immune-brain 4.4.1 → 4.6.0

package/plugins/immune-brain/runtime/claude/kernel_ports.ts

@@ -44,7 +44,6 @@ import { preparePiCanary, revalidatePiCanary } from "../kernel/pi_canary_prepare
 import { runDeterministicQa } from "../assurance/qa";
 import { taskDiffIdentity, taskRevisionIdentity } from "../workspace_scope";
 import { batchReason } from "../unattended/batch_reasons";
-import { startConfirmationDeadline } from "../unattended/confirmation_deadline";
 import { deriveAuthorizationOperation } from "../authorization_operation";
 import { LITERAL_USER_ACTOR_ID, canonicalActorId } from "../kernel/actor_identity";
 import {
@@ -59,6 +58,7 @@ import {
 	projectBatchPreflight,
 	readActiveClaimTaskId,
 	isOwnBatchClaim,
+	findResumableBatchSlugForTask,
 } from "../unattended/batch_preflight";
 import {
 	startBatch,
@@ -391,7 +391,6 @@ async function mintCapability(
 		diff_hash: input.diff_hash,
 		actor_id: input.actor_id,
 		confirmation_ref: input.confirmation_ref,
-		expires_at: new Date(Date.now() + 10 * 60 * 1000).toISOString(),
 		findings_digest: input.action_kind === "request_rework"
 			? findingsDigestV2(input.findings as TaskFinding[])
 			: null,
@@ -587,7 +586,6 @@ export class ClaudeRuntime {
 				preparation_digest: preparation.digest,
 				actor_id: LITERAL_USER_ACTOR_ID,
 				confirmation_ref: gate.confirmation_ref,
-				expires_at: new Date(Date.now() + 10 * 60 * 1000).toISOString(),
 				nonce,
 			};
 			const capability = this.enrollmentRegistry.issue(binding);
@@ -611,20 +609,65 @@ export class ClaudeRuntime {
 		}
 	}
 
-	async advance(taskId: string, signal?: AbortSignal) {
-		return this.withTerminalTracker(
+	async advance(taskId: string, signal?: AbortSignal, meta?: ToolMeta) {
+		return this.closeOutBatchChild(
 			taskId,
-			await this.coordinator.advance(taskId, { cwd: this.cwd }, signal),
+			await this.withTerminalTracker(taskId, await this.coordinator.advance(taskId, { cwd: this.cwd }, signal)),
+			meta,
 		);
 	}
 
-	async submitReview(taskId: string, verdictInput: unknown) {
-		return this.withTerminalTracker(
+	async submitReview(taskId: string, verdictInput: unknown, meta?: ToolMeta) {
+		return this.closeOutBatchChild(
 			taskId,
-			await submitClaudeReview(this.host, this.coordinator, { cwd: this.cwd }, taskId, verdictInput),
+			await this.withTerminalTracker(
+				taskId,
+				await submitClaudeReview(this.host, this.coordinator, { cwd: this.cwd }, taskId, verdictInput),
+			),
+			meta,
 		);
 	}
 
+	/**
+	 * Gate-free closeout: a batch child that reached Kernel `done` in the
+	 * foreground re-enters the batch in the same call, reusing its authorization.
+	 * Only `done` continues; a stopped child, a parked child and a live Review
+	 * obligation end where they do today. The continuation is transport: the
+	 * Kernel result is returned unchanged, and any failure is reported beside it
+	 * with one retry action, never thrown into a path that could read as "the
+	 * mutation did not happen".
+	 */
+	private async closeOutBatchChild<T>(taskId: string, result: T, meta?: ToolMeta): Promise<T> {
+		if (!meta || result === null || typeof result !== "object") return result;
+		const lifecycle = (result as { record?: { lifecycle?: unknown } }).record?.lifecycle;
+		if ((result as { state?: unknown }).state !== "completed" && lifecycle !== "done") return result;
+		let slug: string | null;
+		try {
+			slug = findResumableBatchSlugForTask(this.cwd, taskId);
+		} catch {
+			return result;
+		}
+		if (!slug) return result;
+		try {
+			// The batch commit takes exactly the scope envelope plus this task's own
+			// audit evidence, and its preflight refuses unstaged changes: stage only
+			// that evidence, the step an Executor otherwise does by hand.
+			if (existsSync(join(this.cwd, ".imm", "audit", taskId)))
+				execFileSync("git", ["-C", this.cwd, "add", "--", `.imm/audit/${taskId}`], { stdio: "ignore" });
+			const batch = await this.startUnattendedBatch(slug, meta, { reuseOnly: true });
+			return { ...(result as object), batch } as T;
+		} catch (error) {
+			return {
+				...(result as object),
+				batch: {
+					state: "rejected",
+					reason: `batch continuation failed: ${error instanceof Error ? error.message : String(error)}`,
+					recovery_action: "call start_unattended_batch with the same Initiative to continue the batch",
+				},
+			} as T;
+		}
+	}
+
 	/**
 	 * Post-settlement GitHub tracker projection: the same shared step the Pi Host
 	 * runs, so an opted-in terminal projection no longer depends on which Host
@@ -987,15 +1030,18 @@ export class ClaudeRuntime {
 	async startUnattendedBatch(
 		initiativeSlug: string,
 		meta: ToolMeta,
+		options: { reuseOnly?: boolean } = {},
 	): Promise<ClaudeBatchStartResult> {
 		throwIfCancelled(meta.signal);
+		const reuseOnly = options.reuseOnly === true;
 		const probe = probeHost(this.env, process.platform, this.hostVersion);
 		if (!probe.ok) throw new NativeAuthorityError("unsupported_host", probe.reason);
+		// A reuse-only continuation never opens a gate, so it needs no confirmation port.
 		const interactive = meta.interactive ?? this.interactive;
-		if (!interactive) throw new NativeAuthorityError("unsupported_host", "interactive MCP elicitation is unavailable");
+		if (!reuseOnly && !interactive) throw new NativeAuthorityError("unsupported_host", "interactive MCP elicitation is unavailable");
 		// The text is table-owned; only the form (a thrown native error rather than
 		// a returned envelope) is this Host's.
-		if (!this.requestConfirmation)
+		if (!reuseOnly && !this.requestConfirmation)
 			throw new NativeAuthorityError("interaction_not_opened", batchReason("confirmation_port_unavailable").reason);
 
 		// 1. Host-independent batch preflight: claim ownership, branch
@@ -1022,7 +1068,7 @@ export class ClaudeRuntime {
 		const budget = preflight.projection.budget;
 		const planDigest = preflight.projection.plan_digest;
 		const recoveryChildren = preflight.projection.recovery_children;
-		// 5. Literal-user gate plus the shared reuse/expiry decision, the post-gate
+		// 5. Literal-user gate plus the shared reuse decision, the post-gate
 		// claim/drift cascade, and the Batch Authorization binding. The Host supplies
 		// only its gate, its confirmation reference, and its binding nonce.
 		const authorization = await authorizeBatch<ClaudeBatchStartResult>({
@@ -1033,9 +1079,19 @@ export class ClaudeRuntime {
 			readInitiative: this.readInitiative ?? observeGithubInitiative,
 			nonce: enrollmentNonce(),
 			gate: async (facts) => {
-				// review-4: the bounded elicitation deadline is shared behavior now, so
-				// both Hosts bound an unanswered confirmation by the same setting.
-				const deadline = startConfirmationDeadline({ env: this.env, signal: meta.signal });
+				// A continuation after a foreground child never opens a gate: when the
+				// authorization cannot be reused, the user re-enters the batch tool.
+				if (reuseOnly)
+					return {
+						kind: "host_rejection",
+						value: {
+							state: "blocked",
+							reason: `batch authorization cannot be reused (${facts.reuse_blockers.join(", ")})`,
+							recovery_action: "call start_unattended_batch with the same Initiative to confirm a fresh authorization",
+						},
+					};
+				// The gate settles only on the literal user's answer or the caller's
+				// cancellation signal.
 				let confirmationResult: { decision: NativeDecision; requestId: string };
 				try {
 					confirmationResult = await this.requestConfirmation!({
@@ -1057,7 +1113,6 @@ export class ClaudeRuntime {
 								reason: child.reason,
 							})),
 							budget: facts.budget,
-							expires_at: facts.expires_at,
 							...(facts.reuse_blockers.length > 0
 								? {
 										re_confirmation_required: facts.reuse_blockers,
@@ -1065,10 +1120,9 @@ export class ClaudeRuntime {
 									}
 								: {}),
 						},
-						signal: deadline.signal,
+						signal: meta.signal,
 					});
 				} catch (err) {
-					if (deadline.timedOut()) return { kind: "host_rejection", value: batchReason("confirmation_timed_out") };
 					if (meta.signal?.aborted)
 						return { kind: "host_rejection", value: batchReason("cancelled_before_execution") };
 					if (err instanceof NativeAuthorityError) {
@@ -1088,13 +1142,8 @@ export class ClaudeRuntime {
 						kind: "host_rejection",
 						value: batchReason("confirmation_failed", err instanceof Error ? err.message : String(err)),
 					};
-				} finally {
-					deadline.clear();
 				}
 
-				// A transport that answers "cancel" on abort is still a timeout, not a user
-				// decision: the Host that owns the transport reports which one it was.
-				if (deadline.timedOut()) return { kind: "host_rejection", value: batchReason("confirmation_timed_out") };
 				if (confirmationResult.decision === "cancel" && meta.signal?.aborted)
 					return { kind: "host_rejection", value: batchReason("confirmation_cancelled") };
 				if (meta.signal?.aborted)
@@ -1122,14 +1171,12 @@ export class ClaudeRuntime {
 		});
 		if (authorization.outcome === "host_rejection") return authorization.value;
 		if (authorization.outcome === "rejected") return authorization.rejection;
-		const { binding, batch_id: batchId, expires_at: expiresAt } = authorization;
+		const { binding, batch_id: batchId } = authorization;
 
 		// review-1: verify cancellation signal right before authority issuance and startBatch
 		if (meta.signal?.aborted) return batchReason("cancelled_before_execution");
 
 		now = new Date().toISOString();
-		if (Date.parse(expiresAt) <= Date.parse(now))
-			return batchReason("confirmation_failed", "confirmed batch deadline expired before authorization issuance");
 		const capability = this.batchRegistry.issue(binding, recoveryChildren as any, now);
 
 		const basePort = this.createBatchKernelPort(this.batchRegistry, capability, binding);
@@ -1153,7 +1200,6 @@ export class ClaudeRuntime {
 			plan_digest: planDigest,
 			base_head: binding.base_head,
 			confirmation_time: now,
-			authorization_expires_at: expiresAt,
 			budget,
 			now,
 			kernel: kernelPort,

package/plugins/immune-brain/runtime/claude/mcp_server.ts

@@ -160,10 +160,10 @@ export function createMcpRuntime(options: McpRuntimeOptions = {}) {
 				signal: meta.signal,
 			};
 			if (name === "enroll") return runtime.enroll(taskId, toolMeta);
-			if (name === "advance_assurance") return runtime.advance(taskId, toolMeta.signal);
+			if (name === "advance_assurance") return runtime.advance(taskId, toolMeta.signal, toolMeta);
 			if (name === "submit_review") {
 				if (!Object.hasOwn(args, "verdict")) throw new Error("verdict is required");
-				return runtime.submitReview(taskId, args.verdict);
+				return runtime.submitReview(taskId, args.verdict, toolMeta);
 			}
 			if (name === "revise_intent") {
 				if (!Object.hasOwn(args, "next_intent")) throw new Error("next_intent is required");
@@ -369,8 +369,7 @@ export function elicitationParams(input: NativeConfirmationInput) {
 			input.planDigest ? `Plan digest: ${input.planDigest}` : null,
 			b?.children ? `Ordered children (${b.children.length}):\n${b.children.map((c) => `  - ${c.task_id} (${c.slice_id}) [risk: ${c.risk ?? "unknown"}]`).join("\n")}` : null,
 			b?.excluded && b.excluded.length > 0 ? `Excluded children (${b.excluded.length}):\n${b.excluded.map((e) => `  - ${e.task_id} (${e.slice_id}): ${e.reason}`).join("\n")}` : null,
-			b?.budget ? `Budget: max_children=${b.budget.max_children}, deadline_at=${b.budget.deadline_at}, qa_failure_limit=${b.budget.qa_failure_limit}` : null,
-			b?.expires_at ? `Expires at: ${b.expires_at}` : null,
+			b?.budget ? `Budget: max_children=${b.budget.max_children}, qa_failure_limit=${b.budget.qa_failure_limit}` : null,
 		].filter(Boolean);
 		return {
 			mode: "form",

package/plugins/immune-brain/runtime/claude/review_host.ts

@@ -169,12 +169,21 @@ export function parseAsyncAgentLaunch(result: string): AsyncAgentLaunch | null {
 	return { agentId, outputFile };
 }
 
+const HANDBACK_TOOL = "SubagentHandback";
+
 /**
  * Extract the reviewer's terminal message from its own transcript.
  *
  * Each record carries the `agentId` that wrote it, so the caller's independently
  * observed id is matched per record rather than trusted for the file as a whole;
  * a transcript that interleaves another agent cannot contribute its text.
+ *
+ * A subagent ends its run either with an assistant text message or, on Hosts
+ * that hand the report back through a tool, with a `SubagentHandback` call whose
+ * `input.message` is that same report and which leaves no text block behind.
+ * Both are the reviewer's own record in its own transcript, so whichever the
+ * observed agent wrote last is its result — across records and across the
+ * ordered content blocks of a single record.
  */
 export function readAgentTranscriptResult(transcript: string, agentId: string): string | null {
 	let last: string | null = null;
@@ -192,6 +201,12 @@ export function readAgentTranscriptResult(transcript: string, agentId: string):
 			if (!block || typeof block !== "object") continue;
 			const part = block as Record<string, unknown>;
 			if (part.type === "text" && typeof part.text === "string") text += part.text;
+			if (part.type === "tool_use" && part.name === HANDBACK_TOOL && part.input && typeof part.input === "object") {
+				const report = (part.input as Record<string, unknown>).message;
+				// Blocks are ordered, so text before the report is a preamble and
+				// only text written after it can supersede it.
+				if (typeof report === "string" && report.trim()) { last = report; text = ""; }
+			}
 		}
 		if (text.trim()) last = text;
 	}