immune-brain 4.4.1 → 4.6.0

package/plugins/immune-brain/dist/docs/reference/subagent-dispatch-protocol.md

@@ -4,6 +4,18 @@
 
 ## Eligibility
 
+Before any dispatch, state the bounded question and scope: the question being
+investigated, the named paths the probe may read, the expected evidence, and the
+stop condition that closes the probe. A probe without a stated stop condition is
+an open-ended sweep, not a bounded one.
+
+Read known paths directly first. Expand along proved callers, dependencies, and
+state owners only when a concrete missing fact requires it, and stop once the
+question is closed; do not continue reading because a path is nearby. Repository-wide
+listings, unrelated directories, and other projects' session logs are out of
+scope. Project-specific log or history searches stay inside the named project
+paths; do not scan external session directories unless the user explicitly asks.
+
 派发前依次执行：
 
 1. 从任务摘要、changed paths 和显式请求分类为 `trivial`、`single_domain`、`multi_domain` 或 `high_risk`。
@@ -13,6 +25,23 @@
 
 常用 fallback reason：`cost_scope_mismatch`、`unavailable_environment`、`host_authorization_required`、`trigger_not_hit`、`unclear_boundary`。
 
+### Parallel Local Calls And Partial Results
+
+Independent local calls may be issued together and their results inspected
+together, `Promise.allSettled`-style, so one failure does not discard the other
+results. Dependent actions stay ordered: an action that needs another's output
+waits for it. Do not use a settled-all barrier for work that has a real sequence
+dependency.
+
+When output is truncated, continue in bounded pages only while the material is
+still needed for the question; do not restart the read from the top or expand it
+into a full-file sweep. Before retrying an operation that may have partially
+succeeded, inspect what it already produced: a partial edit or partial write is
+retried only for the part that is actually unfinished, never replayed wholesale.
+Telemetry and tool-call counts are observational; they never justify omitting
+evidence the question still requires, and they are not comparable to another
+session's numbers unless the inputs and environment match.
+
 ## Authorization
 
 Canonical project grant:
@@ -103,6 +132,7 @@ Parent workflow role 必须：
 3. 保留 source lens 和 candidate attribution。
 4. 把 partial/error 标记为 `degraded`。
 5. 保留自身 baseline review，不把最终判断权交给 child。
+6. 报告 partial 结果时说明哪些部分已完成、哪些仍未完成，不把部分结果当作完整结果。
 
 普通 advisory/discovery 的每次启动都消耗一个 candidate budget slot；失败、取消、timeout 或 result_untrusted 均丢弃该输出且不得自动重试。Parent 仅在剩余候选仍独立有用且 evidence budget 仍需要时继续，否则转 solo/fail-closed fallback，并记录 `dispatch_failed` 或 `child_timeout`。Read-only eligibility 与 Pi 的 one-foreground-child 调度限制是两回事：只读调查可同时存在多个待派发候选，但实际执行仍逐个 foreground child 串行消费，不得把多个 foreground Agent 假定为并发 batch。该规则不改变 Kernel authority Review 的显式恢复协议。Child 永远不获得实现、Plan write、workflow mutation 或 QA closure authority。
 

package/plugins/immune-brain/dist/imm-brainstorm.md

@@ -65,6 +65,24 @@ delta and explain the new evidence. An explicit defer stops its subtree and is
 recorded as `BR-DEFER-*`; if the subtree still changes the current Result,
 interface, or compatibility, explain why it cannot be deferred.
 
+Every sourced branch closes as resolved, explicitly excluded, explicitly
+deferred, or dependent-blocked with its blocking prerequisite named. An excluded
+or deferred branch is a recorded decision, not a silent omission; a
+dependent-blocked branch blocks only its dependent commitment and is reported as
+an open node. Coverage is complete when every sourced branch carries exactly one
+of those four states, and no branch is dropped for being inconvenient, expensive,
+or downstream. Exhaustive-interview mode changes interview breadth, never this
+coverage. A clear zero-question request performs the same coverage check over
+the request, repository evidence, and confirmed parent decisions before it hands
+off.
+
+Do not narrow a confirmed outcome into a smaller deliverable. "Do X fully" is
+not satisfied by "do part of X", and a dependency ordering such as "prototype
+first" is not a scope reduction such as "prototype only". A generalized
+integration-to-CLI or prototype-first-to-prototype-only narrowing presented as
+the complete result is a conservation failure; the handoff completeness check
+rejects it instead of accepting the smaller deliverable.
+
 Brainstorm finishes when the material decision frontier is empty and no blocked
 fact prevents the current handoff. Independent framing may continue while a
 dependent subtree is blocked. If the user
@@ -97,6 +115,7 @@ empty, or report remaining blocked/open nodes if the user stops early.
 
 - **Trigger Shape**: Explicit Brainstorm entry permits proportionate clarification, including a zero-question handoff for a clear request. Read the exhaustive protocol only on an explicit request for thorough interrogation. Do not add a second confirmation for an unchanged final summary.
 - **Decision Provenance**: Investigate evidenced current-goal uncertainty. A concrete scenario is relevant when the request, repository, or a settled parent decision makes it material; do not invent speculative future needs.
+- **Relevant Coverage**: Traverse every sourced branch — from the user request, repository evidence, or a settled parent decision — to one closing state: resolved, explicitly excluded, explicitly deferred, or dependent-blocked with the blocking node named. Ask only on the currently unblocked frontier, so a dependent-blocked branch stays open instead of being asked early or silently omitted. Coverage is a property of the traversal, not of the question count: a zero-question fast path and a bulk approval close the same branches the exhaustive traversal would.
 - **Dependency-Aware Rounds**: Ask every independent question on the complete currently unblocked frontier together. Ask fewer questions only because dependencies keep downstream branches blocked, never because of an arbitrary question budget.
 - **Read-only by default**: Inspect context and summarize the problem. do not implement inside this skill.
 - **Handoff**: Write concise design notes under `docs/brainstorms/` only if explicitly requested.
@@ -111,6 +130,8 @@ empty, or report remaining blocked/open nodes if the user stops early.
 
 Follow [`docs/reference/subagent-dispatch-protocol.md`](docs/reference/subagent-dispatch-protocol.md) for the full dispatch lifecycle. This section defines brainstorm-specific optional research dispatch.
 
+Before any research path that leaves the repository — an external model or provider call, a fetch of non-project content, or sending project data off-host — check the project's existing research channel and data scope. Documentation, mocks, and local read-only reads are not real-channel evidence, and a public article does not select or authorize a provider. Consume the existing channel; a genuinely new channel or data scope is a material delta that needs its own authorization. Report documentation, mock, real-channel, and model-quality evidence as distinct claims rather than one undifferentiated "verified".
+
 Runtime helpers: `imm_core.buildBrainstormEnsembleRequest`, `imm_core.buildBrainstormEnsembleDispatchEnvelopes`, `imm_core.normalizePiBrainstormAgentResults`, and `imm_core.normalizeBrainstormEnsemblePacket`.
 
 ### Brainstorm Ensemble Advisory

package/plugins/immune-brain/dist/imm-loop.md

@@ -74,8 +74,12 @@ Continue while the current projection has a valid action:
 4. Follow the returned Kernel obligation. Fresh QA suffices for routine work;
    material and critical work additionally require fresh independent Review.
    Normal completion does not require a second user confirmation.
-5. For rework, follow the projected artifact state before editing. Resolve
-   findings only after fixing and verifying their cause. Changed snapshots
+5. For rework, follow the projected artifact state before editing. Submit the
+   rework verdict first, then edit: staging an in-scope change while the
+   artifacts are frozen invalidates the snapshot and discards that verdict,
+   forcing a fresh QA round. After the Kernel returns the artifacts to active,
+   make the fix, resolve findings only after fixing and verifying their cause,
+   then run the newly required obligations. Changed snapshots
    invalidate old evidence; run the newly required obligations. On the second
    rework of one acceptance id or anchor, the fix response must either state why
    it covers every known trigger class of the violated invariant — the shared
@@ -126,11 +130,18 @@ The runtime owns no model invocation and adds no persisted execution lifecycle.
 After diagnostics pass, the Parent advances Kernel QA and dispatches any reserved
 foreground Review once using the exact returned `agent_params`, then submits its
 structured verdict. An open Review reservation stays with that Host invocation;
-batch re-entry waits for it rather than redispatching. On Kernel `done`, stage
-only that child's generated terminal audit evidence and call
-`start_unattended_batch` with the same slug. The driver reconciles settlement,
+batch re-entry waits for it rather than redispatching. When a batch child's
+foreground terminal mutation reaches Kernel `done`, the same tool call stages
+only that child's generated terminal audit evidence and re-enters the batch under
+the still-valid authorization, opening no gate. The driver reconciles settlement,
 adopts or creates the one scope-bound commit, then enrolls the next ready child
-under the still-valid authorization. Ordinary Executor handoff and below-limit
+or settles the batch as `completed`; the result carries the batch report as
+`batch`. A reserved Review, a parked child and a stopped child end where they do
+today and are never committed automatically. If the re-entry fails, the Kernel
+result is unchanged and `batch` carries one recovery action: call
+`start_unattended_batch` with the same slug, which is also how to continue by
+hand. A commit that fast-forwards the batch branch outside the runner is adopted,
+not attributed to a child; any other HEAD movement still fails closed. Ordinary Executor handoff and below-limit
 QA repair do not park the batch; genuine budget/authority stops remain fail-closed.
 
 Batch execution never pushes a ref, opens or updates a pull request, resolves a
@@ -140,6 +151,27 @@ per completed child.
 
 ## Decisions and Recovery
 
+- Resume from authority facts, not prose. After an uncertain interruption, bind
+the exact `task_id`, `run_id`, record revision, lifecycle, artifact state,
+obligation, and claim from the Kernel projection before acting. A compaction
+heading, a Handoff summary, an Issue state, or any other prose summary is not
+authority and can be stale or wrong: when it conflicts with the projection,
+correct the prose and resume the existing owner instead of trusting the summary.
+- The workflow stages are distinct and never inferred from one another:
+authored, validated, published, enrolled, assured, and completed each require
+their own evidence. An open or closed Issue is not Enrollment or completion; a
+published Issue is not Enrollment; a plan-only delivery is not execution
+readiness.
+- Consume a successful operation's fresh projection directly. Do not add a
+status read after an operation that already returned the current projection, and
+never repeat a mutation merely to re-observe its result. Kernel CAS and
+freshness checks remain mandatory, and reducing Parent reads does not bypass
+them.
+- A falsely claimed later-Slice enrollment is a summary defect, not authority.
+Retain the actual owner, and do not create or replay a mutation, gate, or
+completion to match the prose. Summary production outside this repository is not
+locally fixed; the consumer-side protection is these rules, and a producer bug
+is recorded as a separate follow-up rather than resolved here.
 - Scope expansion returns to Planner's Enrolled Intent Revision route. Planner
   prepares the complete proposed revision without replacing the active owner;
   the current Loop submits it through Kernel revision authority. Collect all
@@ -147,6 +179,14 @@ per completed child.
   reasons in one request. Do not edit outside scope while waiting or widen it
   piecemeal without new evidence. Bounded test or PR repair stays inside the same
   TaskIntent.
+- Effects are separate grants. A stage-only recovery restores staging and grants
+  no commit, push, or publication; an existing exact approval, including a valid
+  batch capability bounded to one child, stays usable without another chat gate.
+  Before a new outbound research call, check the project's existing channel and
+  data scope; a public article, a mock, or a local read-only database authorizes
+  no new provider or data effect.
+- Text instructions are contracts, not a hard bash sandbox. They guide and are
+  reviewed; the Kernel authority gates remain the real boundary.
 - Invoke `approve_breaking_intent_revision` with the complete next intent
   directly; the native Host gate is the single user decision. Do not overwrite
   enrolled intent sidecars or ask for chat pre-confirmation.
@@ -240,6 +280,12 @@ Stop reason:
 Next action:
 ```
 
+Every line reports authority evidence, not prose inference: name the exact
+task/run identity and the observed lifecycle, artifact, obligation, and claim
+facts that decided the exit. If a summary claimed more than the projection
+proves — for example a later Slice as enrolled or the task as completed — report
+the projection instead and correct the prose.
+
 ## Failure Output
 
 For `settlement_unknown`, call `advance_assurance` once to reconcile the Kernel

package/plugins/immune-brain/dist/imm-planner.md

@@ -49,6 +49,25 @@ decisions. Resolve a local delta here. If the answer reopens multiple product
 branches or changes the overall goal or Scope, stop and return to
 `imm-brainstorm`.
 
+Before handoff, run one handoff completeness check over the closed-world
+manifest: map every upstream item and every required phase exactly once, report
+each Slice's closable result plus the remaining gap, and confirm the complete
+confirmed outcome and its phases are actually delivered. Upstream items close as
+covered, decisioned, deferred, or out with a reason; a required phase is the
+confirmed outcome itself, so it must be delivered rather than closed out with a
+reason. A reason excuses an upstream item, never a still-required phase: dropping
+one is exactly the silent narrowing this check exists to catch, and the genuine
+reduction is a user decision that returns to `imm-brainstorm` and changes what
+was required. The check fails, and the candidate is not handoff-ready, when a
+required phase or upstream item has no mapping, or when the plan conserves a
+smaller deliverable than the confirmed outcome. An outcome-narrowing
+substitution is such a failure: a confirmed full integration presented as one
+pairwise CLI, or a `prototype first` dependency presented as `prototype only`.
+Both are conservation failures, not scope decisions, and the checker rejects
+them instead of accepting the reduced deliverable. Coverage is independent of
+question count, so a clear request and an already-confirmed decision still pass
+the same check without acquiring an extra confirmation.
+
 Direct Planner entry remains valid for a clear request and does not require a
 Brainstorm pass. Resolve facts and derive technical design; if an unresolved
 user-owned product decision appears, return to `imm-brainstorm` rather than
@@ -254,8 +273,21 @@ goal prose and never truncates a title. The tracker rereads every canonical
 TaskIntent for identity, risk, and acceptance IDs; projection fields and public
 summaries never widen TaskIntent scope or authority. It validates the complete dependency graph before
 remote writes, creates the Parent once, creates all Children, attaches every
-Child as a native Sub-issue, creates native `blocked_by` relations, and rereads
-the complete topology. Every Child carries `ready-for-agent`, blocked Children
+Child as a native Sub-issue, creates native `blocked_by` relations, and takes
+every Issue number from its own create response. The write flow is direct: one
+start-of-run read of the repository identity, the Issue listing, and the label
+listing, then one create per absent Issue in dependency order, one attach per
+Child, and one relation write per edge. No repository listing, attachment,
+dependency or ownership confirmation follows a write; one Issue-scoped read
+follows each create to resolve the database id the relation endpoints need,
+because `gh issue create` returns only the Issue URL. No cumulative deadline
+exists either; each call keeps its own per-call timeout and
+the caller's cancellation. Deduplication is start-only: a rerun of the same
+approved batch adopts whatever the start listing already carries and writes only
+the missing relations, so it never creates a duplicate Issue and never repeats a
+completed write. Concurrent edits made during a run are not detected in that
+run; they surface as drift at the start of the next run. Every Child carries
+`ready-for-agent`, blocked Children
 additionally carry `blocked`, and the Parent carries neither; the tracker never
 creates labels, so a repository missing a required label fails the batch closed
 before any remote write. The Child Agent Brief includes a direct Parent Issue link.
@@ -279,27 +311,39 @@ complete-decomposition decision; or `tracker_projection_failed` with the returne
 failure and exact retry action. A candidate Initiative or partial Issue set
 recorded only in the Spec or final summary is neither user confirmation nor a
 completed carrier outcome. Report `retryable_failure`, `permanent_failure`, or
-`ambiguous_remote_state` and the exact batch retry action. This does not invalidate
+`ambiguous_remote_state` and the exact batch retry action. A failure after the
+request may have landed is reported as uncertain with its confirmed steps, its
+pending steps, and one recovery action: rerun the same approved batch, whose
+start listing adopts whatever landed. This does not invalidate
 already-authored planning files, but it blocks `tracker_associated` and every
 Enrollment or execution handoff for that Initiative until the same complete
-batch succeeds. Do not infer opt-in from tracker output or Issue state, auto-close the Parent,
-import Issue state, create a TaskIntent from an Issue, or store Issue identity in
+batch succeeds. Do not infer opt-in from tracker output or Issue state, import Issue state, create a TaskIntent from an Issue, or store Issue identity in
 TaskIntent or TaskRecord. Existing Issue markers grant permission only for
 idempotent retry of that same approved Initiative; they never grant execution
 authority.
 
+The Planner never closes the Parent. The terminal projection of a Child does: when
+`mark-terminal` closes a Child as completed and every Slice Child of that Initiative
+is closed as completed, the tracker closes the Parent as completed; an open, stopped
+or parked Child keeps it open.
+
 For amending an already-published Initiative, the same
 `imm-tracker publish-initiative --stdin --json` operation accepts an optional
 `amendment` input after the literal user approves the changed pending frontier.
 Provide the complete approved pending Tasks plus the complete read-only
 historical Child list, each binding the observed `issue_number`, title, body,
-and state at approval. The tracker verifies every bound Issue against that
-baseline before any write, updates only approved pending briefs, converges the
-exact approved pending `blocked_by` set, creates newly added pending Children,
-and preserves historical Children byte-for-byte with their native Sub-issue
-links and dependency relations. Omitted membership, baseline drift, or a
-stopped historical prerequisite fails closed with zero or bounded mutations
-and an exact retry action; the strict no-amendment default is unchanged.
+and state at approval. The amendment uses the same direct write flow: one start
+listing (plus Issue-scoped Sub-issue and `blocked_by` reads) verifies every bound
+Issue against its baseline, then the Parent is edited at most once, each approved
+pending brief is edited at most once, newly added pending Children are created as
+in ordinary publication, and each pending Child's `blocked_by` set is converged
+to the approved set. Historical Children are never written and keep their
+byte-exact content, native Sub-issue links and dependency relations. No read
+follows a write and no closing recheck runs, so baseline drift that appears after
+the start listing is not detected in that run; it surfaces at the start of the
+next run. Omitted membership, baseline drift present at start, and a stopped
+historical prerequisite fail closed before any write with an exact retry action;
+the strict no-amendment default is unchanged.
 
 ### Verification Descriptor Discipline
 
@@ -327,9 +371,36 @@ before execution. Report `valid` and `enrollment_ready` only as structural and
 Enrollment readiness; only a completed deterministic QA result proves that a
 descriptor executed and passed.
 
+**Acceptance-to-invariant mapping.** Trace each acceptance assertion to an
+observable invariant at a real seam, then name the positive, negative, and bound
+controls that exercise it. Name the controls explicitly instead of relying on
+the happy path: a happy path alone never proves a guard. The six generalized
+motivating classes to check for are: normalization precedes retrieval (an input
+is normalized before it is used to retrieve); validation precedes merge (a
+rejected input never enters the merged state); the deadline covers the whole
+lifecycle including cleanup; ranking tolerates missing embeddings (an absent
+signal is ranked, not silently skipped); the budget covers the complete
+serialized request; and each success, failure, and timeout outcome carries its
+own duration evidence. These are workflow-quality input patterns, not requests
+to edit the original applications that motivated the audit.
+
+**Environment and prerequisite discipline.** A descriptor that needs a
+prerequisite states its provenance and how it is obtained. Preparation must not
+hide a download, credential use, production write, or system change: authorize
+it explicitly, or redesign the check to avoid it. Require cleanup on failure and
+interruption, and restoration of any explicitly authorized setting. An absent
+dependency, a missing simulator, or a preparation failure is a failed check, not
+a pass. Zero matched checks and skipped required checks are failures: a required
+check that selects no test, or that is skipped, must fail the acceptance rather
+than silently succeed. Separate automated behavioral or geometry evidence from
+human judgment of motion quality; a descriptor can assert only the automated
+half. Textual presence in a contract string is not proof that a provider obeyed
+it, and structural Enrollment readiness is not proof that a descriptor executed.
+
 ## Core Responsibilities
 
 - **Decomposition**: Convert requirements into one or more TaskIntents. Add a Spec under `docs/specs/` only for complex work. Treat Technical Design as one TaskIntent decomposition dimension alongside outcome, Verification, dependency, risk, rollback, compatibility, and authority.
+- **Outcome Conservation**: The plan conserves the complete confirmed outcome and its required phases. A required phase is delivered, not closed out with a reason; a genuine reduction changes what the user confirmed and returns to `imm-brainstorm`. A generalized substitution such as full integration becoming a pairwise CLI, or `prototype first` becoming `prototype only`, is a completeness-check failure rather than a valid plan. Each Slice reports its closable result and the remaining gap so an omitted phase is visible instead of implied.
 - **Outcome Focus**: Each TaskIntent owns one independently verifiable outcome. Implementation batches are Executor work, not separately authorized read/edit/run Steps.
 - **Planning granularity**: Keep a coherent outcome together when acceptance, risk, rollback, and authority can settle together. Use the TaskIntent decomposition rules below for independent outcomes. File count, tokens, compactions, elapsed time, and review rounds are evidence for judgment, not universal gates.
 - **Historical artifacts**: v3 prose Plan mutation is retired. `imm-plan` is a read-only validator for archived Plans; create no new Roadmap, Phase, successor Plan, or State Ledger.
@@ -340,7 +411,7 @@ descriptor executed and passed.
 - **Technical Design Authority**: The Spec is the single Technical Design baseline. TaskIntent acceptance and scope reference the applicable design decisions or invariants without copying Technical Design prose. If discovery invalidates the baseline, stop execution and return to Planner to update the Spec and decide whether `replan` is required. TaskIntent and Initiative text do not duplicate Technical Design prose or become a prose Plan substitute.
 - **TaskIntent decomposition**: Use the selected design boundaries as one retain/split criterion for TaskIntent slices. Keep work in one TaskIntent when the selected views describe one coherent executable slice with shared acceptance, risk treatment, rollback, and authority. Split a successor TaskIntent when a service boundary, state-machine owner, migration/compatibility boundary, independently promotable layer, or sequence dependency needs independent verification, rollback, authorization, or settlement. Do not split merely because the design names several layers, files, or services. Treat trust-boundary changes as the same kind of decomposition evidence: a TaskIntent should normally change one primary trust-boundary invariant, while merely traversing several boundaries or updating both sides of one end-to-end authority chain does not require a split. Split separate trust invariants when they can be independently verified, rolled back, authorized, migrated, or settled. Keep multiple trust-boundary changes together only when they form one atomic security outcome and splitting would create an unsafe or unusable intermediate state; record that reason in the Spec. This is Planner judgment, not a TaskIntent schema field or an Enrollment counting rule. This does not revive prose Plan, Roadmap, or Phase authority.
 - **Mermaid Use**: Mermaid is required only when a medium/high-risk design contains structure, sequence, data flow, or state transition relationships that a diagram materially clarifies. Mermaid is not a universal gate; a diagram supplements adjacent prose and never becomes a second design authority. Medium/High risk Specs record `**Diagram decision**: required|not_required` and a non-empty `**Diagram reason**:`. A `required` decision must have a Mermaid block; `not_required` explains why prose is sufficient. Low-risk Specs omit the empty ceremony and record neither field.
-- **Verification**: Every acceptance assertion has a concrete focused descriptor that can fail on the intended regression. Hypothetical evidence is not execution-ready.
+- **Verification**: Every acceptance assertion has a concrete focused descriptor that can fail on the intended regression, and every named invariant has positive, negative, and bound controls at an observable seam. Hypothetical evidence is not execution-ready; a check that matches zero tests, is skipped, or lacks its prerequisite is a failure rather than a pass.
 - **Executable Scope**: `scope_hint` is the mutation envelope, not discovery context. Close references across callers, tests, generated mirrors, and state-machine owners before authoring. Simple tasks are TaskIntent-only. A complex task binds at most one active Spec by content identity; do not add archive paths for freeze, and do not relocate artifacts. Collect all known scope gaps in one revision request; ask again only when new evidence changes the boundary.
 - **Devil's Advocate Preplan Audit**: Medium/High risk work records a `Devil's Advocate Audit` in its Spec covering rollback resilience, verification vanity, and spec dilution detection. Explain recovery from partial implementation, why verification detects the regression, and how accepted requirements remain covered. Simple TaskIntent-only work records outcome, boundary, and concrete verification on the Intent. Low-risk work omits the empty template.
 - **Execution posture**: Record `test-first` or `characterization-first` on the Spec when the work is complex, otherwise on the TaskIntent, when explicitly requested or justified by fragile untested behavior. The Executor owns the local choreography; do not create prototype or RED/GREEN/REFACTOR authority Steps. Throwaway probes must have a cleanup condition and a durable decision output.
@@ -433,11 +504,23 @@ preparation does not apply the revision or authorize expanded execution.
   verification descriptors or add a mandatory user confirmation.
 - **Review Mapping**: In-scope rework stays with the enrolled TaskIntent and explicit `imm-loop` entry. Cross-scope findings become a Planner decision delta with concrete missing paths and verification evidence; do not create a successor prose Plan.
 - **Brainstorm Manifest Mapping**: Record every upstream `BR-*` item in a Spec `Brainstorm Trace` when the work is complex, otherwise on the TaskIntent, mapped to acceptance, a captured decision, or an explicit reason for deferral or exclusion. Resolve every `BR-Q-*` item before handoff. Do not silently narrow confirmed framing.
+- **Handoff Completeness Check**: Before reporting a candidate as handoff-ready, confirm every upstream item and required phase is mapped exactly once, that required phases are delivered rather than excused by a reason, and that no confirmed outcome was conserved as a smaller deliverable. Reject a narrowed deliverable as a completeness failure; ask again only for a new material delta, never to reconfirm an unchanged clear request or an already-confirmed decision.
 - **Session Lifecycle Ownership**: The user chooses the current or a new session. Tokens, compactions, tool counts, elapsed time, and review rounds never trigger automatic session creation or termination. Recovery uses TaskRecord and the fresh Kernel projection.
 - **Subagents**: Only when optional research is needed, read Research Dispatch and its shared dispatch reference. Default to inline evidence gathering. Plan conditional reviewers such as `security-reviewer` only if their trigger surfaces are explicit; do not manufacture them.
 - **Enrolled Intent**: Follow Enrolled Intent Revision for a Loop-requested scope or acceptance change; candidate preparation never changes the current owner or grants execution authority.
 - **CONTEXT.md Vocabulary**: Consult the relevant `CONTEXT.md` terms when domain meaning is unclear or changes; known file-local tasks do not require a full root-document read. `CONTEXT.md` is vocabulary and architecture navigation, not execution state.
 - **Discovery Protocol**: Read `CONTEXT.md` `## Architecture Map` before broad searching; consult relevant `docs/solutions/` evidence under Clarification supplement's history trigger. Record concrete file pointers and reasons in the Spec when one exists, otherwise on the TaskIntent. Do not read or write a legacy Step discovery cache.
+
+**Bounded discovery.** State the question, the named paths, the expected evidence,
+and the stop condition before an investigation expands. Read known paths directly,
+expand only along proved callers and state owners, and stop once the question is
+closed instead of continuing into nearby unrelated paths. Keep project-specific
+log or history searches inside the named project paths. Reads or investigation
+output that is truncated continue in bounded pages only while still needed, and an
+operation that may have partially succeeded is inspected before it is retried for
+only its unfinished part. Telemetry and tool-call counts are observational: they
+never justify dropping evidence the question requires, and they are not comparable
+to another session's numbers unless the inputs and environment match.
 - **Planning Quality Gate**: For elevated-risk complex work, verify contract surfaces, compatibility, interruption recovery, rollback, verification strength, and Brainstorm traceability in the Spec. Simple TaskIntent-only work verifies those properties on the Intent. Do not invoke retired Plan mutation or State Ledger synchronization.
 - **Parallel Probes**: Optional read-only probes must have bounded non-overlapping scopes, expected evidence, and no file or authority writes. They are advisory discovery, not persisted Step annotations. Probe failure falls back to inline investigation with a recorded reason.
 
@@ -445,6 +528,8 @@ preparation does not apply the revision or authorize expanded execution.
 
 Follow [`docs/reference/subagent-dispatch-protocol.md`](docs/reference/subagent-dispatch-protocol.md) for the full dispatch lifecycle. This section defines planner-specific optional research dispatch.
 
+A discovery path that leaves the repository — an external model/provider call or sending project data off-host — first checks the project's existing research channel and data scope. Architecture exploration and local reads stay on the existing channel; a new channel or data scope is a material delta with its own authorization, and documentation, mock, or local read-only evidence never substitutes for real-channel evidence.
+
 Use the invoking Host's read-only role-boundary route for bounded
 `arch-explorer` and explicit-lens `advisory-reviewer` routing. Invoke the returned foreground Agent envelope
 exactly. The Parent owns Spec/TaskIntent synthesis, Brainstorm traceability,
@@ -492,14 +577,18 @@ a State Ledger. Keep historical Plan validation strictly read-only.
 | Split one outcome into read/edit/run micro-steps | One TaskIntent owns one closable outcome; Executor owns implementation batches. |
 | Append repair outside scope | Return the complete known scope delta for Kernel revision; do not widen execution. |
 | Drop a brainstorm-confirmed item as "out of scope" without saying so | Closed-world handoff: every `BR-*` ID must be covered, decisioned, deferred, scoped out with reason, or resolved as an assumption. |
+| Conserve a narrower deliverable than the confirmed outcome | **Conservation failure**: a full integration is not a pairwise CLI and `prototype first` is not `prototype only`; the handoff completeness check rejects the reduced deliverable instead of accepting a reason for it. |
 | Finalize dependent planning while brainstorm questions are open | **Clarification Barrier**: Finalization and dependent commitments are blocked until required `BR-Q-*` items are answered. Independent investigation and explicitly unapproved alternative drafts may continue; silence is not consent. |
 | Skip adversarial self-review on Medium/High risk because the plan is small | **Devil's Advocate** audit still checks rollback resilience, verification vanity, and spec dilution before the plan is treated as execution-ready. |
 
 ## Red Flags
 
 - Acceptance verification names only hypothetical evidence with no runnable descriptor.
+- An acceptance descriptor names no negative or bound control for its invariant, or its required prerequisite (dependency, simulator, preparation) is absent and still counted as a pass.
+- A required check matches zero tests or is skipped and the run is reported as passing.
 - New work depends on a prose Plan validator, Step activation, or State Ledger.
 - A Brainstorm manifest lacks complete `BR-*` coverage on the Spec (complex) or TaskIntent (simple).
+- The handoff completeness check passed while a required phase or upstream item is unmapped, or while the plan delivers only part of the confirmed outcome.
 - A Medium/High risk Spec lacks a `Devil's Advocate Audit` covering rollback resilience, verification vanity, and spec dilution detection.
 - New Spec prose ignores the document-language policy.
 - Candidate artifacts escape the approved planning scope.

package/plugins/immune-brain/dist/role-prompts/code-review.md

@@ -34,6 +34,25 @@ about the fix's scope, not a new bug. A trigger the accepted contract explicitly
 excludes is reported as an advisory note against that boundary, never as blocking
 rework.
 
+## Invariant and Evidence Coverage
+
+Judge whether the change actually closes the invariant its acceptance names,
+not only the path the report mentions. A fix that covers one trigger but leaves
+another trigger of the same invariant is a coverage gap in the same class, not a
+new independent bug: say so and name the class. Check the negative and bound
+behavior, not only the happy path. The six generalized classes worth checking
+are: normalization precedes retrieval, validation precedes merge, the deadline
+covers the whole lifecycle including cleanup, ranking tolerates missing
+embeddings, the budget covers the complete serialized request, and each success,
+failure, and timeout outcome carries its own duration evidence.
+
+A required check that is skipped, that matches zero tests, or whose prerequisite
+is absent does not prove the acceptance; do not accept it as evidence. Full
+suite coverage reported at a coarse pass count is not per-invariant evidence.
+Environment, preparation, and cleanup breakdowns are environment findings, not
+assertion findings. Keep automated behavioral or geometry evidence separated
+from a human quality judgment.
+
 Return exactly one JSON object with the fields required by the Loop review
 contract: `contract`, `role`, `task_id`, `snapshot_digest`, `decision` (`pass`
 or `rework`), and for `pass` include `approval` (`kind`, `authority_role`,

package/plugins/immune-brain/dist/role-prompts/qa.md

@@ -20,4 +20,16 @@ Plan remains a literal-user decision.
 For elevated-risk work, check the latest referenced Spec's Design Conformance
 against implementation evidence. A local implementation mismatch is `rework`;
 return `rework` with bounded repair evidence. A structural or intended design
-change is `replan`; return `replan` with the missing design fact. QA must not approve a changed design or silently accept a deviation. If the checkpoint is `awaiting_user_successor_decision`, stop without dispatch; only a literal user may invoke `--approve-successor`.
+change is `replan`; return `replan` with the missing design fact. QA must not approve a changed design or silently accept a deviation.
+
+Judge the recorded execution evidence, not the descriptor text. A required check
+proves an acceptance invariant only when it actually executed and passed: an
+absent dependency, a prerequisite preparation failure, a skipped required check,
+or a check that matched zero tests is a failure, not a pass. Structural
+"Enrollment ready" or "descriptor valid" is not execution evidence, and a
+contract string proves nothing about provider behavior. Automated behavioral or
+geometry evidence cannot stand in for a human motion-quality judgment, and vice
+versa; keep the two claims separate. Environment, preparation, and cleanup
+breakdowns are environment findings, not assertion findings: report them with
+the descriptor reference and observed outcome rather than as a code defect.
+ If the checkpoint is `awaiting_user_successor_decision`, stop without dispatch; only a literal user may invoke `--approve-successor`.

package/plugins/immune-brain/runtime/assurance/coordinator.ts

@@ -316,7 +316,10 @@ export interface ForegroundToolUpdate {
 	details: Record<string, unknown>;
 }
 
+/** Wall-clock milliseconds spent per advance stage; the stage names are the progress stages. */
+export interface AssuranceTimings { total_ms: number; stage_ms: Record<string, number> }
 type AssuranceRecoveryFields = {
+	timings?: AssuranceTimings;
 	diagnostics?: QaCheckDiagnostic[];
 	environment_failure?: boolean;
 	recovery?: AssuranceRecovery;
@@ -404,12 +407,23 @@ export interface AssuranceCoordinatorPorts {
 	qaOnAuthorityCommit?: () => void;
 	qaAfterAuthorityCommit?: () => Promise<void>;
 	qaJobTimeoutMs?: number;
+	/** Attach per-stage `timings` to advance results. Defaults to IMM_ASSURANCE_TIMINGS=1. */
+	reportTimings?: boolean;
+	/** Overrides QA_MAX_IDENTICAL_FAILURES; tests only. */
+	qaMaxIdenticalFailures?: number;
 }
 
 export const QA_MIN_JOB_TIMEOUT_SECONDS = 15 * 60;
 export const QA_MAX_JOB_TIMEOUT_SECONDS = 60 * 60;
 export const QA_JOB_OVERHEAD_SECONDS = 2 * 60;
 export const QA_JOB_TIMEOUT_SECONDS = QA_MIN_JOB_TIMEOUT_SECONDS;
+/**
+ * A QA run that fails before attestation writes no authority, so the Kernel
+ * would happily rerun the same descriptors forever. After this many identical
+ * failures on the same snapshot (record revision, intent hash, diff hash) the
+ * coordinator refuses to rerun until the snapshot changes.
+ */
+export const QA_MAX_IDENTICAL_FAILURES = 2;
 export const REVIEW_PREPARATION_TIMEOUT_MS = 30_000;
 export const REVIEW_DISPATCH_TIMEOUT_MS = 120_000;
 export const REVIEW_VERDICT_VALIDATION_TIMEOUT_MS = 30_000;
@@ -705,6 +719,8 @@ export class AssuranceCoordinator {
 	private readonly operationControllers = new Map<string, { operationId: string; controller: AbortController }>();
 	private readonly reviewReservations = new Map<string, ReviewReservation>();
 	private readonly rejectedReviewOperations = new Map<string, { operationId: string; reason: string }>();
+	private readonly qaFailureStreaks = new Map<string, { key: string; count: number }>();
+	private readonly qaAttemptKeys = new Map<string, string>();
 	private readonly unknownOperations = new Map<string, { operation: "qa" | "review"; operationId: string; reason: string }>();
 	private readonly sessionInvocations = new Set<InvocationToken>();
 	private sessionActive = true;
@@ -731,6 +747,8 @@ export class AssuranceCoordinator {
 			this.removeEvidence(reservation);
 		}
 		this.reviewReservations.clear();
+		this.qaFailureStreaks.clear();
+		this.qaAttemptKeys.clear();
 		for (const invocation of [...this.sessionInvocations]) this.closeSessionInvocation(invocation);
 	}
 
@@ -762,7 +780,19 @@ export class AssuranceCoordinator {
 
 	async advance(taskId: string, ctx: HostContext, signal?: AbortSignal, onUpdate?: (update: ForegroundToolUpdate) => void): Promise<AssuranceAdvanceResult> {
 		const checks = new Map<string, QaCheckDiagnostic>();
+		const started = performance.now();
+		const stageMs: Record<string, number> = {};
+		let stage = "preparing";
+		let stageStarted = started;
+		const closeStage = (now: number) => { stageMs[stage] = (stageMs[stage] ?? 0) + Math.round(now - stageStarted); };
 		const result = await this.advanceOnce(taskId, ctx, signal, update => {
+			const next = update.details.stage;
+			if (typeof next === "string" && next !== stage) {
+				const now = performance.now();
+				closeStage(now);
+				stage = next;
+				stageStarted = now;
+			}
 			const diagnostic = update.details.diagnostic as QaCheckDiagnostic | undefined;
 			if (diagnostic) {
 				checks.set(diagnostic.descriptor_ref, diagnostic);
@@ -772,8 +802,25 @@ export class AssuranceCoordinator {
 			}
 			onUpdate?.(update);
 		});
+		this.recordQaAttempt(taskId, result);
 		const diagnostics = result.diagnostics ?? [...checks.values()];
-		return this.withRecovery(taskId, ctx, diagnostics.length ? { ...result, diagnostics } : result);
+		const enriched = diagnostics.length ? { ...result, diagnostics } : result;
+		if (!(this.ports.reportTimings ?? process.env.IMM_ASSURANCE_TIMINGS === "1")) return this.withRecovery(taskId, ctx, enriched);
+		const finished = performance.now();
+		closeStage(finished);
+		return this.withRecovery(taskId, ctx, { ...enriched, timings: { total_ms: Math.round(finished - started), stage_ms: stageMs } });
+	}
+
+	private recordQaAttempt(taskId: string, result: AssuranceAdvanceResult): void {
+		const key = this.qaAttemptKeys.get(taskId);
+		this.qaAttemptKeys.delete(taskId);
+		if (!key || result.state === "cancelled") return;
+		if (result.state !== "failed" || result.operation !== "qa") {
+			this.qaFailureStreaks.delete(taskId);
+			return;
+		}
+		const streak = this.qaFailureStreaks.get(taskId);
+		this.qaFailureStreaks.set(taskId, { key, count: streak?.key === key ? streak.count + 1 : 1 });
 	}
 
 	private async withRecovery<T extends AssuranceAdvanceResult | AssuranceSubmitReviewResult>(taskId: string, ctx: HostContext, enriched: T): Promise<T> {
@@ -947,7 +994,13 @@ export class AssuranceCoordinator {
 				// Preparation counts against the same ceiling as the checks, so the
 				// aggregate clock starts before the first prepared group runs. A host
 				// may only tighten the derived budget, never raise it past the ceiling.
-				const declaredQaJobMs = deriveQaJobTimeoutMs(assurance.descriptors.values());
+				const qaKey = `${assurance.snapshot.record_revision}|${assurance.snapshot.intent_content_hash}|${assurance.snapshot.diff_hash}`;
+					const streak = this.qaFailureStreaks.get(taskId);
+					const maxFailures = this.ports.qaMaxIdenticalFailures ?? QA_MAX_IDENTICAL_FAILURES;
+					if (streak?.key === qaKey && streak.count >= maxFailures)
+						return { state: "blocked", reason: `deterministic QA already failed ${streak.count} times on this exact snapshot; change the workspace diff or intent, or restart the session after fixing the environment, before retrying` };
+					this.qaAttemptKeys.set(taskId, qaKey);
+					const declaredQaJobMs = deriveQaJobTimeoutMs(assurance.descriptors.values());
 				const qaJobTimeoutMs = Math.min(declaredQaJobMs, this.ports.qaJobTimeoutMs ?? declaredQaJobMs);
 				const qaJobDeadline = setTimeout(() => {
 					qaJobBudgetExceeded = true;

package/plugins/immune-brain/runtime/assurance/review_evidence.ts

@@ -463,6 +463,10 @@ function publishInput(
 	const recomputed = `sha256:${createHash("sha256").update(JSON.stringify(snapshot)).digest("hex")}`;
 	if (recomputed !== input.expectedDiffHash)
 		throw new Error("review task revision does not match assurance snapshot");
+	// A revision whose tree equals the base carries nothing to review; reserving
+	// Review for it would settle QA outcomes against bytes it does not contain.
+	if (Object.keys(snapshot.changed_paths).length === 0)
+		throw new Error("review revision carries no task change; stage the task's in-scope work before Review");
 	return { snapshot, revision: publishReviewRevision(snapshot.repository_root, snapshot, recomputed, input.taskId) };
 }
 

package/plugins/immune-brain/runtime/claude/interaction.ts

@@ -81,8 +81,7 @@ export interface NativeConfirmationInput {
 		batch_branch: string;
 		children: Array<{ task_id: string; slice_id: string; risk?: string }>;
 		excluded: Array<{ task_id: string; slice_id: string; reason: string }>;
-		budget: { max_children: number; deadline_at: string; qa_failure_limit: number };
-		expires_at: string;
+		budget: { max_children: number; qa_failure_limit: number };
 	};
 	signal?: AbortSignal;
 }