immune-brain 4.4.0 → 4.5.0

package/plugins/immune-brain/dist/docs/reference/subagent-dispatch-protocol.md

@@ -4,6 +4,18 @@
 
 ## Eligibility
 
+Before any dispatch, state the bounded question and scope: the question being
+investigated, the named paths the probe may read, the expected evidence, and the
+stop condition that closes the probe. A probe without a stated stop condition is
+an open-ended sweep, not a bounded one.
+
+Read known paths directly first. Expand along proved callers, dependencies, and
+state owners only when a concrete missing fact requires it, and stop once the
+question is closed; do not continue reading because a path is nearby. Repository-wide
+listings, unrelated directories, and other projects' session logs are out of
+scope. Project-specific log or history searches stay inside the named project
+paths; do not scan external session directories unless the user explicitly asks.
+
 派发前依次执行：
 
 1. 从任务摘要、changed paths 和显式请求分类为 `trivial`、`single_domain`、`multi_domain` 或 `high_risk`。
@@ -13,6 +25,23 @@
 
 常用 fallback reason：`cost_scope_mismatch`、`unavailable_environment`、`host_authorization_required`、`trigger_not_hit`、`unclear_boundary`。
 
+### Parallel Local Calls And Partial Results
+
+Independent local calls may be issued together and their results inspected
+together, `Promise.allSettled`-style, so one failure does not discard the other
+results. Dependent actions stay ordered: an action that needs another's output
+waits for it. Do not use a settled-all barrier for work that has a real sequence
+dependency.
+
+When output is truncated, continue in bounded pages only while the material is
+still needed for the question; do not restart the read from the top or expand it
+into a full-file sweep. Before retrying an operation that may have partially
+succeeded, inspect what it already produced: a partial edit or partial write is
+retried only for the part that is actually unfinished, never replayed wholesale.
+Telemetry and tool-call counts are observational; they never justify omitting
+evidence the question still requires, and they are not comparable to another
+session's numbers unless the inputs and environment match.
+
 ## Authorization
 
 Canonical project grant:
@@ -103,6 +132,7 @@ Parent workflow role 必须：
 3. 保留 source lens 和 candidate attribution。
 4. 把 partial/error 标记为 `degraded`。
 5. 保留自身 baseline review，不把最终判断权交给 child。
+6. 报告 partial 结果时说明哪些部分已完成、哪些仍未完成，不把部分结果当作完整结果。
 
 普通 advisory/discovery 的每次启动都消耗一个 candidate budget slot；失败、取消、timeout 或 result_untrusted 均丢弃该输出且不得自动重试。Parent 仅在剩余候选仍独立有用且 evidence budget 仍需要时继续，否则转 solo/fail-closed fallback，并记录 `dispatch_failed` 或 `child_timeout`。Read-only eligibility 与 Pi 的 one-foreground-child 调度限制是两回事：只读调查可同时存在多个待派发候选，但实际执行仍逐个 foreground child 串行消费，不得把多个 foreground Agent 假定为并发 batch。该规则不改变 Kernel authority Review 的显式恢复协议。Child 永远不获得实现、Plan write、workflow mutation 或 QA closure authority。
 

package/plugins/immune-brain/dist/imm-brainstorm.md

@@ -65,6 +65,24 @@ delta and explain the new evidence. An explicit defer stops its subtree and is
 recorded as `BR-DEFER-*`; if the subtree still changes the current Result,
 interface, or compatibility, explain why it cannot be deferred.
 
+Every sourced branch closes as resolved, explicitly excluded, explicitly
+deferred, or dependent-blocked with its blocking prerequisite named. An excluded
+or deferred branch is a recorded decision, not a silent omission; a
+dependent-blocked branch blocks only its dependent commitment and is reported as
+an open node. Coverage is complete when every sourced branch carries exactly one
+of those four states, and no branch is dropped for being inconvenient, expensive,
+or downstream. Exhaustive-interview mode changes interview breadth, never this
+coverage. A clear zero-question request performs the same coverage check over
+the request, repository evidence, and confirmed parent decisions before it hands
+off.
+
+Do not narrow a confirmed outcome into a smaller deliverable. "Do X fully" is
+not satisfied by "do part of X", and a dependency ordering such as "prototype
+first" is not a scope reduction such as "prototype only". A generalized
+integration-to-CLI or prototype-first-to-prototype-only narrowing presented as
+the complete result is a conservation failure; the handoff completeness check
+rejects it instead of accepting the smaller deliverable.
+
 Brainstorm finishes when the material decision frontier is empty and no blocked
 fact prevents the current handoff. Independent framing may continue while a
 dependent subtree is blocked. If the user
@@ -97,6 +115,7 @@ empty, or report remaining blocked/open nodes if the user stops early.
 
 - **Trigger Shape**: Explicit Brainstorm entry permits proportionate clarification, including a zero-question handoff for a clear request. Read the exhaustive protocol only on an explicit request for thorough interrogation. Do not add a second confirmation for an unchanged final summary.
 - **Decision Provenance**: Investigate evidenced current-goal uncertainty. A concrete scenario is relevant when the request, repository, or a settled parent decision makes it material; do not invent speculative future needs.
+- **Relevant Coverage**: Traverse every sourced branch — from the user request, repository evidence, or a settled parent decision — to one closing state: resolved, explicitly excluded, explicitly deferred, or dependent-blocked with the blocking node named. Ask only on the currently unblocked frontier, so a dependent-blocked branch stays open instead of being asked early or silently omitted. Coverage is a property of the traversal, not of the question count: a zero-question fast path and a bulk approval close the same branches the exhaustive traversal would.
 - **Dependency-Aware Rounds**: Ask every independent question on the complete currently unblocked frontier together. Ask fewer questions only because dependencies keep downstream branches blocked, never because of an arbitrary question budget.
 - **Read-only by default**: Inspect context and summarize the problem. do not implement inside this skill.
 - **Handoff**: Write concise design notes under `docs/brainstorms/` only if explicitly requested.
@@ -111,6 +130,8 @@ empty, or report remaining blocked/open nodes if the user stops early.
 
 Follow [`docs/reference/subagent-dispatch-protocol.md`](docs/reference/subagent-dispatch-protocol.md) for the full dispatch lifecycle. This section defines brainstorm-specific optional research dispatch.
 
+Before any research path that leaves the repository — an external model or provider call, a fetch of non-project content, or sending project data off-host — check the project's existing research channel and data scope. Documentation, mocks, and local read-only reads are not real-channel evidence, and a public article does not select or authorize a provider. Consume the existing channel; a genuinely new channel or data scope is a material delta that needs its own authorization. Report documentation, mock, real-channel, and model-quality evidence as distinct claims rather than one undifferentiated "verified".
+
 Runtime helpers: `imm_core.buildBrainstormEnsembleRequest`, `imm_core.buildBrainstormEnsembleDispatchEnvelopes`, `imm_core.normalizePiBrainstormAgentResults`, and `imm_core.normalizeBrainstormEnsemblePacket`.
 
 ### Brainstorm Ensemble Advisory

package/plugins/immune-brain/dist/imm-loop.md

@@ -74,8 +74,12 @@ Continue while the current projection has a valid action:
 4. Follow the returned Kernel obligation. Fresh QA suffices for routine work;
    material and critical work additionally require fresh independent Review.
    Normal completion does not require a second user confirmation.
-5. For rework, follow the projected artifact state before editing. Resolve
-   findings only after fixing and verifying their cause. Changed snapshots
+5. For rework, follow the projected artifact state before editing. Submit the
+   rework verdict first, then edit: staging an in-scope change while the
+   artifacts are frozen invalidates the snapshot and discards that verdict,
+   forcing a fresh QA round. After the Kernel returns the artifacts to active,
+   make the fix, resolve findings only after fixing and verifying their cause,
+   then run the newly required obligations. Changed snapshots
    invalidate old evidence; run the newly required obligations. On the second
    rework of one acceptance id or anchor, the fix response must either state why
    it covers every known trigger class of the violated invariant — the shared
@@ -116,6 +120,23 @@ batch state transition: the shared `startBatch` driver in
 `runtime/unattended/` owns every batch transition, and each child is still
 enrolled, assured, and settled by the Kernel under an ordinary TaskRecord.
 
+A successful child Enrollment returns a `running` report with `handoff.role`
+`executor`; the child remains `enrolled`. The Parent implements that TaskIntent
+in the current foreground conversation, stages only its scoped changes, and
+runs focused diagnostics before Kernel Assurance. Re-entering the batch before
+implementation returns the same handoff without QA or another confirmation.
+The runtime owns no model invocation and adds no persisted execution lifecycle.
+
+After diagnostics pass, the Parent advances Kernel QA and dispatches any reserved
+foreground Review once using the exact returned `agent_params`, then submits its
+structured verdict. An open Review reservation stays with that Host invocation;
+batch re-entry waits for it rather than redispatching. On Kernel `done`, stage
+only that child's generated terminal audit evidence and call
+`start_unattended_batch` with the same slug. The driver reconciles settlement,
+adopts or creates the one scope-bound commit, then enrolls the next ready child
+under the still-valid authorization. Ordinary Executor handoff and below-limit
+QA repair do not park the batch; genuine budget/authority stops remain fail-closed.
+
 Batch execution never pushes a ref, opens or updates a pull request, resolves a
 user decision, or creates, switches, or deletes a Git worktree. Its sole Git
 effect is the batch branch `imm/<initiative-slug>` plus one scope-bounded commit
@@ -123,6 +144,27 @@ per completed child.
 
 ## Decisions and Recovery
 
+- Resume from authority facts, not prose. After an uncertain interruption, bind
+the exact `task_id`, `run_id`, record revision, lifecycle, artifact state,
+obligation, and claim from the Kernel projection before acting. A compaction
+heading, a Handoff summary, an Issue state, or any other prose summary is not
+authority and can be stale or wrong: when it conflicts with the projection,
+correct the prose and resume the existing owner instead of trusting the summary.
+- The workflow stages are distinct and never inferred from one another:
+authored, validated, published, enrolled, assured, and completed each require
+their own evidence. An open or closed Issue is not Enrollment or completion; a
+published Issue is not Enrollment; a plan-only delivery is not execution
+readiness.
+- Consume a successful operation's fresh projection directly. Do not add a
+status read after an operation that already returned the current projection, and
+never repeat a mutation merely to re-observe its result. Kernel CAS and
+freshness checks remain mandatory, and reducing Parent reads does not bypass
+them.
+- A falsely claimed later-Slice enrollment is a summary defect, not authority.
+Retain the actual owner, and do not create or replay a mutation, gate, or
+completion to match the prose. Summary production outside this repository is not
+locally fixed; the consumer-side protection is these rules, and a producer bug
+is recorded as a separate follow-up rather than resolved here.
 - Scope expansion returns to Planner's Enrolled Intent Revision route. Planner
   prepares the complete proposed revision without replacing the active owner;
   the current Loop submits it through Kernel revision authority. Collect all
@@ -130,6 +172,14 @@ per completed child.
   reasons in one request. Do not edit outside scope while waiting or widen it
   piecemeal without new evidence. Bounded test or PR repair stays inside the same
   TaskIntent.
+- Effects are separate grants. A stage-only recovery restores staging and grants
+  no commit, push, or publication; an existing exact approval, including a valid
+  batch capability bounded to one child, stays usable without another chat gate.
+  Before a new outbound research call, check the project's existing channel and
+  data scope; a public article, a mock, or a local read-only database authorizes
+  no new provider or data effect.
+- Text instructions are contracts, not a hard bash sandbox. They guide and are
+  reviewed; the Kernel authority gates remain the real boundary.
 - Invoke `approve_breaking_intent_revision` with the complete next intent
   directly; the native Host gate is the single user decision. Do not overwrite
   enrolled intent sidecars or ask for chat pre-confirmation.
@@ -147,8 +197,24 @@ per completed child.
   and exactly one same-Host recovery action. Never recommend another Host,
   worktree, Direct Path, unmanaged implementation, or automatic retry.
 - After interruption, read a fresh projection and run only the pending obligation.
-  A committed QA result is honored; an interrupted precommit QA run produces no
-  approval. Do not rerun fresh QA simply because Review was interrupted.
+  `recovery` carries that task/run/record identity, affected acceptance/finding IDs
+  and one legal `next_action`; it is an observation, never execution readiness.
+  Own-claim technical rework goes to foreground Executor, not user authorization.
+  `review_preparation_failed` keeps the batch running/enrolled: repair the Review
+  evidence environment and resume `run_review`, retaining fresh QA without batch
+  re-confirmation.
+  Repair and verify the cause, then dispose each identified finding explicitly by
+  `resolve_finding` or evidence-bound `refute_finding`. Local green cannot close
+  findings or settle the task; obtain fresh Kernel QA and required Review.
+  Environment preparation/resolution/integrity failure is not an assertion finding.
+  Use its canonical descriptor reference/digest, phase/outcome, timing and byte
+  counts to diagnose; QA diagnostic metadata is capped at 16 KiB and contains no
+  stdout/stderr, argv, environment values or arbitrary executor error text.
+  A frozen child with `run_qa` pending returns to Parent; batch re-entry does not
+  blindly retry an unchanged failure. Fix the environment before a fresh attempt.
+  Scope/authority exceptions still use their existing native gates. A committed
+  QA result is honored; an interrupted precommit QA run produces no approval.
+  Do not rerun fresh QA simply because Review was interrupted.
 - Malformed or stale reviewer output is not a verdict. Keep the existing
   reservation only if the Host reports it valid; use its exact recovery action.
   Do not fabricate a pass or blindly redispatch Review.
@@ -207,6 +273,12 @@ Stop reason:
 Next action:
 ```
 
+Every line reports authority evidence, not prose inference: name the exact
+task/run identity and the observed lifecycle, artifact, obligation, and claim
+facts that decided the exit. If a summary claimed more than the projection
+proves — for example a later Slice as enrolled or the task as completed — report
+the projection instead and correct the prose.
+
 ## Failure Output
 
 For `settlement_unknown`, call `advance_assurance` once to reconcile the Kernel

package/plugins/immune-brain/dist/imm-planner.md

@@ -49,6 +49,25 @@ decisions. Resolve a local delta here. If the answer reopens multiple product
 branches or changes the overall goal or Scope, stop and return to
 `imm-brainstorm`.
 
+Before handoff, run one handoff completeness check over the closed-world
+manifest: map every upstream item and every required phase exactly once, report
+each Slice's closable result plus the remaining gap, and confirm the complete
+confirmed outcome and its phases are actually delivered. Upstream items close as
+covered, decisioned, deferred, or out with a reason; a required phase is the
+confirmed outcome itself, so it must be delivered rather than closed out with a
+reason. A reason excuses an upstream item, never a still-required phase: dropping
+one is exactly the silent narrowing this check exists to catch, and the genuine
+reduction is a user decision that returns to `imm-brainstorm` and changes what
+was required. The check fails, and the candidate is not handoff-ready, when a
+required phase or upstream item has no mapping, or when the plan conserves a
+smaller deliverable than the confirmed outcome. An outcome-narrowing
+substitution is such a failure: a confirmed full integration presented as one
+pairwise CLI, or a `prototype first` dependency presented as `prototype only`.
+Both are conservation failures, not scope decisions, and the checker rejects
+them instead of accepting the reduced deliverable. Coverage is independent of
+question count, so a clear request and an already-confirmed decision still pass
+the same check without acquiring an extra confirmation.
+
 Direct Planner entry remains valid for a clear request and does not require a
 Brainstorm pass. Resolve facts and derive technical design; if an unresolved
 user-owned product decision appears, return to `imm-brainstorm` rather than
@@ -327,9 +346,36 @@ before execution. Report `valid` and `enrollment_ready` only as structural and
 Enrollment readiness; only a completed deterministic QA result proves that a
 descriptor executed and passed.
 
+**Acceptance-to-invariant mapping.** Trace each acceptance assertion to an
+observable invariant at a real seam, then name the positive, negative, and bound
+controls that exercise it. Name the controls explicitly instead of relying on
+the happy path: a happy path alone never proves a guard. The six generalized
+motivating classes to check for are: normalization precedes retrieval (an input
+is normalized before it is used to retrieve); validation precedes merge (a
+rejected input never enters the merged state); the deadline covers the whole
+lifecycle including cleanup; ranking tolerates missing embeddings (an absent
+signal is ranked, not silently skipped); the budget covers the complete
+serialized request; and each success, failure, and timeout outcome carries its
+own duration evidence. These are workflow-quality input patterns, not requests
+to edit the original applications that motivated the audit.
+
+**Environment and prerequisite discipline.** A descriptor that needs a
+prerequisite states its provenance and how it is obtained. Preparation must not
+hide a download, credential use, production write, or system change: authorize
+it explicitly, or redesign the check to avoid it. Require cleanup on failure and
+interruption, and restoration of any explicitly authorized setting. An absent
+dependency, a missing simulator, or a preparation failure is a failed check, not
+a pass. Zero matched checks and skipped required checks are failures: a required
+check that selects no test, or that is skipped, must fail the acceptance rather
+than silently succeed. Separate automated behavioral or geometry evidence from
+human judgment of motion quality; a descriptor can assert only the automated
+half. Textual presence in a contract string is not proof that a provider obeyed
+it, and structural Enrollment readiness is not proof that a descriptor executed.
+
 ## Core Responsibilities
 
 - **Decomposition**: Convert requirements into one or more TaskIntents. Add a Spec under `docs/specs/` only for complex work. Treat Technical Design as one TaskIntent decomposition dimension alongside outcome, Verification, dependency, risk, rollback, compatibility, and authority.
+- **Outcome Conservation**: The plan conserves the complete confirmed outcome and its required phases. A required phase is delivered, not closed out with a reason; a genuine reduction changes what the user confirmed and returns to `imm-brainstorm`. A generalized substitution such as full integration becoming a pairwise CLI, or `prototype first` becoming `prototype only`, is a completeness-check failure rather than a valid plan. Each Slice reports its closable result and the remaining gap so an omitted phase is visible instead of implied.
 - **Outcome Focus**: Each TaskIntent owns one independently verifiable outcome. Implementation batches are Executor work, not separately authorized read/edit/run Steps.
 - **Planning granularity**: Keep a coherent outcome together when acceptance, risk, rollback, and authority can settle together. Use the TaskIntent decomposition rules below for independent outcomes. File count, tokens, compactions, elapsed time, and review rounds are evidence for judgment, not universal gates.
 - **Historical artifacts**: v3 prose Plan mutation is retired. `imm-plan` is a read-only validator for archived Plans; create no new Roadmap, Phase, successor Plan, or State Ledger.
@@ -340,7 +386,7 @@ descriptor executed and passed.
 - **Technical Design Authority**: The Spec is the single Technical Design baseline. TaskIntent acceptance and scope reference the applicable design decisions or invariants without copying Technical Design prose. If discovery invalidates the baseline, stop execution and return to Planner to update the Spec and decide whether `replan` is required. TaskIntent and Initiative text do not duplicate Technical Design prose or become a prose Plan substitute.
 - **TaskIntent decomposition**: Use the selected design boundaries as one retain/split criterion for TaskIntent slices. Keep work in one TaskIntent when the selected views describe one coherent executable slice with shared acceptance, risk treatment, rollback, and authority. Split a successor TaskIntent when a service boundary, state-machine owner, migration/compatibility boundary, independently promotable layer, or sequence dependency needs independent verification, rollback, authorization, or settlement. Do not split merely because the design names several layers, files, or services. Treat trust-boundary changes as the same kind of decomposition evidence: a TaskIntent should normally change one primary trust-boundary invariant, while merely traversing several boundaries or updating both sides of one end-to-end authority chain does not require a split. Split separate trust invariants when they can be independently verified, rolled back, authorized, migrated, or settled. Keep multiple trust-boundary changes together only when they form one atomic security outcome and splitting would create an unsafe or unusable intermediate state; record that reason in the Spec. This is Planner judgment, not a TaskIntent schema field or an Enrollment counting rule. This does not revive prose Plan, Roadmap, or Phase authority.
 - **Mermaid Use**: Mermaid is required only when a medium/high-risk design contains structure, sequence, data flow, or state transition relationships that a diagram materially clarifies. Mermaid is not a universal gate; a diagram supplements adjacent prose and never becomes a second design authority. Medium/High risk Specs record `**Diagram decision**: required|not_required` and a non-empty `**Diagram reason**:`. A `required` decision must have a Mermaid block; `not_required` explains why prose is sufficient. Low-risk Specs omit the empty ceremony and record neither field.
-- **Verification**: Every acceptance assertion has a concrete focused descriptor that can fail on the intended regression. Hypothetical evidence is not execution-ready.
+- **Verification**: Every acceptance assertion has a concrete focused descriptor that can fail on the intended regression, and every named invariant has positive, negative, and bound controls at an observable seam. Hypothetical evidence is not execution-ready; a check that matches zero tests, is skipped, or lacks its prerequisite is a failure rather than a pass.
 - **Executable Scope**: `scope_hint` is the mutation envelope, not discovery context. Close references across callers, tests, generated mirrors, and state-machine owners before authoring. Simple tasks are TaskIntent-only. A complex task binds at most one active Spec by content identity; do not add archive paths for freeze, and do not relocate artifacts. Collect all known scope gaps in one revision request; ask again only when new evidence changes the boundary.
 - **Devil's Advocate Preplan Audit**: Medium/High risk work records a `Devil's Advocate Audit` in its Spec covering rollback resilience, verification vanity, and spec dilution detection. Explain recovery from partial implementation, why verification detects the regression, and how accepted requirements remain covered. Simple TaskIntent-only work records outcome, boundary, and concrete verification on the Intent. Low-risk work omits the empty template.
 - **Execution posture**: Record `test-first` or `characterization-first` on the Spec when the work is complex, otherwise on the TaskIntent, when explicitly requested or justified by fragile untested behavior. The Executor owns the local choreography; do not create prototype or RED/GREEN/REFACTOR authority Steps. Throwaway probes must have a cleanup condition and a durable decision output.
@@ -433,11 +479,23 @@ preparation does not apply the revision or authorize expanded execution.
   verification descriptors or add a mandatory user confirmation.
 - **Review Mapping**: In-scope rework stays with the enrolled TaskIntent and explicit `imm-loop` entry. Cross-scope findings become a Planner decision delta with concrete missing paths and verification evidence; do not create a successor prose Plan.
 - **Brainstorm Manifest Mapping**: Record every upstream `BR-*` item in a Spec `Brainstorm Trace` when the work is complex, otherwise on the TaskIntent, mapped to acceptance, a captured decision, or an explicit reason for deferral or exclusion. Resolve every `BR-Q-*` item before handoff. Do not silently narrow confirmed framing.
+- **Handoff Completeness Check**: Before reporting a candidate as handoff-ready, confirm every upstream item and required phase is mapped exactly once, that required phases are delivered rather than excused by a reason, and that no confirmed outcome was conserved as a smaller deliverable. Reject a narrowed deliverable as a completeness failure; ask again only for a new material delta, never to reconfirm an unchanged clear request or an already-confirmed decision.
 - **Session Lifecycle Ownership**: The user chooses the current or a new session. Tokens, compactions, tool counts, elapsed time, and review rounds never trigger automatic session creation or termination. Recovery uses TaskRecord and the fresh Kernel projection.
 - **Subagents**: Only when optional research is needed, read Research Dispatch and its shared dispatch reference. Default to inline evidence gathering. Plan conditional reviewers such as `security-reviewer` only if their trigger surfaces are explicit; do not manufacture them.
 - **Enrolled Intent**: Follow Enrolled Intent Revision for a Loop-requested scope or acceptance change; candidate preparation never changes the current owner or grants execution authority.
 - **CONTEXT.md Vocabulary**: Consult the relevant `CONTEXT.md` terms when domain meaning is unclear or changes; known file-local tasks do not require a full root-document read. `CONTEXT.md` is vocabulary and architecture navigation, not execution state.
 - **Discovery Protocol**: Read `CONTEXT.md` `## Architecture Map` before broad searching; consult relevant `docs/solutions/` evidence under Clarification supplement's history trigger. Record concrete file pointers and reasons in the Spec when one exists, otherwise on the TaskIntent. Do not read or write a legacy Step discovery cache.
+
+**Bounded discovery.** State the question, the named paths, the expected evidence,
+and the stop condition before an investigation expands. Read known paths directly,
+expand only along proved callers and state owners, and stop once the question is
+closed instead of continuing into nearby unrelated paths. Keep project-specific
+log or history searches inside the named project paths. Reads or investigation
+output that is truncated continue in bounded pages only while still needed, and an
+operation that may have partially succeeded is inspected before it is retried for
+only its unfinished part. Telemetry and tool-call counts are observational: they
+never justify dropping evidence the question requires, and they are not comparable
+to another session's numbers unless the inputs and environment match.
 - **Planning Quality Gate**: For elevated-risk complex work, verify contract surfaces, compatibility, interruption recovery, rollback, verification strength, and Brainstorm traceability in the Spec. Simple TaskIntent-only work verifies those properties on the Intent. Do not invoke retired Plan mutation or State Ledger synchronization.
 - **Parallel Probes**: Optional read-only probes must have bounded non-overlapping scopes, expected evidence, and no file or authority writes. They are advisory discovery, not persisted Step annotations. Probe failure falls back to inline investigation with a recorded reason.
 
@@ -445,6 +503,8 @@ preparation does not apply the revision or authorize expanded execution.
 
 Follow [`docs/reference/subagent-dispatch-protocol.md`](docs/reference/subagent-dispatch-protocol.md) for the full dispatch lifecycle. This section defines planner-specific optional research dispatch.
 
+A discovery path that leaves the repository — an external model/provider call or sending project data off-host — first checks the project's existing research channel and data scope. Architecture exploration and local reads stay on the existing channel; a new channel or data scope is a material delta with its own authorization, and documentation, mock, or local read-only evidence never substitutes for real-channel evidence.
+
 Use the invoking Host's read-only role-boundary route for bounded
 `arch-explorer` and explicit-lens `advisory-reviewer` routing. Invoke the returned foreground Agent envelope
 exactly. The Parent owns Spec/TaskIntent synthesis, Brainstorm traceability,
@@ -492,14 +552,18 @@ a State Ledger. Keep historical Plan validation strictly read-only.
 | Split one outcome into read/edit/run micro-steps | One TaskIntent owns one closable outcome; Executor owns implementation batches. |
 | Append repair outside scope | Return the complete known scope delta for Kernel revision; do not widen execution. |
 | Drop a brainstorm-confirmed item as "out of scope" without saying so | Closed-world handoff: every `BR-*` ID must be covered, decisioned, deferred, scoped out with reason, or resolved as an assumption. |
+| Conserve a narrower deliverable than the confirmed outcome | **Conservation failure**: a full integration is not a pairwise CLI and `prototype first` is not `prototype only`; the handoff completeness check rejects the reduced deliverable instead of accepting a reason for it. |
 | Finalize dependent planning while brainstorm questions are open | **Clarification Barrier**: Finalization and dependent commitments are blocked until required `BR-Q-*` items are answered. Independent investigation and explicitly unapproved alternative drafts may continue; silence is not consent. |
 | Skip adversarial self-review on Medium/High risk because the plan is small | **Devil's Advocate** audit still checks rollback resilience, verification vanity, and spec dilution before the plan is treated as execution-ready. |
 
 ## Red Flags
 
 - Acceptance verification names only hypothetical evidence with no runnable descriptor.
+- An acceptance descriptor names no negative or bound control for its invariant, or its required prerequisite (dependency, simulator, preparation) is absent and still counted as a pass.
+- A required check matches zero tests or is skipped and the run is reported as passing.
 - New work depends on a prose Plan validator, Step activation, or State Ledger.
 - A Brainstorm manifest lacks complete `BR-*` coverage on the Spec (complex) or TaskIntent (simple).
+- The handoff completeness check passed while a required phase or upstream item is unmapped, or while the plan delivers only part of the confirmed outcome.
 - A Medium/High risk Spec lacks a `Devil's Advocate Audit` covering rollback resilience, verification vanity, and spec dilution detection.
 - New Spec prose ignores the document-language policy.
 - Candidate artifacts escape the approved planning scope.

package/plugins/immune-brain/dist/role-prompts/code-review.md

@@ -34,6 +34,25 @@ about the fix's scope, not a new bug. A trigger the accepted contract explicitly
 excludes is reported as an advisory note against that boundary, never as blocking
 rework.
 
+## Invariant and Evidence Coverage
+
+Judge whether the change actually closes the invariant its acceptance names,
+not only the path the report mentions. A fix that covers one trigger but leaves
+another trigger of the same invariant is a coverage gap in the same class, not a
+new independent bug: say so and name the class. Check the negative and bound
+behavior, not only the happy path. The six generalized classes worth checking
+are: normalization precedes retrieval, validation precedes merge, the deadline
+covers the whole lifecycle including cleanup, ranking tolerates missing
+embeddings, the budget covers the complete serialized request, and each success,
+failure, and timeout outcome carries its own duration evidence.
+
+A required check that is skipped, that matches zero tests, or whose prerequisite
+is absent does not prove the acceptance; do not accept it as evidence. Full
+suite coverage reported at a coarse pass count is not per-invariant evidence.
+Environment, preparation, and cleanup breakdowns are environment findings, not
+assertion findings. Keep automated behavioral or geometry evidence separated
+from a human quality judgment.
+
 Return exactly one JSON object with the fields required by the Loop review
 contract: `contract`, `role`, `task_id`, `snapshot_digest`, `decision` (`pass`
 or `rework`), and for `pass` include `approval` (`kind`, `authority_role`,

package/plugins/immune-brain/dist/role-prompts/executor.md

@@ -6,6 +6,12 @@ same-boundary follow-up) in the current Parent conversation. New helpers or
 tests inside an approved directory or glob do not require a revision. Keep
 every edit inside the authorized envelope; do not stage unrelated user files. Do not discover or load a Pi Skill.
 
+On a batch `handoff.role=executor`, implement only its named enrolled child;
+the batch stays `running` with that child `enrolled`. Return to the Parent after
+scoped implementation, staging and focused diagnostics. Enrollment itself does
+not start QA; the Parent owns the subsequent Kernel Assurance and foreground
+Review handoff under the same still-valid batch authorization.
+
 Before handoff, run the permitted diagnostic checks and return commands and
 outcomes to the Parent as structured diagnostic evidence. The read-only Loop
 runtime action only constructs the dispatch envelope; it does not store

package/plugins/immune-brain/dist/role-prompts/qa.md

@@ -20,4 +20,16 @@ Plan remains a literal-user decision.
 For elevated-risk work, check the latest referenced Spec's Design Conformance
 against implementation evidence. A local implementation mismatch is `rework`;
 return `rework` with bounded repair evidence. A structural or intended design
-change is `replan`; return `replan` with the missing design fact. QA must not approve a changed design or silently accept a deviation. If the checkpoint is `awaiting_user_successor_decision`, stop without dispatch; only a literal user may invoke `--approve-successor`.
+change is `replan`; return `replan` with the missing design fact. QA must not approve a changed design or silently accept a deviation.
+
+Judge the recorded execution evidence, not the descriptor text. A required check
+proves an acceptance invariant only when it actually executed and passed: an
+absent dependency, a prerequisite preparation failure, a skipped required check,
+or a check that matched zero tests is a failure, not a pass. Structural
+"Enrollment ready" or "descriptor valid" is not execution evidence, and a
+contract string proves nothing about provider behavior. Automated behavioral or
+geometry evidence cannot stand in for a human motion-quality judgment, and vice
+versa; keep the two claims separate. Environment, preparation, and cleanup
+breakdowns are environment findings, not assertion findings: report them with
+the descriptor reference and observed outcome rather than as a code defect.
+ If the checkpoint is `awaiting_user_successor_decision`, stop without dispatch; only a literal user may invoke `--approve-successor`.