immune-brain 4.4.1 → 4.6.0

package/README.md

@@ -301,7 +301,8 @@ When an Initiative has several ready children, you can run them as one serial ba
 - **Entry is explicit:** the Host's privileged `start_unattended_batch` tool, taking the Initiative slug. Nothing batch-related exists until it is called — without it, `imm-loop` behaves exactly like per-task enrollment and creates no batch state, branch, or authorization.
 - **One confirmation, one digest:** the native gate (Pi TUI dialog or Claude MCP elicitation) shows the ordered child list and the shared plan digest; that single literal-user act is the whole Batch Authorization.
 - **Per-child authority survives:** every child is still enrolled, frozen, QA'd, reviewed, and settled by the Kernel on its own `TaskRecord`. The batch is the scope of one authorization, never a new authority layer.
-- **Bounds:** only published, non-`critical` children run, serially on a dedicated batch branch. The run parks when a child needs a human decision or a budget, deadline, authorization, or commit failure stops it, and dependents of a blocked child are skipped rather than reordered. The runner never pushes, opens PRs, resolves user decisions, or creates, switches, or deletes Git worktrees.
+- **Closeout is automatic:** when a child reaches `done` in the foreground, the same call commits it and enrolls the next child, or marks the batch `completed`, with no new gate. A parked or stopped child is never committed for you, and a failed continuation is reported beside the result with `start_unattended_batch` as the retry. A fast-forward commit you add to the batch branch is adopted; any other HEAD movement still stops the run.
+- **Bounds:** only published, non-`critical` children run, serially on a dedicated batch branch. The run parks when a child needs a human decision or a budget, authorization, or commit failure stops it; the budget is a child count and a QA failure limit, and nothing expires with time, and dependents of a blocked child are skipped rather than reordered. The runner never pushes, opens PRs, resolves user decisions, or creates, switches, or deletes Git worktrees.
 
 ---
 
@@ -361,7 +362,7 @@ docs/specs/                           # Living specs (updated in place)
 
 **A review finding stopped blocking — why?** It was refuted: fresh deterministic QA evidence shows the acceptance it names passes. The refutation is bound to that exact evidence, so the finding blocks again the moment the evidence goes stale for the current revision, intent hash, or diff.
 
-**Can it run a whole Initiative without me?** Only as far as you authorize. Confirm `start_unattended_batch` with the Initiative slug and the runner works through the published, non-`critical` children serially on one batch branch — parking as soon as a child needs a human decision or the run hits a budget, deadline, authorization, or commit failure. It never pushes, opens PRs, or settles user decisions for you.
+**Can it run a whole Initiative without me?** Only as far as you authorize. Confirm `start_unattended_batch` with the Initiative slug and the runner works through the published, non-`critical` children serially on one batch branch — parking as soon as a child needs a human decision or the run hits a budget, authorization, or commit failure. A parked run waits for you indefinitely: neither the confirmation dialog nor the authorization it grants times out. It never pushes, opens PRs, or settles user decisions for you.
 
 **Can I switch between hosts (e.g. plan in Claude Code, code in Pi)?** Yes. Immune-Brain's contracts and state live entirely on disk in the repository, decoupled from conversation sessions. You can leverage Claude Code for deep architectural thinking and Spec planning, then switch to Pi to run `imm-loop` for code execution and deterministic QA. Interrupted tasks can be resumed in either host at any time.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "4.4.1",
+  "version": "4.6.0",
   "description": "Immune-Brain agent skill system",
   "publishConfig": {
     "access": "public",

package/plugins/immune-brain/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "4.4.1",
+  "version": "4.6.0",
   "description": "Immune-Brain Claude Code Host: native Enrollment, QA, Review, and Kernel settlement.",
   "author": {
     "name": "Immune-Brain Team"

package/plugins/immune-brain/.pi-extension/imm-canary-enroll.ts

@@ -557,7 +557,6 @@ async function executeForegroundEnrollment(
 			preparation_digest: preparation.digest,
 			actor_id: LITERAL_USER_ACTOR_ID,
 			confirmation_ref: `pi-confirm-${createHash("sha256").update(`${taskId}\0${now}\0${nonce}`).digest("hex").slice(0, 16)}`,
-			expires_at: new Date(Date.now() + 10 * 60 * 1000).toISOString(),
 			nonce,
 		};
 		const capability = registry.issue(binding);

package/plugins/immune-brain/.pi-extension/imm-canary-work.ts

@@ -21,6 +21,8 @@ import { join, resolve } from "node:path";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { PLUGIN_VERSION } from "../runtime/plugin_version";
+import { findResumableBatchSlugForTask } from "../runtime/unattended/batch_preflight";
+import { executePiUnattendedBatch } from "./imm-unattended-batch";
 import {
 	parseVerificationDescriptor,
 	type VerificationDescriptor,
@@ -581,7 +583,11 @@ export default function (
 							: action.op === "request_stop"
 								? await authorizeExactOperation(taskId, "stop", { ...ctx, signal: signal && ctx.signal ? AbortSignal.any([signal, ctx.signal]) : signal ?? ctx.signal })
 								: await requestAuthorization(taskId, ctx);
-				const enriched = await enrichAssuranceResult(ctx, taskId, result as unknown as Record<string, unknown>);
+				const enriched = await closeOutBatchChild(
+					ctx,
+					taskId,
+					await enrichAssuranceResult(ctx, taskId, result as unknown as Record<string, unknown>),
+				);
 				presentTaskRailResult(ctx, taskId, enriched);
 				throwIfCanaryToolFailure(taskId, action.op, enriched);
 				return toolResult(JSON.stringify(enriched, null, 2), enriched);
@@ -1648,7 +1654,6 @@ async function mintCapability(
 		confirmation_ref: `pi-confirm-${createHash("sha256").update(
 			`${input.task_id}\0${now}\0${input.intent_revision}\0${input.intent_content_hash}\0${input.diff_hash}`,
 		).digest("hex").slice(0, 16)}`,
-		expires_at: new Date(Date.now() + 10 * 60 * 1000).toISOString(),
 		findings_digest:
 			input.action_kind === "request_rework"
 				? await findingsDigestV2(input.findings as never[])
@@ -1732,6 +1737,46 @@ async function reconcileRefsQuietly(root: string): Promise<void> {
 	}
 }
 
+/**
+ * Gate-free closeout: a batch child that reached Kernel `done` in the foreground
+ * re-enters the batch in the same call, reusing its authorization. Only `done`
+ * continues; stopped, parked and Review-pending children end where they do
+ * today. The continuation is transport: the Kernel result is returned
+ * unchanged, and any failure is reported beside it with one retry action.
+ */
+async function closeOutBatchChild(
+	ctx: ExtensionContext,
+	taskId: string,
+	enriched: Record<string, unknown>,
+): Promise<Record<string, unknown>> {
+	const taskState = enriched.task_state as { lifecycle?: unknown } | undefined;
+	if (taskState?.lifecycle !== "done") return enriched;
+	let slug: string | null;
+	try {
+		slug = findResumableBatchSlugForTask(ctx.cwd, taskId);
+	} catch {
+		return enriched;
+	}
+	if (!slug) return enriched;
+	try {
+		// The batch commit takes exactly the scope envelope plus this task's own
+		// audit evidence and refuses unstaged changes: stage only that evidence.
+		if (existsSync(join(ctx.cwd, ".imm", "audit", taskId)))
+			execFileSync("git", ["-C", ctx.cwd, "add", "--", `.imm/audit/${taskId}`], { stdio: "ignore" });
+		const batch = await executePiUnattendedBatch({ root: ctx.cwd, initiativeSlug: slug, reuseOnly: true, signal: ctx.signal });
+		return { ...enriched, batch };
+	} catch (error) {
+		return {
+			...enriched,
+			batch: {
+				state: "rejected",
+				reason: `batch continuation failed: ${error instanceof Error ? error.message : String(error)}`,
+				recovery_action: "call start_unattended_batch with the same Initiative to continue the batch",
+			},
+		};
+	}
+}
+
 async function enrichAssuranceResult(
 	ctx: ExtensionContext,
 	taskId: string,

package/plugins/immune-brain/.pi-extension/imm-unattended-batch.ts

@@ -19,7 +19,6 @@ import {
 	type InitiativeObservationReader,
 } from "./runtime-stub";
 import { batchReason } from "../runtime/unattended/batch_reasons";
-import { startConfirmationDeadline } from "../runtime/unattended/confirmation_deadline";
 import {
 	authorizeBatch,
 	projectBatchPreflight,
@@ -69,12 +68,16 @@ export interface PiBatchExecutionOptions {
 	root: string;
 	initiativeSlug: string;
 	interactive?: boolean;
+	/**
+	 * Gate-free continuation after a foreground child: never opens the
+	 * confirmation, and an authorization that cannot be reused is reported as a
+	 * blocked result with the one action that reopens the gate.
+	 */
+	reuseOnly?: boolean;
 	signal?: AbortSignal;
 	batchKernel?: Partial<BatchRunnerKernelPort>;
 	batchGit?: BatchRunnerGitPort;
 	readInitiative?: InitiativeObservationReader;
-	/** Environment the confirmation deadline reads; production passes process.env. */
-	env?: Record<string, string | undefined>;
 	confirmBatch?: (details: {
 		title: string;
 		summary: string;
@@ -107,9 +110,10 @@ export async function executePiUnattendedBatch(
 	options: PiBatchExecutionOptions,
 ): Promise<PiBatchExecutionResult> {
 	const { root, initiativeSlug, signal } = options;
+	const reuseOnly = options.reuseOnly === true;
 	const interactive = options.interactive ?? true;
 
-	if (!interactive) return { state: "rejected", ...nonInteractiveRefusal() };
+	if (!reuseOnly && !interactive) return { state: "rejected", ...nonInteractiveRefusal() };
 
 	// 1. Host-independent batch preflight: claim ownership, branch availability,
 	// working-tree cleanliness against the authorized scope, recovery children,
@@ -132,7 +136,7 @@ export async function executePiUnattendedBatch(
 	const planDigest = preflight.projection.plan_digest;
 	const recoveryChildren = preflight.projection.recovery_children;
 
-	// 4. Literal-user gate plus the shared reuse/expiry decision, the post-gate
+	// 4. Literal-user gate plus the shared reuse decision, the post-gate
 	// claim/drift cascade, and the Batch Authorization binding. The Host supplies
 	// only its gate, its confirmation reference, and its binding nonce.
 	const authorization = await authorizeBatch<PiBatchExecutionResult>({
@@ -143,36 +147,40 @@ export async function executePiUnattendedBatch(
 		readInitiative: options.readInitiative,
 		nonce: randomUUID(),
 		gate: async (facts) => {
+			if (reuseOnly)
+				return {
+					kind: "host_rejection",
+					value: {
+						state: "blocked",
+						reason: `batch authorization cannot be reused (${facts.reuse_blockers.join(", ")})`,
+						recovery_action: "call start_unattended_batch with the same Initiative to confirm a fresh authorization",
+					},
+				};
 			// review-2: fail closed with zero writes when confirmation port is missing
 			if (!options.confirmBatch) {
 				return { kind: "host_rejection", value: batchReason("confirmation_port_unavailable") };
 			}
 			const confirmDetails = {
 				title: `Authorize Unattended Batch: ${facts.initiative_slug}`,
-				summary: `Initiative: ${facts.initiative_slug}\nBatch branch: ${facts.batch_branch}\nPlan digest: ${facts.plan_digest}\nBudget: max_children=${facts.budget.max_children}, deadline_at=${facts.budget.deadline_at}, qa_failure_limit=${facts.budget.qa_failure_limit}\nExpires at: ${facts.expires_at}`,
+				summary: `Initiative: ${facts.initiative_slug}\nBatch branch: ${facts.batch_branch}\nPlan digest: ${facts.plan_digest}\nBudget: max_children=${facts.budget.max_children}, qa_failure_limit=${facts.budget.qa_failure_limit}`,
 				details: `Ordered children (${facts.children.length}):\n${facts.children.map((child) => `  - ${child.task_id} (${child.slice_id}) [risk: ${child.risk}] [status: ${child.status === "already_settled" ? "completed" : "pending execution"}]`).join("\n")}${facts.excluded.length > 0 ? `\n\nExcluded children:\n${facts.excluded.map((child) => `  - ${child.task_id} (${child.slice_id}): ${child.reason}`).join("\n")}` : ""}${facts.reuse_blockers.length > 0 ? `\n\nRe-confirmation required: ${facts.reuse_blockers.join(", ")}.\nRecovery: confirm to issue a fresh authorization bound to the current plan and HEAD.` : ""}`,
 				planDigest: facts.plan_digest,
 				signal,
 			};
 
-			// The bounded elicitation deadline is shared behavior: an unanswered native
-			// confirmation is bounded by the same setting on both Hosts.
-			const deadline = startConfirmationDeadline({ env: options.env ?? process.env, signal });
+			// The gate settles only on the literal user's answer or the caller's
+			// cancellation signal.
 			let decision: "accept" | "decline" | "cancel";
 			try {
-				decision = await options.confirmBatch({ ...confirmDetails, signal: deadline.signal });
+				decision = await options.confirmBatch(confirmDetails);
 			} catch (err) {
-				if (deadline.timedOut()) return { kind: "host_rejection", value: batchReason("confirmation_timed_out") };
 				if (signal?.aborted) return { kind: "host_rejection", value: batchReason("confirmation_cancelled") };
 				return {
 					kind: "host_rejection",
 					value: batchReason("confirmation_failed", err instanceof Error ? err.message : String(err)),
 				};
-			} finally {
-				deadline.clear();
 			}
 
-			if (deadline.timedOut()) return { kind: "host_rejection", value: batchReason("confirmation_timed_out") };
 			if (decision === "cancel" || signal?.aborted) {
 				return { kind: "host_rejection", value: batchReason("confirmation_cancelled") };
 			}
@@ -195,7 +203,7 @@ export async function executePiUnattendedBatch(
 	});
 	if (authorization.outcome === "host_rejection") return authorization.value;
 	if (authorization.outcome === "rejected") return authorization.rejection;
-	const { binding, batch_id: batchId, expires_at: expiresAt } = authorization;
+	const { binding, batch_id: batchId } = authorization;
 
 	// 6. Issue Batch Authorization through Kernel registry and startBatch
 	const batchRegistry: BatchAuthorityRegistry = await createBatchAuthorityRegistry();
@@ -205,8 +213,6 @@ export async function executePiUnattendedBatch(
 	if (signal?.aborted) return batchReason("cancelled_before_execution");
 
 	now = new Date().toISOString();
-	if (Date.parse(expiresAt) <= Date.parse(now))
-		return batchReason("confirmation_failed", "confirmed batch deadline expired before authorization issuance");
 	const capability = batchRegistry.issue(binding, recoveryChildren as any, now);
 
 	let activeReviewDispatch: { operation_id: string; agent_params: Record<string, unknown> } | null = null;
@@ -300,7 +306,6 @@ export async function executePiUnattendedBatch(
 		plan_digest: planDigest,
 		base_head: binding.base_head,
 		confirmation_time: now,
-		authorization_expires_at: expiresAt,
 		budget,
 		now,
 		kernel: kernelPort,

package/plugins/immune-brain/.pi-extension/runtime-stub.ts

@@ -21,7 +21,6 @@ export interface EnrollmentCapabilityBinding {
 	preparation_digest: string;
 	actor_id: string;
 	confirmation_ref: string;
-	expires_at: string;
 	nonce: string;
 }
 export interface EnrollmentAuthorityRegistry {
@@ -36,7 +35,6 @@ export interface CanaryWaiver {
 	reason: string;
 	actor: string;
 	confirmation_ref: string;
-	expires_at: string;
 	nonce: string;
 }
 export interface PiCanaryPrepareInput {
@@ -66,7 +64,6 @@ export interface CapabilityBindingV2 {
 	diff_hash: string;
 	actor_id: string;
 	confirmation_ref: string;
-	expires_at: string;
 	findings_digest: string | null;
 }
 export interface MutationAuthorityRegistry {

package/plugins/immune-brain/dist/BASELINE.md

@@ -9,6 +9,20 @@
 - Stage only explicit task-owned paths. This staging authority does not grant
   commit, push, broad staging, or authority over pre-existing user changes.
   Never use `git add .` or `git add -A` in a dirty worktree.
+- Grant effects separately: staging, commit, push, publication, and outbound
+  model/data calls are distinct operations. Recovering a stage-only instruction
+  restores staging and nothing more; commit, push, and publication each keep
+  their own existing grant. An explicit approval already covering the same
+  operation, target, and impact — including a valid batch capability — stays
+  usable without another gate.
+- Before a new outbound effect, check the project's existing research channel and
+data scope. A public article, a mock, a documentation example, or a local
+read-only database gives no authority to call an arbitrary provider or send new
+data; authorize only a genuinely new channel/data/effect delta. Distinguish
+documentation, mock, real-channel, and model-quality evidence when reporting.
+- These text rules are instruction contracts, not a hard bash sandbox. They
+guide behavior and are checked as contracts; they do not technically prevent an
+arbitrary shell command, so authority gates and review remain the real boundary.
 - Do not create, switch, or delete Git worktrees; operate only in the Host launch directory.
 - Record reproducible evidence before reporting closure.
 - Required verification must pass before reporting completion; disclosing a gap is not a substitute. Autonomously diagnose, repair, and rerun failing conventional local checks within the authorized scope; never delete, skip, or weaken a valid check to manufacture a pass. If a required check remains failing or cannot run, report the work as incomplete with the concrete blocker.
@@ -81,7 +95,6 @@ non-Kernel operations, an explicit user approval already covering the same
 operation, target, and impact is sufficient; ask again only for a material delta.
 A generic continuation or configured preference is not blanket authorization.
 Mandatory native gates and hash-bound manifest approvals still apply.
-
 Privileged effects include:
 
 - publish, release, deployment, or remote-system mutation;
@@ -91,6 +104,10 @@ Privileged effects include:
   override; and
 - external writes whose target or impact cannot be safely reversed locally.
 
+An existing grant for one of these never inherits another: a stage-only
+instruction stays stage-only, a commit is not push or publication authority,
+and a valid batch capability commits only its own scope-bounded child.
+
 Routine Managed enrollment uses one current-Host native confirmation bound to the TaskIntent content hash after Planner validation. Explicit Plan-only requests stop with candidate artifacts and do not invoke Enrollment; execution-bearing requests open the native gate directly without chat pre-confirmation. Enrollment validates intent, Git ownership, scope, workspace claim, and final authority preconditions without executing acceptance descriptors; deterministic QA executes them after implementation. The routine task proceeds from that single confirmation through enrollment, execution, and QA without a second human stop. Do not request confirmation for local in-scope edits, local verification, ordinary Direct rework, scoped diff review, or completion reporting. Managed evidence, QA, Review, and completion authority remain governed by their Managed contracts; R2 does not weaken them. Managed native-authority failures fail closed with one stable reason and exactly one same-Host recovery action; never offer a Pi, Direct Path, cross-Host/worktree, unmanaged, or automatic-retry fallback.
 
 For an unborn symbolic Git HEAD, the same Enrollment confirmation discloses an empty root commit. After approval, the Host creates that commit without staging project content or changing the index/worktree, then revalidates ownership and rehearses Enrollment against the new base. Git identity uses existing environment/config values with an explicit automation fallback, never config writes. Decline or pre-initialization cancellation leaves HEAD unborn; if later Enrollment fails or is cancelled, report the remaining commit. Invalid Git refs are errors, not initialization candidates.