immune-brain 3.6.4 → 3.6.5

package/plugins/immune-brain/runtime/kernel/intent.ts

@@ -27,6 +27,7 @@ import {
 import {
 	mintToken,
 	type TaskIntentIdentityToken,
+	type TokenIdentity,
 } from "./intent_token_registry";
 
 export const INTENT_MAX_BYTES = 64 * 1024;
@@ -406,6 +407,26 @@ export interface ReadTaskIntentResult {
 	token: TaskIntentIdentityToken;
 }
 
+export interface ObservedTaskIntent {
+	intent: TaskIntentV1;
+	content_hash: string;
+	intent_ref: TaskIntentRefV1;
+}
+
+export class TaskIntentObservationError extends Error {
+	readonly code: "missing" | "invalid";
+
+	constructor(code: "missing" | "invalid", message: string) {
+		super(message);
+		this.name = "TaskIntentObservationError";
+		this.code = code;
+	}
+}
+
+interface TaskIntentReadSource extends ObservedTaskIntent {
+	identity: TokenIdentity;
+}
+
 export function setIntentReaderTestHook(
 	hook: { onBeforeDescriptorRead?: () => void } | null,
 ): void {
@@ -523,11 +544,11 @@ function assertIdentitiesUnchanged(
 	}
 }
 
-export function readTaskIntent(
+function readTaskIntentSource(
 	root: string,
 	taskId: string,
 	requestedPath?: string,
-): ReadTaskIntentResult {
+): TaskIntentReadSource {
 	validateTaskId(taskId);
 
 	const canonicalRoot = resolveCanonicalRoot(root);
@@ -545,7 +566,7 @@ export function readTaskIntent(
 	if (!target.startsWith(canonicalRoot + sep))
 		throw new Error("intent sidecar escapes project root");
 	if (!sidecarPresent(canonicalRoot, sidecarPath))
-		throw new Error(`TaskIntent sidecar is missing at ${sidecarPath}`);
+		throw new TaskIntentObservationError("missing", `TaskIntent sidecar is missing at ${sidecarPath}`);
 
 	const pathIdentities = collectPathIdentities(canonicalRoot, sidecarPath);
 	const fileIdentity = pathIdentities[pathIdentities.length - 1];
@@ -557,13 +578,19 @@ export function readTaskIntent(
 			["ls-files", "--error-unmatch", "--", sidecarPath],
 			{ cwd: canonicalRoot, stdio: ["ignore", "pipe", "pipe"] },
 		);
-	} catch {
-		throw new Error("TaskIntent sidecar is not Git-tracked");
+	} catch (error) {
+		if (
+			typeof error === "object"
+			&& error !== null
+			&& "status" in error
+			&& (error as { status?: unknown }).status === 1
+		) throw new TaskIntentObservationError("invalid", "TaskIntent sidecar is not Git-tracked");
+		throw error;
 	}
 
 	const before = lstatSync(target);
 	if (!before.isFile() || before.size > INTENT_MAX_BYTES)
-		throw new Error("TaskIntent sidecar must be a regular file no larger than 64 KiB");
+		throw new TaskIntentObservationError("invalid", "TaskIntent sidecar must be a regular file no larger than 64 KiB");
 
 	const fd = openSync(target, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
 	let bytes: Buffer;
@@ -576,7 +603,7 @@ export function readTaskIntent(
 		closeSync(fd);
 	}
 	if (bytes.byteLength > INTENT_MAX_BYTES)
-		throw new Error("TaskIntent sidecar exceeds 64 KiB");
+		throw new TaskIntentObservationError("invalid", "TaskIntent sidecar exceeds 64 KiB");
 
 	// Post-read identity re-verification without a second path read as the
 	// source of bytes.
@@ -594,27 +621,15 @@ export function readTaskIntent(
 	try {
 		intent = parseTaskIntentV1(JSON.parse(bytes.toString("utf8")));
 	} catch (error) {
-		throw new Error(
+		throw new TaskIntentObservationError(
+			"invalid",
 			`TaskIntent sidecar is invalid: ${error instanceof Error ? error.message : String(error)}`,
 		);
 	}
 	if (intent.task_id !== taskId)
-		throw new Error("intent.task_id does not match the sidecar filename task id");
+		throw new TaskIntentObservationError("invalid", "intent.task_id does not match the sidecar filename task id");
 
 	const contentHash = canonicalIntentHash(intent);
-	const token = mintToken({
-		canonical_root: canonicalRoot,
-		sidecar_path: sidecarPath,
-		path_dev: fileIdentity.dev,
-		path_ino: fileIdentity.ino,
-		fd_dev: before.dev,
-		fd_ino: before.ino,
-		fd_size: before.size,
-		fd_mtime_ms: before.mtimeMs,
-		source_bytes_sha256: sourceBytesSha256,
-		intent_content_hash: contentHash,
-	});
-
 	return {
 		intent,
 		content_hash: contentHash,
@@ -623,6 +638,35 @@ export function readTaskIntent(
 			revision: intent.revision,
 			content_hash: contentHash,
 		},
-		token,
+		identity: {
+			canonical_root: canonicalRoot,
+			sidecar_path: sidecarPath,
+			path_dev: fileIdentity.dev,
+			path_ino: fileIdentity.ino,
+			fd_dev: before.dev,
+			fd_ino: before.ino,
+			fd_size: before.size,
+			fd_mtime_ms: before.mtimeMs,
+			source_bytes_sha256: sourceBytesSha256,
+			intent_content_hash: contentHash,
+		},
 	};
 }
+
+export function observeTaskIntent(
+	root: string,
+	taskId: string,
+	requestedPath?: string,
+): ObservedTaskIntent {
+	const { identity: _identity, ...observed } = readTaskIntentSource(root, taskId, requestedPath);
+	return observed;
+}
+
+export function readTaskIntent(
+	root: string,
+	taskId: string,
+	requestedPath?: string,
+): ReadTaskIntentResult {
+	const { identity, ...observed } = readTaskIntentSource(root, taskId, requestedPath);
+	return { ...observed, token: mintToken(identity) };
+}

package/plugins/immune-brain/runtime/kernel/reducer.ts

@@ -178,6 +178,7 @@ function hasPrivilegedKind(action: TaskAction): boolean {
 		action.type === "record_approval" ||
 		action.type === "approve_breaking_intent_revision" ||
 		action.type === "request_rework" ||
+		action.type === "authorize_rework" ||
 		action.type === "stop" ||
 		action.type === "resolve_user_decision"
 	);
@@ -449,13 +450,16 @@ export function reduceTask(
 					"request_rework requires review, qa, or user authority",
 				]);
 			const round = reviewRound(record);
-			const reviewAuthorityReworks = record.history.filter(
-				(entry) =>
-					entry.type === "request_rework" &&
-					entry.authority?.authority_kind === "review",
-			).length;
+			const hasPriorBlockingReviewRework = record.findings.some(
+				(finding) =>
+					finding.source === "review" &&
+					finding.kind === "blocking" &&
+					finding.review_round !== null,
+			);
 			const parkForReplan =
-				authorityAudit.authority_kind === "review" && reviewAuthorityReworks >= 1;
+				authorityAudit.authority_kind === "review" &&
+				hasPriorBlockingReviewRework &&
+				action.findings.some((finding) => finding.kind === "blocking");
 			if (!parkForReplan) {
 				record.artifact_state = "active";
 				record.intent_ref.path = `docs/plans/${record.task_id}.intent.json`;
@@ -470,8 +474,8 @@ export function reduceTask(
 				record.findings.push({
 					...finding,
 					status: "open",
-					source: "review",
-					review_round: round,
+					source: authorityAudit.authority_kind === "review" ? "review" : "execution",
+					review_round: authorityAudit.authority_kind === "review" ? round : null,
 				});
 			}
 			if (
@@ -502,6 +506,28 @@ export function reduceTask(
 			appendHistory(record, action, from, `review_round_${round}`, authorityAudit);
 			break;
 		}
+		case "authorize_rework": {
+			if (record.lifecycle !== "active")
+				throw new KernelInvariantError([
+					`cannot authorize rework while lifecycle is ${record.lifecycle}`,
+				]);
+			if (authorityAudit?.authority_kind !== "user")
+				throw new KernelInvariantError([
+					"authorize_rework requires literal-user authority",
+				]);
+			const open = record.findings.filter(
+				(finding) => finding.kind === "replan_required" && finding.status === "open",
+			);
+			if (open.length === 0)
+				throw new KernelInvariantError([
+					"authorize_rework requires an open replan boundary",
+				]);
+			for (const finding of open) finding.status = "resolved";
+			record.artifact_state = "active";
+			record.intent_ref.path = `docs/plans/${record.task_id}.intent.json`;
+			appendHistory(record, action, from, open.map((finding) => finding.id).join(","), authorityAudit);
+			break;
+		}
 		case "complete": {
 			if (record.lifecycle !== "active" || record.artifact_state !== "frozen")
 				throw new KernelInvariantError([

package/plugins/immune-brain/runtime/kernel/types.ts

@@ -297,6 +297,7 @@ export type TaskAction =
 	| (TaskActionBase & { type: "request_rework"; findings: TaskFinding[] })
 	| (TaskActionBase & { type: "complete" })
 	| (TaskActionBase & { type: "stop"; reason: string })
+	| (TaskActionBase & { type: "authorize_rework" })
 	| (TaskActionBase & { type: "resolve_user_decision"; finding_id: string; resolution: string });
 
 

package/plugins/immune-brain/runtime/kernel/validation.ts

@@ -735,6 +735,7 @@ const ACTION_V2_TYPES = [
 	"request_rework",
 	"complete",
 	"stop",
+	"authorize_rework",
 	"resolve_user_decision",
 ] as const;
 
@@ -897,7 +898,8 @@ export function parseTaskAction(raw: unknown): TaskAction {
 			};
 			break;
 		}
-		case "complete": {
+		case "complete":
+		case "authorize_rework": {
 			rejectUnknown(value, [...ACTION_BASE_FIELDS], "action", violations);
 			action = { ...base, type: base.type };
 			break;
@@ -1002,6 +1004,7 @@ export function assertTaskRecordUpdateV3(
 		if (
 			next.intent_ref.path !== previous.intent_ref.path &&
 			action.type !== "request_rework" &&
+			action.type !== "authorize_rework" &&
 			action.type !== "stop"
 		)
 			violations.push("only artifact transitions may change intent_ref path");
@@ -1023,11 +1026,12 @@ export function assertTaskRecordUpdateV3(
 			? [action.finding_id]
 			: action.type === "resolve_user_decision"
 				? [action.finding_id]
-				: action.type === "approve_breaking_intent_revision"
-					? previous.findings
-						.filter((item) => item.kind === "replan_required" && item.status === "open")
-						.map((item) => item.id)
-					: [];
+			: action.type === "authorize_rework" ||
+				  action.type === "approve_breaking_intent_revision"
+				? previous.findings
+					.filter((item) => item.kind === "replan_required" && item.status === "open")
+					.map((item) => item.id)
+				: [];
 	const reworkFindingIds =
 		action.type === "request_rework"
 			? new Set(action.findings.map((item) => item.id))

package/plugins/immune-brain/runtime/plugin_version.ts

@@ -1,2 +1,2 @@
 // Generated by scripts/plugin_versioning.ts from the root package.json.
-export const PLUGIN_VERSION = "3.6.4" as const;
+export const PLUGIN_VERSION = "3.6.5" as const;