immune-brain 4.5.0 → 4.6.0

package/README.md

@@ -301,7 +301,8 @@ When an Initiative has several ready children, you can run them as one serial ba
 - **Entry is explicit:** the Host's privileged `start_unattended_batch` tool, taking the Initiative slug. Nothing batch-related exists until it is called — without it, `imm-loop` behaves exactly like per-task enrollment and creates no batch state, branch, or authorization.
 - **One confirmation, one digest:** the native gate (Pi TUI dialog or Claude MCP elicitation) shows the ordered child list and the shared plan digest; that single literal-user act is the whole Batch Authorization.
 - **Per-child authority survives:** every child is still enrolled, frozen, QA'd, reviewed, and settled by the Kernel on its own `TaskRecord`. The batch is the scope of one authorization, never a new authority layer.
-- **Bounds:** only published, non-`critical` children run, serially on a dedicated batch branch. The run parks when a child needs a human decision or a budget, deadline, authorization, or commit failure stops it, and dependents of a blocked child are skipped rather than reordered. The runner never pushes, opens PRs, resolves user decisions, or creates, switches, or deletes Git worktrees.
+- **Closeout is automatic:** when a child reaches `done` in the foreground, the same call commits it and enrolls the next child, or marks the batch `completed`, with no new gate. A parked or stopped child is never committed for you, and a failed continuation is reported beside the result with `start_unattended_batch` as the retry. A fast-forward commit you add to the batch branch is adopted; any other HEAD movement still stops the run.
+- **Bounds:** only published, non-`critical` children run, serially on a dedicated batch branch. The run parks when a child needs a human decision or a budget, authorization, or commit failure stops it; the budget is a child count and a QA failure limit, and nothing expires with time, and dependents of a blocked child are skipped rather than reordered. The runner never pushes, opens PRs, resolves user decisions, or creates, switches, or deletes Git worktrees.
 
 ---
 
@@ -361,7 +362,7 @@ docs/specs/                           # Living specs (updated in place)
 
 **A review finding stopped blocking — why?** It was refuted: fresh deterministic QA evidence shows the acceptance it names passes. The refutation is bound to that exact evidence, so the finding blocks again the moment the evidence goes stale for the current revision, intent hash, or diff.
 
-**Can it run a whole Initiative without me?** Only as far as you authorize. Confirm `start_unattended_batch` with the Initiative slug and the runner works through the published, non-`critical` children serially on one batch branch — parking as soon as a child needs a human decision or the run hits a budget, deadline, authorization, or commit failure. It never pushes, opens PRs, or settles user decisions for you.
+**Can it run a whole Initiative without me?** Only as far as you authorize. Confirm `start_unattended_batch` with the Initiative slug and the runner works through the published, non-`critical` children serially on one batch branch — parking as soon as a child needs a human decision or the run hits a budget, authorization, or commit failure. A parked run waits for you indefinitely: neither the confirmation dialog nor the authorization it grants times out. It never pushes, opens PRs, or settles user decisions for you.
 
 **Can I switch between hosts (e.g. plan in Claude Code, code in Pi)?** Yes. Immune-Brain's contracts and state live entirely on disk in the repository, decoupled from conversation sessions. You can leverage Claude Code for deep architectural thinking and Spec planning, then switch to Pi to run `imm-loop` for code execution and deterministic QA. Interrupted tasks can be resumed in either host at any time.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "4.5.0",
+  "version": "4.6.0",
   "description": "Immune-Brain agent skill system",
   "publishConfig": {
     "access": "public",

package/plugins/immune-brain/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "immune-brain",
-  "version": "4.5.0",
+  "version": "4.6.0",
   "description": "Immune-Brain Claude Code Host: native Enrollment, QA, Review, and Kernel settlement.",
   "author": {
     "name": "Immune-Brain Team"

package/plugins/immune-brain/.pi-extension/imm-canary-enroll.ts

@@ -557,7 +557,6 @@ async function executeForegroundEnrollment(
 			preparation_digest: preparation.digest,
 			actor_id: LITERAL_USER_ACTOR_ID,
 			confirmation_ref: `pi-confirm-${createHash("sha256").update(`${taskId}\0${now}\0${nonce}`).digest("hex").slice(0, 16)}`,
-			expires_at: new Date(Date.now() + 10 * 60 * 1000).toISOString(),
 			nonce,
 		};
 		const capability = registry.issue(binding);

package/plugins/immune-brain/.pi-extension/imm-canary-work.ts

@@ -21,6 +21,8 @@ import { join, resolve } from "node:path";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { PLUGIN_VERSION } from "../runtime/plugin_version";
+import { findResumableBatchSlugForTask } from "../runtime/unattended/batch_preflight";
+import { executePiUnattendedBatch } from "./imm-unattended-batch";
 import {
 	parseVerificationDescriptor,
 	type VerificationDescriptor,
@@ -581,7 +583,11 @@ export default function (
 							: action.op === "request_stop"
 								? await authorizeExactOperation(taskId, "stop", { ...ctx, signal: signal && ctx.signal ? AbortSignal.any([signal, ctx.signal]) : signal ?? ctx.signal })
 								: await requestAuthorization(taskId, ctx);
-				const enriched = await enrichAssuranceResult(ctx, taskId, result as unknown as Record<string, unknown>);
+				const enriched = await closeOutBatchChild(
+					ctx,
+					taskId,
+					await enrichAssuranceResult(ctx, taskId, result as unknown as Record<string, unknown>),
+				);
 				presentTaskRailResult(ctx, taskId, enriched);
 				throwIfCanaryToolFailure(taskId, action.op, enriched);
 				return toolResult(JSON.stringify(enriched, null, 2), enriched);
@@ -1648,7 +1654,6 @@ async function mintCapability(
 		confirmation_ref: `pi-confirm-${createHash("sha256").update(
 			`${input.task_id}\0${now}\0${input.intent_revision}\0${input.intent_content_hash}\0${input.diff_hash}`,
 		).digest("hex").slice(0, 16)}`,
-		expires_at: new Date(Date.now() + 10 * 60 * 1000).toISOString(),
 		findings_digest:
 			input.action_kind === "request_rework"
 				? await findingsDigestV2(input.findings as never[])
@@ -1732,6 +1737,46 @@ async function reconcileRefsQuietly(root: string): Promise<void> {
 	}
 }
 
+/**
+ * Gate-free closeout: a batch child that reached Kernel `done` in the foreground
+ * re-enters the batch in the same call, reusing its authorization. Only `done`
+ * continues; stopped, parked and Review-pending children end where they do
+ * today. The continuation is transport: the Kernel result is returned
+ * unchanged, and any failure is reported beside it with one retry action.
+ */
+async function closeOutBatchChild(
+	ctx: ExtensionContext,
+	taskId: string,
+	enriched: Record<string, unknown>,
+): Promise<Record<string, unknown>> {
+	const taskState = enriched.task_state as { lifecycle?: unknown } | undefined;
+	if (taskState?.lifecycle !== "done") return enriched;
+	let slug: string | null;
+	try {
+		slug = findResumableBatchSlugForTask(ctx.cwd, taskId);
+	} catch {
+		return enriched;
+	}
+	if (!slug) return enriched;
+	try {
+		// The batch commit takes exactly the scope envelope plus this task's own
+		// audit evidence and refuses unstaged changes: stage only that evidence.
+		if (existsSync(join(ctx.cwd, ".imm", "audit", taskId)))
+			execFileSync("git", ["-C", ctx.cwd, "add", "--", `.imm/audit/${taskId}`], { stdio: "ignore" });
+		const batch = await executePiUnattendedBatch({ root: ctx.cwd, initiativeSlug: slug, reuseOnly: true, signal: ctx.signal });
+		return { ...enriched, batch };
+	} catch (error) {
+		return {
+			...enriched,
+			batch: {
+				state: "rejected",
+				reason: `batch continuation failed: ${error instanceof Error ? error.message : String(error)}`,
+				recovery_action: "call start_unattended_batch with the same Initiative to continue the batch",
+			},
+		};
+	}
+}
+
 async function enrichAssuranceResult(
 	ctx: ExtensionContext,
 	taskId: string,

package/plugins/immune-brain/.pi-extension/imm-unattended-batch.ts

@@ -19,7 +19,6 @@ import {
 	type InitiativeObservationReader,
 } from "./runtime-stub";
 import { batchReason } from "../runtime/unattended/batch_reasons";
-import { startConfirmationDeadline } from "../runtime/unattended/confirmation_deadline";
 import {
 	authorizeBatch,
 	projectBatchPreflight,
@@ -69,12 +68,16 @@ export interface PiBatchExecutionOptions {
 	root: string;
 	initiativeSlug: string;
 	interactive?: boolean;
+	/**
+	 * Gate-free continuation after a foreground child: never opens the
+	 * confirmation, and an authorization that cannot be reused is reported as a
+	 * blocked result with the one action that reopens the gate.
+	 */
+	reuseOnly?: boolean;
 	signal?: AbortSignal;
 	batchKernel?: Partial<BatchRunnerKernelPort>;
 	batchGit?: BatchRunnerGitPort;
 	readInitiative?: InitiativeObservationReader;
-	/** Environment the confirmation deadline reads; production passes process.env. */
-	env?: Record<string, string | undefined>;
 	confirmBatch?: (details: {
 		title: string;
 		summary: string;
@@ -107,9 +110,10 @@ export async function executePiUnattendedBatch(
 	options: PiBatchExecutionOptions,
 ): Promise<PiBatchExecutionResult> {
 	const { root, initiativeSlug, signal } = options;
+	const reuseOnly = options.reuseOnly === true;
 	const interactive = options.interactive ?? true;
 
-	if (!interactive) return { state: "rejected", ...nonInteractiveRefusal() };
+	if (!reuseOnly && !interactive) return { state: "rejected", ...nonInteractiveRefusal() };
 
 	// 1. Host-independent batch preflight: claim ownership, branch availability,
 	// working-tree cleanliness against the authorized scope, recovery children,
@@ -132,7 +136,7 @@ export async function executePiUnattendedBatch(
 	const planDigest = preflight.projection.plan_digest;
 	const recoveryChildren = preflight.projection.recovery_children;
 
-	// 4. Literal-user gate plus the shared reuse/expiry decision, the post-gate
+	// 4. Literal-user gate plus the shared reuse decision, the post-gate
 	// claim/drift cascade, and the Batch Authorization binding. The Host supplies
 	// only its gate, its confirmation reference, and its binding nonce.
 	const authorization = await authorizeBatch<PiBatchExecutionResult>({
@@ -143,36 +147,40 @@ export async function executePiUnattendedBatch(
 		readInitiative: options.readInitiative,
 		nonce: randomUUID(),
 		gate: async (facts) => {
+			if (reuseOnly)
+				return {
+					kind: "host_rejection",
+					value: {
+						state: "blocked",
+						reason: `batch authorization cannot be reused (${facts.reuse_blockers.join(", ")})`,
+						recovery_action: "call start_unattended_batch with the same Initiative to confirm a fresh authorization",
+					},
+				};
 			// review-2: fail closed with zero writes when confirmation port is missing
 			if (!options.confirmBatch) {
 				return { kind: "host_rejection", value: batchReason("confirmation_port_unavailable") };
 			}
 			const confirmDetails = {
 				title: `Authorize Unattended Batch: ${facts.initiative_slug}`,
-				summary: `Initiative: ${facts.initiative_slug}\nBatch branch: ${facts.batch_branch}\nPlan digest: ${facts.plan_digest}\nBudget: max_children=${facts.budget.max_children}, deadline_at=${facts.budget.deadline_at}, qa_failure_limit=${facts.budget.qa_failure_limit}\nExpires at: ${facts.expires_at}`,
+				summary: `Initiative: ${facts.initiative_slug}\nBatch branch: ${facts.batch_branch}\nPlan digest: ${facts.plan_digest}\nBudget: max_children=${facts.budget.max_children}, qa_failure_limit=${facts.budget.qa_failure_limit}`,
 				details: `Ordered children (${facts.children.length}):\n${facts.children.map((child) => `  - ${child.task_id} (${child.slice_id}) [risk: ${child.risk}] [status: ${child.status === "already_settled" ? "completed" : "pending execution"}]`).join("\n")}${facts.excluded.length > 0 ? `\n\nExcluded children:\n${facts.excluded.map((child) => `  - ${child.task_id} (${child.slice_id}): ${child.reason}`).join("\n")}` : ""}${facts.reuse_blockers.length > 0 ? `\n\nRe-confirmation required: ${facts.reuse_blockers.join(", ")}.\nRecovery: confirm to issue a fresh authorization bound to the current plan and HEAD.` : ""}`,
 				planDigest: facts.plan_digest,
 				signal,
 			};
 
-			// The bounded elicitation deadline is shared behavior: an unanswered native
-			// confirmation is bounded by the same setting on both Hosts.
-			const deadline = startConfirmationDeadline({ env: options.env ?? process.env, signal });
+			// The gate settles only on the literal user's answer or the caller's
+			// cancellation signal.
 			let decision: "accept" | "decline" | "cancel";
 			try {
-				decision = await options.confirmBatch({ ...confirmDetails, signal: deadline.signal });
+				decision = await options.confirmBatch(confirmDetails);
 			} catch (err) {
-				if (deadline.timedOut()) return { kind: "host_rejection", value: batchReason("confirmation_timed_out") };
 				if (signal?.aborted) return { kind: "host_rejection", value: batchReason("confirmation_cancelled") };
 				return {
 					kind: "host_rejection",
 					value: batchReason("confirmation_failed", err instanceof Error ? err.message : String(err)),
 				};
-			} finally {
-				deadline.clear();
 			}
 
-			if (deadline.timedOut()) return { kind: "host_rejection", value: batchReason("confirmation_timed_out") };
 			if (decision === "cancel" || signal?.aborted) {
 				return { kind: "host_rejection", value: batchReason("confirmation_cancelled") };
 			}
@@ -195,7 +203,7 @@ export async function executePiUnattendedBatch(
 	});
 	if (authorization.outcome === "host_rejection") return authorization.value;
 	if (authorization.outcome === "rejected") return authorization.rejection;
-	const { binding, batch_id: batchId, expires_at: expiresAt } = authorization;
+	const { binding, batch_id: batchId } = authorization;
 
 	// 6. Issue Batch Authorization through Kernel registry and startBatch
 	const batchRegistry: BatchAuthorityRegistry = await createBatchAuthorityRegistry();
@@ -205,8 +213,6 @@ export async function executePiUnattendedBatch(
 	if (signal?.aborted) return batchReason("cancelled_before_execution");
 
 	now = new Date().toISOString();
-	if (Date.parse(expiresAt) <= Date.parse(now))
-		return batchReason("confirmation_failed", "confirmed batch deadline expired before authorization issuance");
 	const capability = batchRegistry.issue(binding, recoveryChildren as any, now);
 
 	let activeReviewDispatch: { operation_id: string; agent_params: Record<string, unknown> } | null = null;
@@ -300,7 +306,6 @@ export async function executePiUnattendedBatch(
 		plan_digest: planDigest,
 		base_head: binding.base_head,
 		confirmation_time: now,
-		authorization_expires_at: expiresAt,
 		budget,
 		now,
 		kernel: kernelPort,

package/plugins/immune-brain/.pi-extension/runtime-stub.ts

@@ -21,7 +21,6 @@ export interface EnrollmentCapabilityBinding {
 	preparation_digest: string;
 	actor_id: string;
 	confirmation_ref: string;
-	expires_at: string;
 	nonce: string;
 }
 export interface EnrollmentAuthorityRegistry {
@@ -36,7 +35,6 @@ export interface CanaryWaiver {
 	reason: string;
 	actor: string;
 	confirmation_ref: string;
-	expires_at: string;
 	nonce: string;
 }
 export interface PiCanaryPrepareInput {
@@ -66,7 +64,6 @@ export interface CapabilityBindingV2 {
 	diff_hash: string;
 	actor_id: string;
 	confirmation_ref: string;
-	expires_at: string;
 	findings_digest: string | null;
 }
 export interface MutationAuthorityRegistry {