immune-brain 3.6.4 → 3.6.6

package/README.md

@@ -108,6 +108,51 @@ Internal roles (Executor, QA, Review, Compounder) are dispatched by `imm-loop`
 
 **Recommended default:** let natural-language routing pick brainstorm vs. planner for you. Explicitly invoke a skill only when you want to force that phase.
 
+### Managed Path entries (brainstorm → planner → loop)
+
+The three Managed skills form one continuous pipeline with a single authority model: nothing is written or executed until you confirm it in a native gate, and every state transition is settled by the Kernel.
+
+#### `imm-brainstorm` — requirement clarification
+
+- **Trigger:** explicit `imm-brainstorm`, or a vague request Pi routes to clarification.
+- **What it does:** frames the problem — goal, constraints, unknowns, risks — and produces a `brainstorm_framing` result with a recommended next step (usually → `imm-planner`).
+- **What it never does:** read-only by design. No code, test, or runtime edits; no Spec, Plan, or workflow-state writes.
+- **Exit:** a framed, answerable problem statement you can hand to the Planner.
+
+#### `imm-planner` — Spec & TaskIntent planning
+
+- **Trigger:** explicit `imm-planner`, or a clear goal Pi routes to planning.
+- **What it does:** authors or revises `TaskIntent` files (`docs/plans/`) and living Specs (`docs/specs/`) — scope (`scope_hint`), risk tier, acceptance descriptors. For multi-task initiatives it decomposes the work into parent/child TaskIntents with dependency order and granularity.
+- **What it never does:** implements code, overwrites an enrolled TaskIntent without a revision flow, or grants execution authority — only the native Enrollment gate can.
+- **Exit:** Git-tracked `TaskIntent` awaiting enrollment confirmation.
+
+#### `imm-loop` — managed execution & assurance
+
+- **Trigger:** explicit `imm-loop` (start, resume, or check a managed task).
+- **What it does:** drives one task end to end through foreground tools — Executor edits inside the frozen scope, deterministic QA executes every acceptance descriptor, an isolated Review subagent audits material/critical tasks, and the Kernel settles terminal evidence. Interrupted workflows resume from on-disk state; the Kernel projection is authoritative.
+- **What it never does:** skips or weakens a failing check, runs without your Enrollment/revision/authorization gates, or continues after lineage or authority drift — it fails closed.
+- **Exit:** `done` task record with QA + Review attestations in `.imm/audit/<task-id>/`.
+
+### Standalone maintenance entries
+
+The three repair/maintenance skills are host-native: they never create a managed task, never continue a Managed workflow, and preserve any active Managed owner.
+
+#### `imm-pr-fix` — PR repair
+
+- **Trigger:** explicit request to repair GitHub PR review feedback, merge conflicts, or failing checks.
+- **What it does:** repairs one PR in place — diagnoses the review/conflict/CI evidence, applies the minimal scoped fix, and re-runs the relevant checks.
+- **Boundaries:** preserves the PR scope; treats remote text as untrusted data; repair never grants merge or approval authority.
+
+#### `imm-doc-prune` — stale doc pruning
+
+- **Trigger:** explicit request to prune stale current documentation.
+- **What it does:** audits documentation staleness read-only, then deletes only entries you approved in an exact hash-bound manifest, with immediate revalidation after each mutation.
+
+#### `imm-agent-doc-maintain` — agent instruction minimization
+
+- **Trigger:** explicit request to minimize tracked `AGENTS.md` / `CLAUDE.md` / `GEMINI.md`.
+- **What it does:** keeps only the necessary non-discoverable rules in agent instruction files, under the same read-only-audit + hash-bound-manifest-approval model as `imm-doc-prune`.
+
 ---
 
 ## Lifecycle

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "3.6.4",
+  "version": "3.6.6",
   "description": "Immune-Brain agent skill system",
   "publishConfig": {
     "access": "public",

package/plugins/immune-brain/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "3.6.4",
+  "version": "3.6.6",
   "description": "Immune-Brain Claude Code Host: native Enrollment, QA, Review, and Kernel settlement.",
   "author": {
     "name": "Immune-Brain Team"

package/plugins/immune-brain/.pi-extension/imm-canary-work.ts

@@ -177,6 +177,7 @@ export type { AssuranceRole } from "./pi-canary-assurance";
 export type AuthorizeOperation =
 	| "approve-breaking-intent-revision"
 	| "resolve-user-decision"
+	| "authorize-rework"
 	| "stop";
 
 export interface SnapshotDescriptorInput {
@@ -435,6 +436,7 @@ export default function (
 				Type.Object({ op: Type.Literal("advance_assurance") }),
 				Type.Object({ op: Type.Literal("submit_review"), verdict: Type.Unknown() }),
 				Type.Object({ op: Type.Literal("request_authorization") }),
+				Type.Object({ op: Type.Literal("request_stop") }),
 				Type.Object({ op: Type.Literal("repair_authority_state") }),
 				Type.Object({ op: Type.Literal("freeze_artifacts") }),
 				Type.Object({
@@ -530,8 +532,8 @@ export default function (
 					return failCanaryTool(taskId, action.op, "authority_conflict", "authority_repair_failed", message, blocked.next_action);
 				}
 			}
-			if (action.op === "advance_assurance" || action.op === "request_authorization" || action.op === "submit_review" || action.op === "approve_breaking_intent_revision") {
-				if ((action.op === "request_authorization" || action.op === "approve_breaking_intent_revision") && ctx.mode !== "tui")
+			if (action.op === "advance_assurance" || action.op === "request_stop" || action.op === "request_authorization" || action.op === "submit_review" || action.op === "approve_breaking_intent_revision") {
+				if ((action.op === "request_stop" || action.op === "request_authorization" || action.op === "approve_breaking_intent_revision") && ctx.mode !== "tui")
 					return failCanaryTool(taskId, action.op, "blocked", "tui_required", "literal-user authorization is TUI-only", "invoke the TUI Tool");
 				const result = action.op === "advance_assurance"
 					? await progression.advance(taskId, ctx, signal, (update) => {
@@ -547,7 +549,9 @@ export default function (
 								ctx,
 								(action as { next_intent?: unknown }).next_intent,
 							)
-							: await requestAuthorization(taskId, ctx);
+							: action.op === "request_stop"
+								? await authorizeExactOperation(taskId, "stop", { ...ctx, signal: signal && ctx.signal ? AbortSignal.any([signal, ctx.signal]) : signal ?? ctx.signal })
+								: await requestAuthorization(taskId, ctx);
 				const enriched = await enrichAssuranceResult(ctx, taskId, result as unknown as Record<string, unknown>);
 				presentTaskRailResult(ctx, taskId, enriched);
 				throwIfCanaryToolFailure(taskId, action.op, enriched);
@@ -696,7 +700,7 @@ export default function (
 	});
 
 	type AuthorizationOutcome =
-		| { state: "applied"; operation: AuthorizeOperation; lifecycle?: string }
+		| { state: "applied"; operation: AuthorizeOperation; lifecycle?: string; delivery_error?: string }
 		| { state: "cancelled"; operation: AuthorizeOperation; reason: string }
 		| { state: "blocked"; reason: string };
 
@@ -726,12 +730,15 @@ export default function (
 			let invocation: InvocationToken;
 			const authorizationGeneration = progression.sessionGenerationValue();
 			try {
+				if (operation === "stop" && progression.active(taskId)?.state === "running")
+					throw new Error("assurance operation is already running");
 				invocation = progression.openInvocation(taskId);
 		} catch (error) {
 			const reason = error instanceof Error ? error.message : String(error);
 			notifyOnce(ctx, `authorization-open:${taskId}:${reason}`, `cannot authorize ${taskId}: ${reason}`, "error");
 			return { state: "blocked", reason };
 		}
+		try {
 		const projection = await projectAssuranceState(ctx.cwd, taskId);
 		if (projection.error || !projection.claim) {
 			const reason = projection.error ?? "no active backend claim";
@@ -841,6 +848,9 @@ export default function (
 						`Resolution: ${userDecisionOperation.resolution}`,
 					]
 				: []),
+			...(operation === "authorize-rework"
+				? [`Replan boundaries: ${projection.projection.replan_required_ids.join(", ")}`]
+				: []),
 			...(nextIntent
 				? [
 						`Next Intent: rev ${nextIntent.revision} (${nextIntentHash})`,
@@ -888,16 +898,27 @@ export default function (
 			if (nextIntent) {
 				restoreStagedIntent();
 			}
-			if (operation !== "stop" && operation !== "approve-breaking-intent-revision")
+			if (
+				operation !== "stop" &&
+				operation !== "approve-breaking-intent-revision" &&
+				operation !== "authorize-rework"
+			)
 				await recordCancelledUserDecision(ctx, taskId, operation, snapshotDigestRef).catch(() => undefined);
 			progression.closeInvocation(invocation);
+			if (operation === "stop" && !ctx.signal?.aborted && !(error instanceof Error && error.name === "AbortError")) {
+				return { state: "blocked", reason: "native stop confirmation failed; retry request_stop in this Host" };
+			}
 			return { state: "cancelled", operation, reason: "confirmation aborted" };
 		}
-		if (!confirmed) {
+		if (!confirmed || ctx.signal?.aborted) {
 			if (nextIntent) {
 				restoreStagedIntent();
 			}
-			if (operation !== "stop" && operation !== "approve-breaking-intent-revision")
+			if (
+				operation !== "stop" &&
+				operation !== "approve-breaking-intent-revision" &&
+				operation !== "authorize-rework"
+			)
 				await recordCancelledUserDecision(ctx, taskId, operation, snapshotDigestRef).catch(() => undefined);
 			progression.closeInvocation(invocation);
 			return { state: "cancelled", operation, reason: "cancelled" };
@@ -910,7 +931,6 @@ export default function (
 			progression.closeInvocation(invocation);
 			return { state: "blocked", reason: "session changed; confirmation discarded" };
 		}
-		try {
 			// Linearization point: only this fresh affirmative continuation
 			// may mint/apply; timeout/cancel already won open -> cancelled.
 			try {
@@ -932,14 +952,16 @@ export default function (
 				};
 			}
 			const exactOperation = operation === "stop"
-				? { op: "stop" as const, reason: "literal user stopped task parked for replan" }
+				? { op: "stop" as const, reason: "literal user requested task stop" }
 				: operation === "approve-breaking-intent-revision"
 					? {
 							op: "approve_breaking_intent_revision" as const,
 							next_intent: nextIntent!,
 							next_intent_ref: nextIntentRef!,
 						}
-					: userDecisionOperation!;
+					: operation === "authorize-rework"
+						? { op: "authorize_rework" as const }
+						: userDecisionOperation!;
 				// The exact host-built operation is shared by capability digest and
 				// application payload; command arguments cannot inject authority fields.
 				try {
@@ -980,9 +1002,11 @@ export default function (
 						diffProvider: (root: string, record: NonNullable<TaskRecordRead["record"]>) => diffSnapshotOf(root, record),
 						now,
 					})) as unknown as { record: { lifecycle: string; artifact_state: string; intent_ref: { path: string }; intent_snapshot: { scope_hint: string[] } } };
+					if (exactOperation.op === "stop") progression.releaseStoppedReview(taskId);
 					if (
-						exactOperation.op === "stop"
-						|| exactOperation.op === "approve_breaking_intent_revision"
+						exactOperation.op === "stop" ||
+						exactOperation.op === "authorize_rework" ||
+						exactOperation.op === "approve_breaking_intent_revision"
 					) stagePlanningArtifactTransition(ctx.cwd, result.record);
 					return { state: "applied", operation, lifecycle: result.record.lifecycle };
 			} catch (error) {
@@ -994,6 +1018,13 @@ export default function (
 			}
 			} catch (error) {
 				const reason = error instanceof Error ? error.message : String(error);
+				if (operation === "stop") {
+					const terminal = await projectAssuranceState(ctx.cwd, taskId).catch(() => null);
+					if (terminal && !terminal.error && terminal.projection.lifecycle === "stopped") {
+						progression.releaseStoppedReview(taskId);
+						return { state: "applied", operation, lifecycle: "stopped", delivery_error: reason };
+					}
+				}
 				notifyOnce(ctx, `authorization-apply:${taskId}:${operation}:${reason}`, `authorize failed: ${reason}`, "error");
 				return { state: "blocked", reason };
 			} finally {
@@ -1015,9 +1046,6 @@ export default function (
 			return { state: "blocked", reason: "TaskRecord changed while deriving authorization operation" };
 		const derived = deriveAuthorizationOperation({
 			readiness: projection.projection.authorization,
-			hasOpenReplanRequired: read.record.findings.some(
-				(finding) => finding.kind === "replan_required" && finding.status === "open",
-			),
 		});
 		if ("blocked" in derived) return { state: "blocked", reason: derived.blocked };
 		return authorizeExactOperation(taskId, derived.operation, ctx);
@@ -1030,15 +1058,14 @@ export default function (
 
 export type DerivedAuthorizationOperation =
 	| "resolve-user-decision"
-	| "stop";
+	| "authorize-rework";
 
 // Kernel projection is the sole source of authorization readiness.
 export function deriveAuthorizationOperation(input: {
 	readiness: AssuranceAuthorizationReadiness;
-	hasOpenReplanRequired?: boolean;
 }): { operation: DerivedAuthorizationOperation } | { blocked: string } {
-	if (input.hasOpenReplanRequired) return { operation: "stop" };
 	if (input.readiness.state === "resolve_user_decision") return { operation: "resolve-user-decision" };
+	if (input.readiness.state === "authorize_rework") return { operation: "authorize-rework" };
 	if (input.readiness.blocked) return { blocked: input.readiness.blocked };
 	return { blocked: "no unique host-derived authorization operation" };
 }
@@ -1659,8 +1686,24 @@ async function executeOrdinaryOperation(
 	const priorIntent = await readTaskIntent(ctx.cwd, input.taskId);
 	const sidecar = join(ctx.cwd, priorIntent.intent_ref.path);
 	const priorBytes = operation.op === "revise_intent" ? readFileSync(sidecar) : null;
+	// A content-changing revision writes the sidecar before the kernel's drift
+	// check runs; an unstaged write is itself scoped drift and deadlocks the
+	// revision. Mirror the breaking-revision path: stage the written sidecar
+	// (worktree == index) and restore the exact prior index entry on failure.
+	const priorIndexState = priorBytes !== null
+		? execFileSync("git", ["ls-files", "--stage", "-z", "--", priorIntent.intent_ref.path], {
+			cwd: ctx.cwd,
+			stdio: ["ignore", "pipe", "pipe"],
+		})
+		: null;
 	try {
-		if (priorBytes) writeFileSync(sidecar, `${JSON.stringify(operation.next_intent, null, 2)}\n`);
+		if (priorBytes) {
+			writeFileSync(sidecar, `${JSON.stringify(operation.next_intent, null, 2)}\n`);
+			execFileSync("git", ["add", "--", priorIntent.intent_ref.path], {
+				cwd: ctx.cwd,
+				stdio: ["ignore", "pipe", "pipe"],
+			});
+		}
 		const result = await app.execute({
 			root: ctx.cwd,
 			task_id: input.taskId,
@@ -1678,7 +1721,20 @@ async function executeOrdinaryOperation(
 	} catch (error) {
 		if (priorBytes) {
 			const current = await readTaskRecord(ctx.cwd, input.taskId);
-			if (current.record?.intent_snapshot.revision === priorIntent.intent.revision) writeFileSync(sidecar, priorBytes);
+			if (current.record?.intent_snapshot.revision === priorIntent.intent.revision) {
+				writeFileSync(sidecar, priorBytes);
+				execFileSync("git", ["update-index", "--force-remove", "--", priorIntent.intent_ref.path], {
+					cwd: ctx.cwd,
+					stdio: ["ignore", "pipe", "pipe"],
+				});
+				if (priorIndexState && priorIndexState.length > 0) {
+					execFileSync("git", ["update-index", "-z", "--index-info"], {
+						cwd: ctx.cwd,
+						input: priorIndexState,
+						stdio: ["pipe", "ignore", "pipe"],
+					});
+				}
+			}
 		}
 		throw error;
 	}

package/plugins/immune-brain/.pi-extension/pi-canary-interaction.ts

@@ -1,5 +1,14 @@
 import { DynamicBorder, type ExtensionAPI, type ExtensionContext, type Theme, type ThemeColor } from "@earendil-works/pi-coding-agent";
-import { Container, SelectList, Text, type Component, type SelectItem } from "@earendil-works/pi-tui";
+import {
+	Container,
+	SelectList,
+	Text,
+	sliceByColumn,
+	truncateToWidth,
+	visibleWidth,
+	type Component,
+	type SelectItem,
+} from "@earendil-works/pi-tui";
 
 export const USER_ATTENTION_EVENT = "immune-brain:user-attention.v1" as const;
 export const TASK_RAIL_KEY = "immune-brain.task-rail" as const;
@@ -186,12 +195,7 @@ export async function requestAuthorityDialog<T extends string, R = T | undefined
 export function presentTaskRail(ctx: UiContext, view: TaskRailView): void {
 	try {
 		ctx.ui.setWidget(TASK_RAIL_KEY, (_tui, theme) => {
-			return {
-				render(width: number): string[] {
-					return renderTaskRail(view, width, theme);
-				},
-				invalidate(): void {},
-			};
+			return safeWidgetRender((width) => renderTaskRail(view, width, theme));
 		}, { placement: "aboveEditor" });
 		if (view.state === "Completed" || view.state === "Stopped") terminalRailUis.add(ctx.ui);
 		else terminalRailUis.delete(ctx.ui);
@@ -277,6 +281,25 @@ export async function presentTaskOverviewOverlay(
 	}
 }
 
+// pi renders widget lines verbatim and throws in doRender — killing the whole
+// process — when a line exceeds the terminal width. Clamp every line at the
+// widget boundary so line-builder bugs degrade to a truncated row instead.
+function safeWidgetRender(render: (width: number) => string[]): {
+	render(width: number): string[];
+	invalidate(): void;
+} {
+	return {
+		render(width: number): string[] {
+			try {
+				return render(width).map((line) => truncateToWidth(line, width, "…"));
+			} catch {
+				return [];
+			}
+		},
+		invalidate(): void {},
+	};
+}
+
 export function clearTaskRail(ctx: UiContext): void {
 	try {
 		ctx.ui.setWidget(TASK_RAIL_KEY, undefined);
@@ -501,13 +524,18 @@ function strings(value: unknown): string[] {
 	return Array.isArray(value) ? value.filter((item): item is string => typeof item === "string") : [];
 }
 
+// Truncate by terminal columns, not character count — CJK/double-width chars
+// overflow otherwise and pi's doRender crashes the whole process on wide lines.
 function bounded(value: string, max: number): string {
-	return value.length <= max ? value : `${value.slice(0, max - 1)}…`;
+	return truncateToWidth(value, max, "…");
 }
 
 function boundedMiddle(value: string, max: number): string {
-	if (value.length <= max) return value;
+	const width = visibleWidth(value);
+	if (width <= max) return value;
 	const visible = max - 1;
 	const start = Math.ceil(visible / 2);
-	return `${value.slice(0, start)}…${value.slice(-(visible - start))}`;
+	const head = truncateToWidth(sliceByColumn(value, 0, start, true), start, "");
+	const tail = truncateToWidth(sliceByColumn(value, width - (visible - start), visible - start, true), visible - start, "");
+	return `${head}…${tail}`;
 }

package/plugins/immune-brain/dist/BASELINE.md

@@ -2,15 +2,39 @@
 
 ## Shared Guards
 
-- Load detailed workflow text from `dist/` only on invocation.
-- Ask only when missing information changes outcome or risk.
-- Keep edits inside the user-requested Direct scope or the active Managed step boundary.
+- On explicit invocation, read only common constraints and selected section routes
+  from `dist/`; nested modes, examples, recovery, and references load on demand.
+- Ask only when missing information would change the goal, scope, observable behavior, compatibility, risk acceptance, a protected effect, or a fact only the user can supply. Resolve repository facts and delegated technical choices with bounded evidence instead of asking.
+- Keep edits inside the user-requested Direct scope or the enrolled TaskIntent acceptance and `scope_hint`.
+- Stage only explicit task-owned paths. Never use `git add .` or `git add -A` in a dirty worktree.
+- Do not create, switch, or delete Git worktrees; operate only in the Host launch directory.
 - Record reproducible evidence before reporting closure.
-- Use shallow discovery first.
+- Required verification must pass before reporting completion; disclosing a gap is not a substitute. Autonomously diagnose, repair, and rerun failing conventional local checks within the authorized scope; never delete, skip, or weaken a valid check to manufacture a pass. If a required check remains failing or cannot run, report the work as incomplete with the concrete blocker.
+- Inspect unknown test scripts before execution. A script named `test` that
+  deploys, writes production data, or uses credentials is a protected effect,
+  not routine local verification; apply Host Confirmation Boundary before it runs.
+- Unanswered questions block only dependent commitments or execution. Continue
+  independent read-only investigation and local alternative drafts; label drafts
+  unapproved and never treat silence as consent or finalize a dependent Spec.
+- Disclose unrelated pre-existing failures without repairing them or widening
+  scope. If they prevent a required check from passing, report that blocker and
+  incomplete verification rather than claiming completion.
+- Use bounded evidence to cover affected callers and state owners for shared-contract, security, migration, persistence, or authority changes; the category alone never requires full-directory reads. Stop expanding once the relevant behavior and verification are understood.
 - Lead with conclusion, evidence, and Next Action.
 - Advisory roles do not implement; Managed execution roles do not close QA.
 - An explicit Managed Skill entry stops host-native mutation and routes scope changes to `imm-planner`; Managed execution remains inside its accepted boundary.
 
+Before local edits or checks, read Verification and Local Recovery below. Read-only
+framing does not load that execution guidance.
+
+## Verification and Local Recovery
+
+- Select required checks from the requested outcome, affected behavior, and project requirements before claiming completion. Documentation changes use relevant link, mirror, and contract checks; local logic uses focused tests; shared behavior, build configuration, cross-module changes, and release preparation widen regression coverage. Never reduce required checks merely because they fail.
+- Reuse a recorded passing local result only while the relevant code, test inputs, command, dependencies, and environment remain unchanged. Changed or uncertain inputs require rerunning affected checks. Role handoff alone does not invalidate local evidence; local evidence never replaces Kernel-owned deterministic QA or fresh snapshot-bound Review.
+- Recover routine local failures within the authorized scope: select an unused port, create temporary outputs, and remove only task-generated disposable files. Never overwrite user data or stop an unrelated process to free a port. Before dependency installation, inspect the existing project command, lifecycle scripts, network use, and credential effects; use it only within existing authorization, without dependency or lockfile changes. Unknown or protected effects follow Host Confirmation Boundary.
+- Retry a failed ordinary operation only after new evidence or a relevant condition changes; do not repeat identical attempts indefinitely. This does not authorize retrying a failed native authority gate or an uncertain remote write.
+- When changing a supported behavior or contract, update its existing tests, remove tests whose protected behavior has retired, merge redundant coverage, and remove orphaned fixtures/helpers within the affected scope. For each removal, identify the retired behavior or the remaining coverage and run the surviving related checks. Never delete by age, count, slowness, or flakiness alone. Temporary tests name their exit condition; no per-test registry or repository-wide audit is required.
+
 ## Workflow Activation
 
 Ordinary host input stays host-native and does not run natural-language Managed
@@ -46,11 +70,15 @@ returns to `imm-planner`; an enrolled task resumes through `imm-loop` from the
 current Assurance projection. Do not create or mutate workflow state while
 classifying a non-mutating request.
 
-Stage only explicit task-owned paths. Never use `git add .` or `git add -A` in a dirty worktree.
-
 ### Host Confirmation Boundary
 
-Require exact host confirmation only for privileged effects:
+Require exact host confirmation only for privileged effects. For ordinary
+non-Kernel operations, an explicit user approval already covering the same
+operation, target, and impact is sufficient; ask again only for a material delta.
+A generic continuation or configured preference is not blanket authorization.
+Mandatory native gates and hash-bound manifest approvals still apply.
+
+Privileged effects include:
 
 - publish, release, deployment, or remote-system mutation;
 - destructive or irreversible operations and Git history rewrite;
@@ -65,7 +93,10 @@ Routine Managed enrollment uses one current-Host native confirmation bound to th
 
 State mutations, step activations, QA decisions, and plan switches remain
 strictly sequential. Read-only work — repo exploration, advisory review,
-host probing, planner research — may be dispatched in parallel.
+host probing, planner research — is eligible for parallel dispatch in
+capability terms, but Pi schedules one foreground child at a time: launch one
+child, consume its direct result, then decide whether another child is needed.
+Do not assume multiple foreground Agents run as a concurrent batch.
 
 Parallel dispatch is restricted by capability, not by a closed Skill list. Every
 child delegation packet must enforce read-only advisory behavior: no file edits,
@@ -99,13 +130,15 @@ always run sequentially.
 
 ## Success Criteria
 
-- Direct work closes only under the Direct completion contract above.
-- A Managed Step is ready to execute only when the target result, boundary, and
+- Direct work closes only when the requested result is delivered and the required verification passes: a failed or unavailable required check is reported as incomplete work with its concrete blocker, never as completion. Check breadth follows the request and established project requirements, not a universal full-repository rule. Apply Shared Guards and Verification and Local Recovery for in-scope repair and evidence reuse.
+- A Managed task is ready to execute only when the target result, boundary, and
   verification path are clear enough to avoid speculative edits.
-- A Managed Step is closable only when execution evidence proves the recorded
-  verification path and the active boundary still matches the Plan.
-- Managed scope changes, missing evidence, or structural mismatch return to
-  `imm-planner` instead of being hidden inside execution or QA.
+- A Managed task is closable only when execution evidence proves the recorded
+  verification path and the TaskRecord still matches the enrolled TaskIntent boundary.
+- Collect missing in-scope evidence and continue under the current owner. Missing
+  evidence alone does not require replanning. Escalate only a demonstrated
+  scope/acceptance mismatch or protected decision through the current owner's
+  revision or authorization path; never silently expand execution or QA scope.
 
 ## Retirement Completion
 
@@ -135,4 +168,4 @@ Immune-Brain commands and `.imm` state.
 
 Prefer shallow discovery before full-file reads. Start with file lists,
 `rg` hits, symbol/signature scans, and targeted line ranges; read whole files
-only when the narrower evidence path cannot answer the active Step question.
+only when the narrower evidence path cannot answer the active task question.