immune-brain 4.4.1 → 4.6.0

package/plugins/immune-brain/runtime/kernel/application.ts

@@ -53,7 +53,6 @@ export interface ApplyTaskActionInput {
 	capability?: MutationAuthorityCapabilityV2;
 	/** Trusted injected diff provider; the action's diff_hash is only an expectation. */
 	diffProvider: (root: string, record: TaskRecord) => string | { diff_hash: string; changed_paths?: readonly string[] };
-	now?: number;
 	/**
 	 * Terminal commit mode: record + workspace + active-claim removal + task
 	 * tombstone converge through one recoverable terminal transaction marker
@@ -72,8 +71,7 @@ export interface ApplyTaskActionInput {
 export function applyTaskAction(
 	input: ApplyTaskActionInput,
 ): StoredTaskMutationV3 {
-	const { root, task_id, prior_intent_token, registry, capability, diffProvider, now } =
-		input;
+	const { root, task_id, prior_intent_token, registry, capability, diffProvider } = input;
 	return withKernelStoreLock(root, () => {
 		const current = readTaskRecordRaw(root, task_id);
 		if (!current.record)
@@ -192,7 +190,7 @@ export function applyTaskAction(
 		// replay identity, and conflicting reuse, so any throw is a zero-write
 		// failure (including stale record/workspace CAS).
 		const inspectedAudit = expectedAuthority
-			? registry.inspect(capability, expectedAuthority, now)
+			? registry.inspect(capability, expectedAuthority)
 			: null;
 		const authorityRunId = inspectedAudit?.run_id;
 		const mutation = reduceTask(
@@ -237,7 +235,6 @@ export function applyTaskAction(
 			registry.consume(
 				capability as MutationAuthorityCapabilityV2,
 				expectedAuthority,
-				now,
 			);
 		}
 

package/plugins/immune-brain/runtime/kernel/authority_port.ts

@@ -62,17 +62,15 @@ export interface MutationAuthorityRegistry {
 	readonly brand: symbol;
 	/** Issue one capability bound to an exact binding. Library primitive; no production caller in P2B2. */
 	issue(binding: CapabilityBindingV2, issuedAt?: string): MutationAuthorityCapabilityV2;
-	/** Inspect without consuming. Fails on missing, expired, mismatched, or reused capability. */
+	/** Inspect without consuming. Fails on missing, mismatched, or reused capability. */
 	inspect(
 		capability: MutationAuthorityCapabilityV2 | undefined,
 		expected: MutationAuthorityInspection,
-		now?: number,
 	): ValidatedAuthorityV2;
 	/** Consume irreversibly. Returns the validated authority. */
 	consume(
 		capability: MutationAuthorityCapabilityV2,
 		expected: MutationAuthorityInspection,
-		now?: number,
 	): ValidatedAuthorityV2;
 	isConsumed(capability: MutationAuthorityCapabilityV2): boolean;
 }
@@ -88,7 +86,7 @@ export function createMutationAuthorityRegistry(): MutationAuthorityRegistry {
 	const inner = createCapabilityRegistry<CapabilityBindingV2, MutationAuthorityInspection, ValidatedAuthorityV2, MutationAuthorityCapabilityV2>(
 		MUTATION_AUTHORITY_CAPABILITY_BRAND,
 		{
-			validateBinding(binding, issuedAt) {
+			validateBinding(binding) {
 				const missing: string[] = [];
 				if (binding.run_id !== undefined && binding.run_id.length === 0)
 					throw new Error("authority capability run_id must not be empty");
@@ -100,12 +98,8 @@ export function createMutationAuthorityRegistry(): MutationAuthorityRegistry {
 					throw new Error(`authority capability binding is incomplete: ${missing.join(", ")}`);
 				if (binding.findings_digest !== null && !/^sha256:[a-f0-9]{64}$/.test(binding.findings_digest))
 					throw new Error("authority capability findings_digest must be a canonical sha256 hash");
-				if (Number.isNaN(Date.parse(binding.expires_at)) || Date.parse(binding.expires_at) <= Date.parse(issuedAt))
-					throw new Error("authority capability must have a future expiry");
 			},
-			validateAndProject(state, expected, now) {
-				if (Date.parse(state.expires_at) <= now)
-					throw new Error("authority capability has expired");
+			validateAndProject(state, expected) {
 				const actionDigest = digestOfAction(expected.action);
 				if (state.action_digest !== actionDigest)
 					throw new Error("authority capability action digest mismatch");
@@ -141,7 +135,6 @@ export function createMutationAuthorityRegistry(): MutationAuthorityRegistry {
 						actor_id: canonicalActorId(state.actor_id),
 						confirmation_ref: state.confirmation_ref,
 						issued_at: state.issued_at,
-						expires_at: state.expires_at,
 					},
 					action_digest: actionDigest,
 					...(state.run_id !== undefined ? { run_id: state.run_id } : {}),
@@ -162,12 +155,11 @@ export function createMutationAuthorityRegistry(): MutationAuthorityRegistry {
 		inspect(
 			capability: MutationAuthorityCapabilityV2 | undefined,
 			expected: MutationAuthorityInspection,
-			now = Date.now(),
 		): ValidatedAuthorityV2 {
 			if (!capability)
 				throw new Error("privileged action requires an opaque authority capability");
 			try {
-				return inner.inspect(capability, expected, now);
+				return inner.inspect(capability, expected);
 			} catch (err) {
 				if (err instanceof Error && err.message.includes("not recognized by this registry"))
 					throw new Error("privileged action requires an opaque authority capability");
@@ -177,10 +169,9 @@ export function createMutationAuthorityRegistry(): MutationAuthorityRegistry {
 		consume(
 			capability: MutationAuthorityCapabilityV2,
 			expected: MutationAuthorityInspection,
-			now = Date.now(),
 		): ValidatedAuthorityV2 {
 			try {
-				return inner.consume(capability, expected, now);
+				return inner.consume(capability, expected);
 			} catch (err) {
 				if (err instanceof Error && err.message.includes("not recognized by this registry"))
 					throw new Error("privileged action requires an opaque authority capability");

package/plugins/immune-brain/runtime/kernel/batch_authority.ts

@@ -8,6 +8,7 @@
 // plus an advancing HEAD lineage instead.
 
 import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
 import { createCapabilityRegistry } from "./capability_registry";
 import { isLiteralUserActor } from "./actor_identity";
 import type { BaseCapabilityBinding, EnrollmentCapabilityBinding } from "./enrollment_authority";
@@ -19,15 +20,6 @@ export const BATCH_AUTHORITY_CAPABILITY_BRAND = Symbol.for(
 
 const GIT_COMMIT_ID = /^[a-f0-9]{40}$/;
 
-/** review-7(3rd rework): typed expiry marker thrown at the Kernel enrollment
- * boundary so the driver can classify a real enrollment-time expiry as an
- * intentional budget stop without free-form message matching. */
-export class BatchAuthorizationExpiryError extends Error {
-	constructor(message: string) {
-		super(message);
-		this.name = "BatchAuthorizationExpiryError";
-	}
-}
 
 export interface BatchPlanChild {
 	task_id: string;
@@ -39,7 +31,6 @@ export interface BatchPlanChild {
 
 export interface BatchBudget {
 	max_children: number;
-	deadline_at: string;
 	qa_failure_limit: number;
 }
 
@@ -63,7 +54,6 @@ export interface ValidatedBatchAuthorization {
 	actor_id: string;
 	confirmation_ref: string;
 	issued_at: string;
-	expires_at: string;
 	nonce: string;
 }
 
@@ -81,7 +71,6 @@ export interface BatchAuthorityRegistry {
 	inspect(
 		capability: object,
 		expected: BatchAuthorizationBinding,
-		now?: number,
 	): ValidatedBatchAuthorization;
 	children(capability: object): BatchPlanChild[];
 	consumedChildren(capability: object): string[];
@@ -91,7 +80,6 @@ export interface BatchAuthorityRegistry {
 		capability: object,
 		expected: BatchAuthorizationBinding,
 		taskId: string,
-		now?: number,
 	): ValidatedBatchAuthorization;
 	/** Undo one slot consumption when the bound write did not commit. */
 	releaseChild(capability: object, taskId: string): void;
@@ -138,7 +126,6 @@ function requireNonEmpty(binding: BatchAuthorizationBinding): void {
 		"base_head",
 		"actor_id",
 		"confirmation_ref",
-		"expires_at",
 		"nonce",
 	] as const) {
 		const value = binding[key];
@@ -149,14 +136,11 @@ function requireNonEmpty(binding: BatchAuthorizationBinding): void {
 		throw new Error(`batch authorization binding is incomplete: ${missing.join(", ")}`);
 }
 
-function validateBudget(budget: BatchBudget, issuedAt: string): void {
+function validateBudget(budget: BatchBudget): void {
 	if (!Number.isInteger(budget.max_children) || budget.max_children <= 0)
 		throw new Error("batch budget max_children must be a positive integer");
 	if (!Number.isInteger(budget.qa_failure_limit) || budget.qa_failure_limit <= 0)
 		throw new Error("batch budget qa_failure_limit must be a positive integer");
-	const deadline = Date.parse(budget.deadline_at);
-	if (Number.isNaN(deadline) || deadline <= Date.parse(issuedAt))
-		throw new Error("batch budget must have a future deadline_at");
 }
 
 function validateChildren(children: BatchPlanChild[], planDigest: string): void {
@@ -210,7 +194,7 @@ export function createBatchAuthorityRegistry(): BatchAuthorityRegistry {
 	>(
 		BATCH_AUTHORITY_CAPABILITY_BRAND,
 		{
-			validateBinding(binding, issuedAt) {
+			validateBinding(binding) {
 				requireNonEmpty(binding);
 				// Both the canonical literal-user spelling and the historical `user`
 				// spelling are read, so a batch authorized before the convergence keeps
@@ -219,29 +203,15 @@ export function createBatchAuthorityRegistry(): BatchAuthorityRegistry {
 					throw new Error("batch authorization requires a literal-user actor_id");
 				if (!GIT_COMMIT_ID.test(binding.base_head))
 					throw new Error("batch authorization base_head must be a committed 40-hex commit id");
-				const expires = Date.parse(binding.expires_at);
-				if (Number.isNaN(expires) || expires <= Date.parse(issuedAt))
-					throw new Error("batch authorization must have a future expiry");
-				validateBudget(binding.budget, issuedAt);
+				validateBudget(binding.budget);
 			},
-			validateAndProject(state, expected, now) {
-				// Fail closed on an unusable clock. `now` reaches here as
-				// Date.parse(...) from callers, and NaN makes every `<=` compare
-				// false, which would silently accept an expired authorization.
-				if (!Number.isFinite(now))
-					throw new Error("batch authorization requires a valid clock");
-				const expires = Date.parse(state.expires_at);
-				if (Number.isNaN(expires) || expires <= now)
-					throw new BatchAuthorizationExpiryError("batch authorization has expired");
-				if (Date.parse(state.budget.deadline_at) <= now)
-					throw new BatchAuthorizationExpiryError("batch authorization deadline has expired");
+			validateAndProject(state, expected) {
 				for (const key of Object.keys(expected) as Array<keyof BatchAuthorizationBinding>) {
 					if (key === "budget") {
 						const a = state.budget ?? ({} as BatchBudget);
 						const b = expected.budget ?? ({} as BatchBudget);
 						if (
 							a.max_children !== b.max_children ||
-							a.deadline_at !== b.deadline_at ||
 							a.qa_failure_limit !== b.qa_failure_limit
 						)
 							throw new Error("batch authorization budget mismatch");
@@ -263,7 +233,6 @@ export function createBatchAuthorityRegistry(): BatchAuthorityRegistry {
 					actor_id: state.actor_id,
 					confirmation_ref: state.confirmation_ref,
 					issued_at: state.issued_at,
-					expires_at: state.expires_at,
 					nonce: state.nonce,
 				};
 			},
@@ -299,9 +268,9 @@ export function createBatchAuthorityRegistry(): BatchAuthorityRegistry {
 			consumed.set(capability, new Set<string>());
 			return capability;
 		},
-		inspect(capability, expected, now = Date.now()) {
+		inspect(capability, expected) {
 			planOf(capability);
-			return inner.inspect(capability, expected, now);
+			return inner.inspect(capability, expected);
 		},
 		children(capability) {
 			return planOf(capability).map((child) => ({ ...child, blocked_by: [...child.blocked_by] }));
@@ -312,8 +281,8 @@ export function createBatchAuthorityRegistry(): BatchAuthorityRegistry {
 		isChildConsumed(capability, taskId) {
 			return slotsOf(capability).has(taskId);
 		},
-		consumeChild(capability, expected, taskId, now = Date.now()) {
-			const validated = this.inspect(capability, expected, now);
+		consumeChild(capability, expected, taskId) {
+			const validated = this.inspect(capability, expected);
 			const plan = planOf(capability);
 			if (!plan.some((child) => child.task_id === taskId))
 				throw new Error(`batch_child_not_in_plan: ${taskId}`);
@@ -331,6 +300,24 @@ export function createBatchAuthorityRegistry(): BatchAuthorityRegistry {
 	};
 }
 
+/**
+ * Before a batch has consumed a slot it has created no commit, so its lineage
+ * can only stand on the confirmed base_head or on a fast-forward of it: the
+ * user's own commit on the batch branch, which the runner adopts. A head that
+ * does not descend from base_head is not a lineage.
+ */
+export function assertBatchLineageOrigin(root: string, baseHead: string, expectedHead: string): void {
+	if (expectedHead === baseHead) return;
+	const descends =
+		spawnSync("git", ["-C", root, "merge-base", "--is-ancestor", baseHead, expectedHead], {
+			stdio: ["ignore", "ignore", "ignore"],
+		}).status === 0;
+	if (!descends)
+		throw new Error(
+			`batch_head_lineage_broken: the first child must enroll on the confirmed base_head ${baseHead} or a fast-forward of it, not ${expectedHead}`,
+		);
+}
+
 export interface DeriveChildEnrollmentInput {
 	capability: object;
 	binding: BatchAuthorizationBinding;
@@ -355,7 +342,7 @@ export function deriveChildEnrollment(
 	registry: BatchAuthorityRegistry,
 	input: DeriveChildEnrollmentInput,
 ): DerivedChildEnrollment {
-	const validated = registry.inspect(input.capability, input.binding, Date.parse(input.now));
+	const validated = registry.inspect(input.capability, input.binding);
 	const child = registry
 		.children(input.capability)
 		.find((entry) => entry.task_id === input.task_id);
@@ -385,13 +372,8 @@ export function deriveChildEnrollment(
 	// settled a child there is no commit it could have created, so a
 	// caller-supplied expected_head other than base_head is not a lineage.
 	// Checked last so the intent-divergence reason keeps its precedence.
-	if (
-		registry.consumedChildren(input.capability).length === 0 &&
-		input.expected_head !== validated.base_head
-	)
-		throw new Error(
-			`batch_head_lineage_broken: the first child must enroll on the confirmed base_head ${validated.base_head}, not ${input.expected_head}`,
-		);
+	if (registry.consumedChildren(input.capability).length === 0)
+		assertBatchLineageOrigin(root, validated.base_head, input.expected_head);
 
 	return {
 		child,
@@ -404,7 +386,6 @@ export function deriveChildEnrollment(
 			preparation_digest: preparation.digest,
 			actor_id: validated.actor_id,
 			confirmation_ref: validated.confirmation_ref,
-			expires_at: validated.expires_at,
 			nonce: `${validated.nonce}:${child.task_id}`,
 		},
 	};

package/plugins/immune-brain/runtime/kernel/canary_application.ts

@@ -431,7 +431,6 @@ export function createCanaryApplication(
 			registry,
 			capability: capability as never,
 			diffProvider: input.diffProvider,
-			now: Date.parse(now),
 			...(operation.op === "complete" || operation.op === "stop"
 				? { terminal: { terminalized_at: now } }
 				: {}),
@@ -492,7 +491,7 @@ export function createCanaryApplication(
 				intent_revision: current.record.intent_snapshot.revision,
 				intent_content_hash: current.record.intent_ref.content_hash,
 				diff_hash: "sha256:" + "0".repeat(64),
-			}, Date.parse(now));
+			});
 			const nextClaim: BackendClaim = {
 				...claim,
 				lifecycle_status: "draining",

package/plugins/immune-brain/runtime/kernel/canary_eligibility.ts

@@ -23,7 +23,6 @@ export interface CanaryWaiver {
 	reason: string;
 	actor: string;
 	confirmation_ref: string;
-	expires_at: string;
 	nonce: string;
 }
 

package/plugins/immune-brain/runtime/kernel/capability_registry.ts

@@ -4,20 +4,19 @@
 
 export interface CapabilityRegistryHooks<TBinding, TExpected, TValidated> {
 	/** Validate the binding at issue time. Throw on invalid input. */
-	validateBinding(binding: TBinding, issuedAt: string): void;
+	validateBinding(binding: TBinding): void;
 	/** Validate stored state against expected input at inspect time. Return the domain-specific validated result. */
 	validateAndProject(
 		state: TBinding & { issued_at: string },
 		expected: TExpected,
-		now: number,
 	): TValidated;
 }
 
 export interface CapabilityRegistry<TBinding, TExpected, TValidated, TCapability> {
 	readonly brand: symbol;
 	issue(binding: TBinding, issuedAt?: string): TCapability;
-	inspect(capability: TCapability, expected: TExpected, now?: number): TValidated;
-	consume(capability: TCapability, expected: TExpected, now?: number): TValidated;
+	inspect(capability: TCapability, expected: TExpected): TValidated;
+	consume(capability: TCapability, expected: TExpected): TValidated;
 	isConsumed(capability: TCapability): boolean;
 }
 
@@ -53,7 +52,7 @@ export function createCapabilityRegistry<TBinding, TExpected, TValidated, TCapab
 	return {
 		brand,
 		issue(binding: TBinding, issuedAt = new Date().toISOString()): TCapability {
-			hooks.validateBinding(binding, issuedAt);
+			hooks.validateBinding(binding);
 			const capability = Object.freeze(
 				Object.defineProperties(
 					{},
@@ -66,7 +65,7 @@ export function createCapabilityRegistry<TBinding, TExpected, TValidated, TCapab
 			states.set(capability as object, { binding: { ...binding }, issued_at: issuedAt, consumed: false });
 			return capability;
 		},
-		inspect(capability: TCapability, expected: TExpected, now = Date.now()): TValidated {
+		inspect(capability: TCapability, expected: TExpected): TValidated {
 			if (!isCapability(capability))
 				throw new Error(`${domainLabel} capability is not recognized by this registry`);
 			const state = stateOf(capability);
@@ -74,11 +73,10 @@ export function createCapabilityRegistry<TBinding, TExpected, TValidated, TCapab
 			return hooks.validateAndProject(
 				{ ...state.binding, issued_at: state.issued_at },
 				expected,
-				now,
 			);
 		},
-		consume(capability: TCapability, expected: TExpected, now = Date.now()): TValidated {
-			const validated = this.inspect(capability, expected, now);
+		consume(capability: TCapability, expected: TExpected): TValidated {
+			const validated = this.inspect(capability, expected);
 			stateOf(capability).consumed = true;
 			return validated;
 		},

package/plugins/immune-brain/runtime/kernel/enrollment.ts

@@ -15,8 +15,9 @@ import type {
 	BatchAuthorizationBinding,
 } from "./batch_authority";
 import type { BackendClaim } from "./backend_claim";
+import { assertBatchLineageOrigin } from "./batch_authority";
 import { preparePiCanary, readGitHead } from "./pi_canary_prepare";
-import { writeEnrollmentBaseline } from "../workspace_scope";
+import { dirtyScopePaths, writeEnrollmentBaseline } from "../workspace_scope";
 import { enrollmentRequestDigest } from "./run_identity";
 import {
 	commitEnrollmentLocked,
@@ -163,6 +164,20 @@ function runEnrollmentPreconditionChecks<T>(
 		} catch (error) {
 			fail(`git base: ${error instanceof Error ? error.message : String(error)}`, error);
 		}
+		// In-scope dirt present now would be recorded in the Enrollment baseline as
+		// user dirt and withheld from every later task snapshot, so the task could
+		// never deliver it. Refuse before the capability is consumed.
+		if (intent && gitBaseHead) {
+			try {
+				const dirty = dirtyScopePaths(root, intent.intent.scope_hint, input.task_id);
+				if (dirty.length > 0) {
+					const message = `task scope is already dirty before Enrollment: ${dirty.join(", ")}; commit, stash or revert these paths first`;
+					fail(message, new Error(message));
+				}
+			} catch (error) {
+				fail(`scope: ${error instanceof Error ? error.message : String(error)}`, error);
+			}
+		}
 
 		const state: EnrollmentPreconditionState = {
 			validated,
@@ -332,24 +347,19 @@ export function enrollCanaryTask(
 
 			// A batch-derived enrollment must still stand on the lineage the
 			// literal user confirmed: child N's base is the commit child N-1
-			// produced on the batch branch, and child 1's base is base_head.
+			// produced on the batch branch, and child 1's base is base_head or a
+			// fast-forward of it the runner adopted.
 			// expected_head is caller-supplied, so anchor its origin here rather
 			// than trusting the caller's own assertion: before this batch has
 			// consumed any slot it has created no commit, so the only lineage
-			// value it can hold is the confirmed base_head.
+			// value it can hold descends from the confirmed base_head.
 			if (input.batch) {
 				const batch = input.batch.registry.inspect(
 					input.batch.capability,
 					input.batch.binding,
-					Date.parse(input.now),
 				);
-				if (
-					input.batch.registry.consumedChildren(input.batch.capability).length === 0 &&
-					input.batch.expected_head !== batch.base_head
-				)
-					throw new Error(
-						`batch_head_lineage_broken: the first child must enroll on the confirmed base_head ${batch.base_head}, not ${input.batch.expected_head}`,
-					);
+				if (input.batch.registry.consumedChildren(input.batch.capability).length === 0)
+					assertBatchLineageOrigin(root, batch.base_head, input.batch.expected_head);
 				if (checks.gitBaseHead !== input.batch.expected_head)
 					throw new Error(
 						`batch_head_lineage_broken: expected ${input.batch.expected_head}, found ${checks.gitBaseHead}`,
@@ -364,7 +374,6 @@ export function enrollCanaryTask(
 					input.batch.capability,
 					input.batch.binding,
 					input.task_id,
-					Date.parse(input.now),
 				);
 
 			// Set by beforeLock above, which throws when the repository has no

package/plugins/immune-brain/runtime/kernel/enrollment_authority.ts

@@ -7,7 +7,7 @@ import { createCapabilityRegistry } from "./capability_registry";
 export const ENROLLMENT_CAPABILITY_BRAND = Symbol.for("assurance-kernel.enrollment-capability-brand");
 
 /**
- * The three fields every capability binding shares, whichever authority issues
+ * The two fields every capability binding shares, whichever authority issues
  * it. `nonce` is deliberately not part of this base: the enrollment and batch
  * bindings carry it for their own replay digest, while `CapabilityBindingV2`
  * uses `action_digest` instead and has no `nonce` field at all.
@@ -15,7 +15,6 @@ export const ENROLLMENT_CAPABILITY_BRAND = Symbol.for("assurance-kernel.enrollme
 export interface BaseCapabilityBinding {
 	actor_id: string;
 	confirmation_ref: string;
-	expires_at: string;
 }
 
 export interface EnrollmentCapabilityBinding extends BaseCapabilityBinding {
@@ -36,7 +35,6 @@ export interface ValidatedEnrollment {
 	actor_id: string;
 	confirmation_ref: string;
 	issued_at: string;
-	expires_at: string;
 	nonce: string;
 }
 
@@ -44,8 +42,8 @@ export interface EnrollmentAuthorityRegistry {
 	readonly brand: symbol;
 	/** Issue one capability bound to an exact binding. Library primitive. */
 	issue(binding: EnrollmentCapabilityBinding, issuedAt?: string): object;
-	inspect(capability: object, expected: EnrollmentCapabilityBinding, now?: number): ValidatedEnrollment;
-	consume(capability: object, expected: EnrollmentCapabilityBinding, now?: number): ValidatedEnrollment;
+	inspect(capability: object, expected: EnrollmentCapabilityBinding): ValidatedEnrollment;
+	consume(capability: object, expected: EnrollmentCapabilityBinding): ValidatedEnrollment;
 	isConsumed(capability: object): boolean;
 }
 
@@ -53,18 +51,15 @@ export function createEnrollmentAuthorityRegistry(): EnrollmentAuthorityRegistry
 	return createCapabilityRegistry<EnrollmentCapabilityBinding, EnrollmentCapabilityBinding, ValidatedEnrollment>(
 		ENROLLMENT_CAPABILITY_BRAND,
 		{
-			validateBinding(binding, issuedAt) {
+			validateBinding(binding) {
 				const missing: string[] = [];
 				for (const [key, value] of Object.entries(binding)) {
 					if (value === undefined || value === null || value === "") missing.push(key);
 				}
 				if (missing.length > 0)
 					throw new Error(`enrollment capability binding is incomplete: ${missing.join(", ")}`);
-				if (Number.isNaN(Date.parse(binding.expires_at)) || Date.parse(binding.expires_at) <= Date.parse(issuedAt))
-					throw new Error("enrollment capability must have a future expiry");
 			},
-			validateAndProject(state, expected, now) {
-				if (Date.parse(state.expires_at) <= now) throw new Error("enrollment capability has expired");
+			validateAndProject(state, expected) {
 				for (const key of Object.keys(expected) as Array<keyof EnrollmentCapabilityBinding>) {
 					if (state[key] !== expected[key])
 						throw new Error(`enrollment capability ${key} mismatch`);
@@ -78,7 +73,6 @@ export function createEnrollmentAuthorityRegistry(): EnrollmentAuthorityRegistry
 					actor_id: state.actor_id,
 					confirmation_ref: state.confirmation_ref,
 					issued_at: state.issued_at,
-					expires_at: state.expires_at,
 					nonce: state.nonce,
 				};
 			},

package/plugins/immune-brain/runtime/kernel/storage.ts

@@ -480,10 +480,15 @@ function ensureSecureDirectory(root: string, relativePath: string): string {
 	return target.path;
 }
 
-export function readSecureProjectFile(
+export function readSecureProjectFile(root: string, relativePath: string): string {
+	return readSecureProjectBytes(root, relativePath).toString("utf8");
+}
+
+/** Preserve byte identity while retaining the same secure filesystem checks. */
+export function readSecureProjectBytes(
 	root: string,
 	relativePath: string,
-): string {
+): Buffer {
 	const candidate = safeCandidate(root, relativePath);
 	assertNoSymlinkSegments(candidate.root, candidate.path);
 	const before = pathStatOrNull(candidate.path);
@@ -498,7 +503,7 @@ export function readSecureProjectFile(
 		const opened = fstatSync(fd);
 		if (opened.dev !== before.dev || opened.ino !== before.ino)
 			throw new KernelStoreSecurityError(`source identity changed: ${relativePath}`);
-		const content = readFileSync(fd, "utf8");
+		const content = readFileSync(fd);
 		const after = lstatSync(candidate.path);
 		if (after.dev !== opened.dev || after.ino !== opened.ino)
 			throw new KernelStoreSecurityError(`source identity changed: ${relativePath}`);

package/plugins/immune-brain/runtime/kernel/types.ts

@@ -265,7 +265,8 @@ export interface AuthorityAuditDescriptor {
 	actor_id: string;
 	confirmation_ref: string;
 	issued_at: string;
-	expires_at: string;
+	/** Read-only: history written before authority lost its clock still carries it. Never written. */
+	expires_at?: string;
 }
 
 export interface TaskActionBase {

package/plugins/immune-brain/runtime/kernel/validation.ts

@@ -287,7 +287,9 @@ function parseHistoryV3(
 			actor_id: stringAt(auth.actor_id, `${path}.authority.actor_id`, violations),
 			confirmation_ref: stringAt(auth.confirmation_ref, `${path}.authority.confirmation_ref`, violations),
 			issued_at: stringAt(auth.issued_at, `${path}.authority.issued_at`, violations),
-			expires_at: stringAt(auth.expires_at, `${path}.authority.expires_at`, violations),
+			...(auth.expires_at !== undefined
+				? { expires_at: stringAt(auth.expires_at, `${path}.authority.expires_at`, violations) }
+				: {}),
 		};
 	}
 	return {

package/plugins/immune-brain/runtime/plugin_version.ts

@@ -1,2 +1,2 @@
 // Generated by scripts/plugin_versioning.ts from the root package.json.
-export const PLUGIN_VERSION = "4.4.1" as const;
+export const PLUGIN_VERSION = "4.6.0" as const;

package/plugins/immune-brain/runtime/prompts/code-review.md

@@ -34,6 +34,25 @@ about the fix's scope, not a new bug. A trigger the accepted contract explicitly
 excludes is reported as an advisory note against that boundary, never as blocking
 rework.
 
+## Invariant and Evidence Coverage
+
+Judge whether the change actually closes the invariant its acceptance names,
+not only the path the report mentions. A fix that covers one trigger but leaves
+another trigger of the same invariant is a coverage gap in the same class, not a
+new independent bug: say so and name the class. Check the negative and bound
+behavior, not only the happy path. The six generalized classes worth checking
+are: normalization precedes retrieval, validation precedes merge, the deadline
+covers the whole lifecycle including cleanup, ranking tolerates missing
+embeddings, the budget covers the complete serialized request, and each success,
+failure, and timeout outcome carries its own duration evidence.
+
+A required check that is skipped, that matches zero tests, or whose prerequisite
+is absent does not prove the acceptance; do not accept it as evidence. Full
+suite coverage reported at a coarse pass count is not per-invariant evidence.
+Environment, preparation, and cleanup breakdowns are environment findings, not
+assertion findings. Keep automated behavioral or geometry evidence separated
+from a human quality judgment.
+
 Return exactly one JSON object with the fields required by the Loop review
 contract: `contract`, `role`, `task_id`, `snapshot_digest`, `decision` (`pass`
 or `rework`), and for `pass` include `approval` (`kind`, `authority_role`,

package/plugins/immune-brain/runtime/prompts/qa.md

@@ -20,4 +20,16 @@ Plan remains a literal-user decision.
 For elevated-risk work, check the latest referenced Spec's Design Conformance
 against implementation evidence. A local implementation mismatch is `rework`;
 return `rework` with bounded repair evidence. A structural or intended design
-change is `replan`; return `replan` with the missing design fact. QA must not approve a changed design or silently accept a deviation. If the checkpoint is `awaiting_user_successor_decision`, stop without dispatch; only a literal user may invoke `--approve-successor`.
+change is `replan`; return `replan` with the missing design fact. QA must not approve a changed design or silently accept a deviation.
+
+Judge the recorded execution evidence, not the descriptor text. A required check
+proves an acceptance invariant only when it actually executed and passed: an
+absent dependency, a prerequisite preparation failure, a skipped required check,
+or a check that matched zero tests is a failure, not a pass. Structural
+"Enrollment ready" or "descriptor valid" is not execution evidence, and a
+contract string proves nothing about provider behavior. Automated behavioral or
+geometry evidence cannot stand in for a human motion-quality judgment, and vice
+versa; keep the two claims separate. Environment, preparation, and cleanup
+breakdowns are environment findings, not assertion findings: report them with
+the descriptor reference and observed outcome rather than as a code defect.
+ If the checkpoint is `awaiting_user_successor_decision`, stop without dispatch; only a literal user may invoke `--approve-successor`.

package/plugins/immune-brain/runtime/unattended/batch_git.ts

@@ -20,6 +20,7 @@ import { dirname, join } from "node:path";
 import { localRunId, readAuditTaskPair, readSecureProjectFile } from "../kernel/storage";
 import { captureGitTaskRevisionSnapshot, pathMatchesScope } from "../workspace_scope";
 import { expectedBatchHead, findExistingActiveBatch, findSettledBatchRecord } from "./batch_preflight";
+export { classifyBatchLineage, type BatchLineage } from "./batch_preflight";
 
 export type BatchGitPreflightRejectReason =
 	| "batch_branch_exists"
@@ -744,7 +745,14 @@ export async function lookupBatchCommit(input: {
 			stdio: ["ignore", "pipe", "pipe"],
 		});
 		const currentHead = currentHeadResult.stdout.trim();
-		if (currentHead !== commit) {
+		// HEAD is the own commit, or a fast-forward the user added on top of it
+		// before the runner persisted it.
+		if (
+			currentHead !== commit &&
+			spawnSync("git", ["-C", root, "merge-base", "--is-ancestor", commit, currentHead], {
+				stdio: ["ignore", "ignore", "ignore"],
+			}).status !== 0
+		) {
 			throw new Error(`batch_head_lineage_broken: current HEAD ${currentHead} diverged from adopted commit ${commit}`);
 		}
 		const parentsResult = spawnSync("git", ["-C", root, "rev-parse", `${commit}^@`], {