immune-brain 3.6.3 → 3.6.5

package/plugins/immune-brain/runtime/assurance/coordinator.ts

@@ -17,6 +17,7 @@ import { createInvocationRegistry, type InvocationState, type InvocationToken }
 import type { ReviewBundle, ReviewManifestV5, ReviewRevision } from "./review_evidence";
 import { buildRoleDelegationPacket } from "../role_prompt_bridge";
 import type { AssuranceProjectionResult } from "../kernel/assurance_projection";
+import type { TaskIntentIdentityToken } from "../kernel/intent_token_registry";
 import type { AssuranceHostPort, HostReviewReservation } from "./host_port";
 
 export type AssuranceRole = "qa" | "review";
@@ -38,7 +39,11 @@ export interface TaskRecordRead {
 	record?: { contract?: string; findings: Array<{ kind: string; status: string }> } | null;
 }
 export interface TaskIntentRead {
-	token?: string;
+	/**
+	 * The kernel's own intent identity token. Declared as `string` before this
+	 * port was ever type checked, which is a shape no host reader has produced.
+	 */
+	token?: TaskIntentIdentityToken;
 }
 
 export interface GithubTerminalProjectionInput {
@@ -431,6 +436,7 @@ export class AssuranceCoordinator {
 	sessionGenerationValue(): number { return this.sessionGeneration; }
 
 	async advance(taskId: string, ctx: HostContext, signal?: AbortSignal, onUpdate?: (update: ForegroundToolUpdate) => void): Promise<AssuranceAdvanceResult> {
+		if (this.isInvocationOpen(taskId)) return { state: "blocked", reason: "an authority invocation is already open" };
 		const active = this.active(taskId);
 		if (active?.state === "review_ready") {
 			const reservation = this.reviewReservations.get(taskId);
@@ -814,6 +820,17 @@ export class AssuranceCoordinator {
 		return { state: "blocked", reason: `Kernel requires ${settled.projection.next_obligation} after Review` };
 	}
 
+	isReviewVerdictValid(taskId: string, verdictInput: unknown): boolean {
+		const reservation = this.reviewReservations.get(taskId);
+		if (!reservation) return false;
+		try {
+			parseAssuranceVerdict(verdictInput, reservation.snapshot);
+			return true;
+		} catch {
+			return false;
+		}
+	}
+
 	abandonReview(taskId: string, reason: string): AssuranceSubmitReviewResult {
 		const reservation = this.reviewReservations.get(taskId);
 		if (!reservation) return { state: "blocked", reason };
@@ -828,6 +845,12 @@ export class AssuranceCoordinator {
 		return { state: "review_ready", operation: "review", operation_id: reservation.operationId, snapshot_digest: snapshotDigest(reservation.snapshot), review_bundle_digest: reservation.snapshot.review_bundle_digest ?? "", agent_params: reservation.hostReservation.dispatch };
 	}
 
+	releaseStoppedReview(taskId: string): void {
+		const reservation = this.reviewReservations.get(taskId);
+		if (reservation) this.releaseReviewReservation(taskId, reservation);
+		this.rejectedReviewOperations.delete(taskId);
+	}
+
 	private releaseReviewReservation(taskId: string, reservation: ReviewReservation, rejectionReason?: string): void {
 		if (this.reviewReservations.get(taskId) !== reservation) return;
 		this.reviewReservations.delete(taskId);
@@ -873,7 +896,17 @@ export class AssuranceCoordinator {
 		}
 	}
 
-	private unknownAfterCommit(taskId: string, operation: "qa" | "review", operationId: string, reason: string): AssuranceAdvanceResult {
+	/**
+	 * Declared as the wider advance result, which made it unusable from
+	 * `submitReview` without an implicit widen. The value has always been the
+	 * settlement_unknown member both result unions share.
+	 */
+	private unknownAfterCommit(
+		taskId: string,
+		operation: "qa" | "review",
+		operationId: string,
+		reason: string,
+	): { state: "settlement_unknown"; operation: "qa" | "review"; operation_id: string; reason: string } {
 		this.unknownOperations.set(taskId, { operation, operationId, reason });
 		return { state: "settlement_unknown", operation, operation_id: operationId, reason };
 	}

package/plugins/immune-brain/runtime/assurance/review_evidence.ts

@@ -240,14 +240,32 @@ const SNAPSHOT_IDENTITY = {
 	date: "1970-01-01T00:00:00 +0000",
 };
 
-export interface ReviewRevision {
+/**
+ * The bare synthetic-commit identity. `publishReviewRevision` can prove these
+ * five fields from Git alone; it has no manifest inputs and therefore cannot
+ * produce a digest.
+ */
+export interface ReviewRevisionCommit {
 	contract: "assurance_kernel/review_revision/v1";
 	base_head: string;
 	review_tree: string;
 	review_commit: string;
 	review_ref: string;
 	diff_hash: string;
-	manifest_digest?: string;
+}
+
+/**
+ * The full Review revision identity a host port must return.
+ *
+ * `manifest_digest` was optional here, which is the type-level hole that let a
+ * host return the bare commit identity and still satisfy
+ * `AssuranceCoordinatorPorts.ensureReviewRevision`. `submitReview` compares all
+ * four identity fields against the reservation, so an absent digest compared
+ * against a real one and failed every v4 submission at runtime instead of at
+ * build time. Requiring it makes that omission a compile error.
+ */
+export interface ReviewRevision extends ReviewRevisionCommit {
+	manifest_digest: string;
 }
 
 export interface ReviewManifestV5 {
@@ -354,7 +372,7 @@ export function publishReviewRevision(
 	snapshot: GitTaskRevisionSnapshot,
 	diffHash: string,
 	taskId: string,
-): ReviewRevision {
+): ReviewRevisionCommit {
 	if (snapshot.base_head !== snapshot.base_head.toLowerCase() || !GIT_COMMIT_ID.test(snapshot.base_head))
 		throw new Error("review revision base has invalid identity");
 	if (!REVISION_DIFF_HASH.test(diffHash)) throw new Error("review revision diff hash has invalid identity");
@@ -429,7 +447,7 @@ function publishInput(
 		scopeHint: unknown;
 		expectedDiffHash: string;
 	},
-): { snapshot: GitTaskRevisionSnapshot; revision: ReviewRevision } {
+): { snapshot: GitTaskRevisionSnapshot; revision: ReviewRevisionCommit } {
 	if (typeof input.baseHead !== "string" || !GIT_COMMIT_ID.test(input.baseHead))
 		throw new Error("review requires a TaskRecord v4 git_base_head");
 	if (!REVISION_DIFF_HASH.test(input.expectedDiffHash))
@@ -486,14 +504,6 @@ export function captureReviewManifest(
 	return manifest;
 }
 
-/** Publish and return the exact revision a v4 task must use. */
-export function ensureReviewRevision(
-	root: string,
-	input: { taskId: string; baseHead: string; scopeHint: unknown; expectedDiffHash: string },
-): ReviewRevision {
-	return publishInput(root, input).revision;
-}
-
 export function listReviewRefs(root: string): Array<{ ref: string; commit: string; taskId: string }> {
 	const output = gitEvidence(root, ["for-each-ref", "--format=%(refname) %(objectname)", `${REVIEW_REF_NAMESPACE}/`]);
 	const refs: Array<{ ref: string; commit: string; taskId: string }> = [];
@@ -534,7 +544,7 @@ export function reconcileReviewRefs(
 	return { removed, failed };
 }
 
-export function deleteReviewRef(root: string, revision: ReviewRevision): void {
+export function deleteReviewRef(root: string, revision: ReviewRevisionCommit): void {
 	const parts = revision.review_ref.split("/");
 	let validRef = false;
 	if (

package/plugins/immune-brain/runtime/claude/kernel_ports.ts

@@ -20,12 +20,12 @@ import {
 import {
 	captureReviewBundle,
 	captureReviewManifest,
-	ensureReviewRevision,
 	writeNativeReviewEvidence,
+	type ReviewRevision,
 } from "../assurance/review_evidence";
 import { parseVerificationDescriptor } from "../verification_descriptor";
-import { projectAssurance, type AssuranceProjectionResult } from "../kernel/assurance_projection";
-import type { TaskRecord } from "../kernel/types";
+import { projectAssurance, type AssuranceProjection, type AssuranceProjectionResult } from "../kernel/assurance_projection";
+import { isTaskRecordV4, type TaskApprovalV2, type TaskRecord } from "../kernel/types";
 import { readTaskRecord, readTaskRecordRaw } from "../kernel/storage";
 import { canonicalIntentHash, parseTaskIntentV1, readTaskIntent } from "../kernel/intent";
 import { capabilityActionFor, createCanaryApplication } from "../kernel/canary_application";
@@ -51,6 +51,7 @@ import {
 	isPrivilegedOperation,
 	NativeAuthorityError,
 	type NativeConfirmationPort,
+	type PrivilegedOperation,
 } from "./interaction";
 import { ClaudeReviewHost, FileHookEventLog, type ClaudeHookEvent } from "./review_host";
 import { probeHost, type PermissionMode } from "./capability";
@@ -118,21 +119,29 @@ export async function submitClaudeReview(
 		if (observed.release) return coordinator.abandonReview(taskId, observed.reason);
 		return { state: "blocked", reason: observed.reason };
 	}
-	const parentJson = extractVerdictJson(verdictInput);
-	const receiptJson = extractVerdictJson(observed.receipt.result);
-	if (parentJson && receiptJson && verdictFingerprint(parentJson) !== verdictFingerprint(receiptJson)) {
-		return { state: "blocked", reason: "parent verdict does not match reviewer receipt" };
+	const parentValid = coordinator.isReviewVerdictValid(taskId, verdictInput);
+	if (!parentValid) return coordinator.submitReview(taskId, ctx, verdictInput);
+	const receiptValid = coordinator.isReviewVerdictValid(taskId, observed.receipt.result);
+	if (!receiptValid) {
+		return coordinator.abandonReview(taskId, "reviewer receipt is not a valid verdict");
 	}
-	if (parentJson && !receiptJson) {
-		return { state: "blocked", reason: "reviewer receipt is not a valid verdict" };
+	const parentJson = extractVerdictJson(verdictInput)!;
+	const receiptJson = extractVerdictJson(observed.receipt.result)!;
+	if (verdictFingerprint(parentJson) !== verdictFingerprint(receiptJson)) {
+		return { state: "blocked", reason: "parent verdict does not match reviewer receipt" };
 	}
 	return coordinator.submitReview(taskId, ctx, verdictInput);
 }
 
+/** `extra` arrives as `Record<string, unknown>`; only a real string is a reason. */
+function stopReason(value: unknown): string {
+	return typeof value === "string" && value.length > 0 ? value : "user stop";
+}
+
 function assertProjectionBinding(before: AssuranceProjectionResult, after: AssuranceProjectionResult, allowDiffChange = false): void {
-	const fields = (allowDiffChange
+	const fields: ReadonlyArray<keyof AssuranceProjection> = allowDiffChange
 		? ["record_revision", "workspace_revision", "intent_revision", "intent_content_hash"]
-		: ["record_revision", "workspace_revision", "intent_revision", "intent_content_hash", "diff_hash"]) as const;
+		: ["record_revision", "workspace_revision", "intent_revision", "intent_content_hash", "diff_hash"];
 	if (before.error || !before.claim || after.error || !after.claim || before.claim.task_id !== after.claim.task_id
 		|| fields.some((field) => before.projection[field] !== after.projection[field])) {
 		throw new Error("Task changed after native confirmation; authority aborted before capability issuance");
@@ -146,6 +155,58 @@ function qaOutcomes(record: { attestations: Array<{ kind: string; acceptance_res
 	);
 }
 
+/**
+ * Publish the task-scoped synthetic revision for a v4 record and return the
+ * exact identity the Review snapshot binds.
+ *
+ * `submitReview` re-derives this identity and compares all four fields —
+ * `manifest_digest` included — against the reservation. Returning the bare
+ * commit identity therefore compared a real digest against `undefined` and
+ * failed every v4 submission with "Review revision changed before submission",
+ * so the manifest is recomputed here rather than only the commit. The outcomes
+ * come from the same `qaOutcomes` the Review snapshot is built from, which
+ * makes the two digests equal by construction instead of by coincidence.
+ *
+ * v3 records keep the legacy full-source bundle and return null.
+ */
+export async function ensureClaudeReviewRevision(
+	root: string,
+	taskId: string,
+	projection: AssuranceProjectionResult,
+): Promise<ReviewRevision | null> {
+	const current = await readTaskRecord(root, taskId);
+	const record = current.record;
+	if (!record) throw new Error(`task ${taskId} has no TaskRecord`);
+	if (current.revision !== projection.projection.record_revision)
+		throw new Error("TaskRecord changed before Review revision preparation");
+	if (record.contract !== "assurance_kernel/task_record/v4") return null;
+	if (!record.git_base_head)
+		throw new Error("Review revision requires a TaskRecord v4 git_base_head");
+	const manifest = captureReviewManifest(root, {
+		taskId,
+		baseHead: record.git_base_head,
+		scopeHint: record.intent_snapshot.scope_hint,
+		expectedDiffHash: projection.projection.diff_hash,
+		intentRevision: projection.projection.intent_revision,
+		intentContentHash: projection.projection.intent_content_hash,
+		recordRevision: projection.projection.record_revision,
+		workspaceRevision: projection.projection.workspace_revision,
+		lifecycle: projection.projection.lifecycle,
+		artifactState: projection.projection.artifact_state,
+		risk: record.intent_snapshot.risk,
+		outcomes: qaOutcomes(record),
+	});
+	return {
+		contract: "assurance_kernel/review_revision/v1",
+		base_head: manifest.base_head,
+		review_tree: manifest.review_tree,
+		review_commit: manifest.review_commit,
+		review_ref: manifest.review_ref,
+		diff_hash: manifest.diff_hash,
+		manifest_digest: manifest.manifest_digest,
+	};
+}
+
 async function buildAssuranceSnapshot(
 	root: string,
 	taskId: string,
@@ -153,23 +214,25 @@ async function buildAssuranceSnapshot(
 	projection: AssuranceProjectionResult,
 	runner: FrozenRunner,
 ) {
-	const record = await readTaskRecord(root, taskId);
-	if (!record.record || record.revision !== projection.projection.record_revision) throw new Error("TaskRecord changed before assurance snapshot capture");
-	const intent = record.record.intent_snapshot;
+	const read = await readTaskRecord(root, taskId);
+	const record = read.record;
+	if (!record || read.revision !== projection.projection.record_revision) throw new Error("TaskRecord changed before assurance snapshot capture");
+	const intent = record.intent_snapshot;
 	const descriptors = new Map<string, VerificationDescriptor>();
 	for (const item of intent.acceptance) {
 		const descriptor = parseVerificationDescriptor(item.verification);
 		assertRunnerCompatible(descriptor, runner);
 		descriptors.set(item.id, descriptor);
 	}
-	const v4 = record.record.contract === "assurance_kernel/task_record/v4";
-	const reviewBundle = role === "review" && !v4
-		? captureReviewBundle(root, intent.scope_hint, projection.projection.diff_hash, qaOutcomes(record.record))
+	// `git_base_head` exists only on TaskRecord v4, so this must narrow the union
+	// rather than test the contract string into a plain boolean.
+	const reviewBundle = role === "review" && !isTaskRecordV4(record)
+		? captureReviewBundle(root, intent.scope_hint, projection.projection.diff_hash, qaOutcomes(record))
 		: null;
-	const reviewManifest = role === "review" && v4
+	const reviewManifest = role === "review" && isTaskRecordV4(record)
 		? captureReviewManifest(root, {
 			taskId,
-			baseHead: record.record.git_base_head,
+			baseHead: record.git_base_head,
 			scopeHint: intent.scope_hint,
 			expectedDiffHash: projection.projection.diff_hash,
 			intentRevision: projection.projection.intent_revision,
@@ -179,7 +242,7 @@ async function buildAssuranceSnapshot(
 			lifecycle: projection.projection.lifecycle,
 			artifactState: projection.projection.artifact_state,
 			risk: intent.risk,
-			outcomes: qaOutcomes(record.record),
+			outcomes: qaOutcomes(record),
 		})
 		: null;
 	const dirtyFiles = reviewManifest ? Object.keys(reviewManifest.changed_paths) : reviewBundle ? Object.keys(reviewBundle.dirty_files) : [];
@@ -295,7 +358,13 @@ export interface ClaudeRuntimeOptions {
 	cwd: string;
 	env?: Record<string, string | undefined>;
 	host?: ClaudeReviewHost;
-	ports?: AssuranceCoordinatorPorts;
+	/**
+	 * Overrides layered on top of the real production ports, never a
+	 * replacement for them. A whole synthetic ports object could previously be
+	 * substituted here, so a suite could pass while the object production
+	 * actually wires was never constructed once.
+	 */
+	ports?: Partial<AssuranceCoordinatorPorts>;
 	interactive?: boolean;
 	permissionMode?: PermissionMode;
 	requestConfirmation?: NativeConfirmationPort;
@@ -319,11 +388,11 @@ export class ClaudeRuntime {
 		this.interactive = options.interactive ?? true;
 		this.requestConfirmation = options.requestConfirmation;
 		this.host = options.host ?? new ClaudeReviewHost(new FileHookEventLog());
-		if (options.ports) {
-			this.coordinator = new AssuranceCoordinator({ ...options.ports, host: this.host });
-			return;
-		}
-		this.coordinator = new AssuranceCoordinator(this.createKernelPorts());
+		this.coordinator = new AssuranceCoordinator({
+			...this.createKernelPorts(),
+			...options.ports,
+			host: this.host,
+		});
 	}
 
 	observe(event: ClaudeHookEvent): void {
@@ -343,25 +412,25 @@ export class ClaudeRuntime {
 		await this.coordinator.onSessionShutdown();
 	}
 
+	/**
+	 * The exact ports object the coordinator runs on. Public so a conformance
+	 * suite can drive what production wires instead of a hand-built double: the
+	 * host adapter defects that reached published plugins all lived in this
+	 * object and none of them were reachable from a test while it was private.
+	 */
+	kernelPorts(): AssuranceCoordinatorPorts {
+		return this.createKernelPorts();
+	}
+
 	private createKernelPorts(): AssuranceCoordinatorPorts {
 		return {
 			host: this.host,
 			projectTask: (root, taskId) => projectAssurance(root, taskId, diffSnapshotOf),
-			readTaskRecord: (root, taskId) => readTaskRecord(root, taskId),
-			readTaskIntent: (root, taskId) => readTaskIntentForRecord(root, taskId),
+			readTaskRecord: async (root, taskId) => readTaskRecord(root, taskId),
+			readTaskIntent: async (root, taskId) => readTaskIntentForRecord(root, taskId),
 			frozenRunner: async () => resolveBunRunner(),
 			buildAssurance: (root, taskId, role, projection, runner) => buildAssuranceSnapshot(root, taskId, role, projection, runner),
-			ensureReviewRevision: async (root, taskId, projection) => {
-				const current = await readTaskRecord(root, taskId);
-				if (!current.record) throw new Error(`task ${taskId} has no TaskRecord`);
-				if (current.record.contract !== "assurance_kernel/task_record/v4") return null;
-				return ensureReviewRevision(root, {
-					taskId,
-					baseHead: current.record.git_base_head,
-					scopeHint: current.record.intent_snapshot.scope_hint,
-					expectedDiffHash: projection.projection.diff_hash,
-				});
-			},
+			ensureReviewRevision: (root, taskId, projection) => ensureClaudeReviewRevision(root, taskId, projection),
 			runQa: (snapshot, descriptors, runner, options) => runDeterministicQa(snapshot, descriptors, runner, options),
 			writeReviewEvidence: (input) => writeNativeReviewEvidence(input.evidence),
 			applyVerdict: (ctx, input) => this.applyVerdict(ctx, input),
@@ -459,6 +528,19 @@ export class ClaudeRuntime {
 		return submitClaudeReview(this.host, this.coordinator, { cwd: this.cwd }, taskId, verdictInput);
 	}
 
+	/**
+	 * Ordinary Kernel operation, not a privileged one: canary_application builds
+	 * the action without a capability and the Pi Host lists resolve_finding in
+	 * its ordinary KERNEL_OPERATIONS. The reducer owns every precondition, so
+	 * this port reads no findings and tests no kind.
+	 */
+	async resolveFinding(taskId: string, findingId: string) {
+		return this.executeOrdinary({ cwd: this.cwd }, {
+			taskId,
+			operation: { op: "resolve_finding", finding_id: findingId, actor_id: "executor" },
+		});
+	}
+
 	async authorize(taskId: string, operation: string, meta: ToolMeta, extra: Record<string, unknown> = {}) {
 		if (operation === "repair_authority_state") {
 			const authority = reconcileKernelAuthority(this.cwd, taskId);
@@ -468,7 +550,7 @@ export class ClaudeRuntime {
 			return repairKernelAuthority(this.cwd, taskId, authority.revision);
 		}
 		if (!isPrivilegedOperation(operation) && operation !== "request_authorization") throw new Error(`unsupported privileged operation ${operation}`);
-		let op = operation;
+		let op: PrivilegedOperation | "request_authorization" | "resolve_user_decision" | "authorize_rework" = operation;
 		let decisionOp: { finding_id: string; resolution: string } | undefined;
 		const projection = await this.status(taskId);
 		if (projection.error || !projection.claim) throw new Error(projection.error ?? "no active backend claim");
@@ -485,6 +567,8 @@ export class ClaudeRuntime {
 				if (open.length !== 1) throw new Error(`resolve-user-decision requires exactly one open user decision; found ${open.length}`);
 				op = "resolve_user_decision";
 				decisionOp = { finding_id: open[0].id, resolution: `resume after literal-user decision: ${open[0].summary}` };
+			} else if (readiness.state === "authorize_rework") {
+				op = "authorize_rework";
 			} else {
 				throw new Error(readiness.blocked ?? "no unique host-derived authorization operation");
 			}
@@ -584,7 +668,7 @@ export class ClaudeRuntime {
 				confirmation_ref: confirmation,
 				...(op === "approve_breaking_intent_revision" ? { next_intent: nextIntent, next_intent_ref: nextIntentRef } : {}),
 				...(op === "resolve_user_decision" && decisionOp ? decisionOp : {}),
-				...(op === "stop" ? { reason: extra.reason ?? "user stop" } : {}),
+				...(op === "stop" ? { reason: stopReason(extra.reason) } : {}),
 			});
 			throwIfCancelled(meta.signal);
 			const result = app.execute({
@@ -596,13 +680,17 @@ export class ClaudeRuntime {
 					actor_id: actorId,
 					...(op === "approve_breaking_intent_revision" ? { next_intent: nextIntent, next_intent_ref: nextIntentRef } : {}),
 					...(op === "resolve_user_decision" && decisionOp ? decisionOp : {}),
-					...(op === "stop" ? { reason: extra.reason ?? "user stop" } : {}),
+					...(op === "stop" ? { reason: stopReason(extra.reason) } : {}),
 				} as never,
 				prior_intent_token: priorIntent.token,
 				diffProvider: diffSnapshotOf,
 				now,
 			});
-			if (op === "stop" || op === "approve_breaking_intent_revision") stagePlanningArtifactTransition(this.cwd, result.record);
+			if (
+				op === "stop" ||
+				op === "authorize_rework" ||
+				op === "approve_breaking_intent_revision"
+			) stagePlanningArtifactTransition(this.cwd, result.record);
 			return result;
 		} catch (error) {
 			if (sidecar && priorBytes && priorIndexState) {
@@ -672,7 +760,7 @@ export class ClaudeRuntime {
 			stagePlanningArtifactTransition(ctx.cwd, result.record);
 			return;
 		}
-		const approval = {
+		const approval: TaskApprovalV2 = {
 			id: `approval-${input.snapshot.role}-${randomUUID().slice(0, 8)}`,
 			kind: input.snapshot.role === "qa" ? "qa" : "review",
 			authority_role: input.snapshot.role === "qa" ? "qa" : "reviewer",
@@ -707,7 +795,7 @@ export class ClaudeRuntime {
 		}));
 	}
 
-	private async executeOrdinary(ctx: HostContext, input: { taskId: string; operation: { op: string; actor_id: string; next_intent?: unknown } }) {
+	private async executeOrdinary(ctx: HostContext, input: { taskId: string; operation: { op: string; actor_id: string; next_intent?: unknown; finding_id?: string } }) {
 		const { app } = await this.authority();
 		const operation = input.operation.op === "revise_intent"
 			? { ...input.operation, next_intent: await parseTaskIntentV1(input.operation.next_intent) }

package/plugins/immune-brain/runtime/claude/mcp_server.ts

@@ -26,6 +26,7 @@ export const TOOLS = [
 	{ name: "approve_breaking_intent_revision", description: "Approve a breaking TaskIntent revision.", privileged: true },
 	{ name: "stop", description: "Stop the active task with literal-user authority.", privileged: true },
 	{ name: "repair_authority_state", description: "Repair a proven recoverable stale backend claim.", privileged: false },
+	{ name: "resolve_finding", description: "Resolve one open blocking or advisory finding whose cause is fixed and verified.", privileged: false },
 ] as const;
 
 export function listMcpTools() {
@@ -39,8 +40,13 @@ export function listMcpTools() {
 				...(tool.name === "approve_breaking_intent_revision" ? { next_intent: { type: "object" } } : {}),
 				...(tool.name === "stop" ? { reason: { type: "string" } } : {}),
 				...(tool.name === "submit_review" ? { verdict: { type: "object" } } : {}),
+				...(tool.name === "resolve_finding" ? { finding_id: { type: "string" } } : {}),
 			},
-			required: tool.name === "submit_review" ? ["task_id", "verdict"] : ["task_id"],
+			required: tool.name === "submit_review"
+				? ["task_id", "verdict"]
+				: tool.name === "resolve_finding"
+					? ["task_id", "finding_id"]
+					: ["task_id"],
 		},
 		annotations: tool.privileged ? privilegedAnnotations() : { readOnlyHint: tool.name === "status" },
 	}));
@@ -119,6 +125,13 @@ export function createMcpRuntime(options: McpRuntimeOptions = {}) {
 				if (!Object.hasOwn(args, "verdict")) throw new Error("verdict is required");
 				return runtime.submitReview(taskId, args.verdict);
 			}
+			if (name === "resolve_finding") {
+				// Structural only. Which findings may be resolved, and when, stays
+				// the reducer's decision; duplicating it here would create a second
+				// authority that could drift from the Kernel.
+				if (typeof args.finding_id !== "string" || !args.finding_id) throw new Error("finding_id is required");
+				return runtime.resolveFinding(taskId, args.finding_id);
+			}
 			if (name === "request_authorization" || name === "approve_breaking_intent_revision" || name === "stop" || name === "repair_authority_state") {
 				return runtime.authorize(taskId, name, toolMeta, args);
 			}

package/plugins/immune-brain/runtime/claude/review_host.ts

@@ -271,16 +271,6 @@ interface PendingReview {
 	error?: string;
 }
 
-function matchesReservation(event: ClaudeHookEvent, pending: PendingReview): boolean {
-	if ("operationId" in event && event.operationId && event.operationId !== pending.request.operationId) return false;
-	if ("taskId" in event && event.taskId && event.taskId !== pending.request.taskId) return false;
-	if (pending.sessionId && event.sessionId !== pending.sessionId) return false;
-	const eventAgentId = "agentId" in event ? event.agentId : "";
-	if (event.type === "SubagentStop" && (!eventAgentId || !pending.agentId || eventAgentId !== pending.agentId)) return false;
-	if (pending.agentId && eventAgentId && eventAgentId !== pending.agentId) return false;
-	return true;
-}
-
 function bindsStart(event: Extract<ClaudeHookEvent, { type: "SubagentStart" }>, pending: PendingReview): boolean {
 	if (event.taskId && event.taskId !== pending.request.taskId) return false;
 	if (event.prompt !== undefined) {

package/plugins/immune-brain/runtime/commands/kernel.ts

@@ -248,19 +248,6 @@ function runInspect(root: string): KernelExecution {
 				),
 			};
 		}
-		let declared: TaskRisk;
-		let intent: TaskIntentV1;
-		try {
-			const raw = JSON.parse(
-				readSecureProjectFile(root, `docs/plans/${claim.task_id}.intent.json`),
-			) as { risk?: unknown };
-			if (raw.risk !== "routine" && raw.risk !== "material" && raw.risk !== "critical")
-				throw new Error(`intent.risk is unreadable for ${claim.task_id}`);
-			declared = raw.risk;
-			intent = parseTaskIntentV1(raw);
-		} catch (error) {
-			return sourceFailure("inspect", error);
-		}
 		let recordRead: ReturnType<typeof readTaskRecordRaw>;
 		try {
 			recordRead = readTaskRecordRaw(root, claim.task_id);
@@ -285,6 +272,21 @@ function runInspect(root: string): KernelExecution {
 			};
 		}
 		const record = recordRead.record;
+		let declared: TaskRisk;
+		let intent: TaskIntentV1;
+		try {
+			const raw = JSON.parse(
+				readSecureProjectFile(root, record.intent_ref.path),
+			) as { risk?: unknown };
+			if (raw.risk !== "routine" && raw.risk !== "material" && raw.risk !== "critical")
+				throw new Error(`intent.risk is unreadable for ${claim.task_id}`);
+			declared = raw.risk;
+			intent = parseTaskIntentV1(raw);
+			if (canonicalIntentHash(intent) !== record.intent_ref.content_hash)
+				throw new Error("TaskIntent sidecar does not match TaskRecord content hash");
+		} catch (error) {
+			return sourceFailure("inspect", error);
+		}
 		const workspaceState = readWorkspaceStateRaw(root);
 		let identity;
 		try {