immune-brain 3.6.4 → 3.6.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "3.6.4",
+  "version": "3.6.5",
   "description": "Immune-Brain agent skill system",
   "publishConfig": {
     "access": "public",

package/plugins/immune-brain/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "3.6.4",
+  "version": "3.6.5",
   "description": "Immune-Brain Claude Code Host: native Enrollment, QA, Review, and Kernel settlement.",
   "author": {
     "name": "Immune-Brain Team"

package/plugins/immune-brain/.pi-extension/imm-canary-work.ts

@@ -177,6 +177,7 @@ export type { AssuranceRole } from "./pi-canary-assurance";
 export type AuthorizeOperation =
 	| "approve-breaking-intent-revision"
 	| "resolve-user-decision"
+	| "authorize-rework"
 	| "stop";
 
 export interface SnapshotDescriptorInput {
@@ -435,6 +436,7 @@ export default function (
 				Type.Object({ op: Type.Literal("advance_assurance") }),
 				Type.Object({ op: Type.Literal("submit_review"), verdict: Type.Unknown() }),
 				Type.Object({ op: Type.Literal("request_authorization") }),
+				Type.Object({ op: Type.Literal("request_stop") }),
 				Type.Object({ op: Type.Literal("repair_authority_state") }),
 				Type.Object({ op: Type.Literal("freeze_artifacts") }),
 				Type.Object({
@@ -530,8 +532,8 @@ export default function (
 					return failCanaryTool(taskId, action.op, "authority_conflict", "authority_repair_failed", message, blocked.next_action);
 				}
 			}
-			if (action.op === "advance_assurance" || action.op === "request_authorization" || action.op === "submit_review" || action.op === "approve_breaking_intent_revision") {
-				if ((action.op === "request_authorization" || action.op === "approve_breaking_intent_revision") && ctx.mode !== "tui")
+			if (action.op === "advance_assurance" || action.op === "request_stop" || action.op === "request_authorization" || action.op === "submit_review" || action.op === "approve_breaking_intent_revision") {
+				if ((action.op === "request_stop" || action.op === "request_authorization" || action.op === "approve_breaking_intent_revision") && ctx.mode !== "tui")
 					return failCanaryTool(taskId, action.op, "blocked", "tui_required", "literal-user authorization is TUI-only", "invoke the TUI Tool");
 				const result = action.op === "advance_assurance"
 					? await progression.advance(taskId, ctx, signal, (update) => {
@@ -547,7 +549,9 @@ export default function (
 								ctx,
 								(action as { next_intent?: unknown }).next_intent,
 							)
-							: await requestAuthorization(taskId, ctx);
+							: action.op === "request_stop"
+								? await authorizeExactOperation(taskId, "stop", { ...ctx, signal: signal && ctx.signal ? AbortSignal.any([signal, ctx.signal]) : signal ?? ctx.signal })
+								: await requestAuthorization(taskId, ctx);
 				const enriched = await enrichAssuranceResult(ctx, taskId, result as unknown as Record<string, unknown>);
 				presentTaskRailResult(ctx, taskId, enriched);
 				throwIfCanaryToolFailure(taskId, action.op, enriched);
@@ -696,7 +700,7 @@ export default function (
 	});
 
 	type AuthorizationOutcome =
-		| { state: "applied"; operation: AuthorizeOperation; lifecycle?: string }
+		| { state: "applied"; operation: AuthorizeOperation; lifecycle?: string; delivery_error?: string }
 		| { state: "cancelled"; operation: AuthorizeOperation; reason: string }
 		| { state: "blocked"; reason: string };
 
@@ -726,12 +730,15 @@ export default function (
 			let invocation: InvocationToken;
 			const authorizationGeneration = progression.sessionGenerationValue();
 			try {
+				if (operation === "stop" && progression.active(taskId)?.state === "running")
+					throw new Error("assurance operation is already running");
 				invocation = progression.openInvocation(taskId);
 		} catch (error) {
 			const reason = error instanceof Error ? error.message : String(error);
 			notifyOnce(ctx, `authorization-open:${taskId}:${reason}`, `cannot authorize ${taskId}: ${reason}`, "error");
 			return { state: "blocked", reason };
 		}
+		try {
 		const projection = await projectAssuranceState(ctx.cwd, taskId);
 		if (projection.error || !projection.claim) {
 			const reason = projection.error ?? "no active backend claim";
@@ -841,6 +848,9 @@ export default function (
 						`Resolution: ${userDecisionOperation.resolution}`,
 					]
 				: []),
+			...(operation === "authorize-rework"
+				? [`Replan boundaries: ${projection.projection.replan_required_ids.join(", ")}`]
+				: []),
 			...(nextIntent
 				? [
 						`Next Intent: rev ${nextIntent.revision} (${nextIntentHash})`,
@@ -888,16 +898,27 @@ export default function (
 			if (nextIntent) {
 				restoreStagedIntent();
 			}
-			if (operation !== "stop" && operation !== "approve-breaking-intent-revision")
+			if (
+				operation !== "stop" &&
+				operation !== "approve-breaking-intent-revision" &&
+				operation !== "authorize-rework"
+			)
 				await recordCancelledUserDecision(ctx, taskId, operation, snapshotDigestRef).catch(() => undefined);
 			progression.closeInvocation(invocation);
+			if (operation === "stop" && !ctx.signal?.aborted && !(error instanceof Error && error.name === "AbortError")) {
+				return { state: "blocked", reason: "native stop confirmation failed; retry request_stop in this Host" };
+			}
 			return { state: "cancelled", operation, reason: "confirmation aborted" };
 		}
-		if (!confirmed) {
+		if (!confirmed || ctx.signal?.aborted) {
 			if (nextIntent) {
 				restoreStagedIntent();
 			}
-			if (operation !== "stop" && operation !== "approve-breaking-intent-revision")
+			if (
+				operation !== "stop" &&
+				operation !== "approve-breaking-intent-revision" &&
+				operation !== "authorize-rework"
+			)
 				await recordCancelledUserDecision(ctx, taskId, operation, snapshotDigestRef).catch(() => undefined);
 			progression.closeInvocation(invocation);
 			return { state: "cancelled", operation, reason: "cancelled" };
@@ -910,7 +931,6 @@ export default function (
 			progression.closeInvocation(invocation);
 			return { state: "blocked", reason: "session changed; confirmation discarded" };
 		}
-		try {
 			// Linearization point: only this fresh affirmative continuation
 			// may mint/apply; timeout/cancel already won open -> cancelled.
 			try {
@@ -932,14 +952,16 @@ export default function (
 				};
 			}
 			const exactOperation = operation === "stop"
-				? { op: "stop" as const, reason: "literal user stopped task parked for replan" }
+				? { op: "stop" as const, reason: "literal user requested task stop" }
 				: operation === "approve-breaking-intent-revision"
 					? {
 							op: "approve_breaking_intent_revision" as const,
 							next_intent: nextIntent!,
 							next_intent_ref: nextIntentRef!,
 						}
-					: userDecisionOperation!;
+					: operation === "authorize-rework"
+						? { op: "authorize_rework" as const }
+						: userDecisionOperation!;
 				// The exact host-built operation is shared by capability digest and
 				// application payload; command arguments cannot inject authority fields.
 				try {
@@ -980,9 +1002,11 @@ export default function (
 						diffProvider: (root: string, record: NonNullable<TaskRecordRead["record"]>) => diffSnapshotOf(root, record),
 						now,
 					})) as unknown as { record: { lifecycle: string; artifact_state: string; intent_ref: { path: string }; intent_snapshot: { scope_hint: string[] } } };
+					if (exactOperation.op === "stop") progression.releaseStoppedReview(taskId);
 					if (
-						exactOperation.op === "stop"
-						|| exactOperation.op === "approve_breaking_intent_revision"
+						exactOperation.op === "stop" ||
+						exactOperation.op === "authorize_rework" ||
+						exactOperation.op === "approve_breaking_intent_revision"
 					) stagePlanningArtifactTransition(ctx.cwd, result.record);
 					return { state: "applied", operation, lifecycle: result.record.lifecycle };
 			} catch (error) {
@@ -994,6 +1018,13 @@ export default function (
 			}
 			} catch (error) {
 				const reason = error instanceof Error ? error.message : String(error);
+				if (operation === "stop") {
+					const terminal = await projectAssuranceState(ctx.cwd, taskId).catch(() => null);
+					if (terminal && !terminal.error && terminal.projection.lifecycle === "stopped") {
+						progression.releaseStoppedReview(taskId);
+						return { state: "applied", operation, lifecycle: "stopped", delivery_error: reason };
+					}
+				}
 				notifyOnce(ctx, `authorization-apply:${taskId}:${operation}:${reason}`, `authorize failed: ${reason}`, "error");
 				return { state: "blocked", reason };
 			} finally {
@@ -1015,9 +1046,6 @@ export default function (
 			return { state: "blocked", reason: "TaskRecord changed while deriving authorization operation" };
 		const derived = deriveAuthorizationOperation({
 			readiness: projection.projection.authorization,
-			hasOpenReplanRequired: read.record.findings.some(
-				(finding) => finding.kind === "replan_required" && finding.status === "open",
-			),
 		});
 		if ("blocked" in derived) return { state: "blocked", reason: derived.blocked };
 		return authorizeExactOperation(taskId, derived.operation, ctx);
@@ -1030,15 +1058,14 @@ export default function (
 
 export type DerivedAuthorizationOperation =
 	| "resolve-user-decision"
-	| "stop";
+	| "authorize-rework";
 
 // Kernel projection is the sole source of authorization readiness.
 export function deriveAuthorizationOperation(input: {
 	readiness: AssuranceAuthorizationReadiness;
-	hasOpenReplanRequired?: boolean;
 }): { operation: DerivedAuthorizationOperation } | { blocked: string } {
-	if (input.hasOpenReplanRequired) return { operation: "stop" };
 	if (input.readiness.state === "resolve_user_decision") return { operation: "resolve-user-decision" };
+	if (input.readiness.state === "authorize_rework") return { operation: "authorize-rework" };
 	if (input.readiness.blocked) return { blocked: input.readiness.blocked };
 	return { blocked: "no unique host-derived authorization operation" };
 }

package/plugins/immune-brain/dist/claude/mcp-server.mjs

@@ -42,7 +42,7 @@ function probeHost(env = process.env, platform = process.platform, hostVersion)
 }
 
 // plugins/immune-brain/runtime/plugin_version.ts
-var PLUGIN_VERSION = "3.6.4";
+var PLUGIN_VERSION = "3.6.5";
 
 // plugins/immune-brain/runtime/claude/interaction.ts
 import { createHash, randomUUID } from "node:crypto";
@@ -1351,6 +1351,8 @@ class AssuranceCoordinator {
     return this.sessionGeneration;
   }
   async advance(taskId, ctx, signal, onUpdate) {
+    if (this.isInvocationOpen(taskId))
+      return { state: "blocked", reason: "an authority invocation is already open" };
     const active = this.active(taskId);
     if (active?.state === "review_ready") {
       const reservation = this.reviewReservations.get(taskId);
@@ -1728,6 +1730,17 @@ class AssuranceCoordinator {
     }
     return { state: "blocked", reason: `Kernel requires ${settled.projection.next_obligation} after Review` };
   }
+  isReviewVerdictValid(taskId, verdictInput) {
+    const reservation = this.reviewReservations.get(taskId);
+    if (!reservation)
+      return false;
+    try {
+      parseAssuranceVerdict(verdictInput, reservation.snapshot);
+      return true;
+    } catch {
+      return false;
+    }
+  }
   abandonReview(taskId, reason) {
     const reservation = this.reviewReservations.get(taskId);
     if (!reservation)
@@ -1743,6 +1756,12 @@ class AssuranceCoordinator {
       return { state: "blocked", code: "verdict_invalid", reason: "Review verdict correction is required before advancing" };
     return { state: "review_ready", operation: "review", operation_id: reservation.operationId, snapshot_digest: snapshotDigest(reservation.snapshot), review_bundle_digest: reservation.snapshot.review_bundle_digest ?? "", agent_params: reservation.hostReservation.dispatch };
   }
+  releaseStoppedReview(taskId) {
+    const reservation = this.reviewReservations.get(taskId);
+    if (reservation)
+      this.releaseReviewReservation(taskId, reservation);
+    this.rejectedReviewOperations.delete(taskId);
+  }
   releaseReviewReservation(taskId, reservation, rejectionReason) {
     if (this.reviewReservations.get(taskId) !== reservation)
       return;
@@ -3001,6 +3020,15 @@ function classifyIntentRevision(previous, next) {
     return "breaking";
   return next.revision > previous.revision ? "compatible" : "breaking";
 }
+
+class TaskIntentObservationError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "TaskIntentObservationError";
+    this.code = code;
+  }
+}
 var intentReaderTestHook = null;
 function validateTaskId3(taskId) {
   if (!TASK_ID_PATTERN.test(taskId))
@@ -3065,7 +3093,7 @@ function assertIdentitiesUnchanged(expected, canonicalRoot, relativePath) {
       throw new Error(`path component changed while being read: ${parts.slice(0, index + 1).join("/")}`);
   }
 }
-function readTaskIntent(root, taskId, requestedPath) {
+function readTaskIntentSource(root, taskId, requestedPath) {
   validateTaskId3(taskId);
   const canonicalRoot = resolveCanonicalRoot(root);
   const activePath = `${INTENT_SIDECAR_RELATIVE_PREFIX}${taskId}.intent.json`;
@@ -3077,17 +3105,19 @@ function readTaskIntent(root, taskId, requestedPath) {
   if (!target.startsWith(canonicalRoot + sep3))
     throw new Error("intent sidecar escapes project root");
   if (!sidecarPresent(canonicalRoot, sidecarPath))
-    throw new Error(`TaskIntent sidecar is missing at ${sidecarPath}`);
+    throw new TaskIntentObservationError("missing", `TaskIntent sidecar is missing at ${sidecarPath}`);
   const pathIdentities = collectPathIdentities(canonicalRoot, sidecarPath);
   const fileIdentity = pathIdentities[pathIdentities.length - 1];
   try {
     execFileSync3("git", ["ls-files", "--error-unmatch", "--", sidecarPath], { cwd: canonicalRoot, stdio: ["ignore", "pipe", "pipe"] });
-  } catch {
-    throw new Error("TaskIntent sidecar is not Git-tracked");
+  } catch (error) {
+    if (typeof error === "object" && error !== null && "status" in error && error.status === 1)
+      throw new TaskIntentObservationError("invalid", "TaskIntent sidecar is not Git-tracked");
+    throw error;
   }
   const before = lstatSync4(target);
   if (!before.isFile() || before.size > INTENT_MAX_BYTES)
-    throw new Error("TaskIntent sidecar must be a regular file no larger than 64 KiB");
+    throw new TaskIntentObservationError("invalid", "TaskIntent sidecar must be a regular file no larger than 64 KiB");
   const fd = openSync2(target, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
   let bytes;
   try {
@@ -3099,7 +3129,7 @@ function readTaskIntent(root, taskId, requestedPath) {
     closeSync2(fd);
   }
   if (bytes.byteLength > INTENT_MAX_BYTES)
-    throw new Error("TaskIntent sidecar exceeds 64 KiB");
+    throw new TaskIntentObservationError("invalid", "TaskIntent sidecar exceeds 64 KiB");
   const after = lstatSync4(target);
   assertSameIdentity(statIdentity(before), after, "intent sidecar");
   assertIdentitiesUnchanged(pathIdentities, canonicalRoot, sidecarPath);
@@ -3113,23 +3143,11 @@ function readTaskIntent(root, taskId, requestedPath) {
   try {
     intent = parseTaskIntentV1(JSON.parse(bytes.toString("utf8")));
   } catch (error) {
-    throw new Error(`TaskIntent sidecar is invalid: ${error instanceof Error ? error.message : String(error)}`);
+    throw new TaskIntentObservationError("invalid", `TaskIntent sidecar is invalid: ${error instanceof Error ? error.message : String(error)}`);
   }
   if (intent.task_id !== taskId)
-    throw new Error("intent.task_id does not match the sidecar filename task id");
+    throw new TaskIntentObservationError("invalid", "intent.task_id does not match the sidecar filename task id");
   const contentHash = canonicalIntentHash(intent);
-  const token = mintToken({
-    canonical_root: canonicalRoot,
-    sidecar_path: sidecarPath,
-    path_dev: fileIdentity.dev,
-    path_ino: fileIdentity.ino,
-    fd_dev: before.dev,
-    fd_ino: before.ino,
-    fd_size: before.size,
-    fd_mtime_ms: before.mtimeMs,
-    source_bytes_sha256: sourceBytesSha256,
-    intent_content_hash: contentHash
-  });
   return {
     intent,
     content_hash: contentHash,
@@ -3138,9 +3156,24 @@ function readTaskIntent(root, taskId, requestedPath) {
       revision: intent.revision,
       content_hash: contentHash
     },
-    token
+    identity: {
+      canonical_root: canonicalRoot,
+      sidecar_path: sidecarPath,
+      path_dev: fileIdentity.dev,
+      path_ino: fileIdentity.ino,
+      fd_dev: before.dev,
+      fd_ino: before.ino,
+      fd_size: before.size,
+      fd_mtime_ms: before.mtimeMs,
+      source_bytes_sha256: sourceBytesSha256,
+      intent_content_hash: contentHash
+    }
   };
 }
+function readTaskIntent(root, taskId, requestedPath) {
+  const { identity, ...observed } = readTaskIntentSource(root, taskId, requestedPath);
+  return { ...observed, token: mintToken(identity) };
+}
 
 // plugins/immune-brain/runtime/kernel/validation.ts
 var GIT_OBJECT_ID3 = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
@@ -3645,6 +3678,7 @@ var ACTION_V2_TYPES = [
   "request_rework",
   "complete",
   "stop",
+  "authorize_rework",
   "resolve_user_decision"
 ];
 var ACTION_BASE_FIELDS = [
@@ -3740,7 +3774,8 @@ function parseTaskAction(raw) {
       };
       break;
     }
-    case "complete": {
+    case "complete":
+    case "authorize_rework": {
       rejectUnknown2(value, [...ACTION_BASE_FIELDS], "action", violations);
       action = { ...base, type: base.type };
       break;
@@ -3798,7 +3833,7 @@ function assertTaskRecordUpdateV3(previousRaw, nextRaw, action) {
       violations.push("non-intent action cannot change the intent snapshot");
     if (next.intent_ref.content_hash !== previous.intent_ref.content_hash)
       violations.push("non-intent action cannot change intent_ref content hash");
-    if (next.intent_ref.path !== previous.intent_ref.path && action.type !== "request_rework" && action.type !== "stop")
+    if (next.intent_ref.path !== previous.intent_ref.path && action.type !== "request_rework" && action.type !== "authorize_rework" && action.type !== "stop")
       violations.push("only artifact transitions may change intent_ref path");
   }
   if (next.attestations.length < previous.attestations.length)
@@ -3810,7 +3845,7 @@ function assertTaskRecordUpdateV3(previousRaw, nextRaw, action) {
     if (!current || JSON.stringify(current) !== JSON.stringify(prior))
       violations.push(`attestation ${prior.id} was rewritten`);
   }
-  const resolvingFindingIds = action.type === "resolve_finding" ? [action.finding_id] : action.type === "resolve_user_decision" ? [action.finding_id] : action.type === "approve_breaking_intent_revision" ? previous.findings.filter((item) => item.kind === "replan_required" && item.status === "open").map((item) => item.id) : [];
+  const resolvingFindingIds = action.type === "resolve_finding" ? [action.finding_id] : action.type === "resolve_user_decision" ? [action.finding_id] : action.type === "authorize_rework" || action.type === "approve_breaking_intent_revision" ? previous.findings.filter((item) => item.kind === "replan_required" && item.status === "open").map((item) => item.id) : [];
   const reworkFindingIds = action.type === "request_rework" ? new Set(action.findings.map((item) => item.id)) : new Set;
   for (const prior of previous.findings) {
     const current = next.findings.find((item) => item.id === prior.id);
@@ -5039,6 +5074,8 @@ function deriveAssuranceAuthorization(input) {
       state: "none",
       blocked: `resolve-user-decision requires exactly one open user decision; found ${input.open_user_decision_count}`
     };
+  if (input.next_obligation === "revise_intent")
+    return { state: "authorize_rework", blocked: null };
   return { state: "none", blocked: null };
 }
 function emptyProjection() {
@@ -5289,7 +5326,7 @@ function intentRefMatches(intent, ref) {
   return ref.path === `docs/plans/${intent.task_id}.intent.json` && ref.content_hash === canonicalIntentHash(intent);
 }
 function hasPrivilegedKind(action) {
-  return action.type === "record_approval" || action.type === "approve_breaking_intent_revision" || action.type === "request_rework" || action.type === "stop" || action.type === "resolve_user_decision";
+  return action.type === "record_approval" || action.type === "approve_breaking_intent_revision" || action.type === "request_rework" || action.type === "authorize_rework" || action.type === "stop" || action.type === "resolve_user_decision";
 }
 function findingsDigestV2(findings) {
   const normalized = findings.map((finding) => ({
@@ -5507,8 +5544,8 @@ function reduceTask(recordRaw, actionRaw, authorityAudit = null, changedPaths) {
           "request_rework requires review, qa, or user authority"
         ]);
       const round = reviewRound(record);
-      const reviewAuthorityReworks = record.history.filter((entry) => entry.type === "request_rework" && entry.authority?.authority_kind === "review").length;
-      const parkForReplan = authorityAudit.authority_kind === "review" && reviewAuthorityReworks >= 1;
+      const hasPriorBlockingReviewRework = record.findings.some((finding) => finding.source === "review" && finding.kind === "blocking" && finding.review_round !== null);
+      const parkForReplan = authorityAudit.authority_kind === "review" && hasPriorBlockingReviewRework && action.findings.some((finding) => finding.kind === "blocking");
       if (!parkForReplan) {
         record.artifact_state = "active";
         record.intent_ref.path = `docs/plans/${record.task_id}.intent.json`;
@@ -5523,8 +5560,8 @@ function reduceTask(recordRaw, actionRaw, authorityAudit = null, changedPaths) {
         record.findings.push({
           ...finding,
           status: "open",
-          source: "review",
-          review_round: round
+          source: authorityAudit.authority_kind === "review" ? "review" : "execution",
+          review_round: authorityAudit.authority_kind === "review" ? round : null
         });
       }
       if (parkForReplan && !record.findings.some((item) => item.status === "open" && item.kind === "replan_required")) {
@@ -5547,6 +5584,27 @@ function reduceTask(recordRaw, actionRaw, authorityAudit = null, changedPaths) {
       appendHistory(record, action, from, `review_round_${round}`, authorityAudit);
       break;
     }
+    case "authorize_rework": {
+      if (record.lifecycle !== "active")
+        throw new KernelInvariantError([
+          `cannot authorize rework while lifecycle is ${record.lifecycle}`
+        ]);
+      if (authorityAudit?.authority_kind !== "user")
+        throw new KernelInvariantError([
+          "authorize_rework requires literal-user authority"
+        ]);
+      const open = record.findings.filter((finding) => finding.kind === "replan_required" && finding.status === "open");
+      if (open.length === 0)
+        throw new KernelInvariantError([
+          "authorize_rework requires an open replan boundary"
+        ]);
+      for (const finding of open)
+        finding.status = "resolved";
+      record.artifact_state = "active";
+      record.intent_ref.path = `docs/plans/${record.task_id}.intent.json`;
+      appendHistory(record, action, from, open.map((finding) => finding.id).join(","), authorityAudit);
+      break;
+    }
     case "complete": {
       if (record.lifecycle !== "active" || record.artifact_state !== "frozen")
         throw new KernelInvariantError([
@@ -5677,7 +5735,7 @@ function applyTaskAction(input) {
           "intent token does not match the committed record intent"
         ]);
     }
-    const privileged = action.type === "record_approval" || action.type === "approve_breaking_intent_revision" || action.type === "request_rework" || action.type === "stop" || action.type === "resolve_user_decision";
+    const privileged = action.type === "record_approval" || action.type === "approve_breaking_intent_revision" || action.type === "request_rework" || action.type === "authorize_rework" || action.type === "stop" || action.type === "resolve_user_decision";
     const expectedAuthority = privileged ? {
       task_id,
       action,
@@ -5803,6 +5861,8 @@ function capabilityActionFor(input) {
       return { ...base, approval: input.approval };
     case "request_rework":
       return { ...base, findings: input.findings };
+    case "authorize_rework":
+      return { ...base, type: "authorize_rework" };
     case "stop":
       return { ...base, reason: input.reason };
     case "approve_breaking_intent_revision":
@@ -5949,7 +6009,7 @@ function createCanaryApplication(registry) {
     const hasBoundSpec = snapshot.intent_snapshot.scope_hint.some((path) => /^docs\/specs\/(?!archive\/)[^/]+\.spec\.md$/.test(path) && snapshot.intent_snapshot.scope_hint.includes(archivePath(path)));
     if (operation.op === "complete" && hasBoundSpec && snapshot.record.artifact_state !== "frozen")
       throw new KernelInvariantError(["complete requires frozen planning artifacts"]);
-    const artifactTransition = snapshot.record.artifact_state === "frozen" && (operation.op === "request_rework" || operation.op === "approve_breaking_intent_revision") ? transitionFor(input.root, snapshot.record, "restore") : operation.op === "stop" && snapshot.record.artifact_state !== "frozen" ? transitionFor(input.root, snapshot.record, "freeze", true) : undefined;
+    const artifactTransition = snapshot.record.artifact_state === "frozen" && (operation.op === "request_rework" || operation.op === "authorize_rework" || operation.op === "approve_breaking_intent_revision") ? transitionFor(input.root, snapshot.record, "restore") : operation.op === "stop" && snapshot.record.artifact_state !== "frozen" ? transitionFor(input.root, snapshot.record, "freeze", true) : undefined;
     const event_id = `${operation.op}:${input.task_id}:${at}`;
     const base = {
       event_id,
@@ -6015,6 +6075,10 @@ function createCanaryApplication(registry) {
         capability = operation.capability;
         action = { ...base, type: "stop", reason: operation.reason };
         break;
+      case "authorize_rework":
+        capability = operation.capability;
+        action = { ...base, type: "authorize_rework" };
+        break;
       case "resolve_user_decision":
         capability = operation.capability;
         action = {
@@ -6477,7 +6541,16 @@ function enrollCanaryTask(root, input, registry) {
       throw new Error("intent content hash mismatch");
     if (checks.gitBaseHead !== gitBaseHead)
       throw new Error("Git HEAD moved after the enrollment confirmation");
+    if (input.batch) {
+      const batch = input.batch.registry.inspect(input.batch.capability, input.batch.binding, Date.parse(input.now));
+      if (input.batch.registry.consumedChildren(input.batch.capability).length === 0 && input.batch.expected_head !== batch.base_head)
+        throw new Error(`batch_head_lineage_broken: the first child must enroll on the confirmed base_head ${batch.base_head}, not ${input.batch.expected_head}`);
+      if (checks.gitBaseHead !== input.batch.expected_head)
+        throw new Error(`batch_head_lineage_broken: expected ${input.batch.expected_head}, found ${checks.gitBaseHead}`);
+    }
     registry.consume(input.capability, input.capability_binding);
+    if (input.batch)
+      input.batch.registry.consumeChild(input.batch.capability, input.batch.binding, input.task_id, Date.parse(input.now));
     if (!gitBaseHead)
       throw new Error("enrollment requires a committed Git HEAD");
     const record = buildTaskRecordV4(input, checks.intent, gitBaseHead);
@@ -6496,16 +6569,23 @@ function enrollCanaryTask(root, input, registry) {
       created_at: input.now,
       updated_at: input.now
     };
-    const mutation = commitEnrollmentLocked(root, input.task_id, {
-      contract: "assurance_kernel/workspace_transaction/v2",
-      task_id: input.task_id,
-      expected_record_hash: checks.current.revision,
-      next_record_content: `${JSON.stringify(record, null, 2)}
+    let mutation;
+    try {
+      mutation = commitEnrollmentLocked(root, input.task_id, {
+        contract: "assurance_kernel/workspace_transaction/v2",
+        task_id: input.task_id,
+        expected_record_hash: checks.current.revision,
+        next_record_content: `${JSON.stringify(record, null, 2)}
 `,
-      expected_workspace_hash: checks.workspace.revision,
-      next_workspace_content: `${JSON.stringify(nextWorkspace, null, 2)}
+        expected_workspace_hash: checks.workspace.revision,
+        next_workspace_content: `${JSON.stringify(nextWorkspace, null, 2)}
 `
-    }, claim);
+      }, claim);
+    } catch (error) {
+      if (input.batch)
+        input.batch.registry.releaseChild(input.batch.capability, input.task_id);
+      throw error;
+    }
     return {
       record: mutation.record,
       backend_claim: claim,
@@ -6645,14 +6725,18 @@ async function submitClaudeReview(host, coordinator, ctx, taskId, verdictInput)
       return coordinator.abandonReview(taskId, observed.reason);
     return { state: "blocked", reason: observed.reason };
   }
+  const parentValid = coordinator.isReviewVerdictValid(taskId, verdictInput);
+  if (!parentValid)
+    return coordinator.submitReview(taskId, ctx, verdictInput);
+  const receiptValid = coordinator.isReviewVerdictValid(taskId, observed.receipt.result);
+  if (!receiptValid) {
+    return coordinator.abandonReview(taskId, "reviewer receipt is not a valid verdict");
+  }
   const parentJson = extractVerdictJson(verdictInput);
   const receiptJson = extractVerdictJson(observed.receipt.result);
-  if (parentJson && receiptJson && verdictFingerprint(parentJson) !== verdictFingerprint(receiptJson)) {
+  if (verdictFingerprint(parentJson) !== verdictFingerprint(receiptJson)) {
     return { state: "blocked", reason: "parent verdict does not match reviewer receipt" };
   }
-  if (parentJson && !receiptJson) {
-    return { state: "blocked", reason: "reviewer receipt is not a valid verdict" };
-  }
   return coordinator.submitReview(taskId, ctx, verdictInput);
 }
 function stopReason(value) {
@@ -6948,6 +7032,12 @@ class ClaudeRuntime {
   async submitReview(taskId, verdictInput) {
     return submitClaudeReview(this.host, this.coordinator, { cwd: this.cwd }, taskId, verdictInput);
   }
+  async resolveFinding(taskId, findingId) {
+    return this.executeOrdinary({ cwd: this.cwd }, {
+      taskId,
+      operation: { op: "resolve_finding", finding_id: findingId, actor_id: "executor" }
+    });
+  }
   async authorize(taskId, operation, meta, extra = {}) {
     if (operation === "repair_authority_state") {
       const authority = reconcileKernelAuthority(this.cwd, taskId);
@@ -6972,6 +7062,8 @@ class ClaudeRuntime {
           throw new Error(`resolve-user-decision requires exactly one open user decision; found ${open.length}`);
         op = "resolve_user_decision";
         decisionOp = { finding_id: open[0].id, resolution: `resume after literal-user decision: ${open[0].summary}` };
+      } else if (readiness.state === "authorize_rework") {
+        op = "authorize_rework";
       } else {
         throw new Error(readiness.blocked ?? "no unique host-derived authorization operation");
       }
@@ -7088,7 +7180,7 @@ class ClaudeRuntime {
         diffProvider: diffSnapshotOf,
         now
       });
-      if (op === "stop" || op === "approve_breaking_intent_revision")
+      if (op === "stop" || op === "authorize_rework" || op === "approve_breaking_intent_revision")
         stagePlanningArtifactTransition(this.cwd, result.record);
       return result;
     } catch (error) {
@@ -7224,7 +7316,8 @@ var TOOLS = [
   { name: "request_authorization", description: "Apply exact literal-user authorization.", privileged: true },
   { name: "approve_breaking_intent_revision", description: "Approve a breaking TaskIntent revision.", privileged: true },
   { name: "stop", description: "Stop the active task with literal-user authority.", privileged: true },
-  { name: "repair_authority_state", description: "Repair a proven recoverable stale backend claim.", privileged: false }
+  { name: "repair_authority_state", description: "Repair a proven recoverable stale backend claim.", privileged: false },
+  { name: "resolve_finding", description: "Resolve one open blocking or advisory finding whose cause is fixed and verified.", privileged: false }
 ];
 function listMcpTools() {
   return TOOLS.map((tool) => ({
@@ -7236,9 +7329,10 @@ function listMcpTools() {
         task_id: { type: "string" },
         ...tool.name === "approve_breaking_intent_revision" ? { next_intent: { type: "object" } } : {},
         ...tool.name === "stop" ? { reason: { type: "string" } } : {},
-        ...tool.name === "submit_review" ? { verdict: { type: "object" } } : {}
+        ...tool.name === "submit_review" ? { verdict: { type: "object" } } : {},
+        ...tool.name === "resolve_finding" ? { finding_id: { type: "string" } } : {}
       },
-      required: tool.name === "submit_review" ? ["task_id", "verdict"] : ["task_id"]
+      required: tool.name === "submit_review" ? ["task_id", "verdict"] : tool.name === "resolve_finding" ? ["task_id", "finding_id"] : ["task_id"]
     },
     annotations: tool.privileged ? privilegedAnnotations() : { readOnlyHint: tool.name === "status" }
   }));
@@ -7305,6 +7399,11 @@ function createMcpRuntime(options = {}) {
           throw new Error("verdict is required");
         return runtime.submitReview(taskId, args.verdict);
       }
+      if (name === "resolve_finding") {
+        if (typeof args.finding_id !== "string" || !args.finding_id)
+          throw new Error("finding_id is required");
+        return runtime.resolveFinding(taskId, args.finding_id);
+      }
       if (name === "request_authorization" || name === "approve_breaking_intent_revision" || name === "stop" || name === "repair_authority_state") {
         return runtime.authorize(taskId, name, toolMeta, args);
       }

package/plugins/immune-brain/dist/imm-loop.md

@@ -83,8 +83,14 @@ not bypass them. Do not poll or create detached jobs.
 - Invoke `approve_breaking_intent_revision` with the complete next intent
   directly; the native Host gate is the single user decision. Do not overwrite
   enrolled intent sidecars or ask for chat pre-confirmation.
-- On `awaiting_user`, invoke `request_authorization` directly. It is reserved
-  for a concrete unresolved decision or explicit stop, not risk tier alone.
+- On `awaiting_user`, invoke `request_authorization` directly for a concrete
+  unresolved decision or rework authorization, not risk tier alone.
+- When the user explicitly asks to stop a Pi task, invoke
+  `imm_kernel_canary({ task_id, action: { op: "request_stop" } })` directly.
+  Its single native confirmation authorizes existing Kernel stop settlement.
+  Cancellation is not task termination. A busy invocation must finish or be
+  cancelled through existing Host controls before requesting stop; never clear
+  claims manually or use this operation to force-kill QA.
 - Invoke `repair_authority_state` directly for a proven stale claim. Kernel
   revalidation removes only the redundant claim without user interaction.
 - A Managed native authority failure stays fail-closed. Report its stable reason