immune-brain 3.6.5 → 3.6.7

package/plugins/immune-brain/dist/role-prompts/executor.md

@@ -1,13 +1,16 @@
 # Internal role: executor
 
-You are the Immune-Brain Executor role inside Loop. Implement exactly one
-active Step, or one accepted same-boundary follow-up, in the current Parent
-conversation. Use workspace tools only for the supplied target and keep every
-edit inside the authoritative Scope. Do not discover or load a Pi Skill.
+You are the Immune-Brain Executor role inside Loop. Implement exactly the
+enrolled TaskIntent acceptance and `scope_hint` (or one accepted
+same-boundary follow-up) in the current Parent conversation. Use workspace
+tools only for the supplied target and keep every edit inside the
+authoritative Scope. Do not discover or load a Pi Skill.
 
-Before handoff, verify the active Result with the supplied Verification
-commands and record structured execution evidence through the Loop runtime
-action. Preserve failed and blocked attempts. Do not perform QA,
+Before handoff, run the permitted diagnostic checks and return commands and
+outcomes to the Parent as structured diagnostic evidence. The read-only Loop
+runtime action only constructs the dispatch envelope; it does not store
+evidence or change task state. Preserve failed and blocked attempts. Do not
+perform QA,
 review, plan mutation, successor approval, Compounder work, or authority
 writes. If the requested change needs scope expansion, stop and return an
 `imm-planner` route with the concrete missing scope and verification reason.
@@ -22,6 +25,11 @@ Do not weaken tests or hide an incomplete result to make Verification pass.
 Treat naming, function length, parameter count, nesting, and abstraction taste
 as contextual signals, never as automatic failure thresholds.
 
-Fix in-scope integrity defects before Verification. If fixing one requires
-behavior, scope, or authority beyond the active Step, stop and route the
-concrete reason to `imm-planner`.
+Fix in-scope integrity defects before Verification. Autonomously diagnose,
+repair, and rerun failing ordinary local checks within the authorized scope;
+do not stop for a repair round that stays inside the TaskIntent boundary. If
+fixing requires
+behavior, scope, or authority beyond the enrolled TaskIntent, stop and route the
+concrete reason to `imm-planner`. An unavailable or still-failing required
+check is an explicit blocker: report it to the Parent; never present failed
+verification as completion.

package/plugins/immune-brain/dist/role-prompts/pr-fix.md

@@ -71,8 +71,11 @@ decision, stop and report it to the Parent.
 
 ## Boundary
 
-Work only inside the supplied Plan, `plan_id`, changed-file boundary, review
-feedback, and verification commands. Do not create a second Plan, silently
+Work only inside the supplied repair boundary: the current TaskIntent
+acceptance and `scope_hint` when operating under one, otherwise the legacy
+supplied Plan, `plan_id`, changed-file boundary, review feedback, and
+verification commands from the delegation context. Do not create a second
+Plan or TaskIntent, silently
 widen scope, push to unrelated branches, merge, approve a successor, or invoke
 another role. Do not discover or load a Pi Skill.
 

package/plugins/immune-brain/runtime/assurance/coordinator.ts

@@ -7,6 +7,8 @@
 // evidence reservation.
 
 import { createHash, randomUUID } from "node:crypto";
+import type { FindingEvidence, TaskFinding } from "../kernel/types";
+import { anchorForEvidence } from "../kernel/refutation";
 import {
 	findingsDigest,
 	type FrozenRunner,
@@ -88,10 +90,40 @@ export interface AssuranceVerdict {
 		kind: "blocking" | "advisory";
 		acceptance_id: string | null;
 		summary: string;
+		/**
+		 * Derived by `parseAssuranceVerdict` for Review-role rework findings. QA
+		 * findings and pass verdicts never carry it.
+		 */
+		anchor?: string;
+		evidence?: FindingEvidence;
+		/** Digest this plugin's verdict parser derives for one finding. */
 		findings_digest: string;
 	}>;
 }
 
+/**
+ * The single Review-verdict → Kernel-finding mapping both Host adapters use.
+ * Keeping it here is what makes the two Hosts produce the same
+ * `findingsDigestV2` for the same verdict: the reviewer's anchor and evidence
+ * are forwarded unchanged into the capability binding and the Kernel action.
+ */
+export function reviewReworkFindings(verdict: AssuranceVerdict): TaskFinding[] {
+	if (verdict.decision !== "rework" || !verdict.findings?.length)
+		throw new Error("review rework findings require a rework verdict");
+	return verdict.findings.map((finding) => ({
+		id: finding.id,
+		kind: finding.kind,
+		status: "open" as const,
+		acceptance_id: finding.acceptance_id,
+		source: "review" as const,
+		review_round: null,
+		summary: finding.summary,
+		anchor: finding.anchor ?? null,
+		evidence: finding.evidence ?? null,
+		counterevidence: null,
+	}));
+}
+
 export interface ReviewRevisionIdentity {
 	contract: "assurance_kernel/review_revision_identity/v1";
 	base_head: string;
@@ -314,12 +346,57 @@ export function buildReviewPrompt(snapshot: SnapshotDescriptor, evidencePath?: s
 			: `Intent revision ${snapshot.intent_revision} (hash ${snapshot.intent_content_hash}), diff ${snapshot.diff_hash}, review bundle ${snapshot.review_bundle_digest}, state ${snapshot.lifecycle}:${snapshot.artifact_state}.`,
 		"Acceptance assertions:", acceptance,
 		"Reserve the final turn for exactly one strict JSON verdict. Reply with ONLY that object, without markdown fences or commentary.",
+		`Every rework finding must carry machine-checkable provenance: evidence.trigger (the concrete inputs or state that reach the defect), a non-empty evidence.caller_chain (ordered repository paths or symbols), and evidence.violated {kind: "acceptance"|"security_boundary", ref}. The anchor is derived from that evidence; a finding without it is rejected and the correction must be resubmitted.`,
 		`PASS shape: {"contract":"assurance_kernel/assurance_verdict/v2","role":"review","task_id":"${snapshot.task_id}","snapshot_digest":"${digest}","decision":"pass","approval":{"kind":"review","authority_role":"reviewer","summary":"<one line>"}}`,
-		`REWORK shape: {"contract":"assurance_kernel/assurance_verdict/v2","role":"review","task_id":"${snapshot.task_id}","snapshot_digest":"${digest}","decision":"rework","findings":[{"id":"review-1","kind":"blocking|advisory","acceptance_id":"<id|null>","summary":"<one line>"}]}`,
+		`REWORK shape: {"contract":"assurance_kernel/assurance_verdict/v2","role":"review","task_id":"${snapshot.task_id}","snapshot_digest":"${digest}","decision":"rework","findings":[{"id":"review-1","kind":"blocking|advisory","acceptance_id":"<id|null>","summary":"<one line>","evidence":{"trigger":"<concrete inputs or state>","caller_chain":["<path-or-symbol>"],"violated":{"kind":"acceptance|security_boundary","ref":"<acceptance id or boundary>"}}}]}`,
 		`REWORK verdicts must omit the approval field entirely; do not emit "approval": null.`,
 	].join("\n");
 }
 
+function parseVerdictEvidence(value: unknown, index: number): FindingEvidence {
+	if (!value || typeof value !== "object" || Array.isArray(value))
+		throw new Error(`finding ${index} evidence is required`);
+	const evidence = value as Record<string, unknown>;
+	const unknown = Object.keys(evidence).find(
+		(key) => !["trigger", "caller_chain", "violated"].includes(key),
+	);
+	if (unknown) throw new Error(`finding ${index} evidence has unknown field: ${unknown}`);
+	if (typeof evidence.trigger !== "string" || !evidence.trigger.trim())
+		throw new Error(`finding ${index} evidence.trigger must be a non-empty string`);
+	const chain = evidence.caller_chain;
+	if (
+		!Array.isArray(chain) ||
+		chain.length === 0 ||
+		chain.some((entry) => typeof entry !== "string" || !entry.trim())
+	)
+		throw new Error(
+			`finding ${index} evidence.caller_chain must be a non-empty list of paths or symbols`,
+		);
+	const violated = evidence.violated;
+	if (!violated || typeof violated !== "object" || Array.isArray(violated))
+		throw new Error(`finding ${index} evidence.violated is required`);
+	const violatedRecord = violated as Record<string, unknown>;
+	const unknownViolated = Object.keys(violatedRecord).find(
+		(key) => !["kind", "ref"].includes(key),
+	);
+	if (unknownViolated)
+		throw new Error(`finding ${index} evidence.violated has unknown field: ${unknownViolated}`);
+	if (violatedRecord.kind !== "acceptance" && violatedRecord.kind !== "security_boundary")
+		throw new Error(
+			`finding ${index} evidence.violated.kind must be acceptance or security_boundary`,
+		);
+	if (typeof violatedRecord.ref !== "string" || !violatedRecord.ref.trim())
+		throw new Error(`finding ${index} evidence.violated.ref must be a non-empty string`);
+	return {
+		trigger: evidence.trigger,
+		caller_chain: chain as string[],
+		violated: {
+			kind: violatedRecord.kind,
+			ref: violatedRecord.ref,
+		},
+	};
+}
+
 export function parseAssuranceVerdict(input: unknown, snapshot: SnapshotDescriptor): AssuranceVerdict {
 	let raw: Record<string, unknown>;
 	if (typeof input === "string") {
@@ -353,12 +430,33 @@ export function parseAssuranceVerdict(input: unknown, snapshot: SnapshotDescript
 	if (raw.approval !== undefined && raw.approval !== null) throw new Error("rework verdict must omit approval");
 	const findings = raw.findings.map((item, index) => {
 		const finding = item as Record<string, unknown>;
-		const unknownFinding = Object.keys(finding).find((key) => !["id", "kind", "acceptance_id", "summary"].includes(key));
+		const allowedFindingKeys =
+			snapshot.role === "review"
+				? ["id", "kind", "acceptance_id", "summary", "evidence"]
+				: ["id", "kind", "acceptance_id", "summary"];
+		const unknownFinding = Object.keys(finding).find(
+			(key) => !allowedFindingKeys.includes(key),
+		);
 		if (unknownFinding) throw new Error(`finding ${index} has unknown field: ${unknownFinding}`);
 		if (typeof finding.id !== "string" || !finding.id.trim() || (finding.kind !== "blocking" && finding.kind !== "advisory") || (finding.acceptance_id !== null && typeof finding.acceptance_id !== "string") || typeof finding.summary !== "string" || !finding.summary.trim()) throw new Error(`finding ${index} is invalid`);
 		const id = `review-${snapshotDigest(snapshot).slice(7, 19)}-${index + 1}-${finding.id.replace(/[^A-Za-z0-9._-]/g, "-").slice(0, 48)}`;
 		const normalized = { id, kind: finding.kind as "blocking" | "advisory", acceptance_id: finding.acceptance_id as string | null, summary: finding.summary as string };
-		return { ...normalized, findings_digest: findingsDigest([normalized]) };
+		if (snapshot.role !== "review")
+			return { ...normalized, findings_digest: findingsDigest([normalized]) };
+		// Review findings must carry evidence; the anchor is derived here so a
+		// capability minted for one anchor set cannot be spent on another and
+		// the reviewer can never assert the anchor directly.
+		const evidence = parseVerdictEvidence(finding.evidence, index);
+		// The digest that decides refutation inheritance is derived here so the
+		// reviewer can never assert the anchor directly; the Kernel recomputes it
+		// from the same evidence before admitting the finding.
+		const anchor = anchorForEvidence(evidence);
+		return {
+			...normalized,
+			anchor,
+			evidence,
+			findings_digest: findingsDigest([normalized]),
+		};
 	});
 	return { contract: "assurance_kernel/assurance_verdict/v2", role: snapshot.role, task_id: snapshot.task_id, snapshot_digest: snapshotDigest(snapshot), decision: "rework", findings };
 }

package/plugins/immune-brain/runtime/assurance/verification.ts

@@ -5,7 +5,7 @@
 // runner, compatibility gate, fixed execution, and findings digest.
 
 import { createHash } from "node:crypto";
-import { execFileSync, spawn } from "node:child_process";
+import { execFileSync, spawn, spawnSync } from "node:child_process";
 import { realpathSync, statSync } from "node:fs";
 import { isAbsolute, join, resolve, sep, relative } from "node:path";
 
@@ -43,7 +43,18 @@ export function resolveBunRunner(): FrozenRunner {
 	}
 	let real: string;
 	try {
-		real = realpathSync(executable);
+		// When which returns a version-manager shim (e.g. mise or asdf),
+		// realpathSync on the shim resolves to the version-manager binary rather
+		// than bun. Ask bun itself for its real process.execPath.
+		const execPath = spawnSync(executable, ["-e", "console.log(process.execPath)"], {
+			encoding: "utf8",
+			stdio: ["ignore", "pipe", "ignore"],
+		});
+		if (execPath.status === 0 && execPath.stdout.trim().length > 0) {
+			real = realpathSync(execPath.stdout.trim());
+		} else {
+			real = realpathSync(executable);
+		}
 	} catch {
 		throw new VerificationDescriptorError("bun runner realpath is unresolvable");
 	}

package/plugins/immune-brain/runtime/claude/interaction.ts

@@ -5,6 +5,7 @@ export const PRIVILEGED_OPERATIONS = [
 	"request_authorization",
 	"approve_breaking_intent_revision",
 	"stop",
+	"start_unattended_batch",
 ] as const;
 
 export type PrivilegedOperation = (typeof PRIVILEGED_OPERATIONS)[number];
@@ -66,12 +67,22 @@ export function evaluateNativeGate(input: NativeGateInput): NativeGateResult {
 
 export interface NativeConfirmationInput {
 	operation: PrivilegedOperation;
-	taskId: string;
+	taskId?: string;
+	initiativeSlug?: string;
 	toolCallId: string;
 	risk?: string;
 	intentRevision?: number;
 	intentContentHash?: string;
 	bindingDigest?: string;
+	planDigest?: string;
+	batchDetails?: {
+		initiative_slug: string;
+		batch_branch: string;
+		children: Array<{ task_id: string; slice_id: string; risk?: string }>;
+		excluded: Array<{ task_id: string; slice_id: string; reason: string }>;
+		budget: { max_children: number; deadline_at: string; qa_failure_limit: number };
+		expires_at: string;
+	};
 	signal?: AbortSignal;
 }
 
@@ -87,13 +98,15 @@ export function confirmationRef(input: {
 	toolCallId: string;
 	requestId: string;
 	operation: string;
-	taskId: string;
+	taskId?: string;
+	initiativeSlug?: string;
 	intentRevision?: number;
 	intentContentHash?: string;
 	bindingDigest?: string;
+	planDigest?: string;
 }): string {
 	return `claude-confirm-${createHash("sha256")
-		.update(`${input.connectionId}\0${input.toolCallId}\0${input.requestId}\0${input.operation}\0${input.taskId}\0${input.intentRevision ?? ""}\0${input.intentContentHash ?? ""}\0${input.bindingDigest ?? ""}`)
+		.update(`${input.connectionId}\0${input.toolCallId}\0${input.requestId}\0${input.operation}\0${input.taskId ?? ""}\0${input.initiativeSlug ?? ""}\0${input.intentRevision ?? ""}\0${input.intentContentHash ?? ""}\0${input.bindingDigest ?? ""}\0${input.planDigest ?? ""}`)
 		.digest("hex")
 		.slice(0, 16)}`;
 }