immune-brain 4.4.0 → 4.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "4.4.0",
+  "version": "4.4.1",
   "description": "Immune-Brain agent skill system",
   "publishConfig": {
     "access": "public",

package/plugins/immune-brain/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "4.4.0",
+  "version": "4.4.1",
   "description": "Immune-Brain Claude Code Host: native Enrollment, QA, Review, and Kernel settlement.",
   "author": {
     "name": "Immune-Brain Team"

package/plugins/immune-brain/.pi-extension/imm-canary-work.ts

@@ -64,7 +64,7 @@ import {
 	type UserAttentionEventV1,
 	type UserAttentionReason,
 } from "./pi-canary-interaction";
-import { isToolFailureState, throwToolFailure, type ToolFailureV1 } from "./pi-canary-tool-failure";
+import { isToolFailureState, throwToolFailure, type AssuranceFailureDetails, type ToolFailureV1 } from "./pi-canary-tool-failure";
 import { resolveUxLanguage, uxText } from "./ux-language";
 
 /** Host-native UI language; see ux-language.ts. Resolved once per process. */
@@ -1737,6 +1737,11 @@ async function enrichAssuranceResult(
 	taskId: string,
 	result: Record<string, unknown>,
 ): Promise<Record<string, unknown>> {
+	if (result.recovery_error) {
+		// Do not replay a failed observation for Host decoration or tracker hygiene.
+		const taskState = { error: typeof result.reason === "string" ? result.reason : "authority projection unavailable" };
+		return { ...result, task_state: taskState, next_action: nextActionForAssuranceResult(result, taskState) };
+	}
 	const projection = await projectAssuranceState(ctx.cwd, taskId);
 	const taskState: AssuranceTaskState = projection.error
 		? { error: projection.error }
@@ -1761,11 +1766,13 @@ async function enrichAssuranceResult(
 }
 
 function nextActionForAssuranceResult(result: Record<string, unknown>, taskState: AssuranceTaskState): string {
+	const derived = result.recovery as { next_action: string } | undefined;
+	if (derived) return derived.next_action;
 	const recovery = recoveryActionForAssuranceFailure(
 		"error" in taskState ? taskState.error : result.reason,
 	);
 	if (recovery) return recovery;
-	if ("error" in taskState) return "inspect authority state";
+	if (result.recovery_error || "error" in taskState) return "inspect authority state";
 	if (result.state === "review_preparation_failed") return "repair Review preparation, then retry advance_assurance; QA is already committed";
 	if (result.code === "verdict_invalid") return "fix the verdict payload and resubmit submit_review; the Review reservation remains active; do not re-dispatch the reviewer";
 	if (taskState.lifecycle === "done" || taskState.lifecycle === "stopped") return "none";
@@ -1872,6 +1879,7 @@ function failCanaryTool(
 	code: string,
 	message: string,
 	nextAction: string,
+	details: AssuranceFailureDetails = {},
 ): never {
 	return throwToolFailure({
 		tool: "imm_kernel_canary",
@@ -1881,6 +1889,7 @@ function failCanaryTool(
 		code,
 		message,
 		next_action: nextAction,
+		...details,
 	});
 }
 
@@ -1890,6 +1899,7 @@ function throwIfCanaryToolFailure(
 	result: Record<string, unknown>,
 ): void {
 	if (!isToolFailureState(result.state)) return;
+	const details = result as AssuranceFailureDetails;
 	failCanaryTool(
 		taskId,
 		operation,
@@ -1903,6 +1913,13 @@ function throwIfCanaryToolFailure(
 		typeof result.next_action === "string"
 			? result.next_action
 			: "inspect authority state",
+		// Preserve only the coordinator's bounded observation metadata.
+		{
+			...(details.diagnostics ? { diagnostics: details.diagnostics } : {}),
+			...(details.environment_failure ? { environment_failure: true } : {}),
+			...(details.recovery ? { recovery: details.recovery } : {}),
+			...(details.recovery_error ? { recovery_error: details.recovery_error } : {}),
+		},
 	);
 }
 

package/plugins/immune-brain/.pi-extension/imm-unattended-batch.ts

@@ -5,6 +5,7 @@ import {
 	createBatchAuthorityRegistry,
 	deriveChildEnrollment,
 	startBatch,
+	batchQaFailureFacts,
 	readTaskRecord,
 	advancePiTask,
 	projectAssuranceForTask,
@@ -114,7 +115,7 @@ export async function executePiUnattendedBatch(
 	// working-tree cleanliness against the authorized scope, recovery children,
 	// plan digest, and base HEAD are one shared projection, so neither Host
 	// re-implements a batch decision.
-	const now = new Date().toISOString();
+	let now = new Date().toISOString();
 	const preflight = await projectBatchPreflight({
 		root,
 		initiative_slug: initiativeSlug,
@@ -203,6 +204,9 @@ export async function executePiUnattendedBatch(
 	// review-2: verify cancellation signal right before authority issuance and startBatch
 	if (signal?.aborted) return batchReason("cancelled_before_execution");
 
+	now = new Date().toISOString();
+	if (Date.parse(expiresAt) <= Date.parse(now))
+		return batchReason("confirmation_failed", "confirmed batch deadline expired before authorization issuance");
 	const capability = batchRegistry.issue(binding, recoveryChildren as any, now);
 
 	let activeReviewDispatch: { operation_id: string; agent_params: Record<string, unknown> } | null = null;
@@ -251,7 +255,11 @@ export async function executePiUnattendedBatch(
 			return res;
 		},
 		projectTask: async (taskRoot, taskId) => {
-			return projectAssuranceForTask(taskRoot, taskId);
+			const fresh = await projectAssuranceForTask(taskRoot, taskId);
+			if (!fresh.claim || fresh.projection.lifecycle !== "active" || fresh.error !== null) return fresh;
+			const { record, revision } = await readTaskRecord(taskRoot, taskId);
+			if (!record || revision !== fresh.projection.record_revision) throw new Error(`Kernel recovery projection changed for ${taskId}`);
+			return { ...fresh, ...batchQaFailureFacts(record) };
 		},
 		ownsTaskClaim: (taskId) => {
 			if (isResuming && taskId === readActiveClaimTaskId(root)) {

package/plugins/immune-brain/.pi-extension/pi-canary-tool-failure.ts

@@ -1,4 +1,9 @@
-export interface ToolFailureV1 {
+import type { AssuranceAdvanceResult } from "../runtime/assurance/coordinator";
+
+export type AssuranceFailureDetails = Pick<AssuranceAdvanceResult,
+	"diagnostics" | "environment_failure" | "recovery" | "recovery_error">;
+
+export interface ToolFailureV1 extends AssuranceFailureDetails {
 	contract: "immune_brain/tool_failure/v1";
 	tool: "imm_canary_enrollment" | "imm_kernel_canary";
 	task_id: string;

package/plugins/immune-brain/.pi-extension/runtime-stub.ts

@@ -171,10 +171,12 @@ export interface TaskRecordRead {
 				manifest_digest: string;
 			};
 		}>;
+		history: import("../runtime/kernel/types").TaskRecord["history"];
 		findings: Array<{
 			id: string;
 			kind: string;
 			status: string;
+			acceptance_id?: string | null;
 			summary?: string;
 			anchor?: string | null;
 			evidence?: unknown;
@@ -451,6 +453,7 @@ export type {
 	BatchAuthorizationBinding,
 	ValidatedBatchAuthorization,
 } from "../runtime/kernel/batch_authority";
+export { batchQaFailureFacts } from "../runtime/unattended/batch_runner";
 export type {
 	BatchRunnerKernelPort,
 	StartBatchInput,
@@ -553,12 +556,14 @@ export async function getSharedPiProgression(): Promise<any> {
 export async function advancePiTask(root: string, taskId: string): Promise<any> {
 	const progression = await getSharedPiProgression();
 	const result = await progression.advance(taskId, { cwd: root });
-	if (result.state === "completed") return { state: "completed" };
-	if (result.state === "stopped") return { state: "stopped" };
-	if (result.state === "rework") return { state: "rework", operation: result.operation, summary: result.summary };
-	if (result.state === "review_ready") return { state: "review_ready", operation_id: result.operation_id, agent_params: result.agent_params };
-	if (result.state === "blocked") return { state: "blocked", reason: result.reason };
-	return { state: "failed", reason: (result as { reason?: string }).reason ?? "advance failed" };
+	const facts = { diagnostics: result.diagnostics, environment_failure: result.environment_failure, recovery: result.recovery };
+	if (result.state === "completed") return { state: "completed", ...facts };
+	if (result.state === "stopped") return { state: "stopped", ...facts };
+	if (result.state === "rework") return { state: "rework", operation: result.operation, summary: result.summary, ...facts };
+	if (result.state === "review_ready") return { state: "review_ready", operation_id: result.operation_id, agent_params: result.agent_params, ...facts };
+	if (result.state === "review_preparation_failed") return { state: result.state, operation: result.operation, operation_id: result.operation_id, reason: result.reason, ...facts };
+	if (result.state === "blocked") return { state: "blocked", reason: result.reason, ...facts };
+	return { state: "failed", reason: (result as { reason?: string }).reason ?? "advance failed", ...facts };
 }
 
 export async function projectAssuranceForTask(root: string, taskId: string): Promise<any> {