immune-brain 3.6.4 → 3.6.6

package/plugins/immune-brain/runtime/assurance/coordinator.ts

@@ -436,6 +436,7 @@ export class AssuranceCoordinator {
 	sessionGenerationValue(): number { return this.sessionGeneration; }
 
 	async advance(taskId: string, ctx: HostContext, signal?: AbortSignal, onUpdate?: (update: ForegroundToolUpdate) => void): Promise<AssuranceAdvanceResult> {
+		if (this.isInvocationOpen(taskId)) return { state: "blocked", reason: "an authority invocation is already open" };
 		const active = this.active(taskId);
 		if (active?.state === "review_ready") {
 			const reservation = this.reviewReservations.get(taskId);
@@ -819,6 +820,17 @@ export class AssuranceCoordinator {
 		return { state: "blocked", reason: `Kernel requires ${settled.projection.next_obligation} after Review` };
 	}
 
+	isReviewVerdictValid(taskId: string, verdictInput: unknown): boolean {
+		const reservation = this.reviewReservations.get(taskId);
+		if (!reservation) return false;
+		try {
+			parseAssuranceVerdict(verdictInput, reservation.snapshot);
+			return true;
+		} catch {
+			return false;
+		}
+	}
+
 	abandonReview(taskId: string, reason: string): AssuranceSubmitReviewResult {
 		const reservation = this.reviewReservations.get(taskId);
 		if (!reservation) return { state: "blocked", reason };
@@ -833,6 +845,12 @@ export class AssuranceCoordinator {
 		return { state: "review_ready", operation: "review", operation_id: reservation.operationId, snapshot_digest: snapshotDigest(reservation.snapshot), review_bundle_digest: reservation.snapshot.review_bundle_digest ?? "", agent_params: reservation.hostReservation.dispatch };
 	}
 
+	releaseStoppedReview(taskId: string): void {
+		const reservation = this.reviewReservations.get(taskId);
+		if (reservation) this.releaseReviewReservation(taskId, reservation);
+		this.rejectedReviewOperations.delete(taskId);
+	}
+
 	private releaseReviewReservation(taskId: string, reservation: ReviewReservation, rejectionReason?: string): void {
 		if (this.reviewReservations.get(taskId) !== reservation) return;
 		this.reviewReservations.delete(taskId);

package/plugins/immune-brain/runtime/assurance/verification.ts

@@ -5,7 +5,7 @@
 // runner, compatibility gate, fixed execution, and findings digest.
 
 import { createHash } from "node:crypto";
-import { execFileSync, spawn } from "node:child_process";
+import { execFileSync, spawn, spawnSync } from "node:child_process";
 import { realpathSync, statSync } from "node:fs";
 import { isAbsolute, join, resolve, sep, relative } from "node:path";
 
@@ -43,7 +43,18 @@ export function resolveBunRunner(): FrozenRunner {
 	}
 	let real: string;
 	try {
-		real = realpathSync(executable);
+		// When which returns a version-manager shim (e.g. mise or asdf),
+		// realpathSync on the shim resolves to the version-manager binary rather
+		// than bun. Ask bun itself for its real process.execPath.
+		const execPath = spawnSync(executable, ["-e", "console.log(process.execPath)"], {
+			encoding: "utf8",
+			stdio: ["ignore", "pipe", "ignore"],
+		});
+		if (execPath.status === 0 && execPath.stdout.trim().length > 0) {
+			real = realpathSync(execPath.stdout.trim());
+		} else {
+			real = realpathSync(executable);
+		}
 	} catch {
 		throw new VerificationDescriptorError("bun runner realpath is unresolvable");
 	}

package/plugins/immune-brain/runtime/claude/kernel_ports.ts

@@ -119,13 +119,16 @@ export async function submitClaudeReview(
 		if (observed.release) return coordinator.abandonReview(taskId, observed.reason);
 		return { state: "blocked", reason: observed.reason };
 	}
-	const parentJson = extractVerdictJson(verdictInput);
-	const receiptJson = extractVerdictJson(observed.receipt.result);
-	if (parentJson && receiptJson && verdictFingerprint(parentJson) !== verdictFingerprint(receiptJson)) {
-		return { state: "blocked", reason: "parent verdict does not match reviewer receipt" };
+	const parentValid = coordinator.isReviewVerdictValid(taskId, verdictInput);
+	if (!parentValid) return coordinator.submitReview(taskId, ctx, verdictInput);
+	const receiptValid = coordinator.isReviewVerdictValid(taskId, observed.receipt.result);
+	if (!receiptValid) {
+		return coordinator.abandonReview(taskId, "reviewer receipt is not a valid verdict");
 	}
-	if (parentJson && !receiptJson) {
-		return { state: "blocked", reason: "reviewer receipt is not a valid verdict" };
+	const parentJson = extractVerdictJson(verdictInput)!;
+	const receiptJson = extractVerdictJson(observed.receipt.result)!;
+	if (verdictFingerprint(parentJson) !== verdictFingerprint(receiptJson)) {
+		return { state: "blocked", reason: "parent verdict does not match reviewer receipt" };
 	}
 	return coordinator.submitReview(taskId, ctx, verdictInput);
 }
@@ -525,6 +528,19 @@ export class ClaudeRuntime {
 		return submitClaudeReview(this.host, this.coordinator, { cwd: this.cwd }, taskId, verdictInput);
 	}
 
+	/**
+	 * Ordinary Kernel operation, not a privileged one: canary_application builds
+	 * the action without a capability and the Pi Host lists resolve_finding in
+	 * its ordinary KERNEL_OPERATIONS. The reducer owns every precondition, so
+	 * this port reads no findings and tests no kind.
+	 */
+	async resolveFinding(taskId: string, findingId: string) {
+		return this.executeOrdinary({ cwd: this.cwd }, {
+			taskId,
+			operation: { op: "resolve_finding", finding_id: findingId, actor_id: "executor" },
+		});
+	}
+
 	async authorize(taskId: string, operation: string, meta: ToolMeta, extra: Record<string, unknown> = {}) {
 		if (operation === "repair_authority_state") {
 			const authority = reconcileKernelAuthority(this.cwd, taskId);
@@ -534,7 +550,7 @@ export class ClaudeRuntime {
 			return repairKernelAuthority(this.cwd, taskId, authority.revision);
 		}
 		if (!isPrivilegedOperation(operation) && operation !== "request_authorization") throw new Error(`unsupported privileged operation ${operation}`);
-		let op: PrivilegedOperation | "request_authorization" | "resolve_user_decision" = operation;
+		let op: PrivilegedOperation | "request_authorization" | "resolve_user_decision" | "authorize_rework" = operation;
 		let decisionOp: { finding_id: string; resolution: string } | undefined;
 		const projection = await this.status(taskId);
 		if (projection.error || !projection.claim) throw new Error(projection.error ?? "no active backend claim");
@@ -551,6 +567,8 @@ export class ClaudeRuntime {
 				if (open.length !== 1) throw new Error(`resolve-user-decision requires exactly one open user decision; found ${open.length}`);
 				op = "resolve_user_decision";
 				decisionOp = { finding_id: open[0].id, resolution: `resume after literal-user decision: ${open[0].summary}` };
+			} else if (readiness.state === "authorize_rework") {
+				op = "authorize_rework";
 			} else {
 				throw new Error(readiness.blocked ?? "no unique host-derived authorization operation");
 			}
@@ -668,7 +686,11 @@ export class ClaudeRuntime {
 				diffProvider: diffSnapshotOf,
 				now,
 			});
-			if (op === "stop" || op === "approve_breaking_intent_revision") stagePlanningArtifactTransition(this.cwd, result.record);
+			if (
+				op === "stop" ||
+				op === "authorize_rework" ||
+				op === "approve_breaking_intent_revision"
+			) stagePlanningArtifactTransition(this.cwd, result.record);
 			return result;
 		} catch (error) {
 			if (sidecar && priorBytes && priorIndexState) {
@@ -773,7 +795,7 @@ export class ClaudeRuntime {
 		}));
 	}
 
-	private async executeOrdinary(ctx: HostContext, input: { taskId: string; operation: { op: string; actor_id: string; next_intent?: unknown } }) {
+	private async executeOrdinary(ctx: HostContext, input: { taskId: string; operation: { op: string; actor_id: string; next_intent?: unknown; finding_id?: string } }) {
 		const { app } = await this.authority();
 		const operation = input.operation.op === "revise_intent"
 			? { ...input.operation, next_intent: await parseTaskIntentV1(input.operation.next_intent) }

package/plugins/immune-brain/runtime/claude/mcp_server.ts

@@ -26,6 +26,7 @@ export const TOOLS = [
 	{ name: "approve_breaking_intent_revision", description: "Approve a breaking TaskIntent revision.", privileged: true },
 	{ name: "stop", description: "Stop the active task with literal-user authority.", privileged: true },
 	{ name: "repair_authority_state", description: "Repair a proven recoverable stale backend claim.", privileged: false },
+	{ name: "resolve_finding", description: "Resolve one open blocking or advisory finding whose cause is fixed and verified.", privileged: false },
 ] as const;
 
 export function listMcpTools() {
@@ -39,8 +40,13 @@ export function listMcpTools() {
 				...(tool.name === "approve_breaking_intent_revision" ? { next_intent: { type: "object" } } : {}),
 				...(tool.name === "stop" ? { reason: { type: "string" } } : {}),
 				...(tool.name === "submit_review" ? { verdict: { type: "object" } } : {}),
+				...(tool.name === "resolve_finding" ? { finding_id: { type: "string" } } : {}),
 			},
-			required: tool.name === "submit_review" ? ["task_id", "verdict"] : ["task_id"],
+			required: tool.name === "submit_review"
+				? ["task_id", "verdict"]
+				: tool.name === "resolve_finding"
+					? ["task_id", "finding_id"]
+					: ["task_id"],
 		},
 		annotations: tool.privileged ? privilegedAnnotations() : { readOnlyHint: tool.name === "status" },
 	}));
@@ -119,6 +125,13 @@ export function createMcpRuntime(options: McpRuntimeOptions = {}) {
 				if (!Object.hasOwn(args, "verdict")) throw new Error("verdict is required");
 				return runtime.submitReview(taskId, args.verdict);
 			}
+			if (name === "resolve_finding") {
+				// Structural only. Which findings may be resolved, and when, stays
+				// the reducer's decision; duplicating it here would create a second
+				// authority that could drift from the Kernel.
+				if (typeof args.finding_id !== "string" || !args.finding_id) throw new Error("finding_id is required");
+				return runtime.resolveFinding(taskId, args.finding_id);
+			}
 			if (name === "request_authorization" || name === "approve_breaking_intent_revision" || name === "stop" || name === "repair_authority_state") {
 				return runtime.authorize(taskId, name, toolMeta, args);
 			}

package/plugins/immune-brain/runtime/commands/kernel.ts

@@ -248,19 +248,6 @@ function runInspect(root: string): KernelExecution {
 				),
 			};
 		}
-		let declared: TaskRisk;
-		let intent: TaskIntentV1;
-		try {
-			const raw = JSON.parse(
-				readSecureProjectFile(root, `docs/plans/${claim.task_id}.intent.json`),
-			) as { risk?: unknown };
-			if (raw.risk !== "routine" && raw.risk !== "material" && raw.risk !== "critical")
-				throw new Error(`intent.risk is unreadable for ${claim.task_id}`);
-			declared = raw.risk;
-			intent = parseTaskIntentV1(raw);
-		} catch (error) {
-			return sourceFailure("inspect", error);
-		}
 		let recordRead: ReturnType<typeof readTaskRecordRaw>;
 		try {
 			recordRead = readTaskRecordRaw(root, claim.task_id);
@@ -285,6 +272,21 @@ function runInspect(root: string): KernelExecution {
 			};
 		}
 		const record = recordRead.record;
+		let declared: TaskRisk;
+		let intent: TaskIntentV1;
+		try {
+			const raw = JSON.parse(
+				readSecureProjectFile(root, record.intent_ref.path),
+			) as { risk?: unknown };
+			if (raw.risk !== "routine" && raw.risk !== "material" && raw.risk !== "critical")
+				throw new Error(`intent.risk is unreadable for ${claim.task_id}`);
+			declared = raw.risk;
+			intent = parseTaskIntentV1(raw);
+			if (canonicalIntentHash(intent) !== record.intent_ref.content_hash)
+				throw new Error("TaskIntent sidecar does not match TaskRecord content hash");
+		} catch (error) {
+			return sourceFailure("inspect", error);
+		}
 		const workspaceState = readWorkspaceStateRaw(root);
 		let identity;
 		try {