immune-brain 3.6.9 → 4.0.1

package/plugins/immune-brain/.pi-extension/pi-canary-assurance-progression.ts

@@ -8,6 +8,7 @@
 export {
 	AssuranceCoordinator,
 	deriveGithubTerminalProjectionInput,
+	projectTerminalTrackerState,
 	deriveQaJobTimeoutMs,
 	classifyReviewWorkload,
 	reviewTurnBudget,

package/plugins/immune-brain/.pi-extension/pi-canary-verification.ts

@@ -7,10 +7,10 @@ export {
 	type VerificationDescriptor,
 } from "../runtime/verification_descriptor";
 export {
-	resolveBunRunner,
-	assertRunnerCompatible,
+	resolveVerificationCommand,
+	assertCommandIdentity,
 	runFixedVerification,
 	findingsDigest,
 	VerificationAbortedError,
-	type FrozenRunner,
+	type FrozenCommand,
 } from "../runtime/assurance/verification";

package/plugins/immune-brain/.pi-extension/runtime-stub.ts

@@ -6,6 +6,12 @@
 // carries no static runtime import, but a Kernel contract change now breaks
 // the extension's build instead of silently drifting from it.
 
+// --- Kernel constants the extension must carry as values ---
+// The literal-user authority identity. Mirrored here because extensions cannot
+// statically import Kernel modules; tests/dual-host-assurance-conformance.test.ts
+// pins this value to runtime/kernel/actor_identity.ts, so the two cannot drift.
+export const LITERAL_USER_ACTOR_ID = "literal-user";
+
 // --- Types (structural contracts, no runtime import) ---
 export interface EnrollmentCapabilityBinding {
 	task_id: string;
@@ -123,6 +129,7 @@ export interface KernelAuthorityProjection {
 	requested_task_id: string;
 	state: "unowned" | "active_owner" | "terminal_owner" | "repairable_stale_claim" | "authority_conflict";
 	owner_task_id: string | null;
+	owner_run_id: string | null;
 	owner_lifecycle: string | null;
 	claim_lifecycle_status: "active" | "draining" | null;
 	diagnostic: string | null;
@@ -302,6 +309,14 @@ export async function withKernelStoreLock<T>(root: string, operation: () => T):
 	const mod = await import(/* @vite-ignore */ kernelPath("storage"));
 	return mod.withKernelStoreLock(root, operation);
 }
+export async function withKernelStoreLockForTask<T>(
+	root: string,
+	taskId: string,
+	operation: () => T,
+): Promise<T> {
+	const mod = await import(/* @vite-ignore */ kernelPath("storage"));
+	return mod.withKernelStoreLockForTask(root, taskId, operation);
+}
 export async function readBackendClaim(root: string): Promise<BackendClaim | null> {
 	const mod = await import(/* @vite-ignore */ kernelPath("backend_claim"));
 	return mod.readBackendClaim(root);
@@ -553,51 +568,10 @@ export async function projectAssuranceForTask(root: string, taskId: string): Pro
 		if (record.contract === "assurance_kernel/task_record/v4") {
 			if (!record.git_base_head)
 				throw new Error("TaskRecord v4 is missing git_base_head");
-			return scopeMod.taskRevisionIdentity(r, record.intent_snapshot.scope_hint, record.git_base_head);
+			return scopeMod.taskRevisionIdentity(r, record.intent_snapshot.scope_hint, record.git_base_head, record.task_id);
 		}
-		return scopeMod.taskDiffIdentity(r, record.intent_snapshot.scope_hint);
+		return scopeMod.taskDiffIdentity(r, record.intent_snapshot.scope_hint, record.task_id);
 	};
 	return assuranceMod.projectAssurance(root, taskId, diffSnapshotOf);
 }
 
-export async function findExistingActiveBatch(root: string, initiativeSlug: string): Promise<any> {
-	const { join } = await import("node:path");
-	const { existsSync, readdirSync, readFileSync } = await import("node:fs");
-	const batchesDir = join(root, ".imm", "state", "batches");
-	if (!existsSync(batchesDir)) return null;
-	const files = readdirSync(batchesDir);
-	for (const file of files) {
-		if (!file.endsWith(".json")) continue;
-		let record: any;
-		try {
-			record = JSON.parse(readFileSync(join(batchesDir, file), "utf8"));
-		} catch {
-			// Unreadable Kernel batch state must fail closed: silently treating the
-			// initiative as batchless could authorize a parallel run.
-			return { corrupt: true, path: file };
-		}
-		if (record.contract === "assurance_kernel/batch_run_state/v1" && record.initiative_slug === initiativeSlug) {
-			const validStates = new Set([
-				"prepared",
-				"running",
-				"needs_human",
-				"completed",
-				"budget_stopped",
-				"failed",
-				"rejected",
-			]);
-			if (
-				typeof record.batch_id !== "string" ||
-				typeof record.base_head !== "string" ||
-				!Array.isArray(record.children) ||
-				!validStates.has(record.batch_state)
-			) {
-				return { corrupt: true, path: file };
-			}
-			return record;
-		}
-	}
-	return null;
-}
-
-