immune-brain 3.6.9 → 4.0.0

package/plugins/immune-brain/runtime/workspace_scope.ts

@@ -3,11 +3,13 @@ import { createHash } from "node:crypto";
 import {
 	existsSync,
 	lstatSync,
+	mkdirSync,
 	readFileSync,
 	readlinkSync,
 	realpathSync,
+	writeFileSync,
 } from "node:fs";
-import { resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 
 export interface GitWorkspaceSnapshot {
 	kind: "git-workspace-v1";
@@ -34,6 +36,75 @@ function comparePaths(left: string, right: string): number {
 	return 0;
 }
 
+function isDeliveryAttachment(path: string): boolean {
+	return path === ".imm/audit" || path.startsWith(".imm/audit/");
+}
+
+function isNonDeliveryPath(path: string): boolean {
+	return isDeliveryAttachment(path) || isRuntimeAuthorityPath(path);
+}
+
+function isOwnPlanningSidecar(path: string, taskId?: string): boolean {
+	return Boolean(taskId) && (path === `docs/plans/${taskId}.intent.json` || path === `docs/plans/archive/${taskId}.intent.json`);
+}
+
+function isOtherTaskSidecar(path: string, taskId?: string): boolean {
+	return /^docs\/plans\/(?:archive\/)?[^/]+\.intent\.json$/.test(path) && !isOwnPlanningSidecar(path, taskId);
+}
+
+function isPlanningNoise(path: string, taskId?: string): boolean {
+	return path.startsWith("docs/plans/") && !isOtherTaskSidecar(path, taskId) && !isOwnPlanningSidecar(path, taskId);
+}
+
+function enrollmentBaselinePath(root: string): string {
+	return join(root, ".imm/state/enrollment-baseline.json");
+}
+
+export function writeEnrollmentBaseline(root: string): void {
+	const snapshot = captureGitWorkspaceSnapshot(root);
+	if (!snapshot) return;
+	const path = enrollmentBaselinePath(root);
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, `${JSON.stringify(snapshot)}\n`);
+}
+
+function readEnrollmentBaseline(root: string): GitWorkspaceSnapshot | null {
+	const baselinePath = enrollmentBaselinePath(root);
+	if (!existsSync(baselinePath)) return null;
+	try {
+		const baseline = JSON.parse(readFileSync(baselinePath, "utf8")) as GitWorkspaceSnapshot;
+		return isGitWorkspaceSnapshot(baseline) ? baseline : null;
+	} catch {
+		throw new Error("enrollment baseline is unreadable");
+	}
+}
+
+function assertNoEnvelopeEscape(
+	root: string,
+	stagedPaths: readonly string[],
+	scope: string[],
+	taskId?: string,
+): void {
+	const baseline = readEnrollmentBaseline(root);
+	const current = baseline ? captureGitWorkspaceSnapshot(root) : null;
+	if (baseline && !current) throw new Error("enrollment baseline cannot be compared because Git is unavailable");
+	const escaped = [...new Set(stagedPaths)]
+		.filter((path) => !isNonDeliveryPath(path) && !isOwnPlanningSidecar(path, taskId) && !isPlanningNoise(path, taskId) && !taskPathMatchesScope(path, scope))
+		.filter((path) => !baseline || baseline.dirty_files[path] !== current?.dirty_files[path])
+		.sort(comparePaths);
+	if (escaped.length > 0)
+		throw new Error(`task delivery contains paths outside the authorization envelope: ${escaped.join(", ")}`);
+	if (!baseline || !current) return;
+	const staged = new Set(stagedPaths);
+	const mixed = [...new Set([...Object.keys(baseline.dirty_files), ...Object.keys(current.dirty_files)])]
+		.filter((path) => !isNonDeliveryPath(path) && !isOwnPlanningSidecar(path, taskId) && !isPlanningNoise(path, taskId) && !taskPathMatchesScope(path, scope))
+		.filter((path) => !isOtherTaskSidecar(path, taskId) || staged.has(path))
+		.filter((path) => baseline.dirty_files[path] !== current.dirty_files[path])
+		.sort(comparePaths);
+	if (mixed.length > 0)
+		throw new Error(`task delivery contains paths outside the authorization envelope: ${mixed.join(", ")}`);
+}
+
 function isRuntimeAuthorityPath(path: string): boolean {
 	return (
 		// Kernel v2 task state, workspace coordination, and authority journals are
@@ -315,7 +386,7 @@ function taskPathMatchesScope(path: string, scope: string[]): boolean {
 	return scope.some((scopePath) => pathMatchesScope(path, scopePath));
 }
 
-function taskSnapshotOnce(root: string, scope: string[]): GitTaskSnapshot {
+function taskSnapshotOnce(root: string, scope: string[], taskId?: string): GitTaskSnapshot {
 	const repositoryRoot = git(root, ["rev-parse", "--show-toplevel"])?.trim();
 	const head = git(root, ["rev-parse", "--verify", "HEAD^{commit}"])?.trim();
 	if (!repositoryRoot || !head || !GIT_OBJECT_ID.test(head))
@@ -343,14 +414,18 @@ function taskSnapshotOnce(root: string, scope: string[]): GitTaskSnapshot {
 		"untracked task paths",
 	);
 	assertNoCaseFoldCollisions([...stagedPaths, ...unstagedPaths, ...untrackedPaths], "Git task paths");
+	assertNoEnvelopeEscape(root, stagedPaths, scope, taskId);
 	const uncommittedInScope = [...new Set([...unstagedPaths, ...untrackedPaths])]
 		.filter((path) => taskPathMatchesScope(path, scope))
 		.sort(comparePaths);
 	if (uncommittedInScope.length > 0)
 		throw new Error(`task scope contains unstaged or untracked changes: ${uncommittedInScope.join(", ")}`);
 
+	const baseline = readEnrollmentBaseline(root);
+	const current = baseline ? captureGitWorkspaceSnapshot(root) : null;
 	const taskPaths = [...new Set(stagedPaths)]
-		.filter((path) => taskPathMatchesScope(path, scope))
+		.filter((path) => !isNonDeliveryPath(path) && taskPathMatchesScope(path, scope))
+		.filter((path) => !(baseline && current && baseline.dirty_files[path] === current.dirty_files[path] && baseline.dirty_files[path] !== undefined))
 		.sort(comparePaths);
 	const stagedFiles: Record<string, GitTaskIndexEntry> = {};
 	for (const path of taskPaths) {
@@ -377,6 +452,7 @@ function taskSnapshotOnce(root: string, scope: string[]): GitTaskSnapshot {
 export function captureGitTaskSnapshot(
 	projectRoot: string,
 	scopeHint: unknown,
+	taskId?: string,
 ): GitTaskSnapshot {
 	const requestedRoot = resolve(projectRoot);
 	const requestedStat = lstatSync(requestedRoot);
@@ -384,9 +460,9 @@ export function captureGitTaskSnapshot(
 		throw new Error("task snapshot root must be a real directory");
 	const root = realpathSync(requestedRoot);
 	const scope = assertCanonicalTaskScope(scopeHint);
-	const before = taskSnapshotOnce(root, scope);
+	const before = taskSnapshotOnce(root, scope, taskId);
 	gitTaskSnapshotTestHook?.();
-	const after = taskSnapshotOnce(root, scope);
+	const after = taskSnapshotOnce(root, scope, taskId);
 	if (JSON.stringify(after) !== JSON.stringify(before))
 		throw new Error("Git task snapshot changed while being captured");
 	return before;
@@ -404,16 +480,17 @@ function hashTaskSnapshot(snapshot: object): string {
 export function taskDiffIdentity(
 	projectRoot: string,
 	scopeHint: unknown,
+	taskId?: string,
 ): GitTaskDiffIdentity {
-	const snapshot = captureGitTaskSnapshot(projectRoot, scopeHint);
+	const snapshot = captureGitTaskSnapshot(projectRoot, scopeHint, taskId);
 	return {
 		diff_hash: hashTaskSnapshot(snapshot),
 		changed_paths: Object.keys(snapshot.staged_files).sort(comparePaths),
 	};
 }
 
-export function taskDiffHash(projectRoot: string, scopeHint: unknown): string {
-	return taskDiffIdentity(projectRoot, scopeHint).diff_hash;
+export function taskDiffHash(projectRoot: string, scopeHint: unknown, taskId?: string): string {
+	return taskDiffIdentity(projectRoot, scopeHint, taskId).diff_hash;
 }
 
 function gitRequired(root: string, args: string[], failure: string): string {
@@ -441,6 +518,7 @@ function taskRevisionSnapshotOnce(
 	root: string,
 	scope: string[],
 	baseHead: string,
+	taskId?: string,
 ): GitTaskRevisionSnapshot {
 	const repositoryRoot = git(root, ["rev-parse", "--show-toplevel"])?.trim();
 	const head = git(root, ["rev-parse", "--verify", "HEAD^{commit}"])?.trim();
@@ -476,7 +554,11 @@ function taskRevisionSnapshotOnce(
 		gitBytes(root, ["ls-files", "--others", "--exclude-standard", "-z", "--"]),
 		"untracked task revision paths",
 	);
-	const scopedStagedPaths = stagedPaths.filter((path) => taskPathMatchesScope(path, scope));
+	assertNoEnvelopeEscape(root, stagedPaths, scope, taskId);
+	const baseline = readEnrollmentBaseline(root);
+	const current = baseline ? captureGitWorkspaceSnapshot(root) : null;
+	const scopedStagedPaths = stagedPaths.filter((path) => !isNonDeliveryPath(path) && taskPathMatchesScope(path, scope))
+		.filter((path) => !(baseline && current && baseline.dirty_files[path] === current.dirty_files[path] && baseline.dirty_files[path] !== undefined));
 	const scopedUnstagedPaths = unstagedPaths.filter((path) => taskPathMatchesScope(path, scope));
 	const scopedUntrackedPaths = untrackedPaths.filter((path) => taskPathMatchesScope(path, scope));
 	assertNoCaseFoldCollisions(
@@ -517,6 +599,7 @@ export function captureGitTaskRevisionSnapshot(
 	projectRoot: string,
 	scopeHint: unknown,
 	baseHead: unknown,
+	taskId?: string,
 ): GitTaskRevisionSnapshot {
 	const requestedRoot = resolve(projectRoot);
 	const requestedStat = lstatSync(requestedRoot);
@@ -527,9 +610,9 @@ export function captureGitTaskRevisionSnapshot(
 		throw new Error("task revision base must be a Git commit id");
 	const scope = assertCanonicalTaskScope(scopeHint);
 	const normalizedBase = baseHead.toLowerCase();
-	const before = taskRevisionSnapshotOnce(root, scope, normalizedBase);
+	const before = taskRevisionSnapshotOnce(root, scope, normalizedBase, taskId);
 	gitTaskSnapshotTestHook?.();
-	const after = taskRevisionSnapshotOnce(root, scope, normalizedBase);
+	const after = taskRevisionSnapshotOnce(root, scope, normalizedBase, taskId);
 	if (JSON.stringify(after) !== JSON.stringify(before))
 		throw new Error("Git task revision changed while being captured");
 	return before;
@@ -539,8 +622,9 @@ export function taskRevisionIdentity(
 	projectRoot: string,
 	scopeHint: unknown,
 	baseHead: string,
+	taskId?: string,
 ): GitTaskDiffIdentity {
-	const snapshot = captureGitTaskRevisionSnapshot(projectRoot, scopeHint, baseHead);
+	const snapshot = captureGitTaskRevisionSnapshot(projectRoot, scopeHint, baseHead, taskId);
 	return {
 		diff_hash: hashTaskSnapshot(snapshot),
 		changed_paths: Object.keys(snapshot.changed_paths).sort(comparePaths),
@@ -552,8 +636,9 @@ export function taskRevisionDiffHash(
 	projectRoot: string,
 	scopeHint: unknown,
 	baseHead: string,
+	taskId?: string,
 ): string {
-	return taskRevisionIdentity(projectRoot, scopeHint, baseHead).diff_hash;
+	return taskRevisionIdentity(projectRoot, scopeHint, baseHead, taskId).diff_hash;
 }
 
 function isGitWorkspaceSnapshot(value: unknown): value is GitWorkspaceSnapshot {

package/plugins/immune-brain/skills/imm-planner/SKILL.md

@@ -9,8 +9,8 @@ Use [`../../dist/imm-planner.md`](../../dist/imm-planner.md) as the canonical co
 index, not a whole-document read. Explicit entry only: ordinary host requests stay
 host-native.
 
-Mandatory constraints before any action: Planner writes candidate Specs and
-TaskIntents only; it never implements, overwrites an enrolled TaskIntent, or
+Mandatory constraints before any action: Planner writes a TaskIntent, and a Spec
+only for complex work; it never implements, overwrites an enrolled TaskIntent, or
 grants execution authority — only the native Enrollment gate can.
 
 Section routes - load a section's instructions only when its branch applies.
@@ -35,7 +35,7 @@ own routes instead of these stages.
 - retirement design: [Retirement Completion Contract](../../dist/imm-planner.md#retirement-completion-contract)
 - optional research dispatch: [Research Dispatch](../../dist/imm-planner.md#research-dispatch)
 
-Plan-only requests stop after candidate Spec/TaskIntent validation. Requests
+Plan-only requests stop after candidate TaskIntent validation, plus Spec validation when the work is complex. Requests
 that include execution invoke the current Host's native Enrollment gate
 directly, without chat pre-confirmation. Native-gate failure stays fail-closed
 in that Host: report its reason and one retry action only; never suggest

package/plugins/immune-brain/bin/imm-retire-stale-wrapper

@@ -1,4 +0,0 @@
-#!/bin/sh
-set -eu
-PLUGIN_ROOT=$(cd "$(dirname "$0")/.." && pwd -P)
-exec bun "$PLUGIN_ROOT/runtime/v4_runtime.ts" cli imm-retire-stale-wrapper "$@"

package/plugins/immune-brain/bin/imm-retired

@@ -1,4 +0,0 @@
-#!/bin/sh
-set -eu
-PLUGIN_ROOT=$(cd "$(dirname "$0")/.." && pwd -P)
-exec bun "$PLUGIN_ROOT/runtime/v4_runtime.ts" cli imm-work "$@"