immune-brain 3.6.5 → 3.6.6

package/plugins/immune-brain/dist/imm-doc-prune.md

@@ -1,6 +1,6 @@
 ---
 name: imm-doc-prune
-description: Use to prune stale current documentation from a Git repository after an explicit, hash-bound, user-approved manifest; never deletes Managed authority artifacts.
+description: Use when the user explicitly requests Immune-Brain pruning of stale current documentation.
 ---
 
 # Immune-Brain: Doc Prune
@@ -36,6 +36,8 @@ no persistent report, and no automatic commit.
 
 ## Ordered Pruning Protocol
 
+### Inventory and Manifest
+
 1. **Establish repository safety.** Mutation requires a Git worktree. A
    non-Git repository or an untracked candidate is audit-only. Record the
    candidate path, blob/content hash, tracked status, and candidate-local
@@ -91,6 +93,8 @@ no persistent report, and no automatic commit.
    "clean stale docs" is insufficient. Interruption starts a fresh scan; no
    manifest is persisted.
 
+### Approved Mutation
+
 9. **Revalidate and mutate minimally.** Re-read candidate bytes, Git status,
    inbound references, generated ownership, and active scope immediately
    before each approved change. Drift blocks that item. Delete a whole file
@@ -99,6 +103,8 @@ no persistent report, and no automatic commit.
    owner before deleting the obsolete source. Never renumber ADRs and never
    create a new ADR or Solution merely to complete pruning.
 
+### Verify and Report
+
 10. **Verify and report.** Re-scan residual names and paths, current local
     links on current documentation, source/generated parity, existing documentation contract tests,
     and `git diff --check`. This Skill does not execute arbitrary documented

package/plugins/immune-brain/dist/imm-loop.md

@@ -1,6 +1,6 @@
 ---
 name: imm-loop
-description: Use to run an enrolled TaskIntent to completion through Kernel-governed execution, QA, and Review.
+description: Use when the user explicitly requests execution or resumption of an Immune-Brain task.
 ---
 
 # Immune-Brain: Loop
@@ -16,7 +16,12 @@ claim, TaskIntent, and TaskRecord. Invalid or contradictory projections fail
 closed. A candidate TaskIntent is not Enrollment authority.
 
 Before the first Enrollment of a candidate TaskIntent, confirm the Planner
-returned `tracker_associated` for its Initiative. `tracker_projection_failed` or
+returned `tracker_associated` — but only when the candidate belongs to an
+identified GitHub-carried Initiative. Standalone TaskIntents and Local
+Initiatives carry no tracker prerequisite: their Enrollment needs only the
+validated candidate. When membership is uncertain, resolve it against the
+Planner's carrier decision before treating the candidate as exempt; do not
+assume either way. For a GitHub-carried Initiative, `tracker_projection_failed` or
 `awaiting_user_initiative_confirmation` blocks that Enrollment until the same
 complete carrier batch succeeds; report the stable carrier reason and its exact
 retry action instead of enrolling. A carrier command the Host refused, cancelled,
@@ -36,7 +41,7 @@ At every internal role boundary call the read-only `imm_loop_action` Tool. Use
 exploration, advisory review, Compounder, Kernel ownership, or scope expansion.
 Use Kernel ownership for an enrolled task. This Tool projects authority; it does
 not record execution evidence, mutate task state, or replace Kernel operations.
-Follow the [Subagent Dispatch Protocol](docs/reference/subagent-dispatch-protocol.md#authorization-authority).
+Before a child dispatch, read the [Subagent Dispatch Protocol](docs/reference/subagent-dispatch-protocol.md#authorization-authority).
 Never load an internal role as a public Skill or spawn another loop process.
 The standalone `imm-pr-fix`, `imm-doc-prune`, and `imm-agent-doc-maintain` are host-native
 maintenance entries, never dispatched as the Loop role. Internal `test-fixer`
@@ -65,8 +70,12 @@ Continue while the current projection has a valid action:
 6. For rework, follow the projected artifact state before editing. Resolve
    findings only after fixing and verifying their cause. Changed snapshots
    invalidate old evidence; freeze and run the newly required obligations.
-7. Stop on terminal `done` or `stopped`, unresolved user decisions, explicit
-   cancellation, or a failure without a safe projected action.
+7. An unresolved decision pauses only dependent execution. On `awaiting_user`,
+   invoke `request_authorization` directly before ending the turn; use the
+   Decisions and Recovery route for its native-gate handling. End the turn if
+   the decision remains unresolved, is cancelled, or the gate fails. Otherwise
+   continue from the returned projection. Stop on terminal `done` or `stopped`,
+   explicit cancellation, or a failure without a safe projected action.
 
 Use the fresh projection returned by a successful operation when supplied. Read
 `status` after interruption, ambiguous mutation results, absent projections, or
@@ -76,10 +85,13 @@ not bypass them. Do not poll or create detached jobs.
 
 ## Decisions and Recovery
 
-- Scope expansion always returns to `imm-planner`. Collect all currently known missing
-  paths, caller/test/generated mirrors, and verification reasons in one request.
-  Do not edit outside scope while waiting or widen it piecemeal without new
-  evidence. Bounded test or PR repair stays inside the same TaskIntent.
+- Scope expansion returns to Planner's Enrolled Intent Revision route. Planner
+  prepares the complete proposed revision without replacing the active owner;
+  the current Loop submits it through Kernel revision authority. Collect all
+  currently known missing paths, caller/test/generated mirrors, and verification
+  reasons in one request. Do not edit outside scope while waiting or widen it
+  piecemeal without new evidence. Bounded test or PR repair stays inside the same
+  TaskIntent.
 - Invoke `approve_breaking_intent_revision` with the complete next intent
   directly; the native Host gate is the single user decision. Do not overwrite
   enrolled intent sidecars or ask for chat pre-confirmation.
@@ -123,8 +135,6 @@ The internal Compounder is optional: only closed work with structured evidence
 of a reusable Learning may route to it. Routine completion creates no Learning.
 It cannot approve successors or delay terminal settlement. A projection with
 `recommended_authority: user` must not dispatch successor work automatically.
-Do not create, switch,
-or delete Git worktrees; operate only in the Host launch directory.
 
 The Host may attach an opted-in GitHub projection after settlement. Only a fresh claimless
 `done`/`stopped` projection plus its exact terminal tombstone projects
@@ -151,6 +161,8 @@ Stop reason:
 Next action:
 ```
 
+## Failure Output
+
 For `settlement_unknown`, call `advance_assurance` once to reconcile the Kernel
 projection before resuming; never replay the uncertain write directly. The runtime
 retries only explicit `EINTR`/`EAGAIN` failures of its initial projection read, once,

package/plugins/immune-brain/dist/imm-planner.md

@@ -1,6 +1,6 @@
 ---
 name: imm-planner
-description: Use to create or revise a spec and TaskIntent from requirements; owns scope and decomposition, not implementation or Enrollment.
+description: Use when the user explicitly requests Immune-Brain Spec and TaskIntent planning.
 ---
 
 # Immune-Brain: Planner
@@ -16,8 +16,8 @@ an explicit `imm-loop` entry; explicit Planner entry owns planning and the later
 native Enrollment gate.
 
 Plan-only output remains non-authoritative. Planner creates or validates a
-candidate Spec/TaskIntent, but it never enrolls a task or enrolls generated
-artifacts unconditionally. Explicit Plan-only requests stop after returning the
+candidate Spec/TaskIntent. Planner may request the native Enrollment gate;
+only that gate grants execution authority. Explicit Plan-only requests stop after returning the
 planning artifacts. A later literal-user request to start Enrollment is a
 non-authoritative execution trigger: invoke the native Enrollment gate directly,
 without asking for chat pre-confirmation. For a clear mutation request that
@@ -32,9 +32,10 @@ cannot bypass that boundary, QA, Review, authorization, or completion.
 ## Clarification supplement
 
 Planner consumes an upstream Brainstorm manifest as closed-world framing and
-must not repeat, reopen, or rewrite confirmed decisions. Direct Planner entry
-and Medium/High Design Risk work must inspect relevant ADRs and rejected
-Learnings. It resolves repository facts, performs reference closure, and owns
+must not repeat, reopen, or rewrite confirmed decisions. Consult relevant ADRs
+and rejected Learnings only when an architectural decision, known historical
+constraint, or conflict with the existing design makes them relevant. Reuse
+upstream evidence; absent relevant history is not a planning blocker. It resolves repository facts, performs reference closure, and owns
 ordinary technical choices:
 component boundaries, internal interfaces, failure behavior, compatibility,
 migration, recovery and rollback, Verification, execution slices, dependencies,
@@ -71,15 +72,16 @@ resolved wrapper and use the resolved `imm-kernel` wrapper for every Kernel
 command below. Do not assume either bare command is available on shell `PATH`.
 Then route deterministically:
 
-- an active Kernel claim routes to `imm-loop` for foreground Kernel Tool
-  coordination, not new planning;
+- an active Kernel claim remains with `imm-loop` for foreground Kernel Tool
+  coordination, except a Loop-requested revision follows Enrolled Intent Revision
+  below to prepare a non-authoritative proposal for that same owner;
 - an active or otherwise nonterminal v3 Plan remains on its existing v3 route;
 - no routing policy preserves the legacy v3 Planner behavior;
 - a valid `kernel_task_intent` retirement policy produces one TaskIntent draft
   through the current Host's explicit `imm-planner`;
 - an invalid, unreadable, untracked, or tracked-deleted policy rejects new
   planning authority with `routing_policy_invalid`;
-- no Planner path enrolls a task or falls back to v3 after retirement.
+- no Planner path grants execution authority or falls back to v3 after retirement.
 
 Current owner, phase, completion, and authority facts are authoritative only
 when read from the Assurance projection and TaskRecord. `CONTEXT.md` is
@@ -105,6 +107,11 @@ workspace claim, and final authority preconditions without executing acceptance
 descriptors. A routine task proceeds from that single confirmation through
 enrollment, execution and QA without a second human stop.
 
+## Candidate Authoring
+
+Read this section before creating new candidate artifacts, after request routing
+and clarification. It does not apply to Enrolled Intent Revision.
+
 Before authoring a TaskIntent, trace each expected behavior from its public or
 runtime entry point through existing imports and callers to the highest focused
 behavioral tests. Include generated or packaged mirrors and every owner of the
@@ -212,6 +219,19 @@ TaskIntent or TaskRecord. Existing Issue markers grant permission only for
 idempotent retry of that same approved Initiative; they never grant execution
 authority.
 
+For amending an already-published Initiative, the same
+`imm-tracker publish-initiative --stdin --json` operation accepts an optional
+`amendment` input after the literal user approves the changed pending frontier.
+Provide the complete approved pending Tasks plus the complete read-only
+historical Child list, each binding the observed `issue_number`, title, body,
+and state at approval. The tracker verifies every bound Issue against that
+baseline before any write, updates only approved pending briefs, converges the
+exact approved pending `blocked_by` set, creates newly added pending Children,
+and preserves historical Children byte-for-byte with their native Sub-issue
+links and dependency relations. Omitted membership, baseline drift, or a
+stopped historical prerequisite fails closed with zero or bounded mutations
+and an exact retry action; the strict no-amendment default is unchanged.
+
 ### Verification Descriptor Discipline
 
 Every acceptance verification descriptor must be a focused, deterministic,
@@ -237,10 +257,10 @@ descriptors or add a mandatory user confirmation. Use the smallest `timeout_ms`
 - **Design-view selection**: For Medium and High risk, select every materially relevant technical-design view from architecture layers, service/component interfaces, data flow, state transitions, and temporal sequence. Record a short `Design views` statement naming the selected views and why any omitted view cannot affect the design. Do not write empty architecture, interface, data-flow, state, or sequence sections. Low risk remains concise and may omit Technical Design. When a selected view is recorded, also record its required decision content: architecture layers need layer responsibilities, dependency direction, ownership, and prohibited coupling; service/component interfaces need inputs, outputs, errors, compatibility/versioning, and caller/callee ownership; data flow needs source, transformations, validation, destination, and failure handling; state transitions need states, legal transitions, trigger, invariant, terminal ownership, and recovery; temporal sequence needs ordered interactions, authority at each point, interruption behavior, and idempotency.
 - **Technical Design Authority**: The Spec is the single Technical Design baseline. TaskIntent acceptance and scope reference the applicable design decisions or invariants without copying Technical Design prose. If discovery invalidates the baseline, stop execution and return to Planner to update the Spec and decide whether `replan` is required. TaskIntent and Initiative text do not duplicate Technical Design prose or become a prose Plan substitute.
 - **TaskIntent decomposition**: Use the selected design boundaries as one retain/split criterion for TaskIntent slices. Keep work in one TaskIntent when the selected views describe one coherent executable slice with shared acceptance, risk treatment, rollback, and authority. Split a successor TaskIntent when a service boundary, state-machine owner, migration/compatibility boundary, independently promotable layer, or sequence dependency needs independent verification, rollback, authorization, or settlement. Do not split merely because the design names several layers, files, or services. Treat trust-boundary changes as the same kind of decomposition evidence: a TaskIntent should normally change one primary trust-boundary invariant, while merely traversing several boundaries or updating both sides of one end-to-end authority chain does not require a split. Split separate trust invariants when they can be independently verified, rolled back, authorized, migrated, or settled. Keep multiple trust-boundary changes together only when they form one atomic security outcome and splitting would create an unsafe or unusable intermediate state; record that reason in the Spec. This is Planner judgment, not a TaskIntent schema field or an Enrollment counting rule. This does not revive prose Plan, Roadmap, or Phase authority.
-- **Mermaid Use**: Mermaid is required only when a medium/high-risk design contains structure, sequence, data flow, or state transition relationships that a diagram materially clarifies. Mermaid is not a universal gate; a diagram supplements adjacent prose and never becomes a second design authority. Every new or revised Spec records `**Diagram decision**: required|not_required` and a non-empty `**Diagram reason**:`. A `required` decision must have a Mermaid block; `not_required` explains why prose is sufficient.
+- **Mermaid Use**: Mermaid is required only when a medium/high-risk design contains structure, sequence, data flow, or state transition relationships that a diagram materially clarifies. Mermaid is not a universal gate; a diagram supplements adjacent prose and never becomes a second design authority. Medium/High risk Specs record `**Diagram decision**: required|not_required` and a non-empty `**Diagram reason**:`. A `required` decision must have a Mermaid block; `not_required` explains why prose is sufficient. Low-risk Specs omit the empty ceremony and record neither field.
 - **Verification**: Every acceptance assertion has a concrete focused descriptor that can fail on the intended regression. Hypothetical evidence is not execution-ready.
 - **Executable Scope**: `scope_hint` is the mutation envelope, not discovery context. Close references across callers, tests, generated mirrors, and state-machine owners before authoring. Include bound active and archive Spec paths needed for `freeze_artifacts`. Collect all known scope gaps in one revision request; ask again only when new evidence changes the boundary.
-- **Devil's Advocate Preplan Audit**: Record a `Devil's Advocate Audit` in the Spec covering rollback resilience, verification vanity, and spec dilution detection. Explain recovery from partial implementation, why verification detects the regression, and how accepted requirements remain covered.
+- **Devil's Advocate Preplan Audit**: Medium/High risk work records a `Devil's Advocate Audit` in the Spec covering rollback resilience, verification vanity, and spec dilution detection. Explain recovery from partial implementation, why verification detects the regression, and how accepted requirements remain covered. Low-risk work omits the empty template; the Spec records outcome, boundary, and concrete verification only.
 - **Execution posture**: Record `test-first` or `characterization-first` in the Spec when explicitly requested or justified by fragile untested behavior. The Executor owns the local choreography; do not create prototype or RED/GREEN/REFACTOR authority Steps. Throwaway probes must have a cleanup condition and a durable decision output.
 
 ## Settlement-Design Contract
@@ -294,21 +314,36 @@ state coverage, and verification cues for desktop and mobile. Use `Standard` or
 The mode produces an
 implementation-ready contract and routes it to normal planning or execution.
 
+## Enrolled Intent Revision
+
+Use this route instead of new-task planning when the current Loop requests a
+scope or acceptance revision. Planner prepares the complete proposed revision
+from the requested delta and concrete evidence without replacing the active
+owner. Keep unaffected decisions; include all known scope, Spec, and acceptance
+changes in the proposal. Preserve the prior on-disk sidecars until Kernel applies
+the revision; do not overwrite the enrolled TaskIntent, invoke the new-intent
+author command, or request a second Enrollment.
+
+Return the proposal to the current Loop owner for Kernel `revise_intent` or,
+when breaking, `approve_breaking_intent_revision` with the complete next intent.
+The native gate is the single user decision for a breaking revision; candidate
+preparation does not apply the revision or authorize expanded execution.
+
 ## Planning Rules
 
 - **Entry Contract**: Use when Spec/TaskIntent planning is needed. An already enrolled owner remains on its current Kernel authority and resumes only through explicit `imm-loop`; a validated candidate still needs native Enrollment.
 - **Output Language Gate**: Before writing or revising any Spec or Plan, read the project output language policy from `AGENTS.md`, `IMMUNE.md`, or Immune-Brain plugin config. Default Spec and Plan prose to English unless the current user request, project instructions, or host/user preference contains an explicit document-language instruction. A reply-language instruction does not change document language. Keep schema fields, CLI commands, file paths, code identifiers, enum values, JSON keys, and canonical terms such as `Step`, `Plan`, `Spec`, `Verification`, `Discovery cache`, and `Devil's Advocate Audit` literal.
 - **Clarification Supplement**: If an upstream `imm-brainstorm` manifest exists, verify that every `BR-Q-*` item is resolved and every confirmed framing decision is represented; must not repeat, reopen, or rewrite confirmed decisions. Ask only a focused omission, repository-conflict, or invalidated-assumption delta tied to concrete evidence. Resolve a local delta here; return to `imm-brainstorm` when it reopens multiple product branches or changes the overall goal or Scope. Finalization requires no unresolved supplement and no unconfirmed decision introduced by Planner.
 - **Planning Bootstrap**: When no upstream `imm-brainstorm` manifest exists, preserve Direct Planner entry by resolving repository facts and deriving ordinary technical choices. An already-clear request takes the zero-question fast path to a non-blocking correction summary. Discovery of an unresolved user-owned goal, user, scope, behavior, compatibility preference, risk acceptance, or success criterion returns to `imm-brainstorm`; Planner does not convert product uncertainty into a silent assumption or duplicate Brainstorm's interview.
-- **Small-scope budget discipline**: For small or fixture-sized planning tasks,
-  read the named files and root orientation files first (`README.md`,
-  `CONTEXT.md`, `IMMUNE.md`, `HANDOFF.md`, active tests/docs). Avoid broad
-  `rg --files`, plugin `skills/`, plugin `dist/`, generated logs, and
-  unrelated directories until a specific missing fact blocks plan validation.
-- **Decision History Discovery**: Direct Planner entry and Medium/High Design
-  Risk work must inspect relevant ADRs and rejected Learnings. Reuse constraints
-  already covered by an upstream Brainstorm manifest instead of repeating that
-  discovery.
+- **Small-scope budget discipline**: Read the named files first for small or
+  fixture-sized planning tasks. Read relevant orientation documents and follow
+  caller, test, or generated-reference links when a concrete missing fact requires
+  them; root documents are not a fixed preflight checklist. Before broad searching,
+  consult `CONTEXT.md`'s Architecture Map. Avoid repository-wide listings and
+  unrelated directories when targeted evidence resolves the task. Required
+  authority, security, and shared-contract reference closure still applies.
+- **Decision History Discovery**: Apply Clarification supplement's conditional
+  history lookup; reuse upstream evidence rather than repeating discovery.
 - **Testing Seam Selection**: Prefer the highest existing observable behavioral
   test seam and the fewest sufficient seams. Cite relevant test prior art and
   explain how the selected seam catches the intended regression. This is a
@@ -317,10 +352,10 @@ implementation-ready contract and routes it to normal planning or execution.
 - **Review Mapping**: In-scope rework stays with the enrolled TaskIntent and explicit `imm-loop` entry. Cross-scope findings become a Planner decision delta with concrete missing paths and verification evidence; do not create a successor prose Plan.
 - **Brainstorm Manifest Mapping**: Record every upstream `BR-*` item in a Spec `Brainstorm Trace`, mapped to TaskIntent acceptance, a captured decision, or an explicit reason for deferral or exclusion. Resolve every `BR-Q-*` item before handoff. Do not silently narrow confirmed framing.
 - **Session Lifecycle Ownership**: The user chooses the current or a new session. Tokens, compactions, tool counts, elapsed time, and review rounds never trigger automatic session creation or termination. Recovery uses TaskRecord and the fresh Kernel projection.
-- **Subagents**: Follow the Adaptive Cache-First Route in `docs/reference/subagent-dispatch-protocol.md`: classify the task, use cache-first discovery evidence, and add subagent participation only when the Cost-Based Subagent Gate says the slice is multi-domain, high-risk, explicitly requested, or has concrete `parallel_probes`. Plan conditional reviewers such as `security-reviewer` only if their trigger surfaces are explicit; do not manufacture them.
-- **Enrolled Intent**: Planner never overwrites an enrolled TaskIntent. Scope or acceptance changes use Kernel revision authority; breaking revisions invoke the native gate directly with the complete next intent. Preserve the prior on-disk sidecars until Kernel applies the revision.
-- **CONTEXT.md Vocabulary**: Read `CONTEXT.md` at the repo root. Use canonical terms in Spec, acceptance, and scope descriptions. `CONTEXT.md` is vocabulary and architecture navigation, not execution state.
-- **Discovery Protocol**: Read `CONTEXT.md` `## Architecture Map` before broad searching and relevant `docs/solutions/` evidence. Record concrete file pointers and reasons in the Spec. Do not read or write a legacy Step discovery cache.
+- **Subagents**: Only when optional research is needed, read Research Dispatch and its shared dispatch reference. Default to inline evidence gathering. Plan conditional reviewers such as `security-reviewer` only if their trigger surfaces are explicit; do not manufacture them.
+- **Enrolled Intent**: Follow Enrolled Intent Revision for a Loop-requested scope or acceptance change; candidate preparation never changes the current owner or grants execution authority.
+- **CONTEXT.md Vocabulary**: Consult the relevant `CONTEXT.md` terms when domain meaning is unclear or changes; known file-local tasks do not require a full root-document read. `CONTEXT.md` is vocabulary and architecture navigation, not execution state.
+- **Discovery Protocol**: Read `CONTEXT.md` `## Architecture Map` before broad searching; consult relevant `docs/solutions/` evidence under Clarification supplement's history trigger. Record concrete file pointers and reasons in the Spec. Do not read or write a legacy Step discovery cache.
 - **Planning Quality Gate**: For elevated-risk work, verify contract surfaces, compatibility, interruption recovery, rollback, verification strength, and Brainstorm traceability in the Spec. Do not invoke retired Plan mutation or State Ledger synchronization.
 - **Parallel Probes**: Optional read-only probes must have bounded non-overlapping scopes, expected evidence, and no file or authority writes. They are advisory discovery, not persisted Step annotations. Probe failure falls back to inline investigation with a recorded reason.
 
@@ -356,7 +391,9 @@ optional advisory dispatch fails, continue inline and record the reason.
 Spec under `docs/specs/` plus canonical candidate
 `docs/plans/<task-id>.intent.json`. The Spec records outcome, discovery evidence,
 decisions, assumptions, Technical Design when required, output language,
-`Devil's Advocate Audit`, and acceptance/test mapping. Include a complete
+the Medium/High risk Devil's Advocate Audit, and acceptance/test mapping. Low
+risk records outcome, boundary, and concrete verification without the empty
+ceremony. Include a complete
 `Brainstorm Trace` when consuming a Brainstorm manifest. TaskIntent is authored
 and validated through `imm-kernel`; do not write a prose iteration Plan or sync
 a State Ledger. Keep historical Plan validation strictly read-only.
@@ -373,15 +410,15 @@ a State Ledger. Keep historical Plan validation strictly read-only.
 | Split one outcome into read/edit/run micro-steps | One TaskIntent owns one closable outcome; Executor owns implementation batches. |
 | Append repair outside scope | Return the complete known scope delta for Kernel revision; do not widen execution. |
 | Drop a brainstorm-confirmed item as "out of scope" without saying so | Closed-world handoff: every `BR-*` ID must be covered, decisioned, deferred, scoped out with reason, or resolved as an assumption. |
-| Start planning while brainstorm questions are open | **Clarification Barrier**: Planning is blocked until all `BR-Q-*` items are answered; do not speculate on missing product info. |
-| Skip adversarial self-review because the plan is small | **Devil's Advocate** audit still checks rollback resilience, verification vanity, and spec dilution before the plan is treated as execution-ready. |
+| Finalize dependent planning while brainstorm questions are open | **Clarification Barrier**: Finalization and dependent commitments are blocked until required `BR-Q-*` items are answered. Independent investigation and explicitly unapproved alternative drafts may continue; silence is not consent. |
+| Skip adversarial self-review on Medium/High risk because the plan is small | **Devil's Advocate** audit still checks rollback resilience, verification vanity, and spec dilution before the plan is treated as execution-ready. |
 
 ## Red Flags
 
 - Acceptance verification names only hypothetical evidence with no runnable descriptor.
 - New work depends on a prose Plan validator, Step activation, or State Ledger.
 - A Brainstorm manifest lacks a complete Spec `Brainstorm Trace`.
-- A Spec lacks a `Devil's Advocate Audit` covering rollback resilience, verification vanity, and spec dilution detection.
+- A Medium/High risk Spec lacks a `Devil's Advocate Audit` covering rollback resilience, verification vanity, and spec dilution detection.
 - New Spec prose ignores the document-language policy.
 - Candidate artifacts escape the approved planning scope.
 

package/plugins/immune-brain/dist/imm-pr-fix.md

@@ -1,10 +1,12 @@
 ---
 name: imm-pr-fix
-description: Use to repair GitHub PR review feedback, merge conflicts, or failing CI checks within the current PR scope.
+description: Use when the user explicitly requests Immune-Brain repair of GitHub PR review feedback, merge conflicts, or failing checks.
 ---
 
 # Immune-Brain: PR Fix
 
+## Authority Boundary
+
 Repair blockers on one GitHub pull request without creating or mutating
 TaskIntent, TaskRecord, Kernel, Spec, or Plan authority. An already active
 Managed task remains owned by `imm-loop`; stop and direct the user there when
@@ -66,7 +68,9 @@ not repair blockers.
 
 ### 4. Verify and close out
 
-Run the smallest checks that reproduce each blocker, then any repository check
+Before any push or feedback mutation, apply the BASELINE Host Confirmation
+Boundary to the exact remote effect; the repair request alone does not grant
+unrequested publication authority. Run the smallest checks that reproduce each blocker, then any repository check
 required by the changed surface. Re-read remote PR status, verify local HEAD is
 the expected PR head, inspect the final diff, and push only the repair branch.
 Reply to or resolve handled feedback when GitHub permissions and thread state

package/plugins/immune-brain/dist/role-prompts/executor.md

@@ -1,13 +1,16 @@
 # Internal role: executor
 
-You are the Immune-Brain Executor role inside Loop. Implement exactly one
-active Step, or one accepted same-boundary follow-up, in the current Parent
-conversation. Use workspace tools only for the supplied target and keep every
-edit inside the authoritative Scope. Do not discover or load a Pi Skill.
+You are the Immune-Brain Executor role inside Loop. Implement exactly the
+enrolled TaskIntent acceptance and `scope_hint` (or one accepted
+same-boundary follow-up) in the current Parent conversation. Use workspace
+tools only for the supplied target and keep every edit inside the
+authoritative Scope. Do not discover or load a Pi Skill.
 
-Before handoff, verify the active Result with the supplied Verification
-commands and record structured execution evidence through the Loop runtime
-action. Preserve failed and blocked attempts. Do not perform QA,
+Before handoff, run the permitted diagnostic checks and return commands and
+outcomes to the Parent as structured diagnostic evidence. The read-only Loop
+runtime action only constructs the dispatch envelope; it does not store
+evidence or change task state. Preserve failed and blocked attempts. Do not
+perform QA,
 review, plan mutation, successor approval, Compounder work, or authority
 writes. If the requested change needs scope expansion, stop and return an
 `imm-planner` route with the concrete missing scope and verification reason.
@@ -22,6 +25,11 @@ Do not weaken tests or hide an incomplete result to make Verification pass.
 Treat naming, function length, parameter count, nesting, and abstraction taste
 as contextual signals, never as automatic failure thresholds.
 
-Fix in-scope integrity defects before Verification. If fixing one requires
-behavior, scope, or authority beyond the active Step, stop and route the
-concrete reason to `imm-planner`.
+Fix in-scope integrity defects before Verification. Autonomously diagnose,
+repair, and rerun failing ordinary local checks within the authorized scope;
+do not stop for a repair round that stays inside the TaskIntent boundary. If
+fixing requires
+behavior, scope, or authority beyond the enrolled TaskIntent, stop and route the
+concrete reason to `imm-planner`. An unavailable or still-failing required
+check is an explicit blocker: report it to the Parent; never present failed
+verification as completion.

package/plugins/immune-brain/dist/role-prompts/pr-fix.md

@@ -71,8 +71,11 @@ decision, stop and report it to the Parent.
 
 ## Boundary
 
-Work only inside the supplied Plan, `plan_id`, changed-file boundary, review
-feedback, and verification commands. Do not create a second Plan, silently
+Work only inside the supplied repair boundary: the current TaskIntent
+acceptance and `scope_hint` when operating under one, otherwise the legacy
+supplied Plan, `plan_id`, changed-file boundary, review feedback, and
+verification commands from the delegation context. Do not create a second
+Plan or TaskIntent, silently
 widen scope, push to unrelated branches, merge, approve a successor, or invoke
 another role. Do not discover or load a Pi Skill.
 

package/plugins/immune-brain/runtime/assurance/verification.ts

@@ -5,7 +5,7 @@
 // runner, compatibility gate, fixed execution, and findings digest.
 
 import { createHash } from "node:crypto";
-import { execFileSync, spawn } from "node:child_process";
+import { execFileSync, spawn, spawnSync } from "node:child_process";
 import { realpathSync, statSync } from "node:fs";
 import { isAbsolute, join, resolve, sep, relative } from "node:path";
 
@@ -43,7 +43,18 @@ export function resolveBunRunner(): FrozenRunner {
 	}
 	let real: string;
 	try {
-		real = realpathSync(executable);
+		// When which returns a version-manager shim (e.g. mise or asdf),
+		// realpathSync on the shim resolves to the version-manager binary rather
+		// than bun. Ask bun itself for its real process.execPath.
+		const execPath = spawnSync(executable, ["-e", "console.log(process.execPath)"], {
+			encoding: "utf8",
+			stdio: ["ignore", "pipe", "ignore"],
+		});
+		if (execPath.status === 0 && execPath.stdout.trim().length > 0) {
+			real = realpathSync(execPath.stdout.trim());
+		} else {
+			real = realpathSync(executable);
+		}
 	} catch {
 		throw new VerificationDescriptorError("bun runner realpath is unresolvable");
 	}