensionContext, type Theme } from "@earendil-works/pi-coding-agent";
+import { DynamicBorder, type ExtensionAPI, type ExtensionContext, type Theme, type ThemeColor } from "@earendil-works/pi-coding-agent";
 import { Container, SelectList, Text, type Component, type SelectItem } from "@earendil-works/pi-tui";
 
 export const USER_ATTENTION_EVENT = "immune-brain:user-attention.v1" as const;
@@ -75,7 +75,7 @@ export interface AuthorityDialogOptions<T extends string> {
 }
 
 type EventPublisher = Pick<ExtensionAPI, "events">;
-type UiContext = Pick<ExtensionContext, "ui">;
+export type UiContext = Pick<ExtensionContext, "ui">;
 
 const terminalRailUis = new WeakSet<object>();
 const deliveredNotifications = new WeakMap<object, Set<string>>();
@@ -373,7 +373,9 @@ function emitAttention(pi: EventPublisher, event: UserAttentionEventV1): void {
 }
 
 function formatTaskRailState(state: TaskRailState, theme?: Theme): string {
-	const symbolAndColor: Record<TaskRailState, { symbol: string; color: string }> = {
+	// Typed as the theme's own colour union: a plain `string` here silently
+	// accepted a name the theme cannot resolve.
+	const symbolAndColor: Record<TaskRailState, { symbol: string; color: ThemeColor }> = {
 		Planning: { symbol: "●", color: "muted" },
 		"Approval required": { symbol: "▲", color: "accent" },
 		Working: { symbol: "●", color: "accent" },
@@ -383,7 +385,7 @@ function formatTaskRailState(state: TaskRailState, theme?: Theme): string {
 		Completed: { symbol: "✓", color: "success" },
 		Stopped: { symbol: "■", color: "muted" },
 	};
-	const cfg = symbolAndColor[state] ?? { symbol: "●", color: "dim" };
+	const cfg: { symbol: string; color: ThemeColor } = symbolAndColor[state] ?? { symbol: "●", color: "dim" };
 	if (!theme) return `${cfg.symbol} ${state}`;
 	return `${theme.fg(cfg.color, cfg.symbol)} ${theme.fg(cfg.color, state)}`;
 }

package/plugins/immune-brain/.pi-extension/runtime-stub.ts

@@ -1,8 +1,10 @@
 // Extension-local runtime adapter: type-isolated, executable stub.
 // Extensions import this file directly (relative path, resolvable by the Pi
 // extension loader); it forwards to the real Kernel modules via dynamic
-// import. The runtime source graph (with its pre-existing type debt) is never
-// type-checked from the extension.
+// import. Shared contracts are re-exported as types from the real Kernel
+// modules: `export type` is erased at compile time, so the extension still
+// carries no static runtime import, but a Kernel contract change now breaks
+// the extension's build instead of silently drifting from it.
 
 // --- Types (structural contracts, no runtime import) ---
 export interface EnrollmentCapabilityBinding {
@@ -178,40 +180,15 @@ export interface TaskRecordRead {
 
 // --- Assurance projection (host-neutral Kernel facts, not exported from the
 // public Kernel index) ---
-export interface AssuranceAuthorizationReadiness {
-	state: "resolve_user_decision" | "none";
-	blocked: string | null;
-}
-export interface AssuranceProjection {
-	record_revision: string;
-	workspace_revision: string;
-	intent_revision: number;
-	intent_content_hash: string;
-	diff_hash: string;
-	lifecycle: "active" | "done" | "stopped" | "";
-	artifact_state: "active" | "frozen" | "";
-	risk: "routine" | "material" | "critical" | "";
-	next_obligation: "resolve_findings" | "resolve_user_decision" | "revise_intent" | "submit_assurance" | "run_qa" | "run_review" | "complete" | "none";
-	fresh_acceptance_ids: string[];
-	missing_acceptance_ids: string[];
-	stale_attestation_ids: string[];
-	fresh_approval_kinds: string[];
-	missing_approval_kinds: string[];
-	blocking_finding_ids: string[];
-	unresolved_user_decision_ids: string[];
-	replan_required_ids: string[];
-	independence_violations: string[];
-	open_user_decision_count: number;
-	completion_ready: boolean;
-	authorization: AssuranceAuthorizationReadiness;
-}
-export interface AssuranceProjectionResult {
-	contract: "assurance_kernel/assurance_projection/v1";
-	task_id: string;
-	error: string | null;
-	claim: { task_id: string; lifecycle_status: string } | null;
-	projection: AssuranceProjection;
-}
+export type {
+	AssuranceAuthorizationReadiness,
+	AssuranceProjection,
+	AssuranceProjectionResult,
+} from "../runtime/kernel/assurance_projection";
+import type {
+	AssuranceAuthorizationReadiness,
+	AssuranceProjectionResult,
+} from "../runtime/kernel/assurance_projection";
 
 // --- Runtime forwarding (dynamic import keeps the graph out of tsc) ---
 function kernelPath(module: string): string {
@@ -349,12 +326,8 @@ export interface TaskIntentV1 {
 	acceptance: Array<{ id: string; assertion: string; verification: string }>;
 	scope_hint: string[];
 }
-export interface TaskIntentRead {
-	token: object;
-	content_hash: string;
-	intent: TaskIntentV1;
-	intent_ref: { path: string; revision: number; content_hash: string };
-}
+export type { ReadTaskIntentResult as TaskIntentRead } from "../runtime/kernel/intent";
+import type { ReadTaskIntentResult as TaskIntentRead } from "../runtime/kernel/intent";
 export interface WorkspaceRead {
 	revision: string;
 	state: { contract: string; current_working: string | null };
@@ -420,7 +393,7 @@ export async function projectAssurance(
 	},
 ): Promise<AssuranceProjectionResult> {
 	const mod = await import(/* @vite-ignore */ kernelPath("assurance_projection"));
-	return mod.projectAssurance(root, taskId, diffProvider) as unknown as AssuranceProjectionResult;
+	return mod.projectAssurance(root, taskId, diffProvider) as AssuranceProjectionResult;
 }
 
 export async function deriveAssuranceAuthorization(input: {
@@ -428,5 +401,5 @@ export async function deriveAssuranceAuthorization(input: {
 	open_user_decision_count: number;
 }): Promise<AssuranceAuthorizationReadiness> {
 	const mod = await import(/* @vite-ignore */ kernelPath("assurance_projection"));
-	return mod.deriveAssuranceAuthorization(input) as unknown as AssuranceAuthorizationReadiness;
+	return mod.deriveAssuranceAuthorization(input) as AssuranceAuthorizationReadiness;
 }

package/plugins/immune-brain/dist/claude/mcp-server.mjs

@@ -42,7 +42,7 @@ function probeHost(env = process.env, platform = process.platform, hostVersion)
 }
 
 // plugins/immune-brain/runtime/plugin_version.ts
-var PLUGIN_VERSION = "3.6.3";
+var PLUGIN_VERSION = "3.6.4";
 
 // plugins/immune-brain/runtime/claude/interaction.ts
 import { createHash, randomUUID } from "node:crypto";
@@ -2484,9 +2484,6 @@ function captureReviewManifest(root, input) {
     throw new Error("immutable review manifest metadata exceeds bounded output limit");
   return manifest;
 }
-function ensureReviewRevision(root, input) {
-  return publishInput(root, input).revision;
-}
 function writeNativeReviewEvidence(payload) {
   const rawDirectory = mkdtempSync(join4(tmpdir2(), "imm-canary-native-review-"));
   try {
@@ -2716,6 +2713,9 @@ var TASK_RECORD_CONTRACT_V2 = "assurance_kernel/task_record/v2";
 var TASK_RECORD_CONTRACT_V3 = "assurance_kernel/task_record/v3";
 var TASK_RECORD_CONTRACT_V4 = "assurance_kernel/task_record/v4";
 var REVIEW_REVISION_IDENTITY_CONTRACT = "assurance_kernel/review_revision_identity/v1";
+function isTaskRecordV4(record) {
+  return record.contract === TASK_RECORD_CONTRACT_V4;
+}
 var REDUCED_MUTATION_BRAND = Symbol("assurance-kernel-reduced-mutation-v2");
 var MUTATION_AUTHORITY_CAPABILITY_BRAND = Symbol("assurance-kernel-mutation-authority-capability");
 
@@ -5737,6 +5737,8 @@ function applyTaskAction(input) {
       };
     }
     if (input.terminal) {
+      if (nextRecord.lifecycle === "active")
+        throw new Error("terminal settlement requires a done or stopped TaskRecord lifecycle");
       const tombstone = {
         contract: TASK_TOMBSTONE_CONTRACT,
         task_id,
@@ -6476,6 +6478,8 @@ function enrollCanaryTask(root, input, registry) {
     if (checks.gitBaseHead !== gitBaseHead)
       throw new Error("Git HEAD moved after the enrollment confirmation");
     registry.consume(input.capability, input.capability_binding);
+    if (!gitBaseHead)
+      throw new Error("enrollment requires a committed Git HEAD");
     const record = buildTaskRecordV4(input, checks.intent, gitBaseHead);
     const nextWorkspace = {
       ...checks.workspace.state,
@@ -6651,6 +6655,9 @@ async function submitClaudeReview(host, coordinator, ctx, taskId, verdictInput)
   }
   return coordinator.submitReview(taskId, ctx, verdictInput);
 }
+function stopReason(value) {
+  return typeof value === "string" && value.length > 0 ? value : "user stop";
+}
 function assertProjectionBinding(before, after, allowDiffChange = false) {
   const fields = allowDiffChange ? ["record_revision", "workspace_revision", "intent_revision", "intent_content_hash"] : ["record_revision", "workspace_revision", "intent_revision", "intent_content_hash", "diff_hash"];
   if (before.error || !before.claim || after.error || !after.claim || before.claim.task_id !== after.claim.task_id || fields.some((field) => before.projection[field] !== after.projection[field])) {
@@ -6660,22 +6667,57 @@ function assertProjectionBinding(before, after, allowDiffChange = false) {
 function qaOutcomes(record) {
   return Object.fromEntries(record.attestations.filter((item) => item.kind === "qa").flatMap((item) => item.acceptance_results).map((result) => [result.acceptance_id, { status: result.status, summary: result.summary }]));
 }
+async function ensureClaudeReviewRevision(root, taskId, projection) {
+  const current = await readTaskRecord(root, taskId);
+  const record = current.record;
+  if (!record)
+    throw new Error(`task ${taskId} has no TaskRecord`);
+  if (current.revision !== projection.projection.record_revision)
+    throw new Error("TaskRecord changed before Review revision preparation");
+  if (record.contract !== "assurance_kernel/task_record/v4")
+    return null;
+  if (!record.git_base_head)
+    throw new Error("Review revision requires a TaskRecord v4 git_base_head");
+  const manifest = captureReviewManifest(root, {
+    taskId,
+    baseHead: record.git_base_head,
+    scopeHint: record.intent_snapshot.scope_hint,
+    expectedDiffHash: projection.projection.diff_hash,
+    intentRevision: projection.projection.intent_revision,
+    intentContentHash: projection.projection.intent_content_hash,
+    recordRevision: projection.projection.record_revision,
+    workspaceRevision: projection.projection.workspace_revision,
+    lifecycle: projection.projection.lifecycle,
+    artifactState: projection.projection.artifact_state,
+    risk: record.intent_snapshot.risk,
+    outcomes: qaOutcomes(record)
+  });
+  return {
+    contract: "assurance_kernel/review_revision/v1",
+    base_head: manifest.base_head,
+    review_tree: manifest.review_tree,
+    review_commit: manifest.review_commit,
+    review_ref: manifest.review_ref,
+    diff_hash: manifest.diff_hash,
+    manifest_digest: manifest.manifest_digest
+  };
+}
 async function buildAssuranceSnapshot(root, taskId, role, projection, runner) {
-  const record = await readTaskRecord(root, taskId);
-  if (!record.record || record.revision !== projection.projection.record_revision)
+  const read = await readTaskRecord(root, taskId);
+  const record = read.record;
+  if (!record || read.revision !== projection.projection.record_revision)
     throw new Error("TaskRecord changed before assurance snapshot capture");
-  const intent = record.record.intent_snapshot;
+  const intent = record.intent_snapshot;
   const descriptors = new Map;
   for (const item of intent.acceptance) {
     const descriptor = parseVerificationDescriptor(item.verification);
     assertRunnerCompatible(descriptor, runner);
     descriptors.set(item.id, descriptor);
   }
-  const v4 = record.record.contract === "assurance_kernel/task_record/v4";
-  const reviewBundle = role === "review" && !v4 ? captureReviewBundle(root, intent.scope_hint, projection.projection.diff_hash, qaOutcomes(record.record)) : null;
-  const reviewManifest = role === "review" && v4 ? captureReviewManifest(root, {
+  const reviewBundle = role === "review" && !isTaskRecordV4(record) ? captureReviewBundle(root, intent.scope_hint, projection.projection.diff_hash, qaOutcomes(record)) : null;
+  const reviewManifest = role === "review" && isTaskRecordV4(record) ? captureReviewManifest(root, {
     taskId,
-    baseHead: record.record.git_base_head,
+    baseHead: record.git_base_head,
     scopeHint: intent.scope_hint,
     expectedDiffHash: projection.projection.diff_hash,
     intentRevision: projection.projection.intent_revision,
@@ -6685,7 +6727,7 @@ async function buildAssuranceSnapshot(root, taskId, role, projection, runner) {
     lifecycle: projection.projection.lifecycle,
     artifactState: projection.projection.artifact_state,
     risk: intent.risk,
-    outcomes: qaOutcomes(record.record)
+    outcomes: qaOutcomes(record)
   }) : null;
   const dirtyFiles = reviewManifest ? Object.keys(reviewManifest.changed_paths) : reviewBundle ? Object.keys(reviewBundle.dirty_files) : [];
   const snapshot = {
@@ -6784,11 +6826,11 @@ class ClaudeRuntime {
     this.interactive = options.interactive ?? true;
     this.requestConfirmation = options.requestConfirmation;
     this.host = options.host ?? new ClaudeReviewHost(new FileHookEventLog);
-    if (options.ports) {
-      this.coordinator = new AssuranceCoordinator({ ...options.ports, host: this.host });
-      return;
-    }
-    this.coordinator = new AssuranceCoordinator(this.createKernelPorts());
+    this.coordinator = new AssuranceCoordinator({
+      ...this.createKernelPorts(),
+      ...options.ports,
+      host: this.host
+    });
   }
   observe(event) {
     this.host.observe(event);
@@ -6802,27 +6844,18 @@ class ClaudeRuntime {
   async shutdown() {
     await this.coordinator.onSessionShutdown();
   }
+  kernelPorts() {
+    return this.createKernelPorts();
+  }
   createKernelPorts() {
     return {
       host: this.host,
       projectTask: (root, taskId) => projectAssurance(root, taskId, diffSnapshotOf),
-      readTaskRecord: (root, taskId) => readTaskRecord(root, taskId),
-      readTaskIntent: (root, taskId) => readTaskIntentForRecord(root, taskId),
+      readTaskRecord: async (root, taskId) => readTaskRecord(root, taskId),
+      readTaskIntent: async (root, taskId) => readTaskIntentForRecord(root, taskId),
       frozenRunner: async () => resolveBunRunner(),
       buildAssurance: (root, taskId, role, projection, runner) => buildAssuranceSnapshot(root, taskId, role, projection, runner),
-      ensureReviewRevision: async (root, taskId, projection) => {
-        const current = await readTaskRecord(root, taskId);
-        if (!current.record)
-          throw new Error(`task ${taskId} has no TaskRecord`);
-        if (current.record.contract !== "assurance_kernel/task_record/v4")
-          return null;
-        return ensureReviewRevision(root, {
-          taskId,
-          baseHead: current.record.git_base_head,
-          scopeHint: current.record.intent_snapshot.scope_hint,
-          expectedDiffHash: projection.projection.diff_hash
-        });
-      },
+      ensureReviewRevision: (root, taskId, projection) => ensureClaudeReviewRevision(root, taskId, projection),
       runQa: (snapshot, descriptors, runner, options) => runDeterministicQa(snapshot, descriptors, runner, options),
       writeReviewEvidence: (input) => writeNativeReviewEvidence(input.evidence),
       applyVerdict: (ctx, input) => this.applyVerdict(ctx, input),
@@ -7037,7 +7070,7 @@ class ClaudeRuntime {
         confirmation_ref: confirmation,
         ...op === "approve_breaking_intent_revision" ? { next_intent: nextIntent, next_intent_ref: nextIntentRef } : {},
         ...op === "resolve_user_decision" && decisionOp ? decisionOp : {},
-        ...op === "stop" ? { reason: extra.reason ?? "user stop" } : {}
+        ...op === "stop" ? { reason: stopReason(extra.reason) } : {}
       });
       throwIfCancelled(meta.signal);
       const result = app.execute({
@@ -7049,7 +7082,7 @@ class ClaudeRuntime {
           actor_id: actorId,
           ...op === "approve_breaking_intent_revision" ? { next_intent: nextIntent, next_intent_ref: nextIntentRef } : {},
           ...op === "resolve_user_decision" && decisionOp ? decisionOp : {},
-          ...op === "stop" ? { reason: extra.reason ?? "user stop" } : {}
+          ...op === "stop" ? { reason: stopReason(extra.reason) } : {}
         },
         prior_intent_token: priorIntent.token,
         diffProvider: diffSnapshotOf,

package/plugins/immune-brain/runtime/assurance/coordinator.ts

@@ -17,6 +17,7 @@ import { createInvocationRegistry, type InvocationState, type InvocationToken }
 import type { ReviewBundle, ReviewManifestV5, ReviewRevision } from "./review_evidence";
 import { buildRoleDelegationPacket } from "../role_prompt_bridge";
 import type { AssuranceProjectionResult } from "../kernel/assurance_projection";
+import type { TaskIntentIdentityToken } from "../kernel/intent_token_registry";
 import type { AssuranceHostPort, HostReviewReservation } from "./host_port";
 
 export type AssuranceRole = "qa" | "review";
@@ -38,7 +39,11 @@ export interface TaskRecordRead {
 	record?: { contract?: string; findings: Array<{ kind: string; status: string }> } | null;
 }
 export interface TaskIntentRead {
-	token?: string;
+	/**
+	 * The kernel's own intent identity token. Declared as `string` before this
+	 * port was ever type checked, which is a shape no host reader has produced.
+	 */
+	token?: TaskIntentIdentityToken;
 }
 
 export interface GithubTerminalProjectionInput {
@@ -873,7 +878,17 @@ export class AssuranceCoordinator {
 		}
 	}
 
-	private unknownAfterCommit(taskId: string, operation: "qa" | "review", operationId: string, reason: string): AssuranceAdvanceResult {
+	/**
+	 * Declared as the wider advance result, which made it unusable from
+	 * `submitReview` without an implicit widen. The value has always been the
+	 * settlement_unknown member both result unions share.
+	 */
+	private unknownAfterCommit(
+		taskId: string,
+		operation: "qa" | "review",
+		operationId: string,
+		reason: string,
+	): { state: "settlement_unknown"; operation: "qa" | "review"; operation_id: string; reason: string } {
 		this.unknownOperations.set(taskId, { operation, operationId, reason });
 		return { state: "settlement_unknown", operation, operation_id: operationId, reason };
 	}

package/plugins/immune-brain/runtime/assurance/review_evidence.ts

@@ -240,14 +240,32 @@ const SNAPSHOT_IDENTITY = {
 	date: "1970-01-01T00:00:00 +0000",
 };
 
-export interface ReviewRevision {
+/**
+ * The bare synthetic-commit identity. `publishReviewRevision` can prove these
+ * five fields from Git alone; it has no manifest inputs and therefore cannot
+ * produce a digest.
+ */
+export interface ReviewRevisionCommit {
 	contract: "assurance_kernel/review_revision/v1";
 	base_head: string;
 	review_tree: string;
 	review_commit: string;
 	review_ref: string;
 	diff_hash: string;
-	manifest_digest?: string;
+}
+
+/**
+ * The full Review revision identity a host port must return.
+ *
+ * `manifest_digest` was optional here, which is the type-level hole that let a
+ * host return the bare commit identity and still satisfy
+ * `AssuranceCoordinatorPorts.ensureReviewRevision`. `submitReview` compares all
+ * four identity fields against the reservation, so an absent digest compared
+ * against a real one and failed every v4 submission at runtime instead of at
+ * build time. Requiring it makes that omission a compile error.
+ */
+export interface ReviewRevision extends ReviewRevisionCommit {
+	manifest_digest: string;
 }
 
 export interface ReviewManifestV5 {
@@ -354,7 +372,7 @@ export function publishReviewRevision(
 	snapshot: GitTaskRevisionSnapshot,
 	diffHash: string,
 	taskId: string,
-): ReviewRevision {
+): ReviewRevisionCommit {
 	if (snapshot.base_head !== snapshot.base_head.toLowerCase() || !GIT_COMMIT_ID.test(snapshot.base_head))
 		throw new Error("review revision base has invalid identity");
 	if (!REVISION_DIFF_HASH.test(diffHash)) throw new Error("review revision diff hash has invalid identity");
@@ -429,7 +447,7 @@ function publishInput(
 		scopeHint: unknown;
 		expectedDiffHash: string;
 	},
-): { snapshot: GitTaskRevisionSnapshot; revision: ReviewRevision } {
+): { snapshot: GitTaskRevisionSnapshot; revision: ReviewRevisionCommit } {
 	if (typeof input.baseHead !== "string" || !GIT_COMMIT_ID.test(input.baseHead))
 		throw new Error("review requires a TaskRecord v4 git_base_head");
 	if (!REVISION_DIFF_HASH.test(input.expectedDiffHash))
@@ -486,14 +504,6 @@ export function captureReviewManifest(
 	return manifest;
 }
 
-/** Publish and return the exact revision a v4 task must use. */
-export function ensureReviewRevision(
-	root: string,
-	input: { taskId: string; baseHead: string; scopeHint: unknown; expectedDiffHash: string },
-): ReviewRevision {
-	return publishInput(root, input).revision;
-}
-
 export function listReviewRefs(root: string): Array<{ ref: string; commit: string; taskId: string }> {
 	const output = gitEvidence(root, ["for-each-ref", "--format=%(refname) %(objectname)", `${REVIEW_REF_NAMESPACE}/`]);
 	const refs: Array<{ ref: string; commit: string; taskId: string }> = [];
@@ -534,7 +544,7 @@ export function reconcileReviewRefs(
 	return { removed, failed };
 }
 
-export function deleteReviewRef(root: string, revision: ReviewRevision): void {
+export function deleteReviewRef(root: string, revision: ReviewRevisionCommit): void {
 	const parts = revision.review_ref.split("/");
 	let validRef = false;
 	if (

package/plugins/immune-brain/runtime/claude/kernel_ports.ts

@@ -20,12 +20,12 @@ import {
 import {
 	captureReviewBundle,
 	captureReviewManifest,
-	ensureReviewRevision,
 	writeNativeReviewEvidence,
+	type ReviewRevision,
 } from "../assurance/review_evidence";
 import { parseVerificationDescriptor } from "../verification_descriptor";
-import { projectAssurance, type AssuranceProjectionResult } from "../kernel/assurance_projection";
-import type { TaskRecord } from "../kernel/types";
+import { projectAssurance, type AssuranceProjection, type AssuranceProjectionResult } from "../kernel/assurance_projection";
+import { isTaskRecordV4, type TaskApprovalV2, type TaskRecord } from "../kernel/types";
 import { readTaskRecord, readTaskRecordRaw } from "../kernel/storage";
 import { canonicalIntentHash, parseTaskIntentV1, readTaskIntent } from "../kernel/intent";
 import { capabilityActionFor, createCanaryApplication } from "../kernel/canary_application";
@@ -51,6 +51,7 @@ import {
 	isPrivilegedOperation,
 	NativeAuthorityError,
 	type NativeConfirmationPort,
+	type PrivilegedOperation,
 } from "./interaction";
 import { ClaudeReviewHost, FileHookEventLog, type ClaudeHookEvent } from "./review_host";
 import { probeHost, type PermissionMode } from "./capability";
@@ -129,10 +130,15 @@ export async function submitClaudeReview(
 	return coordinator.submitReview(taskId, ctx, verdictInput);
 }
 
+/** `extra` arrives as `Record<string, unknown>`; only a real string is a reason. */
+function stopReason(value: unknown): string {
+	return typeof value === "string" && value.length > 0 ? value : "user stop";
+}
+
 function assertProjectionBinding(before: AssuranceProjectionResult, after: AssuranceProjectionResult, allowDiffChange = false): void {
-	const fields = (allowDiffChange
+	const fields: ReadonlyArray<keyof AssuranceProjection> = allowDiffChange
 		? ["record_revision", "workspace_revision", "intent_revision", "intent_content_hash"]
-		: ["record_revision", "workspace_revision", "intent_revision", "intent_content_hash", "diff_hash"]) as const;
+		: ["record_revision", "workspace_revision", "intent_revision", "intent_content_hash", "diff_hash"];
 	if (before.error || !before.claim || after.error || !after.claim || before.claim.task_id !== after.claim.task_id
 		|| fields.some((field) => before.projection[field] !== after.projection[field])) {
 		throw new Error("Task changed after native confirmation; authority aborted before capability issuance");
@@ -146,6 +152,58 @@ function qaOutcomes(record: { attestations: Array<{ kind: string; acceptance_res
 	);
 }
 
+/**
+ * Publish the task-scoped synthetic revision for a v4 record and return the
+ * exact identity the Review snapshot binds.
+ *
+ * `submitReview` re-derives this identity and compares all four fields —
+ * `manifest_digest` included — against the reservation. Returning the bare
+ * commit identity therefore compared a real digest against `undefined` and
+ * failed every v4 submission with "Review revision changed before submission",
+ * so the manifest is recomputed here rather than only the commit. The outcomes
+ * come from the same `qaOutcomes` the Review snapshot is built from, which
+ * makes the two digests equal by construction instead of by coincidence.
+ *
+ * v3 records keep the legacy full-source bundle and return null.
+ */
+export async function ensureClaudeReviewRevision(
+	root: string,
+	taskId: string,
+	projection: AssuranceProjectionResult,
+): Promise<ReviewRevision | null> {
+	const current = await readTaskRecord(root, taskId);
+	const record = current.record;
+	if (!record) throw new Error(`task ${taskId} has no TaskRecord`);
+	if (current.revision !== projection.projection.record_revision)
+		throw new Error("TaskRecord changed before Review revision preparation");
+	if (record.contract !== "assurance_kernel/task_record/v4") return null;
+	if (!record.git_base_head)
+		throw new Error("Review revision requires a TaskRecord v4 git_base_head");
+	const manifest = captureReviewManifest(root, {
+		taskId,
+		baseHead: record.git_base_head,
+		scopeHint: record.intent_snapshot.scope_hint,
+		expectedDiffHash: projection.projection.diff_hash,
+		intentRevision: projection.projection.intent_revision,
+		intentContentHash: projection.projection.intent_content_hash,
+		recordRevision: projection.projection.record_revision,
+		workspaceRevision: projection.projection.workspace_revision,
+		lifecycle: projection.projection.lifecycle,
+		artifactState: projection.projection.artifact_state,
+		risk: record.intent_snapshot.risk,
+		outcomes: qaOutcomes(record),
+	});
+	return {
+		contract: "assurance_kernel/review_revision/v1",
+		base_head: manifest.base_head,
+		review_tree: manifest.review_tree,
+		review_commit: manifest.review_commit,
+		review_ref: manifest.review_ref,
+		diff_hash: manifest.diff_hash,
+		manifest_digest: manifest.manifest_digest,
+	};
+}
+
 async function buildAssuranceSnapshot(
 	root: string,
 	taskId: string,
@@ -153,23 +211,25 @@ async function buildAssuranceSnapshot(
 	projection: AssuranceProjectionResult,
 	runner: FrozenRunner,
 ) {
-	const record = await readTaskRecord(root, taskId);
-	if (!record.record || record.revision !== projection.projection.record_revision) throw new Error("TaskRecord changed before assurance snapshot capture");
-	const intent = record.record.intent_snapshot;
+	const read = await readTaskRecord(root, taskId);
+	const record = read.record;
+	if (!record || read.revision !== projection.projection.record_revision) throw new Error("TaskRecord changed before assurance snapshot capture");
+	const intent = record.intent_snapshot;
 	const descriptors = new Map<string, VerificationDescriptor>();
 	for (const item of intent.acceptance) {
 		const descriptor = parseVerificationDescriptor(item.verification);
 		assertRunnerCompatible(descriptor, runner);
 		descriptors.set(item.id, descriptor);
 	}
-	const v4 = record.record.contract === "assurance_kernel/task_record/v4";
-	const reviewBundle = role === "review" && !v4
-		? captureReviewBundle(root, intent.scope_hint, projection.projection.diff_hash, qaOutcomes(record.record))
+	// `git_base_head` exists only on TaskRecord v4, so this must narrow the union
+	// rather than test the contract string into a plain boolean.
+	const reviewBundle = role === "review" && !isTaskRecordV4(record)
+		? captureReviewBundle(root, intent.scope_hint, projection.projection.diff_hash, qaOutcomes(record))
 		: null;
-	const reviewManifest = role === "review" && v4
+	const reviewManifest = role === "review" && isTaskRecordV4(record)
 		? captureReviewManifest(root, {
 			taskId,
-			baseHead: record.record.git_base_head,
+			baseHead: record.git_base_head,
 			scopeHint: intent.scope_hint,
 			expectedDiffHash: projection.projection.diff_hash,
 			intentRevision: projection.projection.intent_revision,
@@ -179,7 +239,7 @@ async function buildAssuranceSnapshot(
 			lifecycle: projection.projection.lifecycle,
 			artifactState: projection.projection.artifact_state,
 			risk: intent.risk,
-			outcomes: qaOutcomes(record.record),
+			outcomes: qaOutcomes(record),
 		})
 		: null;
 	const dirtyFiles = reviewManifest ? Object.keys(reviewManifest.changed_paths) : reviewBundle ? Object.keys(reviewBundle.dirty_files) : [];
@@ -295,7 +355,13 @@ export interface ClaudeRuntimeOptions {
 	cwd: string;
 	env?: Record<string, string | undefined>;
 	host?: ClaudeReviewHost;
-	ports?: AssuranceCoordinatorPorts;
+	/**
+	 * Overrides layered on top of the real production ports, never a
+	 * replacement for them. A whole synthetic ports object could previously be
+	 * substituted here, so a suite could pass while the object production
+	 * actually wires was never constructed once.
+	 */
+	ports?: Partial<AssuranceCoordinatorPorts>;
 	interactive?: boolean;
 	permissionMode?: PermissionMode;
 	requestConfirmation?: NativeConfirmationPort;
@@ -319,11 +385,11 @@ export class ClaudeRuntime {
 		this.interactive = options.interactive ?? true;
 		this.requestConfirmation = options.requestConfirmation;
 		this.host = options.host ?? new ClaudeReviewHost(new FileHookEventLog());
-		if (options.ports) {
-			this.coordinator = new AssuranceCoordinator({ ...options.ports, host: this.host });
-			return;
-		}
-		this.coordinator = new AssuranceCoordinator(this.createKernelPorts());
+		this.coordinator = new AssuranceCoordinator({
+			...this.createKernelPorts(),
+			...options.ports,
+			host: this.host,
+		});
 	}
 
 	observe(event: ClaudeHookEvent): void {
@@ -343,25 +409,25 @@ export class ClaudeRuntime {
 		await this.coordinator.onSessionShutdown();
 	}
 
+	/**
+	 * The exact ports object the coordinator runs on. Public so a conformance
+	 * suite can drive what production wires instead of a hand-built double: the
+	 * host adapter defects that reached published plugins all lived in this
+	 * object and none of them were reachable from a test while it was private.
+	 */
+	kernelPorts(): AssuranceCoordinatorPorts {
+		return this.createKernelPorts();
+	}
+
 	private createKernelPorts(): AssuranceCoordinatorPorts {
 		return {
 			host: this.host,
 			projectTask: (root, taskId) => projectAssurance(root, taskId, diffSnapshotOf),
-			readTaskRecord: (root, taskId) => readTaskRecord(root, taskId),
-			readTaskIntent: (root, taskId) => readTaskIntentForRecord(root, taskId),
+			readTaskRecord: async (root, taskId) => readTaskRecord(root, taskId),
+			readTaskIntent: async (root, taskId) => readTaskIntentForRecord(root, taskId),
 			frozenRunner: async () => resolveBunRunner(),
 			buildAssurance: (root, taskId, role, projection, runner) => buildAssuranceSnapshot(root, taskId, role, projection, runner),
-			ensureReviewRevision: async (root, taskId, projection) => {
-				const current = await readTaskRecord(root, taskId);
-				if (!current.record) throw new Error(`task ${taskId} has no TaskRecord`);
-				if (current.record.contract !== "assurance_kernel/task_record/v4") return null;
-				return ensureReviewRevision(root, {
-					taskId,
-					baseHead: current.record.git_base_head,
-					scopeHint: current.record.intent_snapshot.scope_hint,
-					expectedDiffHash: projection.projection.diff_hash,
-				});
-			},
+			ensureReviewRevision: (root, taskId, projection) => ensureClaudeReviewRevision(root, taskId, projection),
 			runQa: (snapshot, descriptors, runner, options) => runDeterministicQa(snapshot, descriptors, runner, options),
 			writeReviewEvidence: (input) => writeNativeReviewEvidence(input.evidence),
 			applyVerdict: (ctx, input) => this.applyVerdict(ctx, input),
@@ -468,7 +534,7 @@ export class ClaudeRuntime {
 			return repairKernelAuthority(this.cwd, taskId, authority.revision);
 		}
 		if (!isPrivilegedOperation(operation) && operation !== "request_authorization") throw new Error(`unsupported privileged operation ${operation}`);
-		let op = operation;
+		let op: PrivilegedOperation | "request_authorization" | "resolve_user_decision" = operation;
 		let decisionOp: { finding_id: string; resolution: string } | undefined;
 		const projection = await this.status(taskId);
 		if (projection.error || !projection.claim) throw new Error(projection.error ?? "no active backend claim");
@@ -584,7 +650,7 @@ export class ClaudeRuntime {
 				confirmation_ref: confirmation,
 				...(op === "approve_breaking_intent_revision" ? { next_intent: nextIntent, next_intent_ref: nextIntentRef } : {}),
 				...(op === "resolve_user_decision" && decisionOp ? decisionOp : {}),
-				...(op === "stop" ? { reason: extra.reason ?? "user stop" } : {}),
+				...(op === "stop" ? { reason: stopReason(extra.reason) } : {}),
 			});
 			throwIfCancelled(meta.signal);
 			const result = app.execute({
@@ -596,7 +662,7 @@ export class ClaudeRuntime {
 					actor_id: actorId,
 					...(op === "approve_breaking_intent_revision" ? { next_intent: nextIntent, next_intent_ref: nextIntentRef } : {}),
 					...(op === "resolve_user_decision" && decisionOp ? decisionOp : {}),
-					...(op === "stop" ? { reason: extra.reason ?? "user stop" } : {}),
+					...(op === "stop" ? { reason: stopReason(extra.reason) } : {}),
 				} as never,
 				prior_intent_token: priorIntent.token,
 				diffProvider: diffSnapshotOf,
@@ -672,7 +738,7 @@ export class ClaudeRuntime {
 			stagePlanningArtifactTransition(ctx.cwd, result.record);
 			return;
 		}
-		const approval = {
+		const approval: TaskApprovalV2 = {
 			id: `approval-${input.snapshot.role}-${randomUUID().slice(0, 8)}`,
 			kind: input.snapshot.role === "qa" ? "qa" : "review",
 			authority_role: input.snapshot.role === "qa" ? "qa" : "reviewer",

package/plugins/immune-brain/runtime/claude/review_host.ts

@@ -271,16 +271,6 @@ interface PendingReview {
 	error?: string;
 }
 
-function matchesReservation(event: ClaudeHookEvent, pending: PendingReview): boolean {
-	if ("operationId" in event && event.operationId && event.operationId !== pending.request.operationId) return false;
-	if ("taskId" in event && event.taskId && event.taskId !== pending.request.taskId) return false;
-	if (pending.sessionId && event.sessionId !== pending.sessionId) return false;
-	const eventAgentId = "agentId" in event ? event.agentId : "";
-	if (event.type === "SubagentStop" && (!eventAgentId || !pending.agentId || eventAgentId !== pending.agentId)) return false;
-	if (pending.agentId && eventAgentId && eventAgentId !== pending.agentId) return false;
-	return true;
-}
-
 function bindsStart(event: Extract<ClaudeHookEvent, { type: "SubagentStart" }>, pending: PendingReview): boolean {
 	if (event.taskId && event.taskId !== pending.request.taskId) return false;
 	if (event.prompt !== undefined) {

package/plugins/immune-brain/runtime/github_issue_tracker.ts

@@ -275,8 +275,8 @@ export function createGhTransport(binary = "gh"): GhTransport {
 	return {
 		run(args, options = {}) {
 			return new Promise((complete) => {
-				let stdout = Buffer.alloc(0);
-				let stderr = Buffer.alloc(0);
+				let stdout: Buffer = Buffer.alloc(0);
+				let stderr: Buffer = Buffer.alloc(0);
 				let timedOut = false;
 				let outputExceeded = false;
 				let timer: ReturnType<typeof setTimeout> | undefined;
@@ -304,7 +304,7 @@ export function createGhTransport(binary = "gh"): GhTransport {
 					finish(1, error instanceof Error ? error.message : String(error));
 					return;
 				}
-				const append = (current: Buffer, chunk: Buffer): Buffer => {
+				const append = (current: Buffer, chunk: Uint8Array): Buffer => {
 					const available = Math.max(0, MAX_GH_OUTPUT - stdout.length - stderr.length);
 					if (chunk.length > available) {
 						outputExceeded = true;
@@ -312,17 +312,22 @@ export function createGhTransport(binary = "gh"): GhTransport {
 					}
 					return available > 0 ? Buffer.concat([current, chunk.subarray(0, available)]) : current;
 				};
-				child.stdout.on("data", (chunk: Buffer) => { stdout = append(stdout, chunk); });
-				child.stderr.on("data", (chunk: Buffer) => { stderr = append(stderr, chunk); });
+				const { stdout: childOut, stderr: childErr, stdin: childIn } = child;
+				if (!childOut || !childErr || !childIn) {
+					finish(1, "gh was spawned without the stdio pipes this reader requires");
+					return;
+				}
+				childOut.on("data", (chunk: Uint8Array) => { stdout = append(stdout, chunk); });
+				childErr.on("data", (chunk: Uint8Array) => { stderr = append(stderr, chunk); });
 				child.once("error", (error) => { finish(1, error.message); });
-				child.stdin.once("error", (error) => { finish(1, error.message); });
+				childIn.once("error", (error) => { finish(1, error.message); });
 				timer = setTimeout(() => {
 					timedOut = true;
 					child.kill("SIGKILL");
 				}, GH_TIMEOUT_MS);
 				child.once("close", (code) => { finish(code ?? 1); });
 				try {
-					child.stdin.end(options.stdin ?? "");
+					childIn.end(options.stdin ?? "");
 				} catch (error) {
 					finish(1, error instanceof Error ? error.message : String(error));
 				}
@@ -371,7 +376,7 @@ function parseSubIssueNumbers(raw: string): number[] {
 	if (!Array.isArray(pages)) throw new Error("gh returned malformed Sub-issue list");
 	return pages.map((item, index) => {
 		const number = (item as { number?: unknown })?.number;
-		if (!Number.isSafeInteger(number)) throw new Error(`gh returned a malformed Sub-issue entry at ${index}`);
+		if (typeof number !== "number" || !Number.isSafeInteger(number)) throw new Error(`gh returned a malformed Sub-issue entry at ${index}`);
 		return number;
 	});
 }

package/plugins/immune-brain/runtime/kernel/application.ts

@@ -260,6 +260,11 @@ export function applyTaskAction(
 		}
 
 		if (input.terminal) {
+			// A tombstone may only record a terminal lifecycle. Nothing upstream
+			// proved that, so an active record could have been tombstoned as
+			// `terminal_lifecycle: "active"` in violation of its own contract.
+			if (nextRecord.lifecycle === "active")
+				throw new Error("terminal settlement requires a done or stopped TaskRecord lifecycle");
 			const tombstone: TaskTombstone = {
 				contract: TASK_TOMBSTONE_CONTRACT,
 				task_id,

package/plugins/immune-brain/runtime/kernel/enrollment.ts

@@ -244,6 +244,10 @@ export function enrollCanaryTask(
 			// consume immediately before the marker write
 			registry.consume(input.capability, input.capability_binding);
 
+			// Set by beforeLock above, which throws when the repository has no
+			// committed HEAD. Re-assert it here: the compiler cannot carry a
+			// closure's narrowing across to this one.
+			if (!gitBaseHead) throw new Error("enrollment requires a committed Git HEAD");
 			const record = buildTaskRecordV4(input, checks.intent, gitBaseHead);
 			const nextWorkspace: WorkspaceStateLike = {
 				...checks.workspace.state,

package/plugins/immune-brain/runtime/kernel/index.ts

@@ -19,6 +19,8 @@ export {
 	appendJournalEntry,
 	KernelStoreSecurityError,
 	setAfterTaskTransactionWriteForTest,
+	type JournalEntry,
+	type JournalReasonCode,
 } from "./storage";
 export {
 	reduceTask,

package/plugins/immune-brain/runtime/kernel/observation.ts

@@ -229,10 +229,12 @@ export function buildAuthorityObservationSeedV2(
 function committedReceiptV2(
 	receipt: AuthorityCommitReceipt,
 ): receipt is AuthorityCommitReceipt & {
+	contract: "assurance_kernel/authority_commit_receipt/v2";
 	status: "committed" | "recovered_committed";
 	observation_seed: AuthorityObservationSeedV2;
 } {
 	return (
+		receipt.contract === "assurance_kernel/authority_commit_receipt/v2" &&
 		(receipt.status === "committed" ||
 			receipt.status === "recovered_committed") &&
 		receipt.observation_seed !== undefined

package/plugins/immune-brain/runtime/kernel/storage.ts

@@ -78,7 +78,22 @@ export type JournalReasonCode =
 	| "source_read_failed"
 	| "shadow_divergence"
 	| "migration_ambiguous"
-	| "readiness_query_nonqualifying";
+	| "readiness_query_nonqualifying"
+	// Emitted by runtime/commands/kernel.ts. Absent from this union until the
+	// journal types were first exported and type checked.
+	| "routing_policy_invalid"
+	| "routing_unavailable"
+	| "kernel_owner_active"
+	| "v3_owner_nonterminal"
+	| "input_oversize"
+	| "input_invalid"
+	| "intent_invalid"
+	| "task_path_mismatch"
+	| "destination_invalid"
+	| "destination_parent_invalid"
+	| "destination_parent_missing"
+	| "destination_exists"
+	| "destination_write_failed";
 
 export interface JournalEntry {
 	contract: "assurance_kernel/journal/v1";
@@ -1337,7 +1352,7 @@ export function commitEnrollmentLocked(
 	taskId: string,
 	transaction: WorkspaceTransactionV2,
 	claim: Record<string, unknown>,
-): { record: TaskRecordV2; workspace: WorkspaceState } {
+): { record: TaskRecord; workspace: WorkspaceState } {
 	const marker: EnrollmentMarker = {
 		contract: "assurance_kernel/enrollment_transaction/v1",
 		task_id: taskId,

package/plugins/immune-brain/runtime/kernel/storage_layout_migration.ts

@@ -700,7 +700,7 @@ export function migrateLegacyLayout(root: string): MigrationOutcome {
 			affected_paths: initial.dirty_affected_paths,
 			reason: initial.reason,
 		};
-	if (["migration_blocked_active", "invalid"].includes(initial.layout))
+	if (initial.layout === "migration_blocked_active" || initial.layout === "invalid")
 		return {
 			contract: "immune_brain/storage_layout_migration_result/v1",
 			outcome: initial.layout,

package/plugins/immune-brain/runtime/kernel/storage_paths.ts

@@ -242,10 +242,6 @@ function inspectOldLayout(root: string): OldLayoutFacts {
 				facts.blocked_active = true;
 				continue;
 			}
-			if (kind === "marker") {
-				facts.pending_marker ??= path;
-				continue;
-			}
 			if (kind === "claim") {
 				facts.blocked_active = true;
 				continue;

package/plugins/immune-brain/runtime/kernel/types.ts

@@ -235,6 +235,15 @@ export interface TaskRecordV4 extends Omit<TaskRecordV3, "contract"> {
 /** The record shape every Kernel owner passes around during the v3 drain window. */
 export type TaskRecord = TaskRecordV3 | TaskRecordV4;
 
+/**
+ * Narrow the stored record union before reading a v4-only field such as
+ * `git_base_head`. Comparing `record.contract` into a plain boolean does not
+ * narrow, which let adapters read v4 fields off a v3-shaped value unchecked.
+ */
+export function isTaskRecordV4(record: TaskRecord): record is TaskRecordV4 {
+	return record.contract === TASK_RECORD_CONTRACT_V4;
+}
+
 export interface TaskProjectionV3 extends CompletionDecision {
 	contract: "assurance_kernel/projection/v3";
 	task_id: string;

package/plugins/immune-brain/runtime/managed_task_routing_policy.ts

@@ -26,7 +26,7 @@
 
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import {
+import { type Stats,
 	closeSync,
 	constants as fsConstants,
 	fstatSync,
@@ -145,7 +145,7 @@ export function setRoutingPolicyReaderTestHook(
 	routingPolicyReaderTestHook = hook;
 }
 
-function statIdentity(stat: ReturnType<typeof statSync>): {
+function statIdentity(stat: Stats): {
 	dev: number;
 	ino: number;
 	size: number;

package/plugins/immune-brain/runtime/plugin_version.ts

@@ -1,2 +1,2 @@
 // Generated by scripts/plugin_versioning.ts from the root package.json.
-export const PLUGIN_VERSION = "3.6.3" as const;
+export const PLUGIN_VERSION = "3.6.4" as const;