immune-brain 4.4.0 → 4.5.0

package/plugins/immune-brain/skills/BASELINE.md

@@ -9,6 +9,20 @@
 - Stage only explicit task-owned paths. This staging authority does not grant
   commit, push, broad staging, or authority over pre-existing user changes.
   Never use `git add .` or `git add -A` in a dirty worktree.
+- Grant effects separately: staging, commit, push, publication, and outbound
+  model/data calls are distinct operations. Recovering a stage-only instruction
+  restores staging and nothing more; commit, push, and publication each keep
+  their own existing grant. An explicit approval already covering the same
+  operation, target, and impact — including a valid batch capability — stays
+  usable without another gate.
+- Before a new outbound effect, check the project's existing research channel and
+data scope. A public article, a mock, a documentation example, or a local
+read-only database gives no authority to call an arbitrary provider or send new
+data; authorize only a genuinely new channel/data/effect delta. Distinguish
+documentation, mock, real-channel, and model-quality evidence when reporting.
+- These text rules are instruction contracts, not a hard bash sandbox. They
+guide behavior and are checked as contracts; they do not technically prevent an
+arbitrary shell command, so authority gates and review remain the real boundary.
 - Do not create, switch, or delete Git worktrees; operate only in the Host launch directory.
 - Record reproducible evidence before reporting closure.
 - Required verification must pass before reporting completion; disclosing a gap is not a substitute. Autonomously diagnose, repair, and rerun failing conventional local checks within the authorized scope; never delete, skip, or weaken a valid check to manufacture a pass. If a required check remains failing or cannot run, report the work as incomplete with the concrete blocker.
@@ -81,7 +95,6 @@ non-Kernel operations, an explicit user approval already covering the same
 operation, target, and impact is sufficient; ask again only for a material delta.
 A generic continuation or configured preference is not blanket authorization.
 Mandatory native gates and hash-bound manifest approvals still apply.
-
 Privileged effects include:
 
 - publish, release, deployment, or remote-system mutation;
@@ -91,6 +104,10 @@ Privileged effects include:
   override; and
 - external writes whose target or impact cannot be safely reversed locally.
 
+An existing grant for one of these never inherits another: a stage-only
+instruction stays stage-only, a commit is not push or publication authority,
+and a valid batch capability commits only its own scope-bounded child.
+
 Routine Managed enrollment uses one current-Host native confirmation bound to the TaskIntent content hash after Planner validation. Explicit Plan-only requests stop with candidate artifacts and do not invoke Enrollment; execution-bearing requests open the native gate directly without chat pre-confirmation. Enrollment validates intent, Git ownership, scope, workspace claim, and final authority preconditions without executing acceptance descriptors; deterministic QA executes them after implementation. The routine task proceeds from that single confirmation through enrollment, execution, and QA without a second human stop. Do not request confirmation for local in-scope edits, local verification, ordinary Direct rework, scoped diff review, or completion reporting. Managed evidence, QA, Review, and completion authority remain governed by their Managed contracts; R2 does not weaken them. Managed native-authority failures fail closed with one stable reason and exactly one same-Host recovery action; never offer a Pi, Direct Path, cross-Host/worktree, unmanaged, or automatic-retry fallback.
 
 For an unborn symbolic Git HEAD, the same Enrollment confirmation discloses an empty root commit. After approval, the Host creates that commit without staging project content or changing the index/worktree, then revalidates ownership and rehearses Enrollment against the new base. Git identity uses existing environment/config values with an explicit automation fallback, never config writes. Decline or pre-initialization cancellation leaves HEAD unborn; if later Enrollment fails or is cancelled, report the remaining commit. Invalid Git refs are errors, not initialization candidates.

package/plugins/immune-brain/skills/imm-brainstorm/SKILL.md

@@ -28,3 +28,8 @@ When framing discusses later execution, describe Enrollment only as the
 current Host's native gate. A failed Managed authority interaction stays
 fail-closed: report one same-Host recovery action, never another Host,
 worktree, or unmanaged implementation.
+
+Every sourced branch closes as resolved, explicitly excluded, explicitly
+deferred, or dependent-blocked with its blocking node named, including for a
+clear zero-question request; a confirmed outcome is never conserved as a
+smaller deliverable.

package/plugins/immune-brain/skills/imm-loop/SKILL.md

@@ -11,7 +11,9 @@ ordinary host input never resumes a Managed owner implicitly.
 
 Mandatory constraints before any action: verify the active backend claim,
 TaskIntent, and TaskRecord via `imm_kernel_canary` `status` first; invalid or
-contradictory projections fail closed. All Managed authority gates use the
+contradictory projections fail closed. Resume only from those authority facts:
+a compaction heading, HANDOFF summary, or Issue state is prose, never authority.
+All Managed authority gates use the
 current Host's native interaction. A failed gate stays fail-closed and
 reports one same-Host recovery action; never suggest another Host, worktree,
 or unmanaged implementation as a fallback.
@@ -24,5 +26,5 @@ or all references as an entry prerequisite.
 - common: [Shared Guards](../../dist/BASELINE.md#shared-guards), [Workflow Activation](../../dist/BASELINE.md#workflow-activation), [Host Confirmation Boundary](../../dist/BASELINE.md#host-confirmation-boundary), [Kernel Canary Routing and Authority](../../dist/imm-loop.md#kernel-canary-routing-and-authority)
 - unattended batch run, or any question about whether `imm-loop` starts one: [Unattended Batch Opt-In](../../dist/imm-loop.md#unattended-batch-opt-in)
 - steady execution: [Verification and Local Recovery](../../dist/BASELINE.md#verification-and-local-recovery), [Execution Loop](../../dist/imm-loop.md#execution-loop), [Observable Output](../../dist/imm-loop.md#observable-output)
-- rework, scope expansion, breaking revision, user decision, stop, interruption or unknown state before any action: [Decisions and Recovery](../../dist/imm-loop.md#decisions-and-recovery), [Failure Output](../../dist/imm-loop.md#failure-output); re-read `status`, then the pending obligation
+- rework, scope expansion, breaking revision, user decision, stop, interruption or unknown state before any action: [Decisions and Recovery](../../dist/imm-loop.md#decisions-and-recovery), [Failure Output](../../dist/imm-loop.md#failure-output); re-read `status`, then the pending obligation. Rework submits the verdict before editing, and an uncertain interruption resumes from exact task/run authority facts rather than a summary.
 - review or post-settlement learning: [Review and Learning](../../dist/imm-loop.md#review-and-learning)

package/plugins/immune-brain/skills/imm-planner/SKILL.md

@@ -11,7 +11,10 @@ host-native.
 
 Mandatory constraints before any action: Planner writes a TaskIntent, and a Spec
 only for complex work; it never implements, overwrites an enrolled TaskIntent, or
-grants execution authority — only the native Enrollment gate can.
+grants execution authority — only the native Enrollment gate can. Before
+handoff it maps every upstream item and required phase exactly once and reports
+each Slice result plus the remaining gap; a plan that conserves a smaller
+deliverable than the confirmed outcome fails that check instead of passing.
 
 Section routes - load a section's instructions only when its branch applies.
 Read each linked heading body up to the next heading; nested sections and
@@ -40,3 +43,9 @@ that include execution invoke the current Host's native Enrollment gate
 directly, without chat pre-confirmation. Native-gate failure stays fail-closed
 in that Host: report its reason and one retry action only; never suggest
 another Host, worktree, or unmanaged implementation as a fallback.
+
+Before that handoff, confirm complete mapping of every upstream item and
+required phase with each Slice's result and the remaining gap; reject a plan
+that conserved only part of the confirmed outcome, and ask again only for a
+newly evidenced material delta rather than reconfirming an unchanged clear
+request or an already-confirmed decision.