immune-brain 3.6.8 → 4.0.0

package/README.md

@@ -25,7 +25,7 @@ Pi and Claude Code are the supported hosts. Undeclared adapters remain unsupport
 - [Installation](#installation)
 - [Quick Start](#quick-start)
 - [How to Use](#how-to-use)
-- [The 6 Skills](#the-6-skills)
+- [The 7 Skills](#the-7-skills)
 - [Lifecycle](#lifecycle)
 - [Unattended Batch Runs](#unattended-batch-runs)
 - [Configuration](#configuration)
@@ -119,6 +119,7 @@ Immune-Brain provides two clean modes: **Host-native** for daily coding, and **M
 | PR has review comments or failing CI | `/imm-pr-fix` on that PR | → Standalone repair: minimal scoped fix in place, no managed task created |
 | Project docs out of date | `/imm-doc-prune` | → Read-only audit; deletes only user-approved stale docs from manifest |
 | Agent instructions bloated | `/imm-agent-doc-maintain` | → Minimizes tracked `AGENTS.md` / `CLAUDE.md` to essential non-discoverable rules |
+| Which model's edits keep coming back for review | `/imm-review-retro` | → Ranks models by review load and reports project usage from session logs |
 
 > **Core Principle: Skill-Explicit Entry**
 > - **Ordinary input stays host-native**: Natural language queries never automatically start planning or task enrollment. You choose when to turn on engineering rigor.
@@ -126,7 +127,7 @@ Immune-Brain provides two clean modes: **Host-native** for daily coding, and **M
 
 ---
 
-## The 6 Skills
+## The 7 Skills
 
 | Skill | Type | When to use | What it does |
 |---|---|---|---|
@@ -136,10 +137,11 @@ Immune-Brain provides two clean modes: **Host-native** for daily coding, and **M
 | `imm-pr-fix` | Standalone | CI failed / review comments on a PR | Repairs one PR in place, no managed authority |
 | `imm-doc-prune` | Standalone | Stale current docs | Deletes only the hash-approved manifest entries |
 | `imm-agent-doc-maintain` | Standalone | Bloated agent instructions | Minimizes tracked AGENTS/CLAUDE/GEMINI.md to necessary context |
+| `imm-review-retro` | Standalone | Compare models by review load | Ranks authors of reviewed code and reports project usage |
 
 Internal roles (Executor, QA, Review, Compounder) are dispatched by `imm-loop` — you never invoke them directly.
 
-All 6 skills are invoked explicitly. For new features, start with `imm-brainstorm` (if requirements are uncertain) or `imm-planner` (if requirements are clear), then proceed to `imm-loop` once enrolled.
+All 7 skills are invoked explicitly. For new features, start with `imm-brainstorm` (if requirements are uncertain) or `imm-planner` (if requirements are clear), then proceed to `imm-loop` once enrolled.
 
 ### Managed Path entries (brainstorm → planner → loop)
 
@@ -187,6 +189,11 @@ The three repair/maintenance skills are host-native: they never create a managed
 - **Trigger:** explicit request to minimize tracked `AGENTS.md` / `CLAUDE.md` / `GEMINI.md`.
 - **What it does:** keeps only the necessary non-discoverable rules in agent instruction files, under the same read-only-audit + hash-bound-manifest-approval model as `imm-doc-prune`.
 
+#### `imm-review-retro` — review load and project usage
+
+- **Trigger:** explicit request for a cross-model review retro or project usage look-back.
+- **What it does:** ranks models by how much review their own edits triggered, plus sessions/turns/edits/tool mix, from pi session logs. Read-only. Not a diff review.
+
 ---
 
 ## Lifecycle
@@ -265,7 +272,7 @@ See [`docs/reference/immune-brain-config.md`](docs/reference/immune-brain-config
 package.json                          # Pi package manifest (skills + extensions)
 plugins/immune-brain/
 ├── .pi-extension/                    # Pi TUI + Kernel authority extension
-├── skills/                           # 6 public Skills (trigger shims)
+├── skills/                           # 7 public Skills (trigger shims)
 ├── dist/                             # Built skill contracts & references
 ├── runtime/                          # Bun + TypeScript runtime & Kernel
 └── bin/                              # CLI wrappers (→ runtime/v4_runtime.ts)

package/README.zh-CN.md

@@ -25,7 +25,7 @@ Pi 与 Claude Code 是支持的宿主。未声明的适配器仍不受支持。C
 - [安装](#安装)
 - [快速开始](#快速开始)
 - [如何使用](#如何使用)
-- [6 个 Skills](#6-个-skills)
+- [7 个 Skills](#7-个-skills)
 - [生命周期](#生命周期)
 - [无人值守批次运行](#无人值守批次运行)
 - [配置](#配置)
@@ -119,6 +119,7 @@ Immune-Brain 提供两种清晰的工作模式：日常轻量编码走 **Host-na
 | PR 被评论 / CI 挂了 | 对该 PR 使用 `/imm-pr-fix` | → 独立修复：在当前 PR 内针对性修复，不创建新 managed 任务 |
 | 文档过时需要清理 | `/imm-doc-prune` | → 只读审计过时文档，仅删除经哈希审批的条目 |
 | Agent 指令文件膨胀 | `/imm-agent-doc-maintain` | → 将 tracked `AGENTS.md` / `CLAUDE.md` 压到最小必要上下文 |
+| 想知道哪个模型的改动总被审查 | `/imm-review-retro` | → 按模型排名审查负载，并从 session logs 汇报项目使用量 |
 
 > **核心原则：Skill 显式调用**
 > - **普通输入保持 Host-native**：自然语言提问绝不自动绑架流程或发起 Enrollment。你完全自主决定何时开启严格工程保障。
@@ -126,7 +127,7 @@ Immune-Brain 提供两种清晰的工作模式：日常轻量编码走 **Host-na
 
 ---
 
-## 6 个 Skills
+## 7 个 Skills
 
 | Skill | 类型 | 何时使用 | 职责 |
 |---|---|---|---|
@@ -136,10 +137,11 @@ Immune-Brain 提供两种清晰的工作模式：日常轻量编码走 **Host-na
 | `imm-pr-fix` | 独立 | PR 需修复 | 原地修复单个 PR，不触及 managed authority |
 | `imm-doc-prune` | 独立 | 清理过时文档 | 仅删除哈希绑定的 manifest 条目 |
 | `imm-agent-doc-maintain` | 独立 | Agent instruction 膨胀 | 将 tracked AGENTS/CLAUDE/GEMINI.md 压到最小必要上下文 |
+| `imm-review-retro` | 独立 | 比较模型的审查负载 | 排名被审查代码的作者并汇报项目使用量 |
 
 Executor、QA、Review、Compounder 等为 `imm-loop` 内部调度的角色，无需手动调用。
 
-所有 6 个 Skill 均显式调用。新需求开发时：若需求含糊先调 `imm-brainstorm`，目标清晰直接调 `imm-planner`，完成确认后调 `imm-loop` 推进闭环。
+所有 7 个 Skill 均显式调用。新需求开发时：若需求含糊先调 `imm-brainstorm`，目标清晰直接调 `imm-planner`，完成确认后调 `imm-loop` 推进闭环。
 
 ### Managed Path 入口（brainstorm → planner → loop）
 
@@ -187,6 +189,11 @@ Executor、QA、Review、Compounder 等为 `imm-loop` 内部调度的角色，
 - **触发方式：** 显式要求精简版本控制下的 `AGENTS.md` / `CLAUDE.md` / `GEMINI.md`。
 - **职责：** 遵循与 `imm-doc-prune` 相同的「只读审计 + 哈希清单审批」模式，仅保留无法直接推导的必要规则。
 
+#### `imm-review-retro` — 审查负载与项目使用回顾
+
+- **触发方式：** 显式要求跨模型审查复盘或项目使用量回顾。
+- **职责：** 从 pi session logs 按模型排名被审查代码的作者，并汇报 sessions/turns/编辑量/工具分布。只读；不审查 diff。
+
 ---
 
 ## 生命周期

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "3.6.8",
+  "version": "4.0.0",
   "description": "Immune-Brain agent skill system",
   "publishConfig": {
     "access": "public",
@@ -72,9 +72,10 @@
     "plugins/immune-brain/runtime/plan_core.ts",
     "plugins/immune-brain/runtime/commands/kernel.ts",
     "plugins/immune-brain/runtime/kernel",
+    "plugins/immune-brain/runtime/authorization_operation.ts",
     "plugins/immune-brain/runtime/canonical_json.ts",
+    "plugins/immune-brain/runtime/staged_intent.ts",
     "plugins/immune-brain/runtime/workspace_scope.ts",
-    "plugins/immune-brain/runtime/authority_commit_receipts.ts",
     "plugins/immune-brain/runtime/managed_task_routing_policy.ts",
     "plugins/immune-brain/runtime/github_issue_tracker.ts",
     "plugins/immune-brain/runtime/verification_descriptor.ts",

package/plugins/immune-brain/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "3.6.8",
+  "version": "4.0.0",
   "description": "Immune-Brain Claude Code Host: native Enrollment, QA, Review, and Kernel settlement.",
   "author": {
     "name": "Immune-Brain Team"

package/plugins/immune-brain/.pi-extension/imm-canary-enroll.ts

@@ -14,6 +14,7 @@ import { resolve } from "node:path";
 // can resolve them at runtime), and the stub forwards to the real Kernel
 // modules via dynamic import.
 import {
+	LITERAL_USER_ACTOR_ID,
 	createEnrollmentAuthorityRegistry,
 	preparePiCanary,
 	revalidatePiCanary,
@@ -408,7 +409,7 @@ async function executeForegroundEnrollment(
 				`Terminal task ${authority.owner_task_id} retains an exactly proven stale backend claim`,
 				`invoke imm_kernel_canary repair_authority_state for ${authority.owner_task_id}`,
 			);
-		if (authority.state === "authority_conflict" || authority.state === "terminal_owner")
+		if (authority.state === "authority_conflict")
 			return terminal(
 				action,
 				taskId,
@@ -417,6 +418,21 @@ async function executeForegroundEnrollment(
 				authority.diagnostic ?? `Kernel authority state is ${authority.state}`,
 				"inspect authority state; do not retry enrollment",
 			);
+		// terminal_owner with a local run is this worktree's settled task and
+		// forbids re-enrollment. terminal_owner *without* one is historical audit
+		// evidence (a fresh clone, or another worktree's run reaching here through
+		// Git): evidence is not local authority, and this worktree may enroll the
+		// task for the first time. The Kernel's own precondition check enforces
+		// the same rule against the local run.
+		if (authority.state === "terminal_owner" && authority.owner_run_id !== null)
+			return terminal(
+				action,
+				taskId,
+				"authority_conflict",
+				stage,
+				`task ${taskId} is terminal in this worktree`,
+				"inspect authority state; do not retry enrollment",
+			);
 		const preparation = await preparePiCanary(root, { task_id: taskId, now });
 		signal.throwIfAborted();
 		if (!preparation.intent)
@@ -523,7 +539,7 @@ async function executeForegroundEnrollment(
 			intent_revision: preparation.intent.revision,
 			intent_content_hash: preparation.intent.content_hash,
 			preparation_digest: preparation.digest,
-			actor_id: "user",
+			actor_id: LITERAL_USER_ACTOR_ID,
 			confirmation_ref: `pi-confirm-${createHash("sha256").update(`${taskId}\0${now}\0${nonce}`).digest("hex").slice(0, 16)}`,
 			expires_at: new Date(Date.now() + 10 * 60 * 1000).toISOString(),
 			nonce,

package/plugins/immune-brain/.pi-extension/imm-canary-work.ts

@@ -23,11 +23,6 @@ import { Type } from "typebox";
 import { PLUGIN_VERSION } from "../runtime/plugin_version";
 import {
 	parseVerificationDescriptor,
-	canonicalDescriptorBytes,
-	resolveBunRunner,
-	assertRunnerCompatible,
-	findingsDigest,
-	type FrozenRunner,
 	type VerificationDescriptor,
 } from "./pi-canary-verification";
 import {
@@ -43,9 +38,9 @@ import {
 import type { InvocationToken } from "./pi-canary-invocations";
 import { runDeterministicQa } from "../runtime/assurance/qa";
 import {
-	reservedAgentParams,
-	type ReservedAgentParams,
-} from "./pi-canary-native-review";
+	captureStagedIntent,
+	restoreStagedIntent as restoreStagedIntentShared,
+} from "../runtime/staged_intent";
 import {
 	renderCanaryCall,
 	renderCanaryResult,
@@ -71,13 +66,13 @@ import {
 } from "./pi-canary-interaction";
 import { isToolFailureState, throwToolFailure, type ToolFailureV1 } from "./pi-canary-tool-failure";
 import { taskDiffIdentity, taskRevisionIdentity, captureGitTaskSnapshot } from "../runtime/workspace_scope";
-import { reviewReworkFindings } from "../runtime/assurance/coordinator";
+import { reviewAdvisoryRecords, reviewReworkFindings } from "../runtime/assurance/coordinator";
 import {
 	AssuranceProgression,
 	buildReviewPrompt,
 	classifyReviewWorkload,
 	deriveQaJobTimeoutMs,
-	deriveGithubTerminalProjectionInput,
+	projectTerminalTrackerState,
 	parseAssuranceVerdict,
 	snapshotDigest,
 	QA_JOB_TIMEOUT_SECONDS,
@@ -85,12 +80,9 @@ import {
 	REVIEW_PREPARATION_TIMEOUT_MS,
 	REVIEW_TIMING_PROFILES,
 	REVIEW_VERDICT_VALIDATION_TIMEOUT_MS,
-	type AssuranceAdvanceResult,
 	type AssuranceProgressionPorts,
-	type AssuranceSubmitReviewResult,
 	type AssuranceVerdict,
 	type HostContext,
-	type QaVerificationProgress,
 	type SnapshotDescriptor,
 } from "./pi-canary-assurance-progression";
 
@@ -109,27 +101,25 @@ import {
 	reconcileKernelAuthority,
 	repairKernelAuthority,
 	readTaskRecord,
-	withKernelStoreLock,
+	withKernelStoreLockForTask,
 	inspectStorageLayout,
 	migrateLegacyLayout,
 	readTaskIntent,
 	parseTaskIntentV1,
 	canonicalIntentHash,
 	projectAssurance,
-	deriveAssuranceAuthorization,
 	findingsDigestV2,
 	capabilityActionFor,
 	digestOfAction,
-	type AssuranceAuthorizationReadiness,
 	type AssuranceProjectionResult,
 	type TaskRecordRead,
 	type CanaryApplication,
 	type MutationAuthorityRegistry,
 	type CapabilityBindingV2,
+	LITERAL_USER_ACTOR_ID,
 } from "./runtime-stub";
 import { invocationRegistry } from "./pi-canary-assurance-progression";
 
-const TASK_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 const LOOP_OWNERS = ["plan", "kernel", "brainstorm", "planner", "loop"] as const;
 const LOOP_TARGETS = [
 	"step",
@@ -186,6 +176,7 @@ export interface SnapshotDescriptorInput {
 	root: string;
 	task_id: string;
 	role: AssuranceRole;
+	run_id?: string | null;
 	record_revision: string;
 	workspace_revision: string;
 	intent_revision: number;
@@ -214,6 +205,7 @@ export function buildSnapshot(input: SnapshotDescriptorInput): SnapshotDescripto
 	return {
 		contract: "assurance_kernel/assurance_snapshot/v2",
 		task_id: input.task_id,
+		run_id: input.run_id ?? null,
 		role: input.role,
 		record_revision: input.record_revision,
 		workspace_revision: input.workspace_revision,
@@ -282,12 +274,11 @@ export function createPiAssuranceProgressionPorts(
 		projectTask: (root, taskId) => projectAssuranceState(root, taskId),
 		readTaskRecord: (root, taskId) => readTaskRecord(root, taskId),
 		readTaskIntent: (root, taskId) => readTaskIntent(root, taskId),
-		frozenRunner: () => frozenRunner(),
-		buildAssurance: (root, taskId, role, projection, runner) =>
-			(dependencies.buildAssurance ?? buildAssuranceSnapshot)(root, taskId, role, projection, runner),
+		buildAssurance: (root, taskId, role, projection) =>
+			(dependencies.buildAssurance ?? buildAssuranceSnapshot)(root, taskId, role, projection),
 		ensureReviewRevision: (root, taskId, projection) => ensureTaskReviewRevision(root, taskId, projection),
-		runQa: (snapshot, descriptors, runner, options) =>
-			(dependencies.runQa ?? runDeterministicQa)(snapshot, descriptors, runner, options),
+		runQa: (snapshot, descriptors, options) =>
+			(dependencies.runQa ?? runDeterministicQa)(snapshot, descriptors, options),
 		writeReviewEvidence: (input) =>
 			(dependencies.writeReviewEvidence ?? writeNativeReviewEvidence)(input),
 		applyVerdict: (ctx, input) =>
@@ -491,7 +482,9 @@ export default function (
 				if (ctx.mode !== "tui")
 					return failCanaryTool(taskId, action.op, "blocked", "tui_required", "Kernel mutation is TUI-only", "invoke the TUI Tool");
 				try {
-					await withKernelStoreLock(ctx.cwd, () => undefined);
+					// Recovery also retires a leftover derived claim/owner file whose
+					// task the store already holds: that file is inert, not authority.
+					await withKernelStoreLockForTask(ctx.cwd, taskId, () => undefined);
 				} catch (error) {
 					return failCanaryTool(taskId, action.op, "blocked", "layout_recovery_failed", `Kernel transaction recovery failed: ${error instanceof Error ? error.message : String(error)}`, "resolve the pending marker and retry");
 				}
@@ -510,6 +503,25 @@ export default function (
 			if (action.op === "repair_authority_state") {
 				if (ctx.mode !== "tui") return failCanaryTool(taskId, action.op, "blocked", "tui_required", "imm_kernel_canary mutation is TUI-only", "invoke the TUI Tool");
 				const authority = await reconcileKernelAuthority(ctx.cwd, taskId);
+				if (authority.state === "terminal_owner" || authority.state === "unowned") {
+					// Repair is unrepresentable-by-construction removal: a leftover
+					// retired claim file is inert, and the store already holds the
+					// settled answer. Report the authority and write nothing.
+					try {
+						const repaired = await repairKernelAuthority(ctx.cwd, taskId, authority.revision);
+						const result = {
+							state: "recovered_retry",
+							operation: action.op,
+							authority: repaired,
+							result: `No stale authority claim exists for ${taskId}; the store owns authority`,
+							next_action: "retry the blocked managed request once",
+						};
+						return toolResult(JSON.stringify(result, null, 2), result);
+					} catch (error) {
+						const message = error instanceof Error ? error.message : String(error);
+						return failCanaryTool(taskId, action.op, "blocked", "authority_repair_failed", message, "inspect the kernel store authority state and retry");
+					}
+				}
 				if (
 					authority.state !== "repairable_stale_claim" ||
 					authority.owner_task_id !== taskId
@@ -762,38 +774,11 @@ export default function (
 		const priorIntent = await readTaskIntent(ctx.cwd, taskId);
 		const sidecar = nextIntent ? join(ctx.cwd, priorIntent.intent_ref.path) : undefined;
 		const priorBytes = sidecar ? readFileSync(sidecar) : undefined;
-		const priorIndexState = sidecar
-			? execFileSync("git", ["ls-files", "--stage", "-z", "--", priorIntent.intent_ref.path], {
-					cwd: ctx.cwd,
-					stdio: ["ignore", "pipe", "pipe"],
-				})
-			: undefined;
+		const stagedSnapshot = sidecar ? captureStagedIntent(ctx.cwd, priorIntent.intent_ref.path) : undefined;
 		let stagedNextDiffHash: string | undefined;
 		const restoreStagedIntent = (): void => {
-			if (!sidecar || !priorBytes || !priorIndexState) return;
-			writeFileSync(sidecar, priorBytes);
-			execFileSync("git", ["update-index", "--force-remove", "--", priorIntent.intent_ref.path], {
-				cwd: ctx.cwd,
-				stdio: ["ignore", "pipe", "pipe"],
-			});
-			if (priorIndexState.length > 0) {
-				execFileSync("git", ["update-index", "-z", "--index-info"], {
-					cwd: ctx.cwd,
-					input: priorIndexState,
-					stdio: ["pipe", "ignore", "pipe"],
-				});
-			}
-			const restoredBytes = readFileSync(sidecar);
-			if (!restoredBytes.equals(priorBytes)) {
-				throw new Error("failed to restore prior intent bytes");
-			}
-			const restoredIndex = execFileSync("git", ["ls-files", "--stage", "-z", "--", priorIntent.intent_ref.path], {
-				cwd: ctx.cwd,
-				stdio: ["ignore", "pipe", "pipe"],
-			});
-			if (!restoredIndex.equals(priorIndexState)) {
-				throw new Error("failed to restore prior intent git index entry");
-			}
+			if (!stagedSnapshot) return;
+			restoreStagedIntentShared(ctx.cwd, stagedSnapshot);
 		};
 		if (nextIntent) {
 			try {
@@ -992,12 +977,13 @@ export default function (
 					const capability = await mintCapability(registry, {
 						authority_kind: "user",
 						task_id: taskId,
+						run_id: projection.projection.run_id,
 						action_kind: exactOperation.op,
 						expected_record_hash: projection.projection.record_revision,
 						intent_revision: nextIntent?.revision ?? projection.projection.intent_revision,
 						intent_content_hash: nextIntentHash ?? projection.projection.intent_content_hash,
 						diff_hash: operationDiffHash,
-						actor_id: "literal-user",
+						actor_id: LITERAL_USER_ACTOR_ID,
 						...(exactOperation.op === "approve_breaking_intent_revision"
 							? { next_intent: exactOperation.next_intent, next_intent_ref: exactOperation.next_intent_ref }
 							: {}),
@@ -1010,7 +996,7 @@ export default function (
 					const result = (await app.execute({
 						root: ctx.cwd,
 						task_id: taskId,
-						operation: { ...exactOperation, capability, actor_id: "literal-user" } as never,
+						operation: { ...exactOperation, capability, actor_id: LITERAL_USER_ACTOR_ID } as never,
 						prior_intent_token: priorIntent.token,
 						diffProvider: (root: string, record: NonNullable<TaskRecordRead["record"]>) => diffSnapshotOf(root, record),
 						now,
@@ -1023,7 +1009,7 @@ export default function (
 					) stagePlanningArtifactTransition(ctx.cwd, result.record);
 					return { state: "applied", operation, lifecycle: result.record.lifecycle };
 			} catch (error) {
-				if (sidecar && priorBytes && priorIndexState) {
+				if (stagedSnapshot) {
 					const current = await readTaskRecord(ctx.cwd, taskId);
 					if (current.record?.intent_snapshot.revision === priorIntent.intent.revision) restoreStagedIntent();
 				}
@@ -1069,19 +1055,14 @@ export default function (
 // Helpers (module scope; no workflow state)
 // ---------------------------------------------------------------------------
 
-export type DerivedAuthorizationOperation =
-	| "resolve-user-decision"
-	| "authorize-rework";
+// The derivation is shared with the Claude adapter so it cannot drift between
+// Hosts; this module re-exports it for its existing callers and tests.
+import {
+	deriveAuthorizationOperation,
+	type DerivedAuthorizationOperation,
+} from "../runtime/authorization_operation";
 
-// Kernel projection is the sole source of authorization readiness.
-export function deriveAuthorizationOperation(input: {
-	readiness: AssuranceAuthorizationReadiness;
-}): { operation: DerivedAuthorizationOperation } | { blocked: string } {
-	if (input.readiness.state === "resolve_user_decision") return { operation: "resolve-user-decision" };
-	if (input.readiness.state === "authorize_rework") return { operation: "authorize-rework" };
-	if (input.readiness.blocked) return { blocked: input.readiness.blocked };
-	return { blocked: "no unique host-derived authorization operation" };
-}
+export { deriveAuthorizationOperation, type DerivedAuthorizationOperation };
 
 /**
  * Ordinary Kernel operation mapping, exported so the conformance suite can
@@ -1142,7 +1123,7 @@ export async function recordCancelledUserDecision(
 				acceptance_id: null,
 				summary: `${operation} confirmation cancelled by literal user; snapshot ${snapshotDigestRef}`,
 			},
-			actor_id: "literal-user",
+			actor_id: LITERAL_USER_ACTOR_ID,
 		} as never,
 		prior_intent_token: (await readTaskIntent(ctx.cwd, taskId)).token,
 		diffProvider: (root: string, record: NonNullable<TaskRecordRead["record"]>) => diffSnapshotOf(root, record),
@@ -1178,9 +1159,9 @@ function diffSnapshotOf(root: string, record: NonNullable<TaskRecordRead["record
 	if (record.contract === "assurance_kernel/task_record/v4") {
 		if (!record.git_base_head)
 			throw new Error("TaskRecord v4 is missing git_base_head");
-		return taskRevisionIdentity(root, record.intent_snapshot.scope_hint, record.git_base_head);
+		return taskRevisionIdentity(root, record.intent_snapshot.scope_hint, record.git_base_head, record.task_id);
 	}
-	return taskDiffIdentity(root, record.intent_snapshot.scope_hint);
+	return taskDiffIdentity(root, record.intent_snapshot.scope_hint, record.task_id);
 }
 
 function diffHashOf(root: string, record: NonNullable<TaskRecordRead["record"]>): string {
@@ -1402,6 +1383,7 @@ async function applyAssuranceVerdict(
 		const capability = await mintCapability(registry, {
 			authority_kind: authorityKind,
 			task_id: snapshot.task_id,
+			run_id: snapshot.run_id,
 			action_kind: "request_rework",
 			expected_record_hash: snapshot.record_revision,
 			intent_revision: snapshot.intent_revision,
@@ -1438,6 +1420,7 @@ async function applyAssuranceVerdict(
 		return;
 	}
 	const now = new Date().toISOString();
+	const advisories = verdict.decision === "pass" ? reviewAdvisoryRecords(verdict) : [];
 	const approval = {
 		id: `approval-${snapshot.role}-${randomUUID().slice(0, 8)}`,
 		kind: snapshot.role === "qa" ? "qa" : "review",
@@ -1452,10 +1435,14 @@ async function applyAssuranceVerdict(
 		...(snapshot.role === "review" && snapshot.review_revision
 			? { review_revision: snapshot.review_revision }
 			: {}),
+		...(snapshot.role === "review" && advisories.length > 0
+			? { advisory_findings: advisories }
+			: {}),
 	};
 	const capability = await mintCapability(registry, {
 		authority_kind: snapshot.role,
 		task_id: snapshot.task_id,
+		run_id: snapshot.run_id,
 		action_kind: "record_approval",
 		expected_record_hash: snapshot.record_revision,
 		intent_revision: snapshot.intent_revision,
@@ -1481,7 +1468,6 @@ async function buildAssuranceSnapshot(
 	taskId: string,
 	role: AssuranceRole,
 	projection: AssuranceProjectionResult,
-	runner: FrozenRunner,
 ): Promise<{
 	snapshot: SnapshotDescriptor;
 	descriptors: Map<string, VerificationDescriptor>;
@@ -1500,12 +1486,9 @@ async function buildAssuranceSnapshot(
 	const intent = record.record.intent_snapshot;
 	const acceptance = intent.acceptance;
 	const descriptors = new Map<string, VerificationDescriptor>();
-		// Every verification string must parse as strict canonical JSON
-		// verification_descriptor/v1 and claim the frozen runner version;
-		// a free-form or version-mismatched string is ineligible.
-	for (const item of acceptance) {
+	// Review resumes from settled outcomes without resolving verification tools.
+	for (const item of role === "qa" ? acceptance : []) {
 		const descriptor = parseVerificationDescriptor(item.verification);
-		assertRunnerCompatible(descriptor, runner);
 		descriptors.set(item.id, descriptor);
 	}
 	// `git_base_head` is optional on the read shape because v3 records carry
@@ -1561,6 +1544,7 @@ async function buildAssuranceSnapshot(
 				root,
 				task_id: taskId,
 				role,
+				run_id: projection.projection.run_id,
 				record_revision: projection.projection.record_revision,
 				workspace_revision: projection.projection.workspace_revision,
 				intent_revision: projection.projection.intent_revision,
@@ -1602,12 +1586,6 @@ function qaOutcomes(
 	);
 }
 
-let frozenRunnerValue: FrozenRunner | undefined;
-async function frozenRunner(): Promise<FrozenRunner> {
-	frozenRunnerValue ??= resolveBunRunner();
-	return frozenRunnerValue;
-}
-
 // The invocation registry is shared with the progression module's
 // module-scoped registry (see the top-level import above); commit/cancel
 // semantics are identical to the previous extension implementation.
@@ -1617,6 +1595,7 @@ async function mintCapability(
 	input: {
 		authority_kind: "review" | "qa" | "user";
 		task_id: string;
+		run_id: string | null;
 		action_kind: string;
 		expected_record_hash: string;
 		intent_revision: number;
@@ -1654,6 +1633,7 @@ async function mintCapability(
 	const binding: CapabilityBindingV2 = {
 		authority_kind: input.authority_kind,
 		task_id: input.task_id,
+		...(input.run_id ? { run_id: input.run_id } : {}),
 		action_digest: digest,
 		expected_record_hash: input.expected_record_hash,
 		intent_revision: input.intent_revision,
@@ -1698,13 +1678,8 @@ async function executeOrdinaryOperation(
 	// A content-changing revision writes the sidecar before the kernel's drift
 	// check runs; an unstaged write is itself scoped drift and deadlocks the
 	// revision. Mirror the breaking-revision path: stage the written sidecar
-	// (worktree == index) and restore the exact prior index entry on failure.
-	const priorIndexState = priorBytes !== null
-		? execFileSync("git", ["ls-files", "--stage", "-z", "--", priorIntent.intent_ref.path], {
-			cwd: ctx.cwd,
-			stdio: ["ignore", "pipe", "pipe"],
-		})
-		: null;
+	// (worktree == index) and restore the exact prior state on failure.
+	const priorStaged = priorBytes !== null ? captureStagedIntent(ctx.cwd, priorIntent.intent_ref.path) : null;
 	try {
 		if (priorBytes) {
 			writeFileSync(sidecar, `${JSON.stringify(operation.next_intent, null, 2)}\n`);
@@ -1730,19 +1705,8 @@ async function executeOrdinaryOperation(
 	} catch (error) {
 		if (priorBytes) {
 			const current = await readTaskRecord(ctx.cwd, input.taskId);
-			if (current.record?.intent_snapshot.revision === priorIntent.intent.revision) {
-				writeFileSync(sidecar, priorBytes);
-				execFileSync("git", ["update-index", "--force-remove", "--", priorIntent.intent_ref.path], {
-					cwd: ctx.cwd,
-					stdio: ["ignore", "pipe", "pipe"],
-				});
-				if (priorIndexState && priorIndexState.length > 0) {
-					execFileSync("git", ["update-index", "-z", "--index-info"], {
-						cwd: ctx.cwd,
-						input: priorIndexState,
-						stdio: ["pipe", "ignore", "pipe"],
-					});
-				}
+			if (current.record?.intent_snapshot.revision === priorIntent.intent.revision && priorStaged) {
+				restoreStagedIntentShared(ctx.cwd, priorStaged);
 			}
 		}
 		throw error;
@@ -1774,24 +1738,15 @@ async function enrichAssuranceResult(
 		: projection.projection;
 	let tracker: Awaited<ReturnType<typeof markGithubTaskTerminal>> | undefined;
 	await reconcileRefsQuietly(ctx.cwd);
-	if (!projection.error) {
-		try {
-			const terminalInput = deriveGithubTerminalProjectionInput(
-				taskId,
-				projection,
-				await readTaskTombstone(ctx.cwd, taskId),
-			);
-			if (terminalInput) tracker = await markGithubTaskTerminal(ctx.cwd, terminalInput);
-		} catch {
-			tracker = {
-				contract: "immune_brain/github_issue_tracker_result/v1",
-				operation: "mark-terminal",
-				status: "retryable_failure",
-				association_found: false,
-				message: "tracker observation failed after authoritative settlement",
-			};
-		}
-	}
+	// One shared projection: the Claude Host runs the same step, so the opted-in
+	// terminal tracker outcome does not depend on which Host settled the task.
+	tracker = await projectTerminalTrackerState({
+		root: ctx.cwd,
+		task_id: taskId,
+		projection,
+		tombstone: await readTaskTombstone(ctx.cwd, taskId),
+		markTerminal: (root, input) => markGithubTaskTerminal(root, input),
+	});
 	return {
 		...result,
 		task_state: taskState,