immune-brain 3.6.6 → 3.6.8

package/plugins/immune-brain/.pi-extension/package.json

@@ -1,11 +1,12 @@
 {
   "name": "immune-brain-pi-extension",
   "private": true,
-  "description": "Explicit extension entry manifest for the Immune-Brain Pi lifecycle Tools. Helper modules in this directory are library code, not extension factories; listing only the two factory files here prevents Pi's directory discovery from loading them as extensions.",
+  "description": "Explicit extension entry manifest for the Immune-Brain Pi lifecycle Tools. Helper modules in this directory are library code, not extension factories; listing only the three factory files here prevents Pi's directory discovery from loading them as extensions.",
   "pi": {
     "extensions": [
       "./imm-canary-enroll.ts",
-      "./imm-canary-work.ts"
+      "./imm-canary-work.ts",
+      "./imm-unattended-batch.ts"
     ]
   }
 }

package/plugins/immune-brain/.pi-extension/pi-canary-interaction.ts

@@ -55,6 +55,8 @@ export interface TaskRailView {
 	recovery?: string;
 	/** Latest per-descriptor QA fact; rendered only while present. */
 	acceptance_progress?: TaskRailAcceptanceProgress;
+	/** Optional pipeline milestone progress indicator. */
+	pipeline?: boolean;
 }
 
 export interface TaskOverviewEntry {
@@ -144,7 +146,7 @@ export async function requestAuthorityDialog<T extends string, R = T | undefined
 					finish = done;
 					if (settled || options.signal?.aborted) done(undefined);
 					let expanded = false;
-					const detailText = new Text(theme.fg("muted", "Details collapsed; press d to expand."), 1, 0);
+					const detailText = new Text(theme.fg("muted", "▸ Details collapsed; press d to expand."), 1, 0);
 					const selectList = new SelectList(
 						options.actions.map((action): SelectItem => ({ ...action })),
 						options.actions.length,
@@ -158,13 +160,27 @@ export async function requestAuthorityDialog<T extends string, R = T | undefined
 					);
 					selectList.onSelect = (item) => complete(item.value as T);
 					selectList.onCancel = () => complete(undefined);
+
+					const affirmativeAction = options.actions.find((a) =>
+						["confirm", "authorize", "yes", "accept"].includes(a.value.toLowerCase()),
+					);
+					const negativeAction = options.actions.find((a) =>
+						["cancel", "decline", "no", "reject"].includes(a.value.toLowerCase()),
+					);
+
+					const affKey = affirmativeAction ? "y/enter" : "enter";
+					const negKey = negativeAction ? "n/esc" : "esc";
+					const affLabel = affirmativeAction ? affirmativeAction.value : "choose";
+					const negLabel = negativeAction ? negativeAction.value : "cancel";
+					const hintLine = `d: details | ${affKey}: ${affLabel} | ${negKey}: ${negLabel}`;
+
 					const container = new Container();
 					container.addChild(new DynamicBorder((text: string) => theme.fg("accent", text)));
 					container.addChild(new Text(theme.fg("accent", theme.bold(options.title)), 1, 0));
-					container.addChild(new Text(options.summary, 1, 0));
+					container.addChild(new Text(formatDialogSummary(options.summary, theme), 1, 0));
 					container.addChild(detailText);
 					container.addChild(selectList);
-					container.addChild(new Text(theme.fg("dim", "d: toggle details | enter: choose | esc: cancel"), 1, 0));
+					container.addChild(new Text(theme.fg("dim", hintLine), 1, 0));
 					container.addChild(new DynamicBorder((text: string) => theme.fg("accent", text)));
 					return {
 						render: (width) => container.render(width),
@@ -172,10 +188,20 @@ export async function requestAuthorityDialog<T extends string, R = T | undefined
 						handleInput: (data) => {
 							if (data === "d" || data === "D") {
 								expanded = !expanded;
-								detailText.setText(expanded ? options.details : theme.fg("muted", "Details collapsed; press d to expand."));
+								detailText.setText(expanded
+									? `${theme.fg("muted", "▾ Details:")}\n${options.details}`
+									: theme.fg("muted", "▸ Details collapsed; press d to expand."));
 								tui.requestRender();
 								return;
 							}
+							if ((data === "y" || data === "Y") && affirmativeAction) {
+								complete(affirmativeAction.value as T);
+								return;
+							}
+							if ((data === "n" || data === "N") && negativeAction) {
+								complete(negativeAction.value as T);
+								return;
+							}
 							selectList.handleInput(data);
 							tui.requestRender();
 						},
@@ -372,6 +398,13 @@ export function renderStructuredResult(
 	];
 	const recovery = recoveryHint(details);
 	if (recovery) lines.push(`${theme.fg("muted", "Recovery:")} ${theme.fg("dim", recovery)}`);
+	const facts = record(details.facts) ?? record(details.execution_facts);
+	if (facts) {
+		const factParts = Object.entries(facts)
+			.map(([k, v]) => `${k}=${String(v)}`)
+			.join(" · ");
+		if (factParts) lines.push(`${theme.fg("muted", "Facts:")} ${theme.fg("dim", factParts)}`);
+	}
 	if (terminal && taskState) lines.push(...renderFinalLines(taskState, theme));
 	return new Text(lines.join("\n"), 0, 0);
 }
@@ -423,6 +456,9 @@ function renderTaskRail(view: TaskRailView, width = 120, theme?: Theme): string[
 	const lines = [
 		`Task ${boundedMiddle(view.task_id, taskIdWidth)} · ${stateFormatted}`,
 	];
+	if (view.pipeline) {
+		lines.push(`${label("Pipeline:")} ${renderPipelineMilestones(view.state, theme)}`);
+	}
 	if (view.phase) {
 		lines.push(`${label("Phase:")} ${body(bounded(view.phase, availableContentWidth))}`);
 	}
@@ -446,6 +482,69 @@ function renderTaskRail(view: TaskRailView, width = 120, theme?: Theme): string[
 	return lines;
 }
 
+export function renderPipelineMilestones(state: TaskRailState, theme?: Theme): string {
+	const milestones = [
+		{ name: "Plan", key: "plan" },
+		{ name: "Exec", key: "exec" },
+		{ name: "QA", key: "qa" },
+		{ name: "Review", key: "review" },
+	] as const;
+
+	type StepStatus = "done" | "active" | "pending" | "blocked" | "stopped";
+
+	let statuses: [StepStatus, StepStatus, StepStatus, StepStatus];
+	switch (state) {
+		case "Planning":
+			statuses = ["active", "pending", "pending", "pending"];
+			break;
+		case "Approval required":
+		case "Working":
+			statuses = ["done", "active", "pending", "pending"];
+			break;
+		case "Verifying":
+			statuses = ["done", "done", "active", "pending"];
+			break;
+		case "Reviewing":
+			statuses = ["done", "done", "done", "active"];
+			break;
+		case "Completed":
+			statuses = ["done", "done", "done", "done"];
+			break;
+		case "Blocked":
+			statuses = ["done", "blocked", "pending", "pending"];
+			break;
+		case "Stopped":
+			statuses = ["done", "stopped", "pending", "pending"];
+			break;
+		default:
+			statuses = ["pending", "pending", "pending", "pending"];
+	}
+
+	const renderStep = (name: string, status: StepStatus, index: number): string => {
+		const stepNum = index + 1;
+		if (!theme) {
+			const sym = status === "done" ? "✔" : status === "active" ? "●" : status === "blocked" ? "⚠" : status === "stopped" ? "■" : "○";
+			return `[${stepNum}.${name} ${sym}]`;
+		}
+		switch (status) {
+			case "done":
+				return `[${stepNum}.${name} ${theme.fg("success", "✔")}]`;
+			case "active":
+				return `[${stepNum}.${name} ${theme.fg("accent", "●")}]`;
+			case "blocked":
+				return `[${stepNum}.${name} ${theme.fg("warning", "⚠")}]`;
+			case "stopped":
+				return `[${stepNum}.${name} ${theme.fg("muted", "■")}]`;
+			case "pending":
+			default:
+				return `[${stepNum}.${name} ${theme.fg("dim", "○")}]`;
+		}
+	};
+
+	const sep = theme ? ` ${theme.fg("dim", "─")} ` : " ─ ";
+	return milestones.map((m, i) => renderStep(m.name, statuses[i], i)).join(sep);
+}
+
 export function renderTaskOverview(view: TaskOverviewView, width = 120, theme?: Theme): string[] {
 	const label = (text: string) => (theme ? theme.fg("muted", text) : text);
 	const head = (text: string) => (theme ? theme.fg("accent", theme.bold(text)) : text);
@@ -456,6 +555,7 @@ export function renderTaskOverview(view: TaskOverviewView, width = 120, theme?:
 	}
 	if (view.active) {
 		lines.push(`${label("Active:")} ${formatTaskRailState(view.active.state, theme)} ${bounded(view.active.task_id, 60)}`);
+		lines.push(`${label("  Pipeline:")} ${renderPipelineMilestones(view.active.state, theme)}`);
 		lines.push(`${label("  Result:")} ${bounded(view.active.result, 100)}`);
 		lines.push(`${label("  Next:")} ${bounded(view.active.next, 100)}`);
 	} else {
@@ -501,15 +601,60 @@ function renderFinalLines(taskState: Record<string, unknown>, theme: Theme): str
 		+ strings(taskState.unresolved_user_decision_ids).length
 		+ strings(taskState.replan_required_ids).length;
 	const diffHash = string(taskState.diff_hash);
+	const divider = theme.fg("dim", "────────────────────────────────────────");
 	return [
+		divider,
+		theme.fg("accent", theme.bold("Final Settlement Summary")),
 		`${theme.fg("muted", "Acceptance:")} ${theme.fg(missing === 0 ? "success" : "warning", `${fresh}/${fresh + missing} fresh`)}`,
 		`${theme.fg("muted", "QA / Review:")} ${theme.fg("dim", approvals.length > 0 ? approvals.join(", ") : "not recorded")}`,
 		`${theme.fg("muted", "Residual blockers:")} ${theme.fg(blockers === 0 ? "dim" : "warning", String(blockers))}`,
 		`${theme.fg("muted", "Repository health:")} ${theme.fg("dim", "not assessed")}`,
 		`${theme.fg("muted", "Git:")} ${theme.fg("dim", diffHash ? `task diff ${diffHash.slice(0, 15)}` : "not reported")}`,
+		divider,
 	];
 }
 
+function formatDialogSummary(summary: string, theme: Theme): string {
+	const lines = summary.split("\n");
+	return lines.map((line) => {
+		const colonIdx = line.indexOf(":");
+		if (colonIdx === -1) return theme.fg("dim", line);
+		const key = line.slice(0, colonIdx).trim();
+		const value = line.slice(colonIdx + 1).trim();
+		let formattedValue = theme.fg("dim", value);
+		const lowerKey = key.toLowerCase();
+		if (lowerKey === "risk") {
+			const isHigh = /high|material|critical/i.test(value);
+			formattedValue = isHigh ? theme.fg("warning", theme.bold(value)) : theme.fg("accent", value);
+		} else if (lowerKey === "goal") {
+			formattedValue = theme.fg("accent", value);
+		} else if (lowerKey === "acceptance") {
+			formattedValue = theme.fg("success", value);
+		}
+		return `${theme.fg("muted", `${key}:`)} ${formattedValue}`;
+	}).join("\n");
+}
+
+export function boundedPath(path: string, max: number): string {
+	const width = visibleWidth(path);
+	if (width <= max) return path;
+	if (!path.includes("/")) return bounded(path, max);
+	const parts = path.split("/");
+	const fileName = parts.pop() ?? "";
+	const fileWidth = visibleWidth(fileName);
+	if (fileWidth + 2 >= max) {
+		return bounded(fileName, max);
+	}
+	const remaining = max - fileWidth - 3; // "…/"
+	let prefix = "";
+	for (const part of parts) {
+		const next = prefix ? `${prefix}/${part}` : part;
+		if (visibleWidth(next) > remaining) break;
+		prefix = next;
+	}
+	return prefix ? `${prefix}/…/${fileName}` : `…/${fileName}`;
+}
+
 function record(value: unknown): Record<string, unknown> | undefined {
 	return typeof value === "object" && value !== null && !Array.isArray(value)
 		? value as Record<string, unknown>

package/plugins/immune-brain/.pi-extension/runtime-stub.ts

@@ -174,7 +174,15 @@ export interface TaskRecordRead {
 				manifest_digest: string;
 			};
 		}>;
-		findings: Array<{ id: string; kind: string; status: string; summary?: string }>;
+		findings: Array<{
+			id: string;
+			kind: string;
+			status: string;
+			summary?: string;
+			anchor?: string | null;
+			evidence?: unknown;
+			counterevidence?: { attestation_id: string; acceptance_id: string } | null;
+		}>;
 	} | null;
 }
 
@@ -283,7 +291,12 @@ export async function readTaskRecord(
 	taskId: string,
 ): Promise<TaskRecordRead> {
 	const mod = await import(/* @vite-ignore */ kernelPath("storage"));
-	return mod.readTaskRecord(root, taskId);
+	// Lock-free read only. `storage.readTaskRecord` wraps this in
+	// withKernelStoreLock, which first runs pending-transaction recovery, so a
+	// decline, a cancel, or a rejected preflight would otherwise mutate Kernel
+	// state before the literal user ever approved anything. Mutating Kernel
+	// entrypoints still take their own lock when the batch actually starts.
+	return mod.readTaskRecordRaw(root, taskId);
 }
 export async function withKernelStoreLock<T>(root: string, operation: () => T): Promise<T> {
 	const mod = await import(/* @vite-ignore */ kernelPath("storage"));
@@ -403,3 +416,188 @@ export async function deriveAssuranceAuthorization(input: {
 	const mod = await import(/* @vite-ignore */ kernelPath("assurance_projection"));
 	return mod.deriveAssuranceAuthorization(input) as AssuranceAuthorizationReadiness;
 }
+
+// --- Batch Authority & Unattended Runner Forwarding ---
+function unattendedPath(module: string): string {
+	return `../runtime/unattended/${module}.ts`;
+}
+
+export type {
+	BatchPlan,
+	BatchPlanChild,
+	BatchPlanBudget,
+	BatchPlanDigestChild,
+	InitiativeObservationReader,
+} from "../runtime/unattended/types";
+export type {
+	BatchAuthorityRegistry,
+	BatchAuthorizationBinding,
+	ValidatedBatchAuthorization,
+} from "../runtime/kernel/batch_authority";
+export type {
+	BatchRunnerKernelPort,
+	StartBatchInput,
+	BatchRunReport,
+} from "../runtime/unattended/batch_runner";
+export type {
+	BatchRunnerGitPort,
+	BatchGitPreflightResult,
+} from "../runtime/unattended/batch_git";
+
+export async function projectBatchPlan(
+	root: string,
+	initiativeSlug: string,
+	input: any,
+	readInitiative?: any,
+): Promise<any> {
+	const mod = await import(/* @vite-ignore */ unattendedPath("batch_plan"));
+	return mod.projectBatchPlan(root, initiativeSlug, input, readInitiative);
+}
+
+export async function computeBatchPlanDigest(children: any): Promise<string> {
+	const mod = await import(/* @vite-ignore */ kernelPath("batch_authority"));
+	return mod.computeBatchPlanDigest(children);
+}
+
+export async function createBatchAuthorityRegistry(): Promise<any> {
+	const mod = await import(/* @vite-ignore */ kernelPath("batch_authority"));
+	return mod.createBatchAuthorityRegistry();
+}
+
+export async function deriveChildEnrollment(root: string, registry: any, input: any): Promise<any> {
+	const mod = await import(/* @vite-ignore */ kernelPath("batch_authority"));
+	return mod.deriveChildEnrollment(root, registry, input);
+}
+
+export async function startBatch(input: any): Promise<any> {
+	const mod = await import(/* @vite-ignore */ unattendedPath("batch_runner"));
+	return mod.startBatch(input);
+}
+
+export async function runBatchGitPreflight(input: any): Promise<any> {
+	const mod = await import(/* @vite-ignore */ unattendedPath("batch_git"));
+	return mod.runBatchGitPreflight(input);
+}
+
+export async function readGitHead(root: string): Promise<string> {
+	// The Pi extension must reach Kernel prepare only through the shared Enrollment
+	// boundary, so this reads HEAD itself rather than importing the Kernel prepare
+	// module. The unattended Git module reads HEAD the same way.
+	const { spawnSync } = await import("node:child_process");
+	const result = spawnSync("git", ["-C", root, "rev-parse", "HEAD"], { encoding: "utf8" });
+	if (result.status !== 0) throw new Error(`git rev-parse HEAD is unavailable for ${root}`);
+	return result.stdout.trim();
+}
+
+/**
+ * Read the immutable terminal audit record for a settled child.
+ *
+ * A child reaches Kernel settlement before the batch commits it, and settlement
+ * clears the live state record, so the batch resume preflight must resolve the
+ * child's authorized scope from the audit pair instead. Read-only: neither the
+ * audit pair nor this reader mutates Kernel state.
+ */
+export async function readSettledTaskRecord(
+	root: string,
+	taskId: string,
+): Promise<{ scope_hint: string[]; intent_path: string | undefined } | null> {
+	const mod = await import(/* @vite-ignore */ kernelPath("storage"));
+	const pair = mod.readAuditTaskPair(root, taskId);
+	if (!pair?.record) return null;
+	const record = pair.record as {
+		intent_snapshot?: { scope_hint?: string[] };
+		intent_ref?: { path?: string };
+	};
+	return {
+		scope_hint: record.intent_snapshot?.scope_hint ?? [],
+		intent_path: record.intent_ref?.path,
+	};
+}
+
+export async function pathMatchesScope(path: string, scopePath: string): Promise<boolean> {
+	const mod = await import(/* @vite-ignore */ runtimePath("workspace_scope"));
+	return mod.pathMatchesScope(path, scopePath);
+}
+
+const GLOBAL_PI_PROGRESSION_KEY = Symbol.for("immune_brain.pi_assurance_progression");
+
+export async function getSharedPiProgression(): Promise<any> {
+	let progression = (globalThis as any)[GLOBAL_PI_PROGRESSION_KEY];
+	if (!progression) {
+		const workMod = await import(/* @vite-ignore */ "./imm-canary-work");
+		const ports = workMod.createPiAssuranceProgressionPorts();
+		const progMod = await import(/* @vite-ignore */ "./pi-canary-assurance-progression");
+		progression = new progMod.AssuranceProgression(ports);
+		(globalThis as any)[GLOBAL_PI_PROGRESSION_KEY] = progression;
+	}
+	return progression;
+}
+
+export async function advancePiTask(root: string, taskId: string): Promise<any> {
+	const progression = await getSharedPiProgression();
+	const result = await progression.advance(taskId, { cwd: root });
+	if (result.state === "completed") return { state: "completed" };
+	if (result.state === "stopped") return { state: "stopped" };
+	if (result.state === "rework") return { state: "rework", operation: result.operation, summary: result.summary };
+	if (result.state === "review_ready") return { state: "review_ready", operation_id: result.operation_id, agent_params: result.agent_params };
+	if (result.state === "blocked") return { state: "blocked", reason: result.reason };
+	return { state: "failed", reason: (result as { reason?: string }).reason ?? "advance failed" };
+}
+
+export async function projectAssuranceForTask(root: string, taskId: string): Promise<any> {
+	const [assuranceMod, scopeMod] = await Promise.all([
+		import(/* @vite-ignore */ kernelPath("assurance_projection")),
+		import(/* @vite-ignore */ runtimePath("workspace_scope")),
+	]);
+	const diffSnapshotOf = (r: string, record: any) => {
+		if (record.contract === "assurance_kernel/task_record/v4") {
+			if (!record.git_base_head)
+				throw new Error("TaskRecord v4 is missing git_base_head");
+			return scopeMod.taskRevisionIdentity(r, record.intent_snapshot.scope_hint, record.git_base_head);
+		}
+		return scopeMod.taskDiffIdentity(r, record.intent_snapshot.scope_hint);
+	};
+	return assuranceMod.projectAssurance(root, taskId, diffSnapshotOf);
+}
+
+export async function findExistingActiveBatch(root: string, initiativeSlug: string): Promise<any> {
+	const { join } = await import("node:path");
+	const { existsSync, readdirSync, readFileSync } = await import("node:fs");
+	const batchesDir = join(root, ".imm", "state", "batches");
+	if (!existsSync(batchesDir)) return null;
+	const files = readdirSync(batchesDir);
+	for (const file of files) {
+		if (!file.endsWith(".json")) continue;
+		let record: any;
+		try {
+			record = JSON.parse(readFileSync(join(batchesDir, file), "utf8"));
+		} catch {
+			// Unreadable Kernel batch state must fail closed: silently treating the
+			// initiative as batchless could authorize a parallel run.
+			return { corrupt: true, path: file };
+		}
+		if (record.contract === "assurance_kernel/batch_run_state/v1" && record.initiative_slug === initiativeSlug) {
+			const validStates = new Set([
+				"prepared",
+				"running",
+				"needs_human",
+				"completed",
+				"budget_stopped",
+				"failed",
+				"rejected",
+			]);
+			if (
+				typeof record.batch_id !== "string" ||
+				typeof record.base_head !== "string" ||
+				!Array.isArray(record.children) ||
+				!validStates.has(record.batch_state)
+			) {
+				return { corrupt: true, path: file };
+			}
+			return record;
+		}
+	}
+	return null;
+}
+
+