immune-brain 4.0.1 → 4.2.0

package/README.md

@@ -198,29 +198,55 @@ The three repair/maintenance skills are host-native: they never create a managed
 
 ## Lifecycle
 
+```mermaid
+flowchart TD
+    subgraph Planning ["1. Planning Phase"]
+        B["imm-brainstorm<br/>Clarify Requirements & Constraints"] --> P["imm-planner<br/>Author Spec & TaskIntent"]
+        P --> TI["TaskIntent (.intent.json)<br/>• goal / scope_hint<br/>• risk tier<br/>• acceptance descriptors"]
+    end
+
+    subgraph Enrollment ["2. Enrollment Gate"]
+        TI --> EG{"Native User Gate<br/>Host Modal Confirmation"}
+        EG -->|Confirm| KS[(".imm/state/kernel.sqlite<br/>Atomic TaskRecord<br/>Exclusive Workspace Claim")]
+    end
+
+    subgraph Loop ["3. Execution & Assurance Loop (imm-loop)"]
+        KS --> EX["Executor Role<br/>Edit code strictly inside scope_hint"]
+        EX --> FRZ["advance_assurance<br/>Artifacts frozen (active:frozen)"]
+        FRZ --> QA["Deterministic QA Engine<br/>Run acceptance verification commands<br/>Generate QA Attestation"]
+        
+        QA -->|Fail| RW1["Rework / Fix"]
+        RW1 --> EX
+        
+        QA -->|Pass| RK{"Risk Tier?"}
+        RK -->|routine| ST["Settlement"]
+        RK -->|material / critical| RV["Review Role<br/>Structured verdict (Pass / Rework)"]
+        
+        RV -->|Rework| RW2["Rework"]
+        RW2 --> EX
+        RV -->|Pass| ST
+    end
+
+    subgraph Settlement ["4. Settlement & Learnings"]
+        ST --> CLS["Atomic Closure<br/>• Lifecycle: done<br/>• Audit evidence in .imm/audit/<br/>• Release Workspace Claim"]
+        CLS -.-> CP["Compounder Role<br/>Extract Learnings to docs/solutions/"]
+    end
 ```
-Ordinary request: normal coding / Q&A (Host-native, zero overhead)
-                       │
-Explicit skill call (/imm-brainstorm or /imm-planner)
-                       │
-        ┌──────────────┴──────────────┐
-        ▼                             ▼
-  imm-brainstorm                 imm-planner
-(clarify requirements,         (author Spec + TaskIntent,
-  read-only framing)             define acceptance checks)
-        │                             │
-        └──────────────┬──────────────┘
-                       ▼
-            Native Host Confirmation
-        (Pi TUI dialog / Claude MCP elicitation)
-                       │
-                       ▼
-                    imm-loop
-        ├── Executor (edits strictly inside scope)
-        ├── Deterministic QA (runs all acceptance checks)
-        ├── Isolated Review (independent subagent audit)
-        └── Settled (.imm/audit/<task-id>/)
-```
+
+### Core Logic: Three Pillars
+
+1. **Two Paths**
+   - **Host-native Path**: Daily conversation, code inspections, and ad-hoc fixes stay 100% native with zero workflow overhead.
+   - **Managed Path**: Explicitly entered via `imm-brainstorm`, `imm-planner`, or `imm-loop`, strictly governed by the Assurance Kernel.
+
+2. **Authority & Contract**
+   - **TaskIntent (`.intent.json`)**: Machine-readable behavioral contract locking `scope_hint` (file boundaries), `risk` tier, and `acceptance` descriptors.
+   - **Native Gate (Enrollment)**: The single human-authority confirmation gate; Kernel atomically acquires exclusive workspace ownership (`.imm/state/kernel.sqlite` CAS) to prevent concurrency conflicts and scope drift.
+
+3. **Deterministic Assurance**
+   - **QA-First**: The Kernel directly runs verification commands and checks exit codes/byte bounds; never relies on conversational claims.
+   - **Risk-Tiered Gates**: `routine` tasks complete upon QA pass; `material` and `critical` tasks require an isolated Review subagent to issue a structured verdict.
+   - **Unattended Batch**: Serial execution driven by GitHub Issues and bound by `plan_digest`, where each child independently completes its own Enrollment → QA → Review → Commit cycle.
 
 Key invariants:
 

package/README.zh-CN.md

@@ -198,29 +198,55 @@ Executor、QA、Review、Compounder 等为 `imm-loop` 内部调度的角色，
 
 ## 生命周期
 
+```mermaid
+flowchart TD
+    subgraph Planning ["1. 规划阶段"]
+        B["imm-brainstorm<br/>需求澄清/约束"] --> P["imm-planner<br/>编写 Spec & TaskIntent"]
+        P --> TI["TaskIntent (.intent.json)<br/>• goal / scope_hint<br/>• risk tier<br/>• acceptance descriptors"]
+    end
+
+    subgraph Enrollment ["2. 准入登记"]
+        TI --> EG{"Native User Gate<br/>当前 Host 弹窗确认"}
+        EG -->|确认| KS[(".imm/state/kernel.sqlite<br/>原子生成 TaskRecord<br/>独占 Workspace Claim")]
+    end
+
+    subgraph Loop ["3. 执行与验证循环 (imm-loop)"]
+        KS --> EX["Executor 角色<br/>在 scope_hint 范围内修改代码"]
+        EX --> FRZ["advance_assurance<br/>制品冻结 (active:frozen)"]
+        FRZ --> QA["确定性 QA 引擎<br/>原子运行 acceptance 校验命令<br/>生成 QA Attestation"]
+        
+        QA -->|失败| RW1["Rework 返工修正"]
+        RW1 --> EX
+        
+        QA -->|通过| RK{"Risk 等级?"}
+        RK -->|routine| ST["Settlement 结算"]
+        RK -->|material / critical| RV["Review 审查角色<br/>结构化裁决 (Pass / Rework)"]
+        
+        RV -->|Rework| RW2["Rework 驳回"]
+        RW2 --> EX
+        RV -->|Pass| ST
+    end
+
+    subgraph Settlement ["4. 结算与沉淀"]
+        ST --> CLS["原子结项<br/>• Lifecycle: done<br/>• 写入审计日志 .imm/audit/<br/>• 释放 Workspace Claim"]
+        CLS -.-> CP["Compounder 角色<br/>提取经验至 docs/solutions/"]
+    end
 ```
-普通请求：日常编程 / 问答（Host-native，零流程开销）
-                       │
-显式调用 Skill（/imm-brainstorm 或 /imm-planner）
-                       │
-        ┌──────────────┴──────────────┐
-        ▼                             ▼
-  imm-brainstorm                 imm-planner
-（澄清需求、约束与风险，        （编写 Spec + TaskIntent，
-  只读输出 framing）             定义可自动化验证的验收条件）
-        │                             │
-        └──────────────┬──────────────┘
-                       ▼
-               当前 Host 原生确认
-        （Pi TUI 弹窗 / Claude MCP elicitation）
-                       │
-                       ▼
-                    imm-loop
-        ├── Executor（严格在 scope 内修改代码）
-        ├── 确定性 QA（前台逐项执行验收命令）
-        ├── 隔离式 Review（独立 subagent 审查代码）
-        └── 落盘结算（.imm/audit/<task-id>/）
-```
+
+### 核心逻辑三要素
+
+1. **双轨制 (Two Paths)**
+   - **Host-native Path**：日常对话、代码检视、单点修改，不触碰 Kernel 权限，零流程开销。
+   - **Managed Path**：由 `imm-brainstorm` / `imm-planner` / `imm-loop` 显式驱动，全程受 Kernel 约束。
+
+2. **权限与契约 (Authority & Contract)**
+   - **TaskIntent (`.intent.json`)**：机器契约本体，严格锁定 `scope_hint`（文件修改范围）、`risk`（风险层级）与 `acceptance`（确定性断言）。
+   - **Native Gate (Enrollment)**：唯一一次人工介入确认，Kernel 原子抢占工作区所有权（SQLite CAS），防止多任务并发冲突与范围漂移。
+
+3. **客观验证 (Deterministic Assurance)**
+   - **QA 优先**：由 Kernel 直接前台执行命令并校验退出码/输出，不依赖 LLM 口头汇报。
+   - **按险定级**：`routine` 仅需 QA；`material`/`critical` 必须追加独立只读 Reviewer 产出结构化裁决。
+   - **批处理 (Unattended Batch)**：基于 GitHub Issue / `plan_digest` 串行推进，每个子任务独立走完 Enrollment → QA → Review → Commit 闭环。
 
 核心不变量：
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "4.0.1",
+  "version": "4.2.0",
   "description": "Immune-Brain agent skill system",
   "publishConfig": {
     "access": "public",

package/plugins/immune-brain/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "4.0.1",
+  "version": "4.2.0",
   "description": "Immune-Brain Claude Code Host: native Enrollment, QA, Review, and Kernel settlement.",
   "author": {
     "name": "Immune-Brain Team"

package/plugins/immune-brain/.pi-extension/imm-canary-enroll.ts

@@ -37,6 +37,10 @@ import {
 	type UserAttentionReason,
 } from "./pi-canary-interaction";
 import { isToolFailureState, throwToolFailure } from "./pi-canary-tool-failure";
+import { resolveUxLanguage, uxText } from "./ux-language";
+
+/** Host-native UI language; see ux-language.ts. Resolved once per process. */
+const UX_LANG = resolveUxLanguage();
 
 const TASK_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 
@@ -62,7 +66,7 @@ async function requestEnrollmentConfirmation(
 		task_id: taskId,
 		state: "Approval required",
 		result: title,
-		next: "Review enrollment evidence",
+		next: uxText(UX_LANG, "Review enrollment evidence", "请审查 Enrollment 证据"),
 	});
 	const selected = await requestAuthorityDialog(pi, ctx, {
 		attention_id: randomUUID(),
@@ -75,8 +79,8 @@ async function requestEnrollmentConfirmation(
 		details,
 		signal,
 		actions: [
-			{ value: "confirm", label: "Confirm enrollment", description: "Create the Kernel-managed task" },
-			{ value: "cancel", label: "Cancel", description: "Leave planning artifacts and authority unchanged" },
+			{ value: "confirm", label: uxText(UX_LANG, "Confirm enrollment", "确认 Enrollment"), description: uxText(UX_LANG, "Create the Kernel-managed task", "创建 Kernel 托管任务") },
+			{ value: "cancel", label: uxText(UX_LANG, "Cancel", "取消"), description: uxText(UX_LANG, "Leave planning artifacts and authority unchanged", "不改动规划产物与权限状态") },
 		],
 	});
 	return selected === "confirm";
@@ -305,7 +309,7 @@ async function executeForegroundEnrollment(
 
 	try {
 		signal.throwIfAborted();
-		progress("preparing", `Preparing immutable Kernel owners for ${taskId}`);
+		progress("preparing", uxText(UX_LANG, `Preparing immutable Kernel owners for ${taskId}`, `正在为 ${taskId} 准备不可变 Kernel 所有者`));
 		const now = new Date().toISOString();
 		let taskIntent: Awaited<ReturnType<typeof readTaskIntent>>;
 
@@ -489,13 +493,13 @@ async function executeForegroundEnrollment(
 				`Owners: intent+workspace+claim+record checked`,
 				`Route: Kernel enrollment`,
 			].join("\n");
-			progress("awaiting_confirmation", "Waiting for exact literal-user confirmation");
+			progress("awaiting_confirmation", uxText(UX_LANG, "Waiting for exact literal-user confirmation", "等待本人确认"));
 			const confirmed = await requestEnrollmentConfirmation(
 				pi,
 				ctx,
 				taskId,
 				"enrollment",
-				"Create Kernel-managed task?",
+				uxText(UX_LANG, "Create Kernel-managed task?", "创建 Kernel 托管任务？"),
 				confirmationSummary,
 				confirmationDetails,
 				signal,
@@ -526,7 +530,7 @@ async function executeForegroundEnrollment(
 				return terminal(action, taskId, "blocked", stage, "Intent changed after confirmation; enrollment aborted before authority", "restore the intended snapshot and rerun enrollment");
 		}
 
-		progress("revalidating", "Revalidating immutable owners and the confirmed TaskIntent");
+		progress("revalidating", uxText(UX_LANG, "Revalidating immutable owners and the confirmed TaskIntent", "正在重新校验不可变所有者与已确认的 TaskIntent"));
 		const { unchanged } = await revalidatePiCanary(root, { task_id: taskId, now }, preparation);
 		if (!unchanged)
 			return terminal(action, taskId, "blocked", stage, "Workspace changed after confirmation; enrollment aborted before authority", "restore the intended snapshot and rerun enrollment");
@@ -555,7 +559,7 @@ async function executeForegroundEnrollment(
 			now,
 		};
 
-		progress("rehearsing", "Running the zero-write Kernel owner rehearsal");
+		progress("rehearsing", uxText(UX_LANG, "Running the zero-write Kernel owner rehearsal", "正在执行 Kernel 所有者零写入预演"));
 		const rehearsal = await runEnrollmentRehearsal(root, input, capability, registry);
 		if (!rehearsal.rehearsed || rehearsal.evidence.outcome !== "ready")
 			return terminal(action, taskId, "failed", stage, `Kernel enrollment rehearsal failed: ${rehearsal.evidence.blockers.join("; ")}`, "resolve the final-lock preconditions and retry");

package/plugins/immune-brain/.pi-extension/imm-canary-work.ts

@@ -65,6 +65,10 @@ import {
 	type UserAttentionReason,
 } from "./pi-canary-interaction";
 import { isToolFailureState, throwToolFailure, type ToolFailureV1 } from "./pi-canary-tool-failure";
+import { resolveUxLanguage, uxText } from "./ux-language";
+
+/** Host-native UI language; see ux-language.ts. Resolved once per process. */
+const UX_LANG = resolveUxLanguage();
 import { taskDiffIdentity, taskRevisionIdentity, captureGitTaskSnapshot } from "../runtime/workspace_scope";
 import { reviewAdvisoryRecords, reviewReworkFindings } from "../runtime/assurance/coordinator";
 import {
@@ -323,7 +327,7 @@ export default function (
 					task_id: claim.task_id,
 					state: "Blocked",
 					result: projection.error,
-					next: "Inspect authority state",
+					next: uxText(UX_LANG, "Inspect authority state", "检查权限状态"),
 				});
 				return;
 			}
@@ -395,8 +399,8 @@ export default function (
 			if (input?.task_id) presentTaskRail(ctx, {
 				task_id: input.task_id,
 				state: "Planning",
-				result: "Preparing enrollment",
-				next: "Review the native enrollment decision",
+				result: uxText(UX_LANG, "Preparing enrollment", "正在准备 Enrollment"),
+				next: uxText(UX_LANG, "Review the native enrollment decision", "请审查原生 Enrollment 决策"),
 			});
 		}
 	});
@@ -584,11 +588,12 @@ export default function (
 			}
 			const projection = await projectAssuranceState(ctx.cwd, taskId);
 			if (projection.error) {
+				const nextAction = recoveryActionForAssuranceFailure(projection.error) ?? "inspect authority state";
 				const details = {
 					state: "blocked",
 					operation: action.op,
 					result: projection.error,
-					next_action: "inspect authority state",
+					next_action: nextAction,
 				};
 				presentTaskRailResult(ctx, taskId, details);
 				return failCanaryTool(taskId, action.op, "blocked", "projection_unavailable", projection.error, details.next_action);
@@ -871,24 +876,24 @@ export default function (
 		presentTaskRail(ctx, {
 			task_id: taskId,
 			state: "Approval required",
-			result: `${operation} requires your confirmation`,
-			next: `Decide ${operation}`,
+			result: uxText(UX_LANG, `${operation} requires your confirmation`, `${operation} 需要您的确认`),
+			next: uxText(UX_LANG, `Decide ${operation}`, `请决策 ${operation}`),
 		});
 		const attention = {
 			attention_id: randomUUID(),
 			task_id: taskId,
 			reason: attentionReason,
-			label: `${operation} approval required`,
+			label: uxText(UX_LANG, `${operation} approval required`, `${operation} 待您批准`),
 		};
 		try {
 			const selected = await requestAuthorityDialog(pi, ctx, attention, {
-				title: `Authorize ${operation}?`,
+				title: uxText(UX_LANG, `Authorize ${operation}?`, `是否批准 ${operation}？`),
 				summary: dialogSummary,
 				details: dialogDetails,
 				signal: ctx.signal,
 				actions: [
-					{ value: "authorize", label: "Authorize", description: `Apply ${operation} after re-checking state` },
-					{ value: "cancel", label: "Cancel", description: "Leave managed authority unchanged" },
+					{ value: "authorize", label: uxText(UX_LANG, "Authorize", "批准"), description: uxText(UX_LANG, `Apply ${operation} after re-checking state`, `重新校验状态后应用 ${operation}`) },
+					{ value: "cancel", label: uxText(UX_LANG, "Cancel", "取消"), description: uxText(UX_LANG, "Leave managed authority unchanged", "保持托管权限状态不变") },
 				],
 			});
 			confirmed = selected === "authorize";
@@ -1532,7 +1537,7 @@ async function buildAssuranceSnapshot(
 			})
 		: null;
 	const taskSnapshot = !reviewBundle && !reviewManifest
-		? captureGitTaskSnapshot(root, intent.scope_hint)
+		? captureGitTaskSnapshot(root, intent.scope_hint, taskId)
 		: null;
 	const dirtyFiles = reviewManifest
 		? Object.keys(reviewManifest.changed_paths)
@@ -1756,6 +1761,10 @@ async function enrichAssuranceResult(
 }
 
 function nextActionForAssuranceResult(result: Record<string, unknown>, taskState: AssuranceTaskState): string {
+	const recovery = recoveryActionForAssuranceFailure(
+		"error" in taskState ? taskState.error : result.reason,
+	);
+	if (recovery) return recovery;
 	if ("error" in taskState) return "inspect authority state";
 	if (result.state === "review_preparation_failed") return "repair Review preparation, then retry advance_assurance; QA is already committed";
 	if (result.code === "verdict_invalid") return "fix the verdict payload and resubmit submit_review; the Review reservation remains active; do not re-dispatch the reviewer";
@@ -1775,6 +1784,17 @@ function nextActionForAssuranceResult(result: Record<string, unknown>, taskState
 	}
 }
 
+function recoveryActionForAssuranceFailure(reason: unknown): string | null {
+	if (typeof reason !== "string") return null;
+	if (reason.includes("task scope contains unstaged or untracked changes:"))
+		return "stage only the listed task-owned paths, then retry the blocked operation";
+	if (reason.includes("QA resolution failed ("))
+		return "repair the verification command or delivery environment, then retry advance_assurance";
+	if (reason.includes("task delivery contains paths outside the authorization envelope:"))
+		return "reconcile the listed paths: unstage unrelated paths or revise TaskIntent scope for task-owned paths, then retry advance_assurance";
+	return null;
+}
+
 function toolResult(text: string, details?: Record<string, unknown>) {
 	return { content: [{ type: "text" as const, text }], details };
 }

package/plugins/immune-brain/.pi-extension/ux-language.ts

@@ -0,0 +1,28 @@
+/**
+ * Host-native UI language for Immune-Brain TUI text (Task Rail sentences,
+ * authority dialog titles/actions, progress summaries). This layer is
+ * deterministic extension code, so conversational AGENTS.md reply-language
+ * rules cannot reach it; users opt in with IMM_UX_LANGUAGE (for example
+ * `zh`). Anything unrecognized keeps English, the published default.
+ *
+ * Boundary: only sentence-level interaction text follows this setting.
+ * Machine contracts and domain terms (state enums, operation ids, Task /
+ * Intent / Claim / Acceptance field labels, hashes, paths, CLI commands)
+ * always stay literal, as do agent-facing Tool result reasons and
+ * diagnostic notifications.
+ */
+export type UxLanguage = "en" | "zh";
+
+export function resolveUxLanguage(
+	env: Readonly<Record<string, string | undefined>> = process.env,
+): UxLanguage {
+	const raw = env.IMM_UX_LANGUAGE?.trim().toLowerCase();
+	if (raw === "zh" || raw === "zh-cn" || raw === "zh-tw" || raw === "chinese" || raw === "中文")
+		return "zh";
+	return "en";
+}
+
+/** Pick the interaction sentence for the resolved language. */
+export function uxText(lang: UxLanguage, en: string, zh: string): string {
+	return lang === "zh" ? zh : en;
+}

package/plugins/immune-brain/dist/BASELINE.md

@@ -6,7 +6,9 @@
   from `dist/`; nested modes, examples, recovery, and references load on demand.
 - Ask only when missing information would change the goal, scope, observable behavior, compatibility, risk acceptance, a protected effect, or a fact only the user can supply. Resolve repository facts and delegated technical choices with bounded evidence instead of asking.
 - Keep edits inside the user-requested Direct scope or the enrolled TaskIntent acceptance and `scope_hint`.
-- Stage only explicit task-owned paths. Never use `git add .` or `git add -A` in a dirty worktree.
+- Stage only explicit task-owned paths. This staging authority does not grant
+  commit, push, broad staging, or authority over pre-existing user changes.
+  Never use `git add .` or `git add -A` in a dirty worktree.
 - Do not create, switch, or delete Git worktrees; operate only in the Host launch directory.
 - Record reproducible evidence before reporting closure.
 - Required verification must pass before reporting completion; disclosing a gap is not a substitute. Autonomously diagnose, repair, and rerun failing conventional local checks within the authorized scope; never delete, skip, or weaken a valid check to manufacture a pass. If a required check remains failing or cannot run, report the work as incomplete with the concrete blocker.
@@ -46,7 +48,9 @@ routing. A new Managed workflow starts only from explicit `imm-brainstorm`,
    Managed owner remains authoritative; the user resumes it with `imm-loop`.
 2. **Start explicitly**: the selected Immune-Brain Skill owns its planning or
    coordination work. It creates only requested artifacts and their required
-   parent directories; it does not install project-wide contract files.
+   parent directories. Explicit Planner entry also owns absent routing-policy
+   activation under Planner's Kernel TaskIntent Routing section;
+   it does not otherwise install project-wide contract files.
 3. **Preserve authority**: Planner output is a candidate for later literal-user
    Enrollment, and Fast-Track preserves TaskIntent scope, Enrollment, QA,
    Review, authorization, and completion boundaries.
@@ -124,6 +128,17 @@ always run sequentially.
 - Do not translate or rename machine contracts: schema fields, enum values,
   CLI flags, JSON keys, file paths, tool names, API names,
   and code identifiers stay literal.
+- Host-native UI text (Task Rail sentences, authority dialog titles and
+  actions, enrollment progress summaries) is deterministic extension code and
+  cannot follow conversational rules; users localize it with the
+  `IMM_UX_LANGUAGE` environment variable (for example `IMM_UX_LANGUAGE=zh`).
+  Only sentence-level interaction text follows it; machine contracts, domain
+  field labels, and agent-facing Tool result reasons stay literal English.
+- Internal role dispatches (`dispatch_role` and routed role contexts) carry
+  the user-facing interaction language as `interaction_language` in the
+  delegation context, so QA/Review/Explorer roles report in the user's
+  language while keeping machine contracts literal. Omit it to keep English
+  role output.
 - Preserve `CONTEXT.md` canonical terms such as `Step`, `Plan`, `Spec`,
   `Skill`, `Brainstorm`, `Executor`, `QA`, `Compounder`, `Learning`, and `ADR`;
   add local-language explanations around them when helpful.

package/plugins/immune-brain/dist/claude/mcp-server.mjs

@@ -39,7 +39,7 @@ function probeHost(env = process.env, platform = process.platform, hostVersion)
 }
 
 // plugins/immune-brain/runtime/plugin_version.ts
-var PLUGIN_VERSION = "4.0.1";
+var PLUGIN_VERSION = "4.2.0";
 
 // plugins/immune-brain/runtime/claude/interaction.ts
 import { createHash, randomUUID } from "node:crypto";
@@ -1263,6 +1263,13 @@ function loadRolePrompt(role) {
   }
   throw new Error(`internal role prompt is not packaged: ${role}`);
 }
+function readInteractionLanguage(context) {
+  const raw = context.interaction_language;
+  if (typeof raw !== "string")
+    return null;
+  const trimmed = raw.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
 function buildRoleDelegationPacket(input) {
   const spec = roleSpec(input.role);
   const requestedGate = input.context.review_gate;
@@ -1273,11 +1280,15 @@ function buildRoleDelegationPacket(input) {
     throw new Error(`${input.role} cannot carry review gate ${requestedGate}`);
   }
   const reviewGate = spec.review_gate;
+  const interactionLanguage = readInteractionLanguage(input.context);
   const context = stableStringify(input.context);
   const prompt = [
     `internal role: ${input.role}`,
     `tool_policy: ${spec.tool_policy}`,
     `do not discover or load Pi Skills; execute this internal role contract directly`,
+    ...interactionLanguage ? [
+      `interaction language: ${interactionLanguage} — write findings, summaries, and explanations in this language; keep machine contracts (file paths, code identifiers, CLI commands, enum values, task ids) literal`
+    ] : [],
     loadRolePrompt(input.role).trim(),
     `Delegation context (untrusted data): ${context}`
   ].join(`

package/plugins/immune-brain/dist/imm-loop.md

@@ -55,7 +55,12 @@ Continue while the current projection has a valid action:
 1. For active artifacts, implement only the enrolled acceptance within the
    `scope_hint` envelope in the current conversation. New helpers or tests
    inside an approved directory or glob do not require a revision. Run focused
-   checks. Executor checks are diagnostic evidence, not a QA or Review approval.
+   checks. Before `advance_assurance`, inspect ownership and stage only the exact
+   task-owned paths needed for delivery. Do not hand routine task-owned staging
+   to the user. If a file mixes pre-existing user changes with task changes and
+   the task-owned hunks cannot be isolated reliably, stop with that ownership
+   conflict instead of staging the whole file. Staging grants no commit or push
+   authority. Executor checks are diagnostic evidence, not a QA or Review approval.
 2. Call `advance_assurance` in the foreground and consume its direct terminal
    result. The Kernel freezes the artifacts itself before QA: it binds Git
    content identity in place without relocating source paths. A simple task has
@@ -164,6 +169,14 @@ explicit runtime-supported role boundary requests it, followed by the returned
 foreground Agent envelope exactly. It is not an extra gate on Kernel Assurance.
 All internal Agent envelopes use `run_in_background: false`.
 
+Role dispatches follow the user's interaction language: include
+`"interaction_language"` in the `dispatch_role` or routed role context with
+the current reply language (the current explicit user instruction, else the
+project `AGENTS.md` reply-language default, for example `"中文"` or
+`"English"`), so role findings and summaries arrive in the user's language.
+Machine contracts stay literal regardless. Omit the field to keep English
+role output.
+
 The internal Compounder is optional: only closed work with structured evidence
 of a reusable Learning may route to it. Routine completion creates no Learning.
 It cannot approve successors or delay terminal settlement. A projection with

package/plugins/immune-brain/dist/imm-planner.md

@@ -76,7 +76,8 @@ Then route deterministically:
   coordination, except a Loop-requested revision follows Enrolled Intent Revision
   below to prepare a non-authoritative proposal for that same owner;
 - an active or otherwise nonterminal v3 Plan remains on its existing v3 route;
-- no routing policy preserves the legacy v3 Planner behavior;
+- no routing policy on an otherwise unowned workspace triggers automatic policy
+  activation below before producing any planning artifact;
 - a valid `kernel_task_intent` retirement policy produces one TaskIntent draft
   through the current Host's explicit `imm-planner`;
 - an invalid, unreadable, untracked, or tracked-deleted policy rejects new
@@ -107,6 +108,46 @@ workspace claim, and final authority preconditions without executing acceptance
 descriptors. A routine task proceeds from that single confirmation through
 enrollment, execution and QA without a second human stop.
 
+**Automatic policy activation**
+
+Explicit `imm-planner` entry includes local routing setup, including for plan-only
+requests. When the routing projection reports `policy_status: legacy_v3` and
+`ownership: absent`, and neither Kernel nor nonterminal v3 ownership exists,
+perform these steps without a separate enablement question:
+
+1. Create `docs/plans/` if needed. Require real directories without symlink
+   components; create `docs/plans/managed-task-routing-policy.json` exclusively
+   (fail if it already exists), using exactly the JSON below with two-space
+   indentation, the shown field order, and one trailing newline.
+2. Run `git add -- docs/plans/managed-task-routing-policy.json` only for the file
+   created in this activation. Preserve all other worktree and index changes;
+   do not commit, force-add an ignored file, or alter Git configuration.
+3. Re-run `imm-plan --routing-status --json` through the resolved wrapper.
+   Continue canonical TaskIntent authoring only when `policy_status: active`,
+   `route: kernel_task_intent`, and `ownership: tracked_clean` all hold. Report
+   automatic activation briefly and continue planning in the same turn.
+
+```json
+{
+  "contract": "immune_brain/managed_task_routing_policy/v1",
+  "revision": 1,
+  "new_task_route": "kernel_task_intent",
+  "v3_new_plan_sync": "retired",
+  "legacy_v3_mode": "drain_read_only",
+  "terminal_import": "disabled"
+}
+```
+
+An already active policy needs no write or staging. An existing invalid,
+untracked, unreadable, tracked-deleted, or divergent policy is not an activation
+candidate: preserve it and report `routing_policy_invalid`. If creation,
+staging, or verification fails, report the concrete blocker and retain any
+created file; stop before authoring, without overwriting existing bytes or
+falling back to v3. A repository/user prohibition on policy setup or staging
+blocks only this dependent planning step. Activation grants no execution
+authority; the native Enrollment gate remains required. Read-only routing
+queries and the canonical author command retain their existing runtime behavior.
+
 ## Candidate Authoring
 
 Read this section before creating new candidate artifacts, after request routing
@@ -133,6 +174,12 @@ file creation; then it validates the created artifact with
 continue through Kernel `revise_intent` authority and are not a Planner
 overwrite path.
 
+After authoring, inspect ownership and stage only the exact Planner-produced
+Spec and TaskIntent paths before validation and handoff. Do not hand routine
+Planner-owned staging to the user. This grants no commit, push, broad staging,
+or authority over pre-existing user changes; a mixed-change ownership conflict
+stops only the affected handoff.
+
 Before authoring a TaskIntent that adds a field or verdict branch to a state
 machine, enumerate every consumer of that value and of the version gates around
 it: the producing side, each branch or switch that reads it, and any migration or
@@ -263,7 +310,12 @@ script or host tool through its literal `command`; do not infer a language,
 package manager, or runner. Add `environment.prepare` only when the check needs
 explicit setup, and declare only the generated directories it needs in
 `environment.writable_paths`. Never hide package installation inside an
-acceptance command. Prefer the highest existing observable behavioral test seam
+acceptance command. For every descriptor, identify whether its executable is
+provided by the QA host or by tracked delivery content, where every dependency
+comes from in the disposable delivery, what explicit setup is required, and
+which declared writable paths that setup or check creates. A dependency found
+only in the Planner's live worktree, including an absolute local `node_modules`
+path, is not delivery provenance. Prefer the highest existing observable behavioral test seam
 and the fewest sufficient seams; never use the full test suite, a build, network
 access, or redundant heavyweight checks as acceptance. Cite relevant test prior
 art and explain how the selected seam catches the intended regression. This is
@@ -271,7 +323,9 @@ a planning heuristic: it must not weaken acceptance-specific focused
 verification descriptors or add a mandatory user confirmation. Use the smallest
 `timeout_ms` and `max_output_bytes` that cover deterministic post-implementation
 QA. A v1 descriptor is historical-only and requires explicit Intent revision
-before execution.
+before execution. Report `valid` and `enrollment_ready` only as structural and
+Enrollment readiness; only a completed deterministic QA result proves that a
+descriptor executed and passed.
 
 ## Core Responsibilities
 
@@ -410,7 +464,7 @@ optional advisory dispatch fails, continue inline and record the reason.
 
 ## Boundary
 
-- **Allowed**: Write a TaskIntent. Add a Spec only for complex work. Initiative planning carriers and necessary domain vocabulary.
+- **Allowed**: Write a TaskIntent. Add a Spec only for complex work. Activate an absent routing policy under Kernel TaskIntent Routing. Initiative planning carriers and necessary domain vocabulary.
 - **Blocked**: Implementation edits, direct Kernel-store writes, enrolled intent overwrites, and QA/Review decisions.
 - **Workflow guard**: Execution continues through native Enrollment and explicit `imm-loop`. Planner owns design and decomposition, not execution authority.
 

package/plugins/immune-brain/runtime/plugin_version.ts

@@ -1,2 +1,2 @@
 // Generated by scripts/plugin_versioning.ts from the root package.json.
-export const PLUGIN_VERSION = "4.0.1" as const;
+export const PLUGIN_VERSION = "4.2.0" as const;

package/plugins/immune-brain/runtime/role_prompt_bridge.ts

@@ -89,6 +89,14 @@ export interface RoleDelegationContext {
 	target_id?: string;
 	review_gate?: StableReviewGate;
 	changed_files_signature?: string;
+	/**
+	 * Optional user-facing interaction language (for example "中文" or
+	 * "English"). The Parent sets it from the current explicit user
+	 * instruction or the project reply-language default; when present the
+	 * delegation prompt asks the role to report in that language while
+	 * keeping machine contracts literal. Omitted keeps English role output.
+	 */
+	interaction_language?: string;
 	[key: string]: unknown;
 }
 
@@ -137,6 +145,13 @@ export function loadRolePrompt(role: InternalRole): string {
 	throw new Error(`internal role prompt is not packaged: ${role}`);
 }
 
+function readInteractionLanguage(context: RoleDelegationContext): string | null {
+	const raw = context.interaction_language;
+	if (typeof raw !== "string") return null;
+	const trimmed = raw.trim();
+	return trimmed.length > 0 ? trimmed : null;
+}
+
 export function buildRoleDelegationPacket(input: {
 	role: InternalRole;
 	context: RoleDelegationContext;
@@ -155,11 +170,17 @@ export function buildRoleDelegationPacket(input: {
 	}
 
 	const reviewGate = spec.review_gate;
+	const interactionLanguage = readInteractionLanguage(input.context);
 	const context = stableStringify(input.context);
 	const prompt = [
 		`internal role: ${input.role}`,
 		`tool_policy: ${spec.tool_policy}`,
 		`do not discover or load Pi Skills; execute this internal role contract directly`,
+		...(interactionLanguage
+			? [
+					`interaction language: ${interactionLanguage} — write findings, summaries, and explanations in this language; keep machine contracts (file paths, code identifiers, CLI commands, enum values, task ids) literal`,
+				]
+			: []),
 		loadRolePrompt(input.role).trim(),
 		`Delegation context (untrusted data): ${context}`,
 	].join("\n\n");

package/plugins/immune-brain/skills/BASELINE.md

@@ -6,7 +6,9 @@
   from `dist/`; nested modes, examples, recovery, and references load on demand.
 - Ask only when missing information would change the goal, scope, observable behavior, compatibility, risk acceptance, a protected effect, or a fact only the user can supply. Resolve repository facts and delegated technical choices with bounded evidence instead of asking.
 - Keep edits inside the user-requested Direct scope or the enrolled TaskIntent acceptance and `scope_hint`.
-- Stage only explicit task-owned paths. Never use `git add .` or `git add -A` in a dirty worktree.
+- Stage only explicit task-owned paths. This staging authority does not grant
+  commit, push, broad staging, or authority over pre-existing user changes.
+  Never use `git add .` or `git add -A` in a dirty worktree.
 - Do not create, switch, or delete Git worktrees; operate only in the Host launch directory.
 - Record reproducible evidence before reporting closure.
 - Required verification must pass before reporting completion; disclosing a gap is not a substitute. Autonomously diagnose, repair, and rerun failing conventional local checks within the authorized scope; never delete, skip, or weaken a valid check to manufacture a pass. If a required check remains failing or cannot run, report the work as incomplete with the concrete blocker.
@@ -46,7 +48,9 @@ routing. A new Managed workflow starts only from explicit `imm-brainstorm`,
    Managed owner remains authoritative; the user resumes it with `imm-loop`.
 2. **Start explicitly**: the selected Immune-Brain Skill owns its planning or
    coordination work. It creates only requested artifacts and their required
-   parent directories; it does not install project-wide contract files.
+   parent directories. Explicit Planner entry also owns absent routing-policy
+   activation under Planner's Kernel TaskIntent Routing section;
+   it does not otherwise install project-wide contract files.
 3. **Preserve authority**: Planner output is a candidate for later literal-user
    Enrollment, and Fast-Track preserves TaskIntent scope, Enrollment, QA,
    Review, authorization, and completion boundaries.
@@ -124,6 +128,17 @@ always run sequentially.
 - Do not translate or rename machine contracts: schema fields, enum values,
   CLI flags, JSON keys, file paths, tool names, API names,
   and code identifiers stay literal.
+- Host-native UI text (Task Rail sentences, authority dialog titles and
+  actions, enrollment progress summaries) is deterministic extension code and
+  cannot follow conversational rules; users localize it with the
+  `IMM_UX_LANGUAGE` environment variable (for example `IMM_UX_LANGUAGE=zh`).
+  Only sentence-level interaction text follows it; machine contracts, domain
+  field labels, and agent-facing Tool result reasons stay literal English.
+- Internal role dispatches (`dispatch_role` and routed role contexts) carry
+  the user-facing interaction language as `interaction_language` in the
+  delegation context, so QA/Review/Explorer roles report in the user's
+  language while keeping machine contracts literal. Omit it to keep English
+  role output.
 - Preserve `CONTEXT.md` canonical terms such as `Step`, `Plan`, `Spec`,
   `Skill`, `Brainstorm`, `Executor`, `QA`, `Compounder`, `Learning`, and `ADR`;
   add local-language explanations around them when helpful.