immune-brain 4.4.0 → 4.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "4.4.0",
+  "version": "4.5.0",
   "description": "Immune-Brain agent skill system",
   "publishConfig": {
     "access": "public",

package/plugins/immune-brain/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "4.4.0",
+  "version": "4.5.0",
   "description": "Immune-Brain Claude Code Host: native Enrollment, QA, Review, and Kernel settlement.",
   "author": {
     "name": "Immune-Brain Team"

package/plugins/immune-brain/.pi-extension/imm-canary-work.ts

@@ -64,7 +64,7 @@ import {
 	type UserAttentionEventV1,
 	type UserAttentionReason,
 } from "./pi-canary-interaction";
-import { isToolFailureState, throwToolFailure, type ToolFailureV1 } from "./pi-canary-tool-failure";
+import { isToolFailureState, throwToolFailure, type AssuranceFailureDetails, type ToolFailureV1 } from "./pi-canary-tool-failure";
 import { resolveUxLanguage, uxText } from "./ux-language";
 
 /** Host-native UI language; see ux-language.ts. Resolved once per process. */
@@ -1737,6 +1737,11 @@ async function enrichAssuranceResult(
 	taskId: string,
 	result: Record<string, unknown>,
 ): Promise<Record<string, unknown>> {
+	if (result.recovery_error) {
+		// Do not replay a failed observation for Host decoration or tracker hygiene.
+		const taskState = { error: typeof result.reason === "string" ? result.reason : "authority projection unavailable" };
+		return { ...result, task_state: taskState, next_action: nextActionForAssuranceResult(result, taskState) };
+	}
 	const projection = await projectAssuranceState(ctx.cwd, taskId);
 	const taskState: AssuranceTaskState = projection.error
 		? { error: projection.error }
@@ -1761,11 +1766,13 @@ async function enrichAssuranceResult(
 }
 
 function nextActionForAssuranceResult(result: Record<string, unknown>, taskState: AssuranceTaskState): string {
+	const derived = result.recovery as { next_action: string } | undefined;
+	if (derived) return derived.next_action;
 	const recovery = recoveryActionForAssuranceFailure(
 		"error" in taskState ? taskState.error : result.reason,
 	);
 	if (recovery) return recovery;
-	if ("error" in taskState) return "inspect authority state";
+	if (result.recovery_error || "error" in taskState) return "inspect authority state";
 	if (result.state === "review_preparation_failed") return "repair Review preparation, then retry advance_assurance; QA is already committed";
 	if (result.code === "verdict_invalid") return "fix the verdict payload and resubmit submit_review; the Review reservation remains active; do not re-dispatch the reviewer";
 	if (taskState.lifecycle === "done" || taskState.lifecycle === "stopped") return "none";
@@ -1872,6 +1879,7 @@ function failCanaryTool(
 	code: string,
 	message: string,
 	nextAction: string,
+	details: AssuranceFailureDetails = {},
 ): never {
 	return throwToolFailure({
 		tool: "imm_kernel_canary",
@@ -1881,6 +1889,7 @@ function failCanaryTool(
 		code,
 		message,
 		next_action: nextAction,
+		...details,
 	});
 }
 
@@ -1890,6 +1899,7 @@ function throwIfCanaryToolFailure(
 	result: Record<string, unknown>,
 ): void {
 	if (!isToolFailureState(result.state)) return;
+	const details = result as AssuranceFailureDetails;
 	failCanaryTool(
 		taskId,
 		operation,
@@ -1903,6 +1913,13 @@ function throwIfCanaryToolFailure(
 		typeof result.next_action === "string"
 			? result.next_action
 			: "inspect authority state",
+		// Preserve only the coordinator's bounded observation metadata.
+		{
+			...(details.diagnostics ? { diagnostics: details.diagnostics } : {}),
+			...(details.environment_failure ? { environment_failure: true } : {}),
+			...(details.recovery ? { recovery: details.recovery } : {}),
+			...(details.recovery_error ? { recovery_error: details.recovery_error } : {}),
+		},
 	);
 }
 

package/plugins/immune-brain/.pi-extension/imm-unattended-batch.ts

@@ -5,6 +5,7 @@ import {
 	createBatchAuthorityRegistry,
 	deriveChildEnrollment,
 	startBatch,
+	batchQaFailureFacts,
 	readTaskRecord,
 	advancePiTask,
 	projectAssuranceForTask,
@@ -114,7 +115,7 @@ export async function executePiUnattendedBatch(
 	// working-tree cleanliness against the authorized scope, recovery children,
 	// plan digest, and base HEAD are one shared projection, so neither Host
 	// re-implements a batch decision.
-	const now = new Date().toISOString();
+	let now = new Date().toISOString();
 	const preflight = await projectBatchPreflight({
 		root,
 		initiative_slug: initiativeSlug,
@@ -203,6 +204,9 @@ export async function executePiUnattendedBatch(
 	// review-2: verify cancellation signal right before authority issuance and startBatch
 	if (signal?.aborted) return batchReason("cancelled_before_execution");
 
+	now = new Date().toISOString();
+	if (Date.parse(expiresAt) <= Date.parse(now))
+		return batchReason("confirmation_failed", "confirmed batch deadline expired before authorization issuance");
 	const capability = batchRegistry.issue(binding, recoveryChildren as any, now);
 
 	let activeReviewDispatch: { operation_id: string; agent_params: Record<string, unknown> } | null = null;
@@ -251,7 +255,11 @@ export async function executePiUnattendedBatch(
 			return res;
 		},
 		projectTask: async (taskRoot, taskId) => {
-			return projectAssuranceForTask(taskRoot, taskId);
+			const fresh = await projectAssuranceForTask(taskRoot, taskId);
+			if (!fresh.claim || fresh.projection.lifecycle !== "active" || fresh.error !== null) return fresh;
+			const { record, revision } = await readTaskRecord(taskRoot, taskId);
+			if (!record || revision !== fresh.projection.record_revision) throw new Error(`Kernel recovery projection changed for ${taskId}`);
+			return { ...fresh, ...batchQaFailureFacts(record) };
 		},
 		ownsTaskClaim: (taskId) => {
 			if (isResuming && taskId === readActiveClaimTaskId(root)) {

package/plugins/immune-brain/.pi-extension/pi-canary-tool-failure.ts

@@ -1,4 +1,9 @@
-export interface ToolFailureV1 {
+import type { AssuranceAdvanceResult } from "../runtime/assurance/coordinator";
+
+export type AssuranceFailureDetails = Pick<AssuranceAdvanceResult,
+	"diagnostics" | "environment_failure" | "recovery" | "recovery_error">;
+
+export interface ToolFailureV1 extends AssuranceFailureDetails {
 	contract: "immune_brain/tool_failure/v1";
 	tool: "imm_canary_enrollment" | "imm_kernel_canary";
 	task_id: string;

package/plugins/immune-brain/.pi-extension/runtime-stub.ts

@@ -171,10 +171,12 @@ export interface TaskRecordRead {
 				manifest_digest: string;
 			};
 		}>;
+		history: import("../runtime/kernel/types").TaskRecord["history"];
 		findings: Array<{
 			id: string;
 			kind: string;
 			status: string;
+			acceptance_id?: string | null;
 			summary?: string;
 			anchor?: string | null;
 			evidence?: unknown;
@@ -451,6 +453,7 @@ export type {
 	BatchAuthorizationBinding,
 	ValidatedBatchAuthorization,
 } from "../runtime/kernel/batch_authority";
+export { batchQaFailureFacts } from "../runtime/unattended/batch_runner";
 export type {
 	BatchRunnerKernelPort,
 	StartBatchInput,
@@ -553,12 +556,14 @@ export async function getSharedPiProgression(): Promise<any> {
 export async function advancePiTask(root: string, taskId: string): Promise<any> {
 	const progression = await getSharedPiProgression();
 	const result = await progression.advance(taskId, { cwd: root });
-	if (result.state === "completed") return { state: "completed" };
-	if (result.state === "stopped") return { state: "stopped" };
-	if (result.state === "rework") return { state: "rework", operation: result.operation, summary: result.summary };
-	if (result.state === "review_ready") return { state: "review_ready", operation_id: result.operation_id, agent_params: result.agent_params };
-	if (result.state === "blocked") return { state: "blocked", reason: result.reason };
-	return { state: "failed", reason: (result as { reason?: string }).reason ?? "advance failed" };
+	const facts = { diagnostics: result.diagnostics, environment_failure: result.environment_failure, recovery: result.recovery };
+	if (result.state === "completed") return { state: "completed", ...facts };
+	if (result.state === "stopped") return { state: "stopped", ...facts };
+	if (result.state === "rework") return { state: "rework", operation: result.operation, summary: result.summary, ...facts };
+	if (result.state === "review_ready") return { state: "review_ready", operation_id: result.operation_id, agent_params: result.agent_params, ...facts };
+	if (result.state === "review_preparation_failed") return { state: result.state, operation: result.operation, operation_id: result.operation_id, reason: result.reason, ...facts };
+	if (result.state === "blocked") return { state: "blocked", reason: result.reason, ...facts };
+	return { state: "failed", reason: (result as { reason?: string }).reason ?? "advance failed", ...facts };
 }
 
 export async function projectAssuranceForTask(root: string, taskId: string): Promise<any> {

package/plugins/immune-brain/dist/BASELINE.md

@@ -9,6 +9,20 @@
 - Stage only explicit task-owned paths. This staging authority does not grant
   commit, push, broad staging, or authority over pre-existing user changes.
   Never use `git add .` or `git add -A` in a dirty worktree.
+- Grant effects separately: staging, commit, push, publication, and outbound
+  model/data calls are distinct operations. Recovering a stage-only instruction
+  restores staging and nothing more; commit, push, and publication each keep
+  their own existing grant. An explicit approval already covering the same
+  operation, target, and impact — including a valid batch capability — stays
+  usable without another gate.
+- Before a new outbound effect, check the project's existing research channel and
+data scope. A public article, a mock, a documentation example, or a local
+read-only database gives no authority to call an arbitrary provider or send new
+data; authorize only a genuinely new channel/data/effect delta. Distinguish
+documentation, mock, real-channel, and model-quality evidence when reporting.
+- These text rules are instruction contracts, not a hard bash sandbox. They
+guide behavior and are checked as contracts; they do not technically prevent an
+arbitrary shell command, so authority gates and review remain the real boundary.
 - Do not create, switch, or delete Git worktrees; operate only in the Host launch directory.
 - Record reproducible evidence before reporting closure.
 - Required verification must pass before reporting completion; disclosing a gap is not a substitute. Autonomously diagnose, repair, and rerun failing conventional local checks within the authorized scope; never delete, skip, or weaken a valid check to manufacture a pass. If a required check remains failing or cannot run, report the work as incomplete with the concrete blocker.
@@ -81,7 +95,6 @@ non-Kernel operations, an explicit user approval already covering the same
 operation, target, and impact is sufficient; ask again only for a material delta.
 A generic continuation or configured preference is not blanket authorization.
 Mandatory native gates and hash-bound manifest approvals still apply.
-
 Privileged effects include:
 
 - publish, release, deployment, or remote-system mutation;
@@ -91,6 +104,10 @@ Privileged effects include:
   override; and
 - external writes whose target or impact cannot be safely reversed locally.
 
+An existing grant for one of these never inherits another: a stage-only
+instruction stays stage-only, a commit is not push or publication authority,
+and a valid batch capability commits only its own scope-bounded child.
+
 Routine Managed enrollment uses one current-Host native confirmation bound to the TaskIntent content hash after Planner validation. Explicit Plan-only requests stop with candidate artifacts and do not invoke Enrollment; execution-bearing requests open the native gate directly without chat pre-confirmation. Enrollment validates intent, Git ownership, scope, workspace claim, and final authority preconditions without executing acceptance descriptors; deterministic QA executes them after implementation. The routine task proceeds from that single confirmation through enrollment, execution, and QA without a second human stop. Do not request confirmation for local in-scope edits, local verification, ordinary Direct rework, scoped diff review, or completion reporting. Managed evidence, QA, Review, and completion authority remain governed by their Managed contracts; R2 does not weaken them. Managed native-authority failures fail closed with one stable reason and exactly one same-Host recovery action; never offer a Pi, Direct Path, cross-Host/worktree, unmanaged, or automatic-retry fallback.
 
 For an unborn symbolic Git HEAD, the same Enrollment confirmation discloses an empty root commit. After approval, the Host creates that commit without staging project content or changing the index/worktree, then revalidates ownership and rehearses Enrollment against the new base. Git identity uses existing environment/config values with an explicit automation fallback, never config writes. Decline or pre-initialization cancellation leaves HEAD unborn; if later Enrollment fails or is cancelled, report the remaining commit. Invalid Git refs are errors, not initialization candidates.